Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
17/08/2024, 07:11
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-17_febb46af7a0e6e91598521336e0150fb_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-08-17_febb46af7a0e6e91598521336e0150fb_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-17_febb46af7a0e6e91598521336e0150fb_mafia.exe
-
Size
530KB
-
MD5
febb46af7a0e6e91598521336e0150fb
-
SHA1
810a21f5aa2dc1a058dc41e4614faf7e6aacf03d
-
SHA256
c6bddfa865f8580b16a5608bf5d6d10940ab256ee2c211e0a5f2b1cdf433ab69
-
SHA512
820369d8fb64963c9d950538ce00d41cf07c0451dc15df2c77cb83c5f974dc2ac3e5a5b5fd83b2e21af4b6d6e3d51f888beb9e6de15a76f47e386e423857c9d8
-
SSDEEP
12288:AU5rCOTeioaQBcEgExOJ3gFPyQIYGS+EN6RvNZulFVg0M1:AUQOJoZcE5eQFPy7YGS+EQ1NclFV/M1
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1840 C505.tmp 3036 C573.tmp 992 C5E0.tmp 1052 C64D.tmp 4728 C6BB.tmp 3784 C709.tmp 556 C757.tmp 2416 C7C4.tmp 1160 C841.tmp 1288 C8AF.tmp 3740 C8FD.tmp 4732 C95B.tmp 4112 C9B8.tmp 4000 CA26.tmp 452 CA93.tmp 2268 CB10.tmp 4540 CB6E.tmp 1964 CBBC.tmp 4260 CC29.tmp 3912 CC97.tmp 1612 CD04.tmp 4032 CD72.tmp 3140 CDDF.tmp 3980 CE3D.tmp 2344 CE9A.tmp 1640 CEE9.tmp 4460 CF56.tmp 2284 CFC3.tmp 4524 D031.tmp 872 D0AE.tmp 4256 D10B.tmp 4300 D169.tmp 3380 D1C7.tmp 2784 D215.tmp 1400 D263.tmp 4632 D2B1.tmp 1584 D2F0.tmp 1040 D33E.tmp 4484 D39C.tmp 5040 D3EA.tmp 4420 D448.tmp 320 D496.tmp 1656 D4E4.tmp 3940 D532.tmp 4980 D580.tmp 1840 D5DE.tmp 1004 D62C.tmp 4836 D67A.tmp 1880 D6C8.tmp 968 D716.tmp 1968 D764.tmp 3328 D7A3.tmp 4412 D7F1.tmp 1252 D84F.tmp 1100 D89D.tmp 4076 D8EB.tmp 1092 D939.tmp 3300 D987.tmp 3348 D9D5.tmp 1064 DA24.tmp 3176 DA81.tmp 1000 DADF.tmp 4112 DB3D.tmp 3224 DB8B.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D263.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFBD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AED9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 769.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F898.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C261.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6184.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 356.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DD1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A93B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDD8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B800.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8894.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5FEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C1C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6963.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1299.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9064.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 877.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C89.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1708 wrote to memory of 1840 1708 2024-08-17_febb46af7a0e6e91598521336e0150fb_mafia.exe 88 PID 1708 wrote to memory of 1840 1708 2024-08-17_febb46af7a0e6e91598521336e0150fb_mafia.exe 88 PID 1708 wrote to memory of 1840 1708 2024-08-17_febb46af7a0e6e91598521336e0150fb_mafia.exe 88 PID 1840 wrote to memory of 3036 1840 C505.tmp 90 PID 1840 wrote to memory of 3036 1840 C505.tmp 90 PID 1840 wrote to memory of 3036 1840 C505.tmp 90 PID 3036 wrote to memory of 992 3036 C573.tmp 92 PID 3036 wrote to memory of 992 3036 C573.tmp 92 PID 3036 wrote to memory of 992 3036 C573.tmp 92 PID 992 wrote to memory of 1052 992 C5E0.tmp 94 PID 992 wrote to memory of 1052 992 C5E0.tmp 94 PID 992 wrote to memory of 1052 992 C5E0.tmp 94 PID 1052 wrote to memory of 4728 1052 C64D.tmp 95 PID 1052 wrote to memory of 4728 1052 C64D.tmp 95 PID 1052 wrote to memory of 4728 1052 C64D.tmp 95 PID 4728 wrote to memory of 3784 4728 C6BB.tmp 96 PID 4728 wrote to memory of 3784 4728 C6BB.tmp 96 PID 4728 wrote to memory of 3784 4728 C6BB.tmp 96 PID 3784 wrote to memory of 556 3784 C709.tmp 97 PID 3784 wrote to memory of 556 3784 C709.tmp 97 PID 3784 wrote to memory of 556 3784 C709.tmp 97 PID 556 wrote to memory of 2416 556 C757.tmp 98 PID 556 wrote to memory of 2416 556 C757.tmp 98 PID 556 wrote to memory of 2416 556 C757.tmp 98 PID 2416 wrote to memory of 1160 2416 C7C4.tmp 99 PID 2416 wrote to memory of 1160 2416 C7C4.tmp 99 PID 2416 wrote to memory of 1160 2416 C7C4.tmp 99 PID 1160 wrote to memory of 1288 1160 C841.tmp 100 PID 1160 wrote to memory of 1288 1160 C841.tmp 100 PID 1160 wrote to memory of 1288 1160 C841.tmp 100 PID 1288 wrote to memory of 3740 1288 C8AF.tmp 101 PID 1288 wrote to memory of 3740 1288 C8AF.tmp 101 PID 1288 wrote to memory of 3740 1288 C8AF.tmp 101 PID 3740 wrote to memory of 4732 3740 C8FD.tmp 102 PID 3740 wrote to memory of 4732 3740 C8FD.tmp 102 PID 3740 wrote to memory of 4732 3740 C8FD.tmp 102 PID 4732 wrote to memory of 4112 4732 C95B.tmp 103 PID 4732 wrote to memory of 4112 4732 C95B.tmp 103 PID 4732 wrote to memory of 4112 4732 C95B.tmp 103 PID 4112 wrote to memory of 4000 4112 C9B8.tmp 104 PID 4112 wrote to memory of 4000 4112 C9B8.tmp 104 PID 4112 wrote to memory of 4000 4112 C9B8.tmp 104 PID 4000 wrote to memory of 452 4000 CA26.tmp 105 PID 4000 wrote to memory of 452 4000 CA26.tmp 105 PID 4000 wrote to memory of 452 4000 CA26.tmp 105 PID 452 wrote to memory of 2268 452 CA93.tmp 106 PID 452 wrote to memory of 2268 452 CA93.tmp 106 PID 452 wrote to memory of 2268 452 CA93.tmp 106 PID 2268 wrote to memory of 4540 2268 CB10.tmp 107 PID 2268 wrote to memory of 4540 2268 CB10.tmp 107 PID 2268 wrote to memory of 4540 2268 CB10.tmp 107 PID 4540 wrote to memory of 1964 4540 CB6E.tmp 108 PID 4540 wrote to memory of 1964 4540 CB6E.tmp 108 PID 4540 wrote to memory of 1964 4540 CB6E.tmp 108 PID 1964 wrote to memory of 4260 1964 CBBC.tmp 109 PID 1964 wrote to memory of 4260 1964 CBBC.tmp 109 PID 1964 wrote to memory of 4260 1964 CBBC.tmp 109 PID 4260 wrote to memory of 3912 4260 CC29.tmp 110 PID 4260 wrote to memory of 3912 4260 CC29.tmp 110 PID 4260 wrote to memory of 3912 4260 CC29.tmp 110 PID 3912 wrote to memory of 1612 3912 CC97.tmp 111 PID 3912 wrote to memory of 1612 3912 CC97.tmp 111 PID 3912 wrote to memory of 1612 3912 CC97.tmp 111 PID 1612 wrote to memory of 4032 1612 CD04.tmp 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-17_febb46af7a0e6e91598521336e0150fb_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-17_febb46af7a0e6e91598521336e0150fb_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\C505.tmp"C:\Users\Admin\AppData\Local\Temp\C505.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\C573.tmp"C:\Users\Admin\AppData\Local\Temp\C573.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\C5E0.tmp"C:\Users\Admin\AppData\Local\Temp\C5E0.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\AppData\Local\Temp\C64D.tmp"C:\Users\Admin\AppData\Local\Temp\C64D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\C709.tmp"C:\Users\Admin\AppData\Local\Temp\C709.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\C757.tmp"C:\Users\Admin\AppData\Local\Temp\C757.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\C841.tmp"C:\Users\Admin\AppData\Local\Temp\C841.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\C8AF.tmp"C:\Users\Admin\AppData\Local\Temp\C8AF.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\C8FD.tmp"C:\Users\Admin\AppData\Local\Temp\C8FD.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\C95B.tmp"C:\Users\Admin\AppData\Local\Temp\C95B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\C9B8.tmp"C:\Users\Admin\AppData\Local\Temp\C9B8.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\CA26.tmp"C:\Users\Admin\AppData\Local\Temp\CA26.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\CA93.tmp"C:\Users\Admin\AppData\Local\Temp\CA93.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Users\Admin\AppData\Local\Temp\CB10.tmp"C:\Users\Admin\AppData\Local\Temp\CB10.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\CB6E.tmp"C:\Users\Admin\AppData\Local\Temp\CB6E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\CBBC.tmp"C:\Users\Admin\AppData\Local\Temp\CBBC.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\CC29.tmp"C:\Users\Admin\AppData\Local\Temp\CC29.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\CC97.tmp"C:\Users\Admin\AppData\Local\Temp\CC97.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\CD04.tmp"C:\Users\Admin\AppData\Local\Temp\CD04.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\CD72.tmp"C:\Users\Admin\AppData\Local\Temp\CD72.tmp"23⤵
- Executes dropped EXE
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\CDDF.tmp"C:\Users\Admin\AppData\Local\Temp\CDDF.tmp"24⤵
- Executes dropped EXE
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\CE3D.tmp"C:\Users\Admin\AppData\Local\Temp\CE3D.tmp"25⤵
- Executes dropped EXE
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\CE9A.tmp"C:\Users\Admin\AppData\Local\Temp\CE9A.tmp"26⤵
- Executes dropped EXE
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\CEE9.tmp"C:\Users\Admin\AppData\Local\Temp\CEE9.tmp"27⤵
- Executes dropped EXE
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\CF56.tmp"C:\Users\Admin\AppData\Local\Temp\CF56.tmp"28⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\CFC3.tmp"C:\Users\Admin\AppData\Local\Temp\CFC3.tmp"29⤵
- Executes dropped EXE
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\D031.tmp"C:\Users\Admin\AppData\Local\Temp\D031.tmp"30⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"31⤵
- Executes dropped EXE
PID:872 -
C:\Users\Admin\AppData\Local\Temp\D10B.tmp"C:\Users\Admin\AppData\Local\Temp\D10B.tmp"32⤵
- Executes dropped EXE
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\D169.tmp"C:\Users\Admin\AppData\Local\Temp\D169.tmp"33⤵
- Executes dropped EXE
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"34⤵
- Executes dropped EXE
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\D215.tmp"C:\Users\Admin\AppData\Local\Temp\D215.tmp"35⤵
- Executes dropped EXE
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\D263.tmp"C:\Users\Admin\AppData\Local\Temp\D263.tmp"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\D2B1.tmp"C:\Users\Admin\AppData\Local\Temp\D2B1.tmp"37⤵
- Executes dropped EXE
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\D2F0.tmp"C:\Users\Admin\AppData\Local\Temp\D2F0.tmp"38⤵
- Executes dropped EXE
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\D33E.tmp"C:\Users\Admin\AppData\Local\Temp\D33E.tmp"39⤵
- Executes dropped EXE
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\D39C.tmp"C:\Users\Admin\AppData\Local\Temp\D39C.tmp"40⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\D3EA.tmp"C:\Users\Admin\AppData\Local\Temp\D3EA.tmp"41⤵
- Executes dropped EXE
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\D448.tmp"C:\Users\Admin\AppData\Local\Temp\D448.tmp"42⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\D496.tmp"C:\Users\Admin\AppData\Local\Temp\D496.tmp"43⤵
- Executes dropped EXE
PID:320 -
C:\Users\Admin\AppData\Local\Temp\D4E4.tmp"C:\Users\Admin\AppData\Local\Temp\D4E4.tmp"44⤵
- Executes dropped EXE
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\D532.tmp"C:\Users\Admin\AppData\Local\Temp\D532.tmp"45⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\D580.tmp"C:\Users\Admin\AppData\Local\Temp\D580.tmp"46⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\D5DE.tmp"C:\Users\Admin\AppData\Local\Temp\D5DE.tmp"47⤵
- Executes dropped EXE
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\D62C.tmp"C:\Users\Admin\AppData\Local\Temp\D62C.tmp"48⤵
- Executes dropped EXE
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\D67A.tmp"C:\Users\Admin\AppData\Local\Temp\D67A.tmp"49⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\D6C8.tmp"C:\Users\Admin\AppData\Local\Temp\D6C8.tmp"50⤵
- Executes dropped EXE
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\D716.tmp"C:\Users\Admin\AppData\Local\Temp\D716.tmp"51⤵
- Executes dropped EXE
PID:968 -
C:\Users\Admin\AppData\Local\Temp\D764.tmp"C:\Users\Admin\AppData\Local\Temp\D764.tmp"52⤵
- Executes dropped EXE
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\D7A3.tmp"C:\Users\Admin\AppData\Local\Temp\D7A3.tmp"53⤵
- Executes dropped EXE
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\D7F1.tmp"C:\Users\Admin\AppData\Local\Temp\D7F1.tmp"54⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\D84F.tmp"C:\Users\Admin\AppData\Local\Temp\D84F.tmp"55⤵
- Executes dropped EXE
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\D89D.tmp"C:\Users\Admin\AppData\Local\Temp\D89D.tmp"56⤵
- Executes dropped EXE
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\D8EB.tmp"C:\Users\Admin\AppData\Local\Temp\D8EB.tmp"57⤵
- Executes dropped EXE
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\D939.tmp"C:\Users\Admin\AppData\Local\Temp\D939.tmp"58⤵
- Executes dropped EXE
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\D987.tmp"C:\Users\Admin\AppData\Local\Temp\D987.tmp"59⤵
- Executes dropped EXE
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\D9D5.tmp"C:\Users\Admin\AppData\Local\Temp\D9D5.tmp"60⤵
- Executes dropped EXE
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\DA24.tmp"C:\Users\Admin\AppData\Local\Temp\DA24.tmp"61⤵
- Executes dropped EXE
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\DA81.tmp"C:\Users\Admin\AppData\Local\Temp\DA81.tmp"62⤵
- Executes dropped EXE
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\DADF.tmp"C:\Users\Admin\AppData\Local\Temp\DADF.tmp"63⤵
- Executes dropped EXE
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\DB3D.tmp"C:\Users\Admin\AppData\Local\Temp\DB3D.tmp"64⤵
- Executes dropped EXE
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\DB8B.tmp"C:\Users\Admin\AppData\Local\Temp\DB8B.tmp"65⤵
- Executes dropped EXE
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\DBE9.tmp"C:\Users\Admin\AppData\Local\Temp\DBE9.tmp"66⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\DC46.tmp"C:\Users\Admin\AppData\Local\Temp\DC46.tmp"67⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\DC95.tmp"C:\Users\Admin\AppData\Local\Temp\DC95.tmp"68⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\DCF2.tmp"C:\Users\Admin\AppData\Local\Temp\DCF2.tmp"69⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\DD40.tmp"C:\Users\Admin\AppData\Local\Temp\DD40.tmp"70⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\DD8F.tmp"C:\Users\Admin\AppData\Local\Temp\DD8F.tmp"71⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\DDDD.tmp"C:\Users\Admin\AppData\Local\Temp\DDDD.tmp"72⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\DE2B.tmp"C:\Users\Admin\AppData\Local\Temp\DE2B.tmp"73⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\DE89.tmp"C:\Users\Admin\AppData\Local\Temp\DE89.tmp"74⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\DEE6.tmp"C:\Users\Admin\AppData\Local\Temp\DEE6.tmp"75⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\DF44.tmp"C:\Users\Admin\AppData\Local\Temp\DF44.tmp"76⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\DF92.tmp"C:\Users\Admin\AppData\Local\Temp\DF92.tmp"77⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"78⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\E03E.tmp"C:\Users\Admin\AppData\Local\Temp\E03E.tmp"79⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\E09C.tmp"C:\Users\Admin\AppData\Local\Temp\E09C.tmp"80⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\E0FA.tmp"C:\Users\Admin\AppData\Local\Temp\E0FA.tmp"81⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\E157.tmp"C:\Users\Admin\AppData\Local\Temp\E157.tmp"82⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\E1B5.tmp"C:\Users\Admin\AppData\Local\Temp\E1B5.tmp"83⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\E213.tmp"C:\Users\Admin\AppData\Local\Temp\E213.tmp"84⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\E271.tmp"C:\Users\Admin\AppData\Local\Temp\E271.tmp"85⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\E2CE.tmp"C:\Users\Admin\AppData\Local\Temp\E2CE.tmp"86⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\E32C.tmp"C:\Users\Admin\AppData\Local\Temp\E32C.tmp"87⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\E38A.tmp"C:\Users\Admin\AppData\Local\Temp\E38A.tmp"88⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\E3E8.tmp"C:\Users\Admin\AppData\Local\Temp\E3E8.tmp"89⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\E436.tmp"C:\Users\Admin\AppData\Local\Temp\E436.tmp"90⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\E493.tmp"C:\Users\Admin\AppData\Local\Temp\E493.tmp"91⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\E4F1.tmp"C:\Users\Admin\AppData\Local\Temp\E4F1.tmp"92⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\E54F.tmp"C:\Users\Admin\AppData\Local\Temp\E54F.tmp"93⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\E5AD.tmp"C:\Users\Admin\AppData\Local\Temp\E5AD.tmp"94⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\E60A.tmp"C:\Users\Admin\AppData\Local\Temp\E60A.tmp"95⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\E678.tmp"C:\Users\Admin\AppData\Local\Temp\E678.tmp"96⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\E6D6.tmp"C:\Users\Admin\AppData\Local\Temp\E6D6.tmp"97⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\E733.tmp"C:\Users\Admin\AppData\Local\Temp\E733.tmp"98⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\E791.tmp"C:\Users\Admin\AppData\Local\Temp\E791.tmp"99⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"100⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\E83D.tmp"C:\Users\Admin\AppData\Local\Temp\E83D.tmp"101⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\E89B.tmp"C:\Users\Admin\AppData\Local\Temp\E89B.tmp"102⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\E8E9.tmp"C:\Users\Admin\AppData\Local\Temp\E8E9.tmp"103⤵
- System Location Discovery: System Language Discovery
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\E947.tmp"C:\Users\Admin\AppData\Local\Temp\E947.tmp"104⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\E9A4.tmp"C:\Users\Admin\AppData\Local\Temp\E9A4.tmp"105⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\EA02.tmp"C:\Users\Admin\AppData\Local\Temp\EA02.tmp"106⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\EA50.tmp"C:\Users\Admin\AppData\Local\Temp\EA50.tmp"107⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\EA9E.tmp"C:\Users\Admin\AppData\Local\Temp\EA9E.tmp"108⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\EAFC.tmp"C:\Users\Admin\AppData\Local\Temp\EAFC.tmp"109⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\EB5A.tmp"C:\Users\Admin\AppData\Local\Temp\EB5A.tmp"110⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\EBB8.tmp"C:\Users\Admin\AppData\Local\Temp\EBB8.tmp"111⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\EC06.tmp"C:\Users\Admin\AppData\Local\Temp\EC06.tmp"112⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\EC54.tmp"C:\Users\Admin\AppData\Local\Temp\EC54.tmp"113⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\ECB2.tmp"C:\Users\Admin\AppData\Local\Temp\ECB2.tmp"114⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\ED00.tmp"C:\Users\Admin\AppData\Local\Temp\ED00.tmp"115⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\ED5D.tmp"C:\Users\Admin\AppData\Local\Temp\ED5D.tmp"116⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\EDAC.tmp"C:\Users\Admin\AppData\Local\Temp\EDAC.tmp"117⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\EDFA.tmp"C:\Users\Admin\AppData\Local\Temp\EDFA.tmp"118⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\EE57.tmp"C:\Users\Admin\AppData\Local\Temp\EE57.tmp"119⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\EEB5.tmp"C:\Users\Admin\AppData\Local\Temp\EEB5.tmp"120⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\EF13.tmp"C:\Users\Admin\AppData\Local\Temp\EF13.tmp"121⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\EF61.tmp"C:\Users\Admin\AppData\Local\Temp\EF61.tmp"122⤵PID:916
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-