Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/08/2024, 07:34
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-19_7ae84cba568093d4bc2f6118167dda74_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-08-19_7ae84cba568093d4bc2f6118167dda74_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-19_7ae84cba568093d4bc2f6118167dda74_mafia.exe
-
Size
765KB
-
MD5
7ae84cba568093d4bc2f6118167dda74
-
SHA1
245ebdf909c482fc8bf5bab5c19a35a045c121da
-
SHA256
cdf2e786443fe4a0c90e2c83e80da8ca55c6a7b618054c2d09dbcd9b125ecc1e
-
SHA512
12105ceeea0e80d73c7e3f71c7b7da77132856968b06f97f6dd0668f2b3e3b37c0ed43b55adfa0a440fe0355d8c4f5435403788409d4c23ed8c6c2fcf2f8cdab
-
SSDEEP
12288:ZU5rCOTeiD/nKiABlFhUqXLq+Xh/Z4UW3ZF5rn5rLOa54U5w5A:ZUQOJD/nKiAjFaKjSr3vh5Oa+UOS
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4864 4FA3.tmp 4596 503F.tmp 4064 50CC.tmp 2064 5149.tmp 4556 51B6.tmp 3700 5233.tmp 2432 5291.tmp 2160 530E.tmp 880 538B.tmp 3432 53F8.tmp 3952 5485.tmp 3528 5502.tmp 4508 557F.tmp 2960 560C.tmp 4204 5689.tmp 5000 5706.tmp 2536 5783.tmp 456 5800.tmp 3600 586D.tmp 2144 58FA.tmp 4308 5977.tmp 2020 59F4.tmp 400 5A51.tmp 4980 5ADE.tmp 4480 5B5B.tmp 3720 5BD8.tmp 4580 5C55.tmp 4232 5CE2.tmp 4616 5D6E.tmp 5088 5DEB.tmp 2044 5E78.tmp 4228 5EF5.tmp 1128 5F62.tmp 4000 5FC0.tmp 2232 601E.tmp 1936 606C.tmp 2816 60CA.tmp 4492 6127.tmp 1892 6185.tmp 1616 61D3.tmp 760 6231.tmp 2096 629E.tmp 1808 62FC.tmp 4060 635A.tmp 4812 63B8.tmp 4312 6406.tmp 4708 6464.tmp 4336 64B2.tmp 3896 650F.tmp 3272 656D.tmp 1408 65BB.tmp 4252 6609.tmp 3208 6658.tmp 4064 6696.tmp 2728 66E4.tmp 2724 6742.tmp 2500 67A0.tmp 2204 67FD.tmp 1132 685B.tmp 5040 68B9.tmp 892 6917.tmp 772 6984.tmp 3816 69E2.tmp 3432 6A40.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E480.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7387.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8634.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C39B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE56.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 339A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9EEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5839.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5EB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ECF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C11A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9998.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5706.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C178.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E367.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 932F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF96.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4444.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 601E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9854.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECBE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5EF5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A286.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D89A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C05E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4761.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5173.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3236 wrote to memory of 4864 3236 2024-08-19_7ae84cba568093d4bc2f6118167dda74_mafia.exe 83 PID 3236 wrote to memory of 4864 3236 2024-08-19_7ae84cba568093d4bc2f6118167dda74_mafia.exe 83 PID 3236 wrote to memory of 4864 3236 2024-08-19_7ae84cba568093d4bc2f6118167dda74_mafia.exe 83 PID 4864 wrote to memory of 4596 4864 4FA3.tmp 85 PID 4864 wrote to memory of 4596 4864 4FA3.tmp 85 PID 4864 wrote to memory of 4596 4864 4FA3.tmp 85 PID 4596 wrote to memory of 4064 4596 503F.tmp 87 PID 4596 wrote to memory of 4064 4596 503F.tmp 87 PID 4596 wrote to memory of 4064 4596 503F.tmp 87 PID 4064 wrote to memory of 2064 4064 50CC.tmp 89 PID 4064 wrote to memory of 2064 4064 50CC.tmp 89 PID 4064 wrote to memory of 2064 4064 50CC.tmp 89 PID 2064 wrote to memory of 4556 2064 5149.tmp 90 PID 2064 wrote to memory of 4556 2064 5149.tmp 90 PID 2064 wrote to memory of 4556 2064 5149.tmp 90 PID 4556 wrote to memory of 3700 4556 51B6.tmp 91 PID 4556 wrote to memory of 3700 4556 51B6.tmp 91 PID 4556 wrote to memory of 3700 4556 51B6.tmp 91 PID 3700 wrote to memory of 2432 3700 5233.tmp 92 PID 3700 wrote to memory of 2432 3700 5233.tmp 92 PID 3700 wrote to memory of 2432 3700 5233.tmp 92 PID 2432 wrote to memory of 2160 2432 5291.tmp 93 PID 2432 wrote to memory of 2160 2432 5291.tmp 93 PID 2432 wrote to memory of 2160 2432 5291.tmp 93 PID 2160 wrote to memory of 880 2160 530E.tmp 94 PID 2160 wrote to memory of 880 2160 530E.tmp 94 PID 2160 wrote to memory of 880 2160 530E.tmp 94 PID 880 wrote to memory of 3432 880 538B.tmp 95 PID 880 wrote to memory of 3432 880 538B.tmp 95 PID 880 wrote to memory of 3432 880 538B.tmp 95 PID 3432 wrote to memory of 3952 3432 53F8.tmp 96 PID 3432 wrote to memory of 3952 3432 53F8.tmp 96 PID 3432 wrote to memory of 3952 3432 53F8.tmp 96 PID 3952 wrote to memory of 3528 3952 5485.tmp 97 PID 3952 wrote to memory of 3528 3952 5485.tmp 97 PID 3952 wrote to memory of 3528 3952 5485.tmp 97 PID 3528 wrote to memory of 4508 3528 5502.tmp 98 PID 3528 wrote to memory of 4508 3528 5502.tmp 98 PID 3528 wrote to memory of 4508 3528 5502.tmp 98 PID 4508 wrote to memory of 2960 4508 557F.tmp 99 PID 4508 wrote to memory of 2960 4508 557F.tmp 99 PID 4508 wrote to memory of 2960 4508 557F.tmp 99 PID 2960 wrote to memory of 4204 2960 560C.tmp 100 PID 2960 wrote to memory of 4204 2960 560C.tmp 100 PID 2960 wrote to memory of 4204 2960 560C.tmp 100 PID 4204 wrote to memory of 5000 4204 5689.tmp 101 PID 4204 wrote to memory of 5000 4204 5689.tmp 101 PID 4204 wrote to memory of 5000 4204 5689.tmp 101 PID 5000 wrote to memory of 2536 5000 5706.tmp 102 PID 5000 wrote to memory of 2536 5000 5706.tmp 102 PID 5000 wrote to memory of 2536 5000 5706.tmp 102 PID 2536 wrote to memory of 456 2536 5783.tmp 103 PID 2536 wrote to memory of 456 2536 5783.tmp 103 PID 2536 wrote to memory of 456 2536 5783.tmp 103 PID 456 wrote to memory of 3600 456 5800.tmp 104 PID 456 wrote to memory of 3600 456 5800.tmp 104 PID 456 wrote to memory of 3600 456 5800.tmp 104 PID 3600 wrote to memory of 2144 3600 586D.tmp 105 PID 3600 wrote to memory of 2144 3600 586D.tmp 105 PID 3600 wrote to memory of 2144 3600 586D.tmp 105 PID 2144 wrote to memory of 4308 2144 58FA.tmp 106 PID 2144 wrote to memory of 4308 2144 58FA.tmp 106 PID 2144 wrote to memory of 4308 2144 58FA.tmp 106 PID 4308 wrote to memory of 2020 4308 5977.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-19_7ae84cba568093d4bc2f6118167dda74_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-19_7ae84cba568093d4bc2f6118167dda74_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\4FA3.tmp"C:\Users\Admin\AppData\Local\Temp\4FA3.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\503F.tmp"C:\Users\Admin\AppData\Local\Temp\503F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\50CC.tmp"C:\Users\Admin\AppData\Local\Temp\50CC.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\5149.tmp"C:\Users\Admin\AppData\Local\Temp\5149.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\51B6.tmp"C:\Users\Admin\AppData\Local\Temp\51B6.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\5233.tmp"C:\Users\Admin\AppData\Local\Temp\5233.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\5291.tmp"C:\Users\Admin\AppData\Local\Temp\5291.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\530E.tmp"C:\Users\Admin\AppData\Local\Temp\530E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\538B.tmp"C:\Users\Admin\AppData\Local\Temp\538B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Users\Admin\AppData\Local\Temp\53F8.tmp"C:\Users\Admin\AppData\Local\Temp\53F8.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\5485.tmp"C:\Users\Admin\AppData\Local\Temp\5485.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\5502.tmp"C:\Users\Admin\AppData\Local\Temp\5502.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\557F.tmp"C:\Users\Admin\AppData\Local\Temp\557F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\560C.tmp"C:\Users\Admin\AppData\Local\Temp\560C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\5689.tmp"C:\Users\Admin\AppData\Local\Temp\5689.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\5706.tmp"C:\Users\Admin\AppData\Local\Temp\5706.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\5783.tmp"C:\Users\Admin\AppData\Local\Temp\5783.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\5800.tmp"C:\Users\Admin\AppData\Local\Temp\5800.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Users\Admin\AppData\Local\Temp\586D.tmp"C:\Users\Admin\AppData\Local\Temp\586D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\58FA.tmp"C:\Users\Admin\AppData\Local\Temp\58FA.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\5977.tmp"C:\Users\Admin\AppData\Local\Temp\5977.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\59F4.tmp"C:\Users\Admin\AppData\Local\Temp\59F4.tmp"23⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\5A51.tmp"C:\Users\Admin\AppData\Local\Temp\5A51.tmp"24⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\5ADE.tmp"C:\Users\Admin\AppData\Local\Temp\5ADE.tmp"25⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\5B5B.tmp"C:\Users\Admin\AppData\Local\Temp\5B5B.tmp"26⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\5BD8.tmp"C:\Users\Admin\AppData\Local\Temp\5BD8.tmp"27⤵
- Executes dropped EXE
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\5C55.tmp"C:\Users\Admin\AppData\Local\Temp\5C55.tmp"28⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\5CE2.tmp"C:\Users\Admin\AppData\Local\Temp\5CE2.tmp"29⤵
- Executes dropped EXE
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\5D6E.tmp"C:\Users\Admin\AppData\Local\Temp\5D6E.tmp"30⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\5DEB.tmp"C:\Users\Admin\AppData\Local\Temp\5DEB.tmp"31⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\5E78.tmp"C:\Users\Admin\AppData\Local\Temp\5E78.tmp"32⤵
- Executes dropped EXE
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\5EF5.tmp"C:\Users\Admin\AppData\Local\Temp\5EF5.tmp"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\5F62.tmp"C:\Users\Admin\AppData\Local\Temp\5F62.tmp"34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\5FC0.tmp"C:\Users\Admin\AppData\Local\Temp\5FC0.tmp"35⤵
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\601E.tmp"C:\Users\Admin\AppData\Local\Temp\601E.tmp"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\606C.tmp"C:\Users\Admin\AppData\Local\Temp\606C.tmp"37⤵
- Executes dropped EXE
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\60CA.tmp"C:\Users\Admin\AppData\Local\Temp\60CA.tmp"38⤵
- Executes dropped EXE
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\6127.tmp"C:\Users\Admin\AppData\Local\Temp\6127.tmp"39⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\6185.tmp"C:\Users\Admin\AppData\Local\Temp\6185.tmp"40⤵
- Executes dropped EXE
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\61D3.tmp"C:\Users\Admin\AppData\Local\Temp\61D3.tmp"41⤵
- Executes dropped EXE
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\6231.tmp"C:\Users\Admin\AppData\Local\Temp\6231.tmp"42⤵
- Executes dropped EXE
PID:760 -
C:\Users\Admin\AppData\Local\Temp\629E.tmp"C:\Users\Admin\AppData\Local\Temp\629E.tmp"43⤵
- Executes dropped EXE
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\62FC.tmp"C:\Users\Admin\AppData\Local\Temp\62FC.tmp"44⤵
- Executes dropped EXE
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\635A.tmp"C:\Users\Admin\AppData\Local\Temp\635A.tmp"45⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\63B8.tmp"C:\Users\Admin\AppData\Local\Temp\63B8.tmp"46⤵
- Executes dropped EXE
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\6406.tmp"C:\Users\Admin\AppData\Local\Temp\6406.tmp"47⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\6464.tmp"C:\Users\Admin\AppData\Local\Temp\6464.tmp"48⤵
- Executes dropped EXE
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\64B2.tmp"C:\Users\Admin\AppData\Local\Temp\64B2.tmp"49⤵
- Executes dropped EXE
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\650F.tmp"C:\Users\Admin\AppData\Local\Temp\650F.tmp"50⤵
- Executes dropped EXE
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\656D.tmp"C:\Users\Admin\AppData\Local\Temp\656D.tmp"51⤵
- Executes dropped EXE
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\65BB.tmp"C:\Users\Admin\AppData\Local\Temp\65BB.tmp"52⤵
- Executes dropped EXE
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\6609.tmp"C:\Users\Admin\AppData\Local\Temp\6609.tmp"53⤵
- Executes dropped EXE
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\6658.tmp"C:\Users\Admin\AppData\Local\Temp\6658.tmp"54⤵
- Executes dropped EXE
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\6696.tmp"C:\Users\Admin\AppData\Local\Temp\6696.tmp"55⤵
- Executes dropped EXE
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\66E4.tmp"C:\Users\Admin\AppData\Local\Temp\66E4.tmp"56⤵
- Executes dropped EXE
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\6742.tmp"C:\Users\Admin\AppData\Local\Temp\6742.tmp"57⤵
- Executes dropped EXE
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\67A0.tmp"C:\Users\Admin\AppData\Local\Temp\67A0.tmp"58⤵
- Executes dropped EXE
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\67FD.tmp"C:\Users\Admin\AppData\Local\Temp\67FD.tmp"59⤵
- Executes dropped EXE
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\685B.tmp"C:\Users\Admin\AppData\Local\Temp\685B.tmp"60⤵
- Executes dropped EXE
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\68B9.tmp"C:\Users\Admin\AppData\Local\Temp\68B9.tmp"61⤵
- Executes dropped EXE
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\6917.tmp"C:\Users\Admin\AppData\Local\Temp\6917.tmp"62⤵
- Executes dropped EXE
PID:892 -
C:\Users\Admin\AppData\Local\Temp\6984.tmp"C:\Users\Admin\AppData\Local\Temp\6984.tmp"63⤵
- Executes dropped EXE
PID:772 -
C:\Users\Admin\AppData\Local\Temp\69E2.tmp"C:\Users\Admin\AppData\Local\Temp\69E2.tmp"64⤵
- Executes dropped EXE
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\6A40.tmp"C:\Users\Admin\AppData\Local\Temp\6A40.tmp"65⤵
- Executes dropped EXE
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\6A9D.tmp"C:\Users\Admin\AppData\Local\Temp\6A9D.tmp"66⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\6AFB.tmp"C:\Users\Admin\AppData\Local\Temp\6AFB.tmp"67⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\6B59.tmp"C:\Users\Admin\AppData\Local\Temp\6B59.tmp"68⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\6BA7.tmp"C:\Users\Admin\AppData\Local\Temp\6BA7.tmp"69⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\6BF5.tmp"C:\Users\Admin\AppData\Local\Temp\6BF5.tmp"70⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\6C43.tmp"C:\Users\Admin\AppData\Local\Temp\6C43.tmp"71⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\6C91.tmp"C:\Users\Admin\AppData\Local\Temp\6C91.tmp"72⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\6CEF.tmp"C:\Users\Admin\AppData\Local\Temp\6CEF.tmp"73⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\6D3D.tmp"C:\Users\Admin\AppData\Local\Temp\6D3D.tmp"74⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\6D8B.tmp"C:\Users\Admin\AppData\Local\Temp\6D8B.tmp"75⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\6DD9.tmp"C:\Users\Admin\AppData\Local\Temp\6DD9.tmp"76⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\6E28.tmp"C:\Users\Admin\AppData\Local\Temp\6E28.tmp"77⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\6E85.tmp"C:\Users\Admin\AppData\Local\Temp\6E85.tmp"78⤵
- System Location Discovery: System Language Discovery
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\6EE3.tmp"C:\Users\Admin\AppData\Local\Temp\6EE3.tmp"79⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\6F31.tmp"C:\Users\Admin\AppData\Local\Temp\6F31.tmp"80⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\6F8F.tmp"C:\Users\Admin\AppData\Local\Temp\6F8F.tmp"81⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\6FED.tmp"C:\Users\Admin\AppData\Local\Temp\6FED.tmp"82⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\704A.tmp"C:\Users\Admin\AppData\Local\Temp\704A.tmp"83⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\7099.tmp"C:\Users\Admin\AppData\Local\Temp\7099.tmp"84⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\70F6.tmp"C:\Users\Admin\AppData\Local\Temp\70F6.tmp"85⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\7154.tmp"C:\Users\Admin\AppData\Local\Temp\7154.tmp"86⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\71B2.tmp"C:\Users\Admin\AppData\Local\Temp\71B2.tmp"87⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\7210.tmp"C:\Users\Admin\AppData\Local\Temp\7210.tmp"88⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\726D.tmp"C:\Users\Admin\AppData\Local\Temp\726D.tmp"89⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\72CB.tmp"C:\Users\Admin\AppData\Local\Temp\72CB.tmp"90⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\7319.tmp"C:\Users\Admin\AppData\Local\Temp\7319.tmp"91⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\7387.tmp"C:\Users\Admin\AppData\Local\Temp\7387.tmp"92⤵
- System Location Discovery: System Language Discovery
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\73E4.tmp"C:\Users\Admin\AppData\Local\Temp\73E4.tmp"93⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\7442.tmp"C:\Users\Admin\AppData\Local\Temp\7442.tmp"94⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\74AF.tmp"C:\Users\Admin\AppData\Local\Temp\74AF.tmp"95⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\74FE.tmp"C:\Users\Admin\AppData\Local\Temp\74FE.tmp"96⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\754C.tmp"C:\Users\Admin\AppData\Local\Temp\754C.tmp"97⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\75A9.tmp"C:\Users\Admin\AppData\Local\Temp\75A9.tmp"98⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\75F8.tmp"C:\Users\Admin\AppData\Local\Temp\75F8.tmp"99⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\7655.tmp"C:\Users\Admin\AppData\Local\Temp\7655.tmp"100⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\76B3.tmp"C:\Users\Admin\AppData\Local\Temp\76B3.tmp"101⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\7711.tmp"C:\Users\Admin\AppData\Local\Temp\7711.tmp"102⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\776F.tmp"C:\Users\Admin\AppData\Local\Temp\776F.tmp"103⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\77CC.tmp"C:\Users\Admin\AppData\Local\Temp\77CC.tmp"104⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\782A.tmp"C:\Users\Admin\AppData\Local\Temp\782A.tmp"105⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\7878.tmp"C:\Users\Admin\AppData\Local\Temp\7878.tmp"106⤵PID:332
-
C:\Users\Admin\AppData\Local\Temp\78D6.tmp"C:\Users\Admin\AppData\Local\Temp\78D6.tmp"107⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\7924.tmp"C:\Users\Admin\AppData\Local\Temp\7924.tmp"108⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\7982.tmp"C:\Users\Admin\AppData\Local\Temp\7982.tmp"109⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\79D0.tmp"C:\Users\Admin\AppData\Local\Temp\79D0.tmp"110⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\7A1E.tmp"C:\Users\Admin\AppData\Local\Temp\7A1E.tmp"111⤵
- System Location Discovery: System Language Discovery
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\7A7C.tmp"C:\Users\Admin\AppData\Local\Temp\7A7C.tmp"112⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\7ADA.tmp"C:\Users\Admin\AppData\Local\Temp\7ADA.tmp"113⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\7B37.tmp"C:\Users\Admin\AppData\Local\Temp\7B37.tmp"114⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\7B95.tmp"C:\Users\Admin\AppData\Local\Temp\7B95.tmp"115⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\7BF3.tmp"C:\Users\Admin\AppData\Local\Temp\7BF3.tmp"116⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\7C51.tmp"C:\Users\Admin\AppData\Local\Temp\7C51.tmp"117⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\7C9F.tmp"C:\Users\Admin\AppData\Local\Temp\7C9F.tmp"118⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\7CED.tmp"C:\Users\Admin\AppData\Local\Temp\7CED.tmp"119⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\7D4B.tmp"C:\Users\Admin\AppData\Local\Temp\7D4B.tmp"120⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\7D99.tmp"C:\Users\Admin\AppData\Local\Temp\7D99.tmp"121⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\7DF6.tmp"C:\Users\Admin\AppData\Local\Temp\7DF6.tmp"122⤵PID:5012
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-