Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08/08/2024, 03:45
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-08_36055ced68d9171ad094f9eb71d6751c_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-08-08_36055ced68d9171ad094f9eb71d6751c_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-08_36055ced68d9171ad094f9eb71d6751c_mafia.exe
-
Size
527KB
-
MD5
36055ced68d9171ad094f9eb71d6751c
-
SHA1
d5a809ae840fa0fedfaf94188f1564e7e118d8a1
-
SHA256
34df676e2578ed14d837c96a95524ad40db5f073a9c1c00b5a9ffc4665e908c1
-
SHA512
10bc9064dbeeea7d4f045fbf9b17b0b45fbbfb9a6e1bd3312f33f47ad1906fb374bbbf77865eca3a2928d82732961f70edde42700136d327b50b105dd9088dac
-
SSDEEP
6144:yorf3lPvovsgZnqG2C7mOTeiLRDYaoGWBN/QBA/T3kxc2RIXoq7YVCvkn4fvudN6:fU5rCOTeidHw8AE+onVsXeBDZu
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3220 AFA9.tmp 2912 B035.tmp 4600 B093.tmp 3820 B0F1.tmp 4952 B16E.tmp 2032 B1CB.tmp 3040 B21A.tmp 4700 B287.tmp 2744 B304.tmp 1016 B362.tmp 4576 B3B0.tmp 2916 B41D.tmp 2208 B47B.tmp 1448 B4D9.tmp 3488 B527.tmp 4812 B575.tmp 4404 B5D3.tmp 1184 B621.tmp 4208 B69E.tmp 932 B6EC.tmp 2840 B74A.tmp 3292 B7B7.tmp 3204 B834.tmp 2296 B882.tmp 448 B8F0.tmp 4408 B95D.tmp 3964 B9CA.tmp 2976 BA38.tmp 2812 BAB5.tmp 4544 BB22.tmp 1004 BB8F.tmp 3908 BBDE.tmp 2788 BC4B.tmp 2152 BCA9.tmp 5004 BCF7.tmp 1676 BD55.tmp 2472 BDD2.tmp 4776 BE2F.tmp 4040 BE8D.tmp 1416 BEDB.tmp 684 BF29.tmp 2820 BF77.tmp 3520 BFD5.tmp 1712 C023.tmp 5104 C071.tmp 1332 C0C0.tmp 3584 C10E.tmp 4788 C15C.tmp 2184 C1AA.tmp 4536 C1F8.tmp 4360 C256.tmp 3480 C2A4.tmp 432 C302.tmp 2120 C350.tmp 5052 C39E.tmp 2612 C3FC.tmp 4764 C44A.tmp 3392 C498.tmp 1360 C4E6.tmp 4356 C544.tmp 2772 C5A2.tmp 3296 C5F0.tmp 712 C64D.tmp 964 C6AB.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C54F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4513.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7FD9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D954.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 940D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F68.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E54A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8623.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E078.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2CF7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D04.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDB6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBDE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E838.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B987.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE07.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 500F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F627.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A66C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4592 wrote to memory of 3220 4592 2024-08-08_36055ced68d9171ad094f9eb71d6751c_mafia.exe 86 PID 4592 wrote to memory of 3220 4592 2024-08-08_36055ced68d9171ad094f9eb71d6751c_mafia.exe 86 PID 4592 wrote to memory of 3220 4592 2024-08-08_36055ced68d9171ad094f9eb71d6751c_mafia.exe 86 PID 3220 wrote to memory of 2912 3220 AFA9.tmp 88 PID 3220 wrote to memory of 2912 3220 AFA9.tmp 88 PID 3220 wrote to memory of 2912 3220 AFA9.tmp 88 PID 2912 wrote to memory of 4600 2912 B035.tmp 90 PID 2912 wrote to memory of 4600 2912 B035.tmp 90 PID 2912 wrote to memory of 4600 2912 B035.tmp 90 PID 4600 wrote to memory of 3820 4600 B093.tmp 91 PID 4600 wrote to memory of 3820 4600 B093.tmp 91 PID 4600 wrote to memory of 3820 4600 B093.tmp 91 PID 3820 wrote to memory of 4952 3820 B0F1.tmp 92 PID 3820 wrote to memory of 4952 3820 B0F1.tmp 92 PID 3820 wrote to memory of 4952 3820 B0F1.tmp 92 PID 4952 wrote to memory of 2032 4952 B16E.tmp 93 PID 4952 wrote to memory of 2032 4952 B16E.tmp 93 PID 4952 wrote to memory of 2032 4952 B16E.tmp 93 PID 2032 wrote to memory of 3040 2032 B1CB.tmp 94 PID 2032 wrote to memory of 3040 2032 B1CB.tmp 94 PID 2032 wrote to memory of 3040 2032 B1CB.tmp 94 PID 3040 wrote to memory of 4700 3040 B21A.tmp 95 PID 3040 wrote to memory of 4700 3040 B21A.tmp 95 PID 3040 wrote to memory of 4700 3040 B21A.tmp 95 PID 4700 wrote to memory of 2744 4700 B287.tmp 96 PID 4700 wrote to memory of 2744 4700 B287.tmp 96 PID 4700 wrote to memory of 2744 4700 B287.tmp 96 PID 2744 wrote to memory of 1016 2744 B304.tmp 97 PID 2744 wrote to memory of 1016 2744 B304.tmp 97 PID 2744 wrote to memory of 1016 2744 B304.tmp 97 PID 1016 wrote to memory of 4576 1016 B362.tmp 98 PID 1016 wrote to memory of 4576 1016 B362.tmp 98 PID 1016 wrote to memory of 4576 1016 B362.tmp 98 PID 4576 wrote to memory of 2916 4576 B3B0.tmp 99 PID 4576 wrote to memory of 2916 4576 B3B0.tmp 99 PID 4576 wrote to memory of 2916 4576 B3B0.tmp 99 PID 2916 wrote to memory of 2208 2916 B41D.tmp 100 PID 2916 wrote to memory of 2208 2916 B41D.tmp 100 PID 2916 wrote to memory of 2208 2916 B41D.tmp 100 PID 2208 wrote to memory of 1448 2208 B47B.tmp 101 PID 2208 wrote to memory of 1448 2208 B47B.tmp 101 PID 2208 wrote to memory of 1448 2208 B47B.tmp 101 PID 1448 wrote to memory of 3488 1448 B4D9.tmp 102 PID 1448 wrote to memory of 3488 1448 B4D9.tmp 102 PID 1448 wrote to memory of 3488 1448 B4D9.tmp 102 PID 3488 wrote to memory of 4812 3488 B527.tmp 103 PID 3488 wrote to memory of 4812 3488 B527.tmp 103 PID 3488 wrote to memory of 4812 3488 B527.tmp 103 PID 4812 wrote to memory of 4404 4812 B575.tmp 104 PID 4812 wrote to memory of 4404 4812 B575.tmp 104 PID 4812 wrote to memory of 4404 4812 B575.tmp 104 PID 4404 wrote to memory of 1184 4404 B5D3.tmp 105 PID 4404 wrote to memory of 1184 4404 B5D3.tmp 105 PID 4404 wrote to memory of 1184 4404 B5D3.tmp 105 PID 1184 wrote to memory of 4208 1184 B621.tmp 106 PID 1184 wrote to memory of 4208 1184 B621.tmp 106 PID 1184 wrote to memory of 4208 1184 B621.tmp 106 PID 4208 wrote to memory of 932 4208 B69E.tmp 107 PID 4208 wrote to memory of 932 4208 B69E.tmp 107 PID 4208 wrote to memory of 932 4208 B69E.tmp 107 PID 932 wrote to memory of 2840 932 B6EC.tmp 108 PID 932 wrote to memory of 2840 932 B6EC.tmp 108 PID 932 wrote to memory of 2840 932 B6EC.tmp 108 PID 2840 wrote to memory of 3292 2840 B74A.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-08_36055ced68d9171ad094f9eb71d6751c_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-08_36055ced68d9171ad094f9eb71d6751c_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\B035.tmp"C:\Users\Admin\AppData\Local\Temp\B035.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\B093.tmp"C:\Users\Admin\AppData\Local\Temp\B093.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\B0F1.tmp"C:\Users\Admin\AppData\Local\Temp\B0F1.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\B16E.tmp"C:\Users\Admin\AppData\Local\Temp\B16E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\B21A.tmp"C:\Users\Admin\AppData\Local\Temp\B21A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\B287.tmp"C:\Users\Admin\AppData\Local\Temp\B287.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\B304.tmp"C:\Users\Admin\AppData\Local\Temp\B304.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\B362.tmp"C:\Users\Admin\AppData\Local\Temp\B362.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\B41D.tmp"C:\Users\Admin\AppData\Local\Temp\B41D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\B47B.tmp"C:\Users\Admin\AppData\Local\Temp\B47B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\B527.tmp"C:\Users\Admin\AppData\Local\Temp\B527.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\B575.tmp"C:\Users\Admin\AppData\Local\Temp\B575.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\B5D3.tmp"C:\Users\Admin\AppData\Local\Temp\B5D3.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\B621.tmp"C:\Users\Admin\AppData\Local\Temp\B621.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\B69E.tmp"C:\Users\Admin\AppData\Local\Temp\B69E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Users\Admin\AppData\Local\Temp\B74A.tmp"C:\Users\Admin\AppData\Local\Temp\B74A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"23⤵
- Executes dropped EXE
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\B834.tmp"C:\Users\Admin\AppData\Local\Temp\B834.tmp"24⤵
- Executes dropped EXE
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\B882.tmp"C:\Users\Admin\AppData\Local\Temp\B882.tmp"25⤵
- Executes dropped EXE
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"26⤵
- Executes dropped EXE
PID:448 -
C:\Users\Admin\AppData\Local\Temp\B95D.tmp"C:\Users\Admin\AppData\Local\Temp\B95D.tmp"27⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"28⤵
- Executes dropped EXE
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\BA38.tmp"C:\Users\Admin\AppData\Local\Temp\BA38.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"30⤵
- Executes dropped EXE
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\BB22.tmp"C:\Users\Admin\AppData\Local\Temp\BB22.tmp"31⤵
- Executes dropped EXE
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\BB8F.tmp"C:\Users\Admin\AppData\Local\Temp\BB8F.tmp"32⤵
- Executes dropped EXE
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"34⤵
- Executes dropped EXE
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"35⤵
- Executes dropped EXE
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\BCF7.tmp"C:\Users\Admin\AppData\Local\Temp\BCF7.tmp"36⤵
- Executes dropped EXE
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\BD55.tmp"C:\Users\Admin\AppData\Local\Temp\BD55.tmp"37⤵
- Executes dropped EXE
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"38⤵
- Executes dropped EXE
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"39⤵
- Executes dropped EXE
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"40⤵
- Executes dropped EXE
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"41⤵
- Executes dropped EXE
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\BF29.tmp"C:\Users\Admin\AppData\Local\Temp\BF29.tmp"42⤵
- Executes dropped EXE
PID:684 -
C:\Users\Admin\AppData\Local\Temp\BF77.tmp"C:\Users\Admin\AppData\Local\Temp\BF77.tmp"43⤵
- Executes dropped EXE
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\BFD5.tmp"C:\Users\Admin\AppData\Local\Temp\BFD5.tmp"44⤵
- Executes dropped EXE
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\C023.tmp"C:\Users\Admin\AppData\Local\Temp\C023.tmp"45⤵
- Executes dropped EXE
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\C071.tmp"C:\Users\Admin\AppData\Local\Temp\C071.tmp"46⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"47⤵
- Executes dropped EXE
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\C10E.tmp"C:\Users\Admin\AppData\Local\Temp\C10E.tmp"48⤵
- Executes dropped EXE
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\C15C.tmp"C:\Users\Admin\AppData\Local\Temp\C15C.tmp"49⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"50⤵
- Executes dropped EXE
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\C1F8.tmp"C:\Users\Admin\AppData\Local\Temp\C1F8.tmp"51⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\C256.tmp"C:\Users\Admin\AppData\Local\Temp\C256.tmp"52⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\C2A4.tmp"C:\Users\Admin\AppData\Local\Temp\C2A4.tmp"53⤵
- Executes dropped EXE
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\C302.tmp"C:\Users\Admin\AppData\Local\Temp\C302.tmp"54⤵
- Executes dropped EXE
PID:432 -
C:\Users\Admin\AppData\Local\Temp\C350.tmp"C:\Users\Admin\AppData\Local\Temp\C350.tmp"55⤵
- Executes dropped EXE
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\C39E.tmp"C:\Users\Admin\AppData\Local\Temp\C39E.tmp"56⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"57⤵
- Executes dropped EXE
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\C44A.tmp"C:\Users\Admin\AppData\Local\Temp\C44A.tmp"58⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\C498.tmp"C:\Users\Admin\AppData\Local\Temp\C498.tmp"59⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\C4E6.tmp"C:\Users\Admin\AppData\Local\Temp\C4E6.tmp"60⤵
- Executes dropped EXE
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\C544.tmp"C:\Users\Admin\AppData\Local\Temp\C544.tmp"61⤵
- Executes dropped EXE
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"62⤵
- Executes dropped EXE
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\C5F0.tmp"C:\Users\Admin\AppData\Local\Temp\C5F0.tmp"63⤵
- Executes dropped EXE
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\C64D.tmp"C:\Users\Admin\AppData\Local\Temp\C64D.tmp"64⤵
- Executes dropped EXE
PID:712 -
C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"65⤵
- Executes dropped EXE
PID:964 -
C:\Users\Admin\AppData\Local\Temp\C6F9.tmp"C:\Users\Admin\AppData\Local\Temp\C6F9.tmp"66⤵
- System Location Discovery: System Language Discovery
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\C747.tmp"C:\Users\Admin\AppData\Local\Temp\C747.tmp"67⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\C796.tmp"C:\Users\Admin\AppData\Local\Temp\C796.tmp"68⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\C7E4.tmp"C:\Users\Admin\AppData\Local\Temp\C7E4.tmp"69⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\C841.tmp"C:\Users\Admin\AppData\Local\Temp\C841.tmp"70⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\C890.tmp"C:\Users\Admin\AppData\Local\Temp\C890.tmp"71⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\C8DE.tmp"C:\Users\Admin\AppData\Local\Temp\C8DE.tmp"72⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\C93B.tmp"C:\Users\Admin\AppData\Local\Temp\C93B.tmp"73⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\C999.tmp"C:\Users\Admin\AppData\Local\Temp\C999.tmp"74⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\C9F7.tmp"C:\Users\Admin\AppData\Local\Temp\C9F7.tmp"75⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\CA45.tmp"C:\Users\Admin\AppData\Local\Temp\CA45.tmp"76⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\CA93.tmp"C:\Users\Admin\AppData\Local\Temp\CA93.tmp"77⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\CAF1.tmp"C:\Users\Admin\AppData\Local\Temp\CAF1.tmp"78⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\CB4F.tmp"C:\Users\Admin\AppData\Local\Temp\CB4F.tmp"79⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\CB9D.tmp"C:\Users\Admin\AppData\Local\Temp\CB9D.tmp"80⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\CBEB.tmp"C:\Users\Admin\AppData\Local\Temp\CBEB.tmp"81⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\CC49.tmp"C:\Users\Admin\AppData\Local\Temp\CC49.tmp"82⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\CC87.tmp"C:\Users\Admin\AppData\Local\Temp\CC87.tmp"83⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\CCD5.tmp"C:\Users\Admin\AppData\Local\Temp\CCD5.tmp"84⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\CD23.tmp"C:\Users\Admin\AppData\Local\Temp\CD23.tmp"85⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\CD81.tmp"C:\Users\Admin\AppData\Local\Temp\CD81.tmp"86⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\CDCF.tmp"C:\Users\Admin\AppData\Local\Temp\CDCF.tmp"87⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\CE1D.tmp"C:\Users\Admin\AppData\Local\Temp\CE1D.tmp"88⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\CE6C.tmp"C:\Users\Admin\AppData\Local\Temp\CE6C.tmp"89⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\CEC9.tmp"C:\Users\Admin\AppData\Local\Temp\CEC9.tmp"90⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\CF27.tmp"C:\Users\Admin\AppData\Local\Temp\CF27.tmp"91⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\CF75.tmp"C:\Users\Admin\AppData\Local\Temp\CF75.tmp"92⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\CFC3.tmp"C:\Users\Admin\AppData\Local\Temp\CFC3.tmp"93⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\D011.tmp"C:\Users\Admin\AppData\Local\Temp\D011.tmp"94⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\D060.tmp"C:\Users\Admin\AppData\Local\Temp\D060.tmp"95⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"96⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\D0FC.tmp"C:\Users\Admin\AppData\Local\Temp\D0FC.tmp"97⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\D14A.tmp"C:\Users\Admin\AppData\Local\Temp\D14A.tmp"98⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\D198.tmp"C:\Users\Admin\AppData\Local\Temp\D198.tmp"99⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\D1E6.tmp"C:\Users\Admin\AppData\Local\Temp\D1E6.tmp"100⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\D234.tmp"C:\Users\Admin\AppData\Local\Temp\D234.tmp"101⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\D282.tmp"C:\Users\Admin\AppData\Local\Temp\D282.tmp"102⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\D2D1.tmp"C:\Users\Admin\AppData\Local\Temp\D2D1.tmp"103⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\D31F.tmp"C:\Users\Admin\AppData\Local\Temp\D31F.tmp"104⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\D36D.tmp"C:\Users\Admin\AppData\Local\Temp\D36D.tmp"105⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\D3BB.tmp"C:\Users\Admin\AppData\Local\Temp\D3BB.tmp"106⤵
- System Location Discovery: System Language Discovery
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\D428.tmp"C:\Users\Admin\AppData\Local\Temp\D428.tmp"107⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\D476.tmp"C:\Users\Admin\AppData\Local\Temp\D476.tmp"108⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\D4D4.tmp"C:\Users\Admin\AppData\Local\Temp\D4D4.tmp"109⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\D522.tmp"C:\Users\Admin\AppData\Local\Temp\D522.tmp"110⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\D570.tmp"C:\Users\Admin\AppData\Local\Temp\D570.tmp"111⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\D5BF.tmp"C:\Users\Admin\AppData\Local\Temp\D5BF.tmp"112⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\D61C.tmp"C:\Users\Admin\AppData\Local\Temp\D61C.tmp"113⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\D66A.tmp"C:\Users\Admin\AppData\Local\Temp\D66A.tmp"114⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\D6B9.tmp"C:\Users\Admin\AppData\Local\Temp\D6B9.tmp"115⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\D707.tmp"C:\Users\Admin\AppData\Local\Temp\D707.tmp"116⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\D764.tmp"C:\Users\Admin\AppData\Local\Temp\D764.tmp"117⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\D7C2.tmp"C:\Users\Admin\AppData\Local\Temp\D7C2.tmp"118⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\D810.tmp"C:\Users\Admin\AppData\Local\Temp\D810.tmp"119⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\D85E.tmp"C:\Users\Admin\AppData\Local\Temp\D85E.tmp"120⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\D8AD.tmp"C:\Users\Admin\AppData\Local\Temp\D8AD.tmp"121⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\D8FB.tmp"C:\Users\Admin\AppData\Local\Temp\D8FB.tmp"122⤵PID:2340
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-