Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08/08/2024, 01:29
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-08_817c0d21ab92968bf88a13210990274e_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-08-08_817c0d21ab92968bf88a13210990274e_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-08_817c0d21ab92968bf88a13210990274e_mafia.exe
-
Size
541KB
-
MD5
817c0d21ab92968bf88a13210990274e
-
SHA1
e68c347bd59c755efceb7a91c9a230939a27c079
-
SHA256
a870d17a5c972e6f3ff590efa1618da7ec96a07df120fc046eddffef61b9ed94
-
SHA512
5acc64c82fb194e1ef69390bb7b121ad216480296b1dc3016bd342a853c56684b42c0a6bcb8576cd8b6f6ee13a535ac54b789c9b7bc9e47fe412a520242d3006
-
SSDEEP
12288:UU5rCOTeiftvThDSyMkA/Lsd4znMDbxrrZa73ctO:UUQOJfhhDj4LaDbdrU73ctO
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2036 97EA.tmp 3528 9867.tmp 568 98C5.tmp 2400 9952.tmp 3888 99BF.tmp 2436 9A1D.tmp 3240 9A8A.tmp 3312 9AF8.tmp 2844 9B46.tmp 3748 9BA4.tmp 2788 9C01.tmp 3200 9C7E.tmp 3456 9CFB.tmp 1472 9D59.tmp 4164 9DD6.tmp 788 9E43.tmp 4644 9EA1.tmp 1564 9EFF.tmp 4852 A037.tmp 5012 A095.tmp 3568 A103.tmp 2460 A170.tmp 2540 A1CE.tmp 3516 A22B.tmp 2000 A27A.tmp 3808 A2D7.tmp 1548 A325.tmp 1944 A374.tmp 2740 A3E1.tmp 1460 A45E.tmp 408 A4CB.tmp 5088 A548.tmp 560 A5B6.tmp 4868 A604.tmp 3788 A652.tmp 3672 A6A0.tmp 2556 A6EE.tmp 4072 A73C.tmp 3216 A79A.tmp 4564 A7E8.tmp 644 A836.tmp 4984 A894.tmp 4904 A8F2.tmp 3040 A950.tmp 1208 A99E.tmp 3264 A9EC.tmp 1224 AA3A.tmp 3284 AA88.tmp 4572 AAD6.tmp 1040 AB34.tmp 1648 AB82.tmp 5080 ABE0.tmp 1256 AC2E.tmp 4772 AC8C.tmp 4840 ACDA.tmp 3492 AD38.tmp 4944 AD86.tmp 4424 ADD4.tmp 4144 AE22.tmp 384 AE70.tmp 2384 AEBE.tmp 4268 AF0C.tmp 1444 AF5A.tmp 496 AFB8.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C19A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3052.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB8B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A99E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 776D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B3D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CAD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 819F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C119.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F155.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D06F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D15A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F73.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 872C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F24F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 948A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F201.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B292.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB79.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E589.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CFB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D561.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9100.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B13F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B556.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 177B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4156 wrote to memory of 2036 4156 2024-08-08_817c0d21ab92968bf88a13210990274e_mafia.exe 84 PID 4156 wrote to memory of 2036 4156 2024-08-08_817c0d21ab92968bf88a13210990274e_mafia.exe 84 PID 4156 wrote to memory of 2036 4156 2024-08-08_817c0d21ab92968bf88a13210990274e_mafia.exe 84 PID 2036 wrote to memory of 3528 2036 97EA.tmp 86 PID 2036 wrote to memory of 3528 2036 97EA.tmp 86 PID 2036 wrote to memory of 3528 2036 97EA.tmp 86 PID 3528 wrote to memory of 568 3528 9867.tmp 87 PID 3528 wrote to memory of 568 3528 9867.tmp 87 PID 3528 wrote to memory of 568 3528 9867.tmp 87 PID 568 wrote to memory of 2400 568 98C5.tmp 89 PID 568 wrote to memory of 2400 568 98C5.tmp 89 PID 568 wrote to memory of 2400 568 98C5.tmp 89 PID 2400 wrote to memory of 3888 2400 9952.tmp 90 PID 2400 wrote to memory of 3888 2400 9952.tmp 90 PID 2400 wrote to memory of 3888 2400 9952.tmp 90 PID 3888 wrote to memory of 2436 3888 99BF.tmp 91 PID 3888 wrote to memory of 2436 3888 99BF.tmp 91 PID 3888 wrote to memory of 2436 3888 99BF.tmp 91 PID 2436 wrote to memory of 3240 2436 9A1D.tmp 92 PID 2436 wrote to memory of 3240 2436 9A1D.tmp 92 PID 2436 wrote to memory of 3240 2436 9A1D.tmp 92 PID 3240 wrote to memory of 3312 3240 9A8A.tmp 93 PID 3240 wrote to memory of 3312 3240 9A8A.tmp 93 PID 3240 wrote to memory of 3312 3240 9A8A.tmp 93 PID 3312 wrote to memory of 2844 3312 9AF8.tmp 94 PID 3312 wrote to memory of 2844 3312 9AF8.tmp 94 PID 3312 wrote to memory of 2844 3312 9AF8.tmp 94 PID 2844 wrote to memory of 3748 2844 9B46.tmp 95 PID 2844 wrote to memory of 3748 2844 9B46.tmp 95 PID 2844 wrote to memory of 3748 2844 9B46.tmp 95 PID 3748 wrote to memory of 2788 3748 9BA4.tmp 96 PID 3748 wrote to memory of 2788 3748 9BA4.tmp 96 PID 3748 wrote to memory of 2788 3748 9BA4.tmp 96 PID 2788 wrote to memory of 3200 2788 9C01.tmp 97 PID 2788 wrote to memory of 3200 2788 9C01.tmp 97 PID 2788 wrote to memory of 3200 2788 9C01.tmp 97 PID 3200 wrote to memory of 3456 3200 9C7E.tmp 98 PID 3200 wrote to memory of 3456 3200 9C7E.tmp 98 PID 3200 wrote to memory of 3456 3200 9C7E.tmp 98 PID 3456 wrote to memory of 1472 3456 9CFB.tmp 99 PID 3456 wrote to memory of 1472 3456 9CFB.tmp 99 PID 3456 wrote to memory of 1472 3456 9CFB.tmp 99 PID 1472 wrote to memory of 4164 1472 9D59.tmp 100 PID 1472 wrote to memory of 4164 1472 9D59.tmp 100 PID 1472 wrote to memory of 4164 1472 9D59.tmp 100 PID 4164 wrote to memory of 788 4164 9DD6.tmp 101 PID 4164 wrote to memory of 788 4164 9DD6.tmp 101 PID 4164 wrote to memory of 788 4164 9DD6.tmp 101 PID 788 wrote to memory of 4644 788 9E43.tmp 102 PID 788 wrote to memory of 4644 788 9E43.tmp 102 PID 788 wrote to memory of 4644 788 9E43.tmp 102 PID 4644 wrote to memory of 1564 4644 9EA1.tmp 103 PID 4644 wrote to memory of 1564 4644 9EA1.tmp 103 PID 4644 wrote to memory of 1564 4644 9EA1.tmp 103 PID 1564 wrote to memory of 4852 1564 9EFF.tmp 104 PID 1564 wrote to memory of 4852 1564 9EFF.tmp 104 PID 1564 wrote to memory of 4852 1564 9EFF.tmp 104 PID 4852 wrote to memory of 5012 4852 A037.tmp 105 PID 4852 wrote to memory of 5012 4852 A037.tmp 105 PID 4852 wrote to memory of 5012 4852 A037.tmp 105 PID 5012 wrote to memory of 3568 5012 A095.tmp 106 PID 5012 wrote to memory of 3568 5012 A095.tmp 106 PID 5012 wrote to memory of 3568 5012 A095.tmp 106 PID 3568 wrote to memory of 2460 3568 A103.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-08_817c0d21ab92968bf88a13210990274e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-08_817c0d21ab92968bf88a13210990274e_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\97EA.tmp"C:\Users\Admin\AppData\Local\Temp\97EA.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\9867.tmp"C:\Users\Admin\AppData\Local\Temp\9867.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\98C5.tmp"C:\Users\Admin\AppData\Local\Temp\98C5.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Users\Admin\AppData\Local\Temp\9952.tmp"C:\Users\Admin\AppData\Local\Temp\9952.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\99BF.tmp"C:\Users\Admin\AppData\Local\Temp\99BF.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\9C01.tmp"C:\Users\Admin\AppData\Local\Temp\9C01.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\9D59.tmp"C:\Users\Admin\AppData\Local\Temp\9D59.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\9E43.tmp"C:\Users\Admin\AppData\Local\Temp\9E43.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\A037.tmp"C:\Users\Admin\AppData\Local\Temp\A037.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\A095.tmp"C:\Users\Admin\AppData\Local\Temp\A095.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\A103.tmp"C:\Users\Admin\AppData\Local\Temp\A103.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\A170.tmp"C:\Users\Admin\AppData\Local\Temp\A170.tmp"23⤵
- Executes dropped EXE
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"24⤵
- Executes dropped EXE
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\A22B.tmp"C:\Users\Admin\AppData\Local\Temp\A22B.tmp"25⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\A27A.tmp"C:\Users\Admin\AppData\Local\Temp\A27A.tmp"26⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"27⤵
- Executes dropped EXE
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\A325.tmp"C:\Users\Admin\AppData\Local\Temp\A325.tmp"28⤵
- Executes dropped EXE
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\A374.tmp"C:\Users\Admin\AppData\Local\Temp\A374.tmp"29⤵
- Executes dropped EXE
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"30⤵
- Executes dropped EXE
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\A45E.tmp"C:\Users\Admin\AppData\Local\Temp\A45E.tmp"31⤵
- Executes dropped EXE
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"32⤵
- Executes dropped EXE
PID:408 -
C:\Users\Admin\AppData\Local\Temp\A548.tmp"C:\Users\Admin\AppData\Local\Temp\A548.tmp"33⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"34⤵
- Executes dropped EXE
PID:560 -
C:\Users\Admin\AppData\Local\Temp\A604.tmp"C:\Users\Admin\AppData\Local\Temp\A604.tmp"35⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\A652.tmp"C:\Users\Admin\AppData\Local\Temp\A652.tmp"36⤵
- Executes dropped EXE
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"37⤵
- Executes dropped EXE
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"38⤵
- Executes dropped EXE
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\A73C.tmp"C:\Users\Admin\AppData\Local\Temp\A73C.tmp"39⤵
- Executes dropped EXE
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\A79A.tmp"C:\Users\Admin\AppData\Local\Temp\A79A.tmp"40⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\A836.tmp"C:\Users\Admin\AppData\Local\Temp\A836.tmp"42⤵
- Executes dropped EXE
PID:644 -
C:\Users\Admin\AppData\Local\Temp\A894.tmp"C:\Users\Admin\AppData\Local\Temp\A894.tmp"43⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"44⤵
- Executes dropped EXE
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\A950.tmp"C:\Users\Admin\AppData\Local\Temp\A950.tmp"45⤵
- Executes dropped EXE
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\A99E.tmp"C:\Users\Admin\AppData\Local\Temp\A99E.tmp"46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"47⤵
- Executes dropped EXE
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"48⤵
- Executes dropped EXE
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\AA88.tmp"C:\Users\Admin\AppData\Local\Temp\AA88.tmp"49⤵
- Executes dropped EXE
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"50⤵
- Executes dropped EXE
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\AB34.tmp"C:\Users\Admin\AppData\Local\Temp\AB34.tmp"51⤵
- Executes dropped EXE
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\AB82.tmp"C:\Users\Admin\AppData\Local\Temp\AB82.tmp"52⤵
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"53⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"54⤵
- Executes dropped EXE
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"55⤵
- Executes dropped EXE
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"56⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\AD38.tmp"C:\Users\Admin\AppData\Local\Temp\AD38.tmp"57⤵
- Executes dropped EXE
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\AD86.tmp"C:\Users\Admin\AppData\Local\Temp\AD86.tmp"58⤵
- Executes dropped EXE
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"59⤵
- Executes dropped EXE
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\AE22.tmp"C:\Users\Admin\AppData\Local\Temp\AE22.tmp"60⤵
- Executes dropped EXE
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\AE70.tmp"C:\Users\Admin\AppData\Local\Temp\AE70.tmp"61⤵
- Executes dropped EXE
PID:384 -
C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"62⤵
- Executes dropped EXE
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\AF0C.tmp"C:\Users\Admin\AppData\Local\Temp\AF0C.tmp"63⤵
- Executes dropped EXE
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"64⤵
- Executes dropped EXE
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"65⤵
- Executes dropped EXE
PID:496 -
C:\Users\Admin\AppData\Local\Temp\B006.tmp"C:\Users\Admin\AppData\Local\Temp\B006.tmp"66⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\B054.tmp"C:\Users\Admin\AppData\Local\Temp\B054.tmp"67⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"68⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\B0F1.tmp"C:\Users\Admin\AppData\Local\Temp\B0F1.tmp"69⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\B13F.tmp"C:\Users\Admin\AppData\Local\Temp\B13F.tmp"70⤵
- System Location Discovery: System Language Discovery
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\B18D.tmp"C:\Users\Admin\AppData\Local\Temp\B18D.tmp"71⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"72⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\B229.tmp"C:\Users\Admin\AppData\Local\Temp\B229.tmp"73⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\B277.tmp"C:\Users\Admin\AppData\Local\Temp\B277.tmp"74⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"75⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\B314.tmp"C:\Users\Admin\AppData\Local\Temp\B314.tmp"76⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\B371.tmp"C:\Users\Admin\AppData\Local\Temp\B371.tmp"77⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"78⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\B40E.tmp"C:\Users\Admin\AppData\Local\Temp\B40E.tmp"79⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\B45C.tmp"C:\Users\Admin\AppData\Local\Temp\B45C.tmp"80⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"81⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\B508.tmp"C:\Users\Admin\AppData\Local\Temp\B508.tmp"82⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\B556.tmp"C:\Users\Admin\AppData\Local\Temp\B556.tmp"83⤵
- System Location Discovery: System Language Discovery
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"84⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"85⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\B640.tmp"C:\Users\Admin\AppData\Local\Temp\B640.tmp"86⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\B68E.tmp"C:\Users\Admin\AppData\Local\Temp\B68E.tmp"87⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"88⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\B72A.tmp"C:\Users\Admin\AppData\Local\Temp\B72A.tmp"89⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\B788.tmp"C:\Users\Admin\AppData\Local\Temp\B788.tmp"90⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"91⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\B824.tmp"C:\Users\Admin\AppData\Local\Temp\B824.tmp"92⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\B873.tmp"C:\Users\Admin\AppData\Local\Temp\B873.tmp"93⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\B8D0.tmp"C:\Users\Admin\AppData\Local\Temp\B8D0.tmp"94⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\B92E.tmp"C:\Users\Admin\AppData\Local\Temp\B92E.tmp"95⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\B97C.tmp"C:\Users\Admin\AppData\Local\Temp\B97C.tmp"96⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"97⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\BA28.tmp"C:\Users\Admin\AppData\Local\Temp\BA28.tmp"98⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\BA76.tmp"C:\Users\Admin\AppData\Local\Temp\BA76.tmp"99⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"100⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\BB12.tmp"C:\Users\Admin\AppData\Local\Temp\BB12.tmp"101⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\BB70.tmp"C:\Users\Admin\AppData\Local\Temp\BB70.tmp"102⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"103⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"104⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\BC6A.tmp"C:\Users\Admin\AppData\Local\Temp\BC6A.tmp"105⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"106⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\BD26.tmp"C:\Users\Admin\AppData\Local\Temp\BD26.tmp"107⤵
- System Location Discovery: System Language Discovery
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\BD74.tmp"C:\Users\Admin\AppData\Local\Temp\BD74.tmp"108⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"109⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\BE20.tmp"C:\Users\Admin\AppData\Local\Temp\BE20.tmp"110⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\BE6E.tmp"C:\Users\Admin\AppData\Local\Temp\BE6E.tmp"111⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\BECC.tmp"C:\Users\Admin\AppData\Local\Temp\BECC.tmp"112⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"113⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\BF68.tmp"C:\Users\Admin\AppData\Local\Temp\BF68.tmp"114⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\BFB6.tmp"C:\Users\Admin\AppData\Local\Temp\BFB6.tmp"115⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\C004.tmp"C:\Users\Admin\AppData\Local\Temp\C004.tmp"116⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\C052.tmp"C:\Users\Admin\AppData\Local\Temp\C052.tmp"117⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"118⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"119⤵
- System Location Discovery: System Language Discovery
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\C13D.tmp"C:\Users\Admin\AppData\Local\Temp\C13D.tmp"120⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\C19A.tmp"C:\Users\Admin\AppData\Local\Temp\C19A.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"122⤵PID:2616
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-