Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/08/2024, 07:57
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-21_80582cf52f9f9dbc92f3ef1bb8c413d0_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-08-21_80582cf52f9f9dbc92f3ef1bb8c413d0_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-21_80582cf52f9f9dbc92f3ef1bb8c413d0_mafia.exe
-
Size
529KB
-
MD5
80582cf52f9f9dbc92f3ef1bb8c413d0
-
SHA1
8f549147a45777761a65a4017e934b90e0a29451
-
SHA256
313cb7737b6e2a9e8064893df3ec44bac1988787c042d9b377c1d546a1db41a5
-
SHA512
d19b5263d8808da14a67740c3b2031ce2651e6a544a5c73bd19694b8a014a58776752d7f7495230142788e6e345c838fd22395178add310867dd2c7bf6627e32
-
SSDEEP
12288:NU5rCOTeijcaKFkAYx9MT9iikTtpTZwlH4Hp:NUQOJjcanASMpiikTHTSlH4Hp
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 980 6467.tmp 1132 64E4.tmp 3696 6551.tmp 2248 65CE.tmp 5032 665B.tmp 2576 66D8.tmp 2352 6726.tmp 1968 6784.tmp 1632 67D2.tmp 4456 6820.tmp 4120 687E.tmp 3516 68CC.tmp 4776 6959.tmp 2980 69D6.tmp 1204 6A53.tmp 1952 6AC0.tmp 2344 6B0E.tmp 3584 6B7B.tmp 2800 6BD9.tmp 1988 6C47.tmp 1532 6CC4.tmp 3680 6D12.tmp 1064 6D60.tmp 1864 6DDD.tmp 4968 6E4A.tmp 1572 6EA8.tmp 2740 6EF6.tmp 4944 6F73.tmp 3388 6FE0.tmp 2484 704E.tmp 3476 70BB.tmp 3556 7138.tmp 940 71A6.tmp 4452 71F4.tmp 2768 7251.tmp 3144 72AF.tmp 4092 730D.tmp 3848 735B.tmp 3676 73A9.tmp 3712 73F7.tmp 4772 7445.tmp 3372 7494.tmp 4700 74E2.tmp 5044 7530.tmp 1720 758E.tmp 2756 75EB.tmp 2352 7639.tmp 2912 7697.tmp 3692 76F5.tmp 2392 7743.tmp 2036 77A1.tmp 1852 77FF.tmp 4120 785C.tmp 1464 78BA.tmp 1576 7918.tmp 2336 7976.tmp 2980 79D3.tmp 4280 7A21.tmp 5008 7A70.tmp 544 7ABE.tmp 2400 7B1B.tmp 1744 7B6A.tmp 3584 7BC7.tmp 3972 7C25.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9834.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6AC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8632.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FAD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 437C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5995.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 819F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8770.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B026.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA04.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1410.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C56.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7829.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D86E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CBD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E92.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9078.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 361E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7692.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4004 wrote to memory of 980 4004 2024-08-21_80582cf52f9f9dbc92f3ef1bb8c413d0_mafia.exe 84 PID 4004 wrote to memory of 980 4004 2024-08-21_80582cf52f9f9dbc92f3ef1bb8c413d0_mafia.exe 84 PID 4004 wrote to memory of 980 4004 2024-08-21_80582cf52f9f9dbc92f3ef1bb8c413d0_mafia.exe 84 PID 980 wrote to memory of 1132 980 6467.tmp 86 PID 980 wrote to memory of 1132 980 6467.tmp 86 PID 980 wrote to memory of 1132 980 6467.tmp 86 PID 1132 wrote to memory of 3696 1132 64E4.tmp 87 PID 1132 wrote to memory of 3696 1132 64E4.tmp 87 PID 1132 wrote to memory of 3696 1132 64E4.tmp 87 PID 3696 wrote to memory of 2248 3696 6551.tmp 89 PID 3696 wrote to memory of 2248 3696 6551.tmp 89 PID 3696 wrote to memory of 2248 3696 6551.tmp 89 PID 2248 wrote to memory of 5032 2248 65CE.tmp 91 PID 2248 wrote to memory of 5032 2248 65CE.tmp 91 PID 2248 wrote to memory of 5032 2248 65CE.tmp 91 PID 5032 wrote to memory of 2576 5032 665B.tmp 92 PID 5032 wrote to memory of 2576 5032 665B.tmp 92 PID 5032 wrote to memory of 2576 5032 665B.tmp 92 PID 2576 wrote to memory of 2352 2576 66D8.tmp 93 PID 2576 wrote to memory of 2352 2576 66D8.tmp 93 PID 2576 wrote to memory of 2352 2576 66D8.tmp 93 PID 2352 wrote to memory of 1968 2352 6726.tmp 94 PID 2352 wrote to memory of 1968 2352 6726.tmp 94 PID 2352 wrote to memory of 1968 2352 6726.tmp 94 PID 1968 wrote to memory of 1632 1968 6784.tmp 95 PID 1968 wrote to memory of 1632 1968 6784.tmp 95 PID 1968 wrote to memory of 1632 1968 6784.tmp 95 PID 1632 wrote to memory of 4456 1632 67D2.tmp 96 PID 1632 wrote to memory of 4456 1632 67D2.tmp 96 PID 1632 wrote to memory of 4456 1632 67D2.tmp 96 PID 4456 wrote to memory of 4120 4456 6820.tmp 97 PID 4456 wrote to memory of 4120 4456 6820.tmp 97 PID 4456 wrote to memory of 4120 4456 6820.tmp 97 PID 4120 wrote to memory of 3516 4120 687E.tmp 98 PID 4120 wrote to memory of 3516 4120 687E.tmp 98 PID 4120 wrote to memory of 3516 4120 687E.tmp 98 PID 3516 wrote to memory of 4776 3516 68CC.tmp 99 PID 3516 wrote to memory of 4776 3516 68CC.tmp 99 PID 3516 wrote to memory of 4776 3516 68CC.tmp 99 PID 4776 wrote to memory of 2980 4776 6959.tmp 100 PID 4776 wrote to memory of 2980 4776 6959.tmp 100 PID 4776 wrote to memory of 2980 4776 6959.tmp 100 PID 2980 wrote to memory of 1204 2980 69D6.tmp 101 PID 2980 wrote to memory of 1204 2980 69D6.tmp 101 PID 2980 wrote to memory of 1204 2980 69D6.tmp 101 PID 1204 wrote to memory of 1952 1204 6A53.tmp 102 PID 1204 wrote to memory of 1952 1204 6A53.tmp 102 PID 1204 wrote to memory of 1952 1204 6A53.tmp 102 PID 1952 wrote to memory of 2344 1952 6AC0.tmp 103 PID 1952 wrote to memory of 2344 1952 6AC0.tmp 103 PID 1952 wrote to memory of 2344 1952 6AC0.tmp 103 PID 2344 wrote to memory of 3584 2344 6B0E.tmp 104 PID 2344 wrote to memory of 3584 2344 6B0E.tmp 104 PID 2344 wrote to memory of 3584 2344 6B0E.tmp 104 PID 3584 wrote to memory of 2800 3584 6B7B.tmp 105 PID 3584 wrote to memory of 2800 3584 6B7B.tmp 105 PID 3584 wrote to memory of 2800 3584 6B7B.tmp 105 PID 2800 wrote to memory of 1988 2800 6BD9.tmp 106 PID 2800 wrote to memory of 1988 2800 6BD9.tmp 106 PID 2800 wrote to memory of 1988 2800 6BD9.tmp 106 PID 1988 wrote to memory of 1532 1988 6C47.tmp 107 PID 1988 wrote to memory of 1532 1988 6C47.tmp 107 PID 1988 wrote to memory of 1532 1988 6C47.tmp 107 PID 1532 wrote to memory of 3680 1532 6CC4.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-21_80582cf52f9f9dbc92f3ef1bb8c413d0_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-21_80582cf52f9f9dbc92f3ef1bb8c413d0_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\6551.tmp"C:\Users\Admin\AppData\Local\Temp\6551.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\65CE.tmp"C:\Users\Admin\AppData\Local\Temp\65CE.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\66D8.tmp"C:\Users\Admin\AppData\Local\Temp\66D8.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\69D6.tmp"C:\Users\Admin\AppData\Local\Temp\69D6.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\6A53.tmp"C:\Users\Admin\AppData\Local\Temp\6A53.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\6D12.tmp"C:\Users\Admin\AppData\Local\Temp\6D12.tmp"23⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\6D60.tmp"C:\Users\Admin\AppData\Local\Temp\6D60.tmp"24⤵
- Executes dropped EXE
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"26⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"27⤵
- Executes dropped EXE
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"28⤵
- Executes dropped EXE
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\6F73.tmp"C:\Users\Admin\AppData\Local\Temp\6F73.tmp"29⤵
- Executes dropped EXE
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"30⤵
- Executes dropped EXE
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\704E.tmp"C:\Users\Admin\AppData\Local\Temp\704E.tmp"31⤵
- Executes dropped EXE
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\70BB.tmp"C:\Users\Admin\AppData\Local\Temp\70BB.tmp"32⤵
- Executes dropped EXE
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\7138.tmp"C:\Users\Admin\AppData\Local\Temp\7138.tmp"33⤵
- Executes dropped EXE
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\71A6.tmp"C:\Users\Admin\AppData\Local\Temp\71A6.tmp"34⤵
- Executes dropped EXE
PID:940 -
C:\Users\Admin\AppData\Local\Temp\71F4.tmp"C:\Users\Admin\AppData\Local\Temp\71F4.tmp"35⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\7251.tmp"C:\Users\Admin\AppData\Local\Temp\7251.tmp"36⤵
- Executes dropped EXE
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"37⤵
- Executes dropped EXE
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\730D.tmp"C:\Users\Admin\AppData\Local\Temp\730D.tmp"38⤵
- Executes dropped EXE
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\735B.tmp"C:\Users\Admin\AppData\Local\Temp\735B.tmp"39⤵
- Executes dropped EXE
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\73A9.tmp"C:\Users\Admin\AppData\Local\Temp\73A9.tmp"40⤵
- Executes dropped EXE
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\73F7.tmp"C:\Users\Admin\AppData\Local\Temp\73F7.tmp"41⤵
- Executes dropped EXE
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\7445.tmp"C:\Users\Admin\AppData\Local\Temp\7445.tmp"42⤵
- Executes dropped EXE
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\7494.tmp"C:\Users\Admin\AppData\Local\Temp\7494.tmp"43⤵
- Executes dropped EXE
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"44⤵
- Executes dropped EXE
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\7530.tmp"C:\Users\Admin\AppData\Local\Temp\7530.tmp"45⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\758E.tmp"C:\Users\Admin\AppData\Local\Temp\758E.tmp"46⤵
- Executes dropped EXE
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\75EB.tmp"C:\Users\Admin\AppData\Local\Temp\75EB.tmp"47⤵
- Executes dropped EXE
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\7639.tmp"C:\Users\Admin\AppData\Local\Temp\7639.tmp"48⤵
- Executes dropped EXE
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\7697.tmp"C:\Users\Admin\AppData\Local\Temp\7697.tmp"49⤵
- Executes dropped EXE
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\76F5.tmp"C:\Users\Admin\AppData\Local\Temp\76F5.tmp"50⤵
- Executes dropped EXE
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\7743.tmp"C:\Users\Admin\AppData\Local\Temp\7743.tmp"51⤵
- Executes dropped EXE
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\77A1.tmp"C:\Users\Admin\AppData\Local\Temp\77A1.tmp"52⤵
- Executes dropped EXE
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\77FF.tmp"C:\Users\Admin\AppData\Local\Temp\77FF.tmp"53⤵
- Executes dropped EXE
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\785C.tmp"C:\Users\Admin\AppData\Local\Temp\785C.tmp"54⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\78BA.tmp"C:\Users\Admin\AppData\Local\Temp\78BA.tmp"55⤵
- Executes dropped EXE
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\7918.tmp"C:\Users\Admin\AppData\Local\Temp\7918.tmp"56⤵
- Executes dropped EXE
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\7976.tmp"C:\Users\Admin\AppData\Local\Temp\7976.tmp"57⤵
- Executes dropped EXE
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\79D3.tmp"C:\Users\Admin\AppData\Local\Temp\79D3.tmp"58⤵
- Executes dropped EXE
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\7A21.tmp"C:\Users\Admin\AppData\Local\Temp\7A21.tmp"59⤵
- Executes dropped EXE
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\7A70.tmp"C:\Users\Admin\AppData\Local\Temp\7A70.tmp"60⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"61⤵
- Executes dropped EXE
PID:544 -
C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"62⤵
- Executes dropped EXE
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"63⤵
- Executes dropped EXE
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"64⤵
- Executes dropped EXE
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\7C25.tmp"C:\Users\Admin\AppData\Local\Temp\7C25.tmp"65⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\7C73.tmp"C:\Users\Admin\AppData\Local\Temp\7C73.tmp"66⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"67⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"68⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"69⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"70⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\7E38.tmp"C:\Users\Admin\AppData\Local\Temp\7E38.tmp"71⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\7E86.tmp"C:\Users\Admin\AppData\Local\Temp\7E86.tmp"72⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"73⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\7F42.tmp"C:\Users\Admin\AppData\Local\Temp\7F42.tmp"74⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\7F90.tmp"C:\Users\Admin\AppData\Local\Temp\7F90.tmp"75⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\7FEE.tmp"C:\Users\Admin\AppData\Local\Temp\7FEE.tmp"76⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\804C.tmp"C:\Users\Admin\AppData\Local\Temp\804C.tmp"77⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\80A9.tmp"C:\Users\Admin\AppData\Local\Temp\80A9.tmp"78⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\8107.tmp"C:\Users\Admin\AppData\Local\Temp\8107.tmp"79⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\8165.tmp"C:\Users\Admin\AppData\Local\Temp\8165.tmp"80⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\81C3.tmp"C:\Users\Admin\AppData\Local\Temp\81C3.tmp"81⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\8211.tmp"C:\Users\Admin\AppData\Local\Temp\8211.tmp"82⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\826E.tmp"C:\Users\Admin\AppData\Local\Temp\826E.tmp"83⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\82CC.tmp"C:\Users\Admin\AppData\Local\Temp\82CC.tmp"84⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\832A.tmp"C:\Users\Admin\AppData\Local\Temp\832A.tmp"85⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\8388.tmp"C:\Users\Admin\AppData\Local\Temp\8388.tmp"86⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\83D6.tmp"C:\Users\Admin\AppData\Local\Temp\83D6.tmp"87⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\8434.tmp"C:\Users\Admin\AppData\Local\Temp\8434.tmp"88⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\8491.tmp"C:\Users\Admin\AppData\Local\Temp\8491.tmp"89⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\84EF.tmp"C:\Users\Admin\AppData\Local\Temp\84EF.tmp"90⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\854D.tmp"C:\Users\Admin\AppData\Local\Temp\854D.tmp"91⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\85AB.tmp"C:\Users\Admin\AppData\Local\Temp\85AB.tmp"92⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\8608.tmp"C:\Users\Admin\AppData\Local\Temp\8608.tmp"93⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\8666.tmp"C:\Users\Admin\AppData\Local\Temp\8666.tmp"94⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\86C4.tmp"C:\Users\Admin\AppData\Local\Temp\86C4.tmp"95⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\8712.tmp"C:\Users\Admin\AppData\Local\Temp\8712.tmp"96⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\8770.tmp"C:\Users\Admin\AppData\Local\Temp\8770.tmp"97⤵
- System Location Discovery: System Language Discovery
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\87BE.tmp"C:\Users\Admin\AppData\Local\Temp\87BE.tmp"98⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\880C.tmp"C:\Users\Admin\AppData\Local\Temp\880C.tmp"99⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\886A.tmp"C:\Users\Admin\AppData\Local\Temp\886A.tmp"100⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\88C7.tmp"C:\Users\Admin\AppData\Local\Temp\88C7.tmp"101⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\8925.tmp"C:\Users\Admin\AppData\Local\Temp\8925.tmp"102⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\8983.tmp"C:\Users\Admin\AppData\Local\Temp\8983.tmp"103⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\89E1.tmp"C:\Users\Admin\AppData\Local\Temp\89E1.tmp"104⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"105⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"106⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"107⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\8B38.tmp"C:\Users\Admin\AppData\Local\Temp\8B38.tmp"108⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\8B87.tmp"C:\Users\Admin\AppData\Local\Temp\8B87.tmp"109⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"110⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\8C23.tmp"C:\Users\Admin\AppData\Local\Temp\8C23.tmp"111⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\8C81.tmp"C:\Users\Admin\AppData\Local\Temp\8C81.tmp"112⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"113⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"114⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"115⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"116⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\8E07.tmp"C:\Users\Admin\AppData\Local\Temp\8E07.tmp"117⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\8E55.tmp"C:\Users\Admin\AppData\Local\Temp\8E55.tmp"118⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"119⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"120⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"121⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"122⤵
- System Location Discovery: System Language Discovery
PID:548
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-