Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
20/08/2024, 13:09
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-20_d98e290d2450d0a30da9c5c65e839b7c_mafia.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-08-20_d98e290d2450d0a30da9c5c65e839b7c_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-20_d98e290d2450d0a30da9c5c65e839b7c_mafia.exe
-
Size
536KB
-
MD5
d98e290d2450d0a30da9c5c65e839b7c
-
SHA1
f89a8c6d2353f06724ea9b96d41b2660a461189e
-
SHA256
53bf3e22ce0f105a6a06ad2fab8fabaab4ce626cc3e0ef5134576ee79abdc2d3
-
SHA512
defe46cbbc08f741d8d58b3cc51356adfef18f7c99019d36b34f2ca55a040ee2d2b2526a30aba8a4fdf7ea110f2a5c96f6bf7aca54d102393cadf72cd89ba8cb
-
SSDEEP
12288:wU5rCOTeiULLLDTkLRM+bVeCEKUHZhaZMb/JKOIZxVJ0ZT9:wUQOJULbA++bVji5hUMFKOIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 32 8240.tmp 3596 82AD.tmp 4372 833A.tmp 1592 83B7.tmp 4960 8434.tmp 452 84A1.tmp 636 852E.tmp 4004 85CA.tmp 4676 8637.tmp 4936 86D3.tmp 2364 8750.tmp 5044 87BE.tmp 968 882B.tmp 4124 8899.tmp 4460 8925.tmp 3064 89A2.tmp 2716 8A10.tmp 3672 8A8D.tmp 1760 8B0A.tmp 2612 8B96.tmp 4000 8C13.tmp 1552 8C81.tmp 4168 8D0D.tmp 4736 8D6B.tmp 4456 8DE8.tmp 3220 8E75.tmp 4608 8EF2.tmp 1348 8F5F.tmp 3628 8FCC.tmp 2908 9069.tmp 3460 90D6.tmp 4372 9153.tmp 4528 91D0.tmp 820 921E.tmp 4960 926C.tmp 3664 92E9.tmp 2128 9376.tmp 2036 93D4.tmp 408 9441.tmp 4160 94AE.tmp 636 951C.tmp 4004 9579.tmp 2568 95D7.tmp 3800 9625.tmp 2260 9683.tmp 2852 96F0.tmp 3340 973F.tmp 4524 979C.tmp 3140 9819.tmp 3044 9867.tmp 4600 98B6.tmp 1724 9913.tmp 1936 9971.tmp 1528 99BF.tmp 4084 9A1D.tmp 2112 9A7B.tmp 1732 9AC9.tmp 4000 9B17.tmp 2280 9B65.tmp 1364 9BB3.tmp 4476 9C01.tmp 2620 9C5F.tmp 4252 9CAD.tmp 4336 9D0B.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4457.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5510.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4215.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5658.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ABD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DBB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 124.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC68.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C82D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFA4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADA5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C41B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9073.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 582D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 882B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B026.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C5BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFD7.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2472 wrote to memory of 32 2472 2024-08-20_d98e290d2450d0a30da9c5c65e839b7c_mafia.exe 84 PID 2472 wrote to memory of 32 2472 2024-08-20_d98e290d2450d0a30da9c5c65e839b7c_mafia.exe 84 PID 2472 wrote to memory of 32 2472 2024-08-20_d98e290d2450d0a30da9c5c65e839b7c_mafia.exe 84 PID 32 wrote to memory of 3596 32 8240.tmp 85 PID 32 wrote to memory of 3596 32 8240.tmp 85 PID 32 wrote to memory of 3596 32 8240.tmp 85 PID 3596 wrote to memory of 4372 3596 82AD.tmp 86 PID 3596 wrote to memory of 4372 3596 82AD.tmp 86 PID 3596 wrote to memory of 4372 3596 82AD.tmp 86 PID 4372 wrote to memory of 1592 4372 833A.tmp 87 PID 4372 wrote to memory of 1592 4372 833A.tmp 87 PID 4372 wrote to memory of 1592 4372 833A.tmp 87 PID 1592 wrote to memory of 4960 1592 83B7.tmp 90 PID 1592 wrote to memory of 4960 1592 83B7.tmp 90 PID 1592 wrote to memory of 4960 1592 83B7.tmp 90 PID 4960 wrote to memory of 452 4960 8434.tmp 91 PID 4960 wrote to memory of 452 4960 8434.tmp 91 PID 4960 wrote to memory of 452 4960 8434.tmp 91 PID 452 wrote to memory of 636 452 84A1.tmp 93 PID 452 wrote to memory of 636 452 84A1.tmp 93 PID 452 wrote to memory of 636 452 84A1.tmp 93 PID 636 wrote to memory of 4004 636 852E.tmp 94 PID 636 wrote to memory of 4004 636 852E.tmp 94 PID 636 wrote to memory of 4004 636 852E.tmp 94 PID 4004 wrote to memory of 4676 4004 85CA.tmp 95 PID 4004 wrote to memory of 4676 4004 85CA.tmp 95 PID 4004 wrote to memory of 4676 4004 85CA.tmp 95 PID 4676 wrote to memory of 4936 4676 8637.tmp 96 PID 4676 wrote to memory of 4936 4676 8637.tmp 96 PID 4676 wrote to memory of 4936 4676 8637.tmp 96 PID 4936 wrote to memory of 2364 4936 86D3.tmp 97 PID 4936 wrote to memory of 2364 4936 86D3.tmp 97 PID 4936 wrote to memory of 2364 4936 86D3.tmp 97 PID 2364 wrote to memory of 5044 2364 8750.tmp 98 PID 2364 wrote to memory of 5044 2364 8750.tmp 98 PID 2364 wrote to memory of 5044 2364 8750.tmp 98 PID 5044 wrote to memory of 968 5044 87BE.tmp 99 PID 5044 wrote to memory of 968 5044 87BE.tmp 99 PID 5044 wrote to memory of 968 5044 87BE.tmp 99 PID 968 wrote to memory of 4124 968 882B.tmp 100 PID 968 wrote to memory of 4124 968 882B.tmp 100 PID 968 wrote to memory of 4124 968 882B.tmp 100 PID 4124 wrote to memory of 4460 4124 8899.tmp 101 PID 4124 wrote to memory of 4460 4124 8899.tmp 101 PID 4124 wrote to memory of 4460 4124 8899.tmp 101 PID 4460 wrote to memory of 3064 4460 8925.tmp 102 PID 4460 wrote to memory of 3064 4460 8925.tmp 102 PID 4460 wrote to memory of 3064 4460 8925.tmp 102 PID 3064 wrote to memory of 2716 3064 89A2.tmp 103 PID 3064 wrote to memory of 2716 3064 89A2.tmp 103 PID 3064 wrote to memory of 2716 3064 89A2.tmp 103 PID 2716 wrote to memory of 3672 2716 8A10.tmp 104 PID 2716 wrote to memory of 3672 2716 8A10.tmp 104 PID 2716 wrote to memory of 3672 2716 8A10.tmp 104 PID 3672 wrote to memory of 1760 3672 8A8D.tmp 105 PID 3672 wrote to memory of 1760 3672 8A8D.tmp 105 PID 3672 wrote to memory of 1760 3672 8A8D.tmp 105 PID 1760 wrote to memory of 2612 1760 8B0A.tmp 106 PID 1760 wrote to memory of 2612 1760 8B0A.tmp 106 PID 1760 wrote to memory of 2612 1760 8B0A.tmp 106 PID 2612 wrote to memory of 4000 2612 8B96.tmp 107 PID 2612 wrote to memory of 4000 2612 8B96.tmp 107 PID 2612 wrote to memory of 4000 2612 8B96.tmp 107 PID 4000 wrote to memory of 1552 4000 8C13.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-20_d98e290d2450d0a30da9c5c65e839b7c_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-20_d98e290d2450d0a30da9c5c65e839b7c_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\8240.tmp"C:\Users\Admin\AppData\Local\Temp\8240.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:32 -
C:\Users\Admin\AppData\Local\Temp\82AD.tmp"C:\Users\Admin\AppData\Local\Temp\82AD.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\833A.tmp"C:\Users\Admin\AppData\Local\Temp\833A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\83B7.tmp"C:\Users\Admin\AppData\Local\Temp\83B7.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\8434.tmp"C:\Users\Admin\AppData\Local\Temp\8434.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\84A1.tmp"C:\Users\Admin\AppData\Local\Temp\84A1.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Users\Admin\AppData\Local\Temp\852E.tmp"C:\Users\Admin\AppData\Local\Temp\852E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\85CA.tmp"C:\Users\Admin\AppData\Local\Temp\85CA.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\8637.tmp"C:\Users\Admin\AppData\Local\Temp\8637.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\86D3.tmp"C:\Users\Admin\AppData\Local\Temp\86D3.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\8750.tmp"C:\Users\Admin\AppData\Local\Temp\8750.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\87BE.tmp"C:\Users\Admin\AppData\Local\Temp\87BE.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\882B.tmp"C:\Users\Admin\AppData\Local\Temp\882B.tmp"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Users\Admin\AppData\Local\Temp\8899.tmp"C:\Users\Admin\AppData\Local\Temp\8899.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\8925.tmp"C:\Users\Admin\AppData\Local\Temp\8925.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\89A2.tmp"C:\Users\Admin\AppData\Local\Temp\89A2.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\8A10.tmp"C:\Users\Admin\AppData\Local\Temp\8A10.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\8B96.tmp"C:\Users\Admin\AppData\Local\Temp\8B96.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\8C13.tmp"C:\Users\Admin\AppData\Local\Temp\8C13.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\8C81.tmp"C:\Users\Admin\AppData\Local\Temp\8C81.tmp"23⤵
- Executes dropped EXE
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"24⤵
- Executes dropped EXE
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"25⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\8DE8.tmp"C:\Users\Admin\AppData\Local\Temp\8DE8.tmp"26⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\8E75.tmp"C:\Users\Admin\AppData\Local\Temp\8E75.tmp"27⤵
- Executes dropped EXE
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"28⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"29⤵
- Executes dropped EXE
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"30⤵
- Executes dropped EXE
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\9069.tmp"C:\Users\Admin\AppData\Local\Temp\9069.tmp"31⤵
- Executes dropped EXE
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\90D6.tmp"C:\Users\Admin\AppData\Local\Temp\90D6.tmp"32⤵
- Executes dropped EXE
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\9153.tmp"C:\Users\Admin\AppData\Local\Temp\9153.tmp"33⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\91D0.tmp"C:\Users\Admin\AppData\Local\Temp\91D0.tmp"34⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\921E.tmp"C:\Users\Admin\AppData\Local\Temp\921E.tmp"35⤵
- Executes dropped EXE
PID:820 -
C:\Users\Admin\AppData\Local\Temp\926C.tmp"C:\Users\Admin\AppData\Local\Temp\926C.tmp"36⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\92E9.tmp"C:\Users\Admin\AppData\Local\Temp\92E9.tmp"37⤵
- Executes dropped EXE
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\9376.tmp"C:\Users\Admin\AppData\Local\Temp\9376.tmp"38⤵
- Executes dropped EXE
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\93D4.tmp"C:\Users\Admin\AppData\Local\Temp\93D4.tmp"39⤵
- Executes dropped EXE
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\9441.tmp"C:\Users\Admin\AppData\Local\Temp\9441.tmp"40⤵
- Executes dropped EXE
PID:408 -
C:\Users\Admin\AppData\Local\Temp\94AE.tmp"C:\Users\Admin\AppData\Local\Temp\94AE.tmp"41⤵
- Executes dropped EXE
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\951C.tmp"C:\Users\Admin\AppData\Local\Temp\951C.tmp"42⤵
- Executes dropped EXE
PID:636 -
C:\Users\Admin\AppData\Local\Temp\9579.tmp"C:\Users\Admin\AppData\Local\Temp\9579.tmp"43⤵
- Executes dropped EXE
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\95D7.tmp"C:\Users\Admin\AppData\Local\Temp\95D7.tmp"44⤵
- Executes dropped EXE
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\9625.tmp"C:\Users\Admin\AppData\Local\Temp\9625.tmp"45⤵
- Executes dropped EXE
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\9683.tmp"C:\Users\Admin\AppData\Local\Temp\9683.tmp"46⤵
- Executes dropped EXE
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\96F0.tmp"C:\Users\Admin\AppData\Local\Temp\96F0.tmp"47⤵
- Executes dropped EXE
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\973F.tmp"C:\Users\Admin\AppData\Local\Temp\973F.tmp"48⤵
- Executes dropped EXE
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\979C.tmp"C:\Users\Admin\AppData\Local\Temp\979C.tmp"49⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\9819.tmp"C:\Users\Admin\AppData\Local\Temp\9819.tmp"50⤵
- Executes dropped EXE
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\9867.tmp"C:\Users\Admin\AppData\Local\Temp\9867.tmp"51⤵
- Executes dropped EXE
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\98B6.tmp"C:\Users\Admin\AppData\Local\Temp\98B6.tmp"52⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\9913.tmp"C:\Users\Admin\AppData\Local\Temp\9913.tmp"53⤵
- Executes dropped EXE
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\9971.tmp"C:\Users\Admin\AppData\Local\Temp\9971.tmp"54⤵
- Executes dropped EXE
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\99BF.tmp"C:\Users\Admin\AppData\Local\Temp\99BF.tmp"55⤵
- Executes dropped EXE
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"56⤵
- Executes dropped EXE
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"57⤵
- Executes dropped EXE
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"58⤵
- Executes dropped EXE
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\9B17.tmp"C:\Users\Admin\AppData\Local\Temp\9B17.tmp"59⤵
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\9B65.tmp"C:\Users\Admin\AppData\Local\Temp\9B65.tmp"60⤵
- Executes dropped EXE
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"61⤵
- Executes dropped EXE
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\9C01.tmp"C:\Users\Admin\AppData\Local\Temp\9C01.tmp"62⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"63⤵
- Executes dropped EXE
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"64⤵
- Executes dropped EXE
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"65⤵
- Executes dropped EXE
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\9D59.tmp"C:\Users\Admin\AppData\Local\Temp\9D59.tmp"66⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"67⤵
- System Location Discovery: System Language Discovery
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"68⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\9E53.tmp"C:\Users\Admin\AppData\Local\Temp\9E53.tmp"69⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\9EB1.tmp"C:\Users\Admin\AppData\Local\Temp\9EB1.tmp"70⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"71⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"72⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"73⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"74⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\A057.tmp"C:\Users\Admin\AppData\Local\Temp\A057.tmp"75⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"76⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\A112.tmp"C:\Users\Admin\AppData\Local\Temp\A112.tmp"77⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\A170.tmp"C:\Users\Admin\AppData\Local\Temp\A170.tmp"78⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"79⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\A21C.tmp"C:\Users\Admin\AppData\Local\Temp\A21C.tmp"80⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\A26A.tmp"C:\Users\Admin\AppData\Local\Temp\A26A.tmp"81⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"82⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\A316.tmp"C:\Users\Admin\AppData\Local\Temp\A316.tmp"83⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\A364.tmp"C:\Users\Admin\AppData\Local\Temp\A364.tmp"84⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"85⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\A400.tmp"C:\Users\Admin\AppData\Local\Temp\A400.tmp"86⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\A44E.tmp"C:\Users\Admin\AppData\Local\Temp\A44E.tmp"87⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\A49C.tmp"C:\Users\Admin\AppData\Local\Temp\A49C.tmp"88⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"89⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\A539.tmp"C:\Users\Admin\AppData\Local\Temp\A539.tmp"90⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\A596.tmp"C:\Users\Admin\AppData\Local\Temp\A596.tmp"91⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"92⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\A633.tmp"C:\Users\Admin\AppData\Local\Temp\A633.tmp"93⤵PID:364
-
C:\Users\Admin\AppData\Local\Temp\A681.tmp"C:\Users\Admin\AppData\Local\Temp\A681.tmp"94⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\A6CF.tmp"C:\Users\Admin\AppData\Local\Temp\A6CF.tmp"95⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\A72D.tmp"C:\Users\Admin\AppData\Local\Temp\A72D.tmp"96⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\A77B.tmp"C:\Users\Admin\AppData\Local\Temp\A77B.tmp"97⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"98⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\A836.tmp"C:\Users\Admin\AppData\Local\Temp\A836.tmp"99⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\A894.tmp"C:\Users\Admin\AppData\Local\Temp\A894.tmp"100⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"101⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\A930.tmp"C:\Users\Admin\AppData\Local\Temp\A930.tmp"102⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\A97E.tmp"C:\Users\Admin\AppData\Local\Temp\A97E.tmp"103⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"104⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"105⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\AA69.tmp"C:\Users\Admin\AppData\Local\Temp\AA69.tmp"106⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"107⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\AB05.tmp"C:\Users\Admin\AppData\Local\Temp\AB05.tmp"108⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\AB53.tmp"C:\Users\Admin\AppData\Local\Temp\AB53.tmp"109⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"110⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"111⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"112⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"113⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\AD09.tmp"C:\Users\Admin\AppData\Local\Temp\AD09.tmp"114⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\AD57.tmp"C:\Users\Admin\AppData\Local\Temp\AD57.tmp"115⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"116⤵
- System Location Discovery: System Language Discovery
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"117⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\AE41.tmp"C:\Users\Admin\AppData\Local\Temp\AE41.tmp"118⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"119⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"120⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"121⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\AF89.tmp"C:\Users\Admin\AppData\Local\Temp\AF89.tmp"122⤵PID:4936
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-