Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
17/08/2024, 11:30
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-17_e4e1bb160b35d8e2dce903f88730f5d8_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-08-17_e4e1bb160b35d8e2dce903f88730f5d8_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-17_e4e1bb160b35d8e2dce903f88730f5d8_mafia.exe
-
Size
487KB
-
MD5
e4e1bb160b35d8e2dce903f88730f5d8
-
SHA1
fa9f9c7a87638ca910dc03d8ccb0e86fad8cd872
-
SHA256
0dc9c9b93e0af8e9363a535ded32147c667d7ef5a2c946cac73abcbe85de53c3
-
SHA512
a68cb9e296d1ed93b526caff205b928f961f6d89777b5a3a5b8c456b624a9652e318ea8c52ab2d056130cd90ef2381dc46e708e141d764469ccd7f68d24b26c8
-
SSDEEP
12288:yU5rCOTeiNTXBqYHVzKrAm+YQLy9EiDiqjrBK9W3ybZ:yUQOJNDBqMVEN/9hxU9Wib
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4000 555E.tmp 1200 55CC.tmp 4588 5639.tmp 2164 56E5.tmp 3844 5743.tmp 1756 57C0.tmp 1772 581E.tmp 1152 58BA.tmp 2576 5927.tmp 1652 59C3.tmp 744 5A40.tmp 220 5ABD.tmp 1020 5B1B.tmp 3468 5B89.tmp 2692 5BF6.tmp 4524 5C54.tmp 1680 5CD1.tmp 2948 5D6D.tmp 2776 5DEA.tmp 2608 5E67.tmp 2360 5EB5.tmp 3116 5F22.tmp 4568 5F90.tmp 3204 600D.tmp 4332 607A.tmp 1752 60E8.tmp 4000 6165.tmp 2284 6201.tmp 4588 626E.tmp 4408 62EB.tmp 4044 6368.tmp 3268 63C6.tmp 4636 6433.tmp 3088 64B0.tmp 1132 64FE.tmp 2092 655C.tmp 1524 65AA.tmp 4392 65F8.tmp 2012 6647.tmp 1940 6695.tmp 4400 66E3.tmp 3112 6750.tmp 1516 67BE.tmp 4288 682B.tmp 3776 6879.tmp 780 68C7.tmp 4308 6925.tmp 2540 6973.tmp 4568 69C1.tmp 4088 6A1F.tmp 2672 6AEA.tmp 4332 6B38.tmp 4832 6B86.tmp 4000 6BE4.tmp 3924 6C61.tmp 5064 6CCE.tmp 3588 6D3C.tmp 2312 6D8A.tmp 4728 6DE8.tmp 1840 6E45.tmp 932 6EA3.tmp 752 6F01.tmp 4920 6F5F.tmp 1152 6FAD.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B06A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F77A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AF7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9006.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5663.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A822.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D210.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 525C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4888.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7FB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2447.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 945B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC22.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 788.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6056.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BD9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F92.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DDA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F30.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D80C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3908.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 168C.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3960 wrote to memory of 4000 3960 2024-08-17_e4e1bb160b35d8e2dce903f88730f5d8_mafia.exe 91 PID 3960 wrote to memory of 4000 3960 2024-08-17_e4e1bb160b35d8e2dce903f88730f5d8_mafia.exe 91 PID 3960 wrote to memory of 4000 3960 2024-08-17_e4e1bb160b35d8e2dce903f88730f5d8_mafia.exe 91 PID 4000 wrote to memory of 1200 4000 555E.tmp 92 PID 4000 wrote to memory of 1200 4000 555E.tmp 92 PID 4000 wrote to memory of 1200 4000 555E.tmp 92 PID 1200 wrote to memory of 4588 1200 55CC.tmp 94 PID 1200 wrote to memory of 4588 1200 55CC.tmp 94 PID 1200 wrote to memory of 4588 1200 55CC.tmp 94 PID 4588 wrote to memory of 2164 4588 5639.tmp 96 PID 4588 wrote to memory of 2164 4588 5639.tmp 96 PID 4588 wrote to memory of 2164 4588 5639.tmp 96 PID 2164 wrote to memory of 3844 2164 56E5.tmp 97 PID 2164 wrote to memory of 3844 2164 56E5.tmp 97 PID 2164 wrote to memory of 3844 2164 56E5.tmp 97 PID 3844 wrote to memory of 1756 3844 5743.tmp 99 PID 3844 wrote to memory of 1756 3844 5743.tmp 99 PID 3844 wrote to memory of 1756 3844 5743.tmp 99 PID 1756 wrote to memory of 1772 1756 57C0.tmp 100 PID 1756 wrote to memory of 1772 1756 57C0.tmp 100 PID 1756 wrote to memory of 1772 1756 57C0.tmp 100 PID 1772 wrote to memory of 1152 1772 581E.tmp 101 PID 1772 wrote to memory of 1152 1772 581E.tmp 101 PID 1772 wrote to memory of 1152 1772 581E.tmp 101 PID 1152 wrote to memory of 2576 1152 58BA.tmp 102 PID 1152 wrote to memory of 2576 1152 58BA.tmp 102 PID 1152 wrote to memory of 2576 1152 58BA.tmp 102 PID 2576 wrote to memory of 1652 2576 5927.tmp 103 PID 2576 wrote to memory of 1652 2576 5927.tmp 103 PID 2576 wrote to memory of 1652 2576 5927.tmp 103 PID 1652 wrote to memory of 744 1652 59C3.tmp 104 PID 1652 wrote to memory of 744 1652 59C3.tmp 104 PID 1652 wrote to memory of 744 1652 59C3.tmp 104 PID 744 wrote to memory of 220 744 5A40.tmp 105 PID 744 wrote to memory of 220 744 5A40.tmp 105 PID 744 wrote to memory of 220 744 5A40.tmp 105 PID 220 wrote to memory of 1020 220 5ABD.tmp 106 PID 220 wrote to memory of 1020 220 5ABD.tmp 106 PID 220 wrote to memory of 1020 220 5ABD.tmp 106 PID 1020 wrote to memory of 3468 1020 5B1B.tmp 107 PID 1020 wrote to memory of 3468 1020 5B1B.tmp 107 PID 1020 wrote to memory of 3468 1020 5B1B.tmp 107 PID 3468 wrote to memory of 2692 3468 5B89.tmp 108 PID 3468 wrote to memory of 2692 3468 5B89.tmp 108 PID 3468 wrote to memory of 2692 3468 5B89.tmp 108 PID 2692 wrote to memory of 4524 2692 5BF6.tmp 109 PID 2692 wrote to memory of 4524 2692 5BF6.tmp 109 PID 2692 wrote to memory of 4524 2692 5BF6.tmp 109 PID 4524 wrote to memory of 1680 4524 5C54.tmp 110 PID 4524 wrote to memory of 1680 4524 5C54.tmp 110 PID 4524 wrote to memory of 1680 4524 5C54.tmp 110 PID 1680 wrote to memory of 2948 1680 5CD1.tmp 111 PID 1680 wrote to memory of 2948 1680 5CD1.tmp 111 PID 1680 wrote to memory of 2948 1680 5CD1.tmp 111 PID 2948 wrote to memory of 2776 2948 5D6D.tmp 112 PID 2948 wrote to memory of 2776 2948 5D6D.tmp 112 PID 2948 wrote to memory of 2776 2948 5D6D.tmp 112 PID 2776 wrote to memory of 2608 2776 5DEA.tmp 113 PID 2776 wrote to memory of 2608 2776 5DEA.tmp 113 PID 2776 wrote to memory of 2608 2776 5DEA.tmp 113 PID 2608 wrote to memory of 2360 2608 5E67.tmp 114 PID 2608 wrote to memory of 2360 2608 5E67.tmp 114 PID 2608 wrote to memory of 2360 2608 5E67.tmp 114 PID 2360 wrote to memory of 3116 2360 5EB5.tmp 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-17_e4e1bb160b35d8e2dce903f88730f5d8_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-17_e4e1bb160b35d8e2dce903f88730f5d8_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\555E.tmp"C:\Users\Admin\AppData\Local\Temp\555E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\55CC.tmp"C:\Users\Admin\AppData\Local\Temp\55CC.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\5639.tmp"C:\Users\Admin\AppData\Local\Temp\5639.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\56E5.tmp"C:\Users\Admin\AppData\Local\Temp\56E5.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\5743.tmp"C:\Users\Admin\AppData\Local\Temp\5743.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\57C0.tmp"C:\Users\Admin\AppData\Local\Temp\57C0.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\581E.tmp"C:\Users\Admin\AppData\Local\Temp\581E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\58BA.tmp"C:\Users\Admin\AppData\Local\Temp\58BA.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\5927.tmp"C:\Users\Admin\AppData\Local\Temp\5927.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\59C3.tmp"C:\Users\Admin\AppData\Local\Temp\59C3.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\5A40.tmp"C:\Users\Admin\AppData\Local\Temp\5A40.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Users\Admin\AppData\Local\Temp\5ABD.tmp"C:\Users\Admin\AppData\Local\Temp\5ABD.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\5B1B.tmp"C:\Users\Admin\AppData\Local\Temp\5B1B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\5B89.tmp"C:\Users\Admin\AppData\Local\Temp\5B89.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\5BF6.tmp"C:\Users\Admin\AppData\Local\Temp\5BF6.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\5C54.tmp"C:\Users\Admin\AppData\Local\Temp\5C54.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\5CD1.tmp"C:\Users\Admin\AppData\Local\Temp\5CD1.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\5D6D.tmp"C:\Users\Admin\AppData\Local\Temp\5D6D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\5DEA.tmp"C:\Users\Admin\AppData\Local\Temp\5DEA.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\5E67.tmp"C:\Users\Admin\AppData\Local\Temp\5E67.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\5EB5.tmp"C:\Users\Admin\AppData\Local\Temp\5EB5.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\5F22.tmp"C:\Users\Admin\AppData\Local\Temp\5F22.tmp"23⤵
- Executes dropped EXE
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\5F90.tmp"C:\Users\Admin\AppData\Local\Temp\5F90.tmp"24⤵
- Executes dropped EXE
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\600D.tmp"C:\Users\Admin\AppData\Local\Temp\600D.tmp"25⤵
- Executes dropped EXE
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\607A.tmp"C:\Users\Admin\AppData\Local\Temp\607A.tmp"26⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\60E8.tmp"C:\Users\Admin\AppData\Local\Temp\60E8.tmp"27⤵
- Executes dropped EXE
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\6165.tmp"C:\Users\Admin\AppData\Local\Temp\6165.tmp"28⤵
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\6201.tmp"C:\Users\Admin\AppData\Local\Temp\6201.tmp"29⤵
- Executes dropped EXE
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\626E.tmp"C:\Users\Admin\AppData\Local\Temp\626E.tmp"30⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\62EB.tmp"C:\Users\Admin\AppData\Local\Temp\62EB.tmp"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\6368.tmp"C:\Users\Admin\AppData\Local\Temp\6368.tmp"32⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\63C6.tmp"C:\Users\Admin\AppData\Local\Temp\63C6.tmp"33⤵
- Executes dropped EXE
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\6433.tmp"C:\Users\Admin\AppData\Local\Temp\6433.tmp"34⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\64B0.tmp"C:\Users\Admin\AppData\Local\Temp\64B0.tmp"35⤵
- Executes dropped EXE
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\64FE.tmp"C:\Users\Admin\AppData\Local\Temp\64FE.tmp"36⤵
- Executes dropped EXE
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\655C.tmp"C:\Users\Admin\AppData\Local\Temp\655C.tmp"37⤵
- Executes dropped EXE
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\65AA.tmp"C:\Users\Admin\AppData\Local\Temp\65AA.tmp"38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\65F8.tmp"C:\Users\Admin\AppData\Local\Temp\65F8.tmp"39⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\6647.tmp"C:\Users\Admin\AppData\Local\Temp\6647.tmp"40⤵
- Executes dropped EXE
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\6695.tmp"C:\Users\Admin\AppData\Local\Temp\6695.tmp"41⤵
- Executes dropped EXE
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\66E3.tmp"C:\Users\Admin\AppData\Local\Temp\66E3.tmp"42⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\6750.tmp"C:\Users\Admin\AppData\Local\Temp\6750.tmp"43⤵
- Executes dropped EXE
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\67BE.tmp"C:\Users\Admin\AppData\Local\Temp\67BE.tmp"44⤵
- Executes dropped EXE
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\682B.tmp"C:\Users\Admin\AppData\Local\Temp\682B.tmp"45⤵
- Executes dropped EXE
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\6879.tmp"C:\Users\Admin\AppData\Local\Temp\6879.tmp"46⤵
- Executes dropped EXE
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\68C7.tmp"C:\Users\Admin\AppData\Local\Temp\68C7.tmp"47⤵
- Executes dropped EXE
PID:780 -
C:\Users\Admin\AppData\Local\Temp\6925.tmp"C:\Users\Admin\AppData\Local\Temp\6925.tmp"48⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\6973.tmp"C:\Users\Admin\AppData\Local\Temp\6973.tmp"49⤵
- Executes dropped EXE
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\69C1.tmp"C:\Users\Admin\AppData\Local\Temp\69C1.tmp"50⤵
- Executes dropped EXE
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\6A1F.tmp"C:\Users\Admin\AppData\Local\Temp\6A1F.tmp"51⤵
- Executes dropped EXE
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\6A7D.tmp"C:\Users\Admin\AppData\Local\Temp\6A7D.tmp"52⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\6AEA.tmp"C:\Users\Admin\AppData\Local\Temp\6AEA.tmp"53⤵
- Executes dropped EXE
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\6B38.tmp"C:\Users\Admin\AppData\Local\Temp\6B38.tmp"54⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\6B86.tmp"C:\Users\Admin\AppData\Local\Temp\6B86.tmp"55⤵
- Executes dropped EXE
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\6BE4.tmp"C:\Users\Admin\AppData\Local\Temp\6BE4.tmp"56⤵
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\6C61.tmp"C:\Users\Admin\AppData\Local\Temp\6C61.tmp"57⤵
- Executes dropped EXE
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\6CCE.tmp"C:\Users\Admin\AppData\Local\Temp\6CCE.tmp"58⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\6D3C.tmp"C:\Users\Admin\AppData\Local\Temp\6D3C.tmp"59⤵
- Executes dropped EXE
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\6D8A.tmp"C:\Users\Admin\AppData\Local\Temp\6D8A.tmp"60⤵
- Executes dropped EXE
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\6DE8.tmp"C:\Users\Admin\AppData\Local\Temp\6DE8.tmp"61⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\6E45.tmp"C:\Users\Admin\AppData\Local\Temp\6E45.tmp"62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\6EA3.tmp"C:\Users\Admin\AppData\Local\Temp\6EA3.tmp"63⤵
- Executes dropped EXE
PID:932 -
C:\Users\Admin\AppData\Local\Temp\6F01.tmp"C:\Users\Admin\AppData\Local\Temp\6F01.tmp"64⤵
- Executes dropped EXE
PID:752 -
C:\Users\Admin\AppData\Local\Temp\6F5F.tmp"C:\Users\Admin\AppData\Local\Temp\6F5F.tmp"65⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\6FAD.tmp"C:\Users\Admin\AppData\Local\Temp\6FAD.tmp"66⤵
- Executes dropped EXE
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\701A.tmp"C:\Users\Admin\AppData\Local\Temp\701A.tmp"67⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\7078.tmp"C:\Users\Admin\AppData\Local\Temp\7078.tmp"68⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\70D6.tmp"C:\Users\Admin\AppData\Local\Temp\70D6.tmp"69⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\7143.tmp"C:\Users\Admin\AppData\Local\Temp\7143.tmp"70⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\71B0.tmp"C:\Users\Admin\AppData\Local\Temp\71B0.tmp"71⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\721E.tmp"C:\Users\Admin\AppData\Local\Temp\721E.tmp"72⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\727C.tmp"C:\Users\Admin\AppData\Local\Temp\727C.tmp"73⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\72E9.tmp"C:\Users\Admin\AppData\Local\Temp\72E9.tmp"74⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\7347.tmp"C:\Users\Admin\AppData\Local\Temp\7347.tmp"75⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\7395.tmp"C:\Users\Admin\AppData\Local\Temp\7395.tmp"76⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\73F3.tmp"C:\Users\Admin\AppData\Local\Temp\73F3.tmp"77⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\7460.tmp"C:\Users\Admin\AppData\Local\Temp\7460.tmp"78⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\74BE.tmp"C:\Users\Admin\AppData\Local\Temp\74BE.tmp"79⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\751B.tmp"C:\Users\Admin\AppData\Local\Temp\751B.tmp"80⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\7579.tmp"C:\Users\Admin\AppData\Local\Temp\7579.tmp"81⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\75C7.tmp"C:\Users\Admin\AppData\Local\Temp\75C7.tmp"82⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\7635.tmp"C:\Users\Admin\AppData\Local\Temp\7635.tmp"83⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\7692.tmp"C:\Users\Admin\AppData\Local\Temp\7692.tmp"84⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\76F0.tmp"C:\Users\Admin\AppData\Local\Temp\76F0.tmp"85⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\775E.tmp"C:\Users\Admin\AppData\Local\Temp\775E.tmp"86⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\77BB.tmp"C:\Users\Admin\AppData\Local\Temp\77BB.tmp"87⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\7819.tmp"C:\Users\Admin\AppData\Local\Temp\7819.tmp"88⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\7886.tmp"C:\Users\Admin\AppData\Local\Temp\7886.tmp"89⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\78F4.tmp"C:\Users\Admin\AppData\Local\Temp\78F4.tmp"90⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\7952.tmp"C:\Users\Admin\AppData\Local\Temp\7952.tmp"91⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\79BF.tmp"C:\Users\Admin\AppData\Local\Temp\79BF.tmp"92⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\7A1D.tmp"C:\Users\Admin\AppData\Local\Temp\7A1D.tmp"93⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\7A8A.tmp"C:\Users\Admin\AppData\Local\Temp\7A8A.tmp"94⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\7AF7.tmp"C:\Users\Admin\AppData\Local\Temp\7AF7.tmp"95⤵
- System Location Discovery: System Language Discovery
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\7B46.tmp"C:\Users\Admin\AppData\Local\Temp\7B46.tmp"96⤵
- System Location Discovery: System Language Discovery
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\7BA3.tmp"C:\Users\Admin\AppData\Local\Temp\7BA3.tmp"97⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\7C01.tmp"C:\Users\Admin\AppData\Local\Temp\7C01.tmp"98⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\7C4F.tmp"C:\Users\Admin\AppData\Local\Temp\7C4F.tmp"99⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\7CAD.tmp"C:\Users\Admin\AppData\Local\Temp\7CAD.tmp"100⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\7CFB.tmp"C:\Users\Admin\AppData\Local\Temp\7CFB.tmp"101⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\7D59.tmp"C:\Users\Admin\AppData\Local\Temp\7D59.tmp"102⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\7DA7.tmp"C:\Users\Admin\AppData\Local\Temp\7DA7.tmp"103⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\7E05.tmp"C:\Users\Admin\AppData\Local\Temp\7E05.tmp"104⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\7E62.tmp"C:\Users\Admin\AppData\Local\Temp\7E62.tmp"105⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\7EC0.tmp"C:\Users\Admin\AppData\Local\Temp\7EC0.tmp"106⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\7F1E.tmp"C:\Users\Admin\AppData\Local\Temp\7F1E.tmp"107⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\7F7C.tmp"C:\Users\Admin\AppData\Local\Temp\7F7C.tmp"108⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\7FCA.tmp"C:\Users\Admin\AppData\Local\Temp\7FCA.tmp"109⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\8018.tmp"C:\Users\Admin\AppData\Local\Temp\8018.tmp"110⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\8085.tmp"C:\Users\Admin\AppData\Local\Temp\8085.tmp"111⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\80E3.tmp"C:\Users\Admin\AppData\Local\Temp\80E3.tmp"112⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\8131.tmp"C:\Users\Admin\AppData\Local\Temp\8131.tmp"113⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\817F.tmp"C:\Users\Admin\AppData\Local\Temp\817F.tmp"114⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\81DD.tmp"C:\Users\Admin\AppData\Local\Temp\81DD.tmp"115⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\822B.tmp"C:\Users\Admin\AppData\Local\Temp\822B.tmp"116⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\8289.tmp"C:\Users\Admin\AppData\Local\Temp\8289.tmp"117⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\82E7.tmp"C:\Users\Admin\AppData\Local\Temp\82E7.tmp"118⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\8344.tmp"C:\Users\Admin\AppData\Local\Temp\8344.tmp"119⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\83A2.tmp"C:\Users\Admin\AppData\Local\Temp\83A2.tmp"120⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\8410.tmp"C:\Users\Admin\AppData\Local\Temp\8410.tmp"121⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\846D.tmp"C:\Users\Admin\AppData\Local\Temp\846D.tmp"122⤵PID:1376
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-