Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29/08/2024, 08:27
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-29_1bea53c4c433a343ce15329f7a69e353_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-08-29_1bea53c4c433a343ce15329f7a69e353_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-29_1bea53c4c433a343ce15329f7a69e353_mafia.exe
-
Size
530KB
-
MD5
1bea53c4c433a343ce15329f7a69e353
-
SHA1
2afbb3549d9df7a1b2f906947e2a31f54401481d
-
SHA256
1f253a24e338cb631128d8af7b7cbe7e939d4c9a900b5770941cfc314a5d0024
-
SHA512
944d1550be420314af2b9c5247afffa717b660ad1e9e6a9587f904ad60e4ba4af757c1cd84ac5ab5105823a47faf3006ab0318a977fed789fa5dc6a27a55f561
-
SSDEEP
12288:AU5rCOTeioqxeBxEViR5FtQ3s+U36ONZulFVg0M1:AUQOJoqxi+V65Fu8N5NclFV/M1
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1644 AE8F.tmp 1764 AEFD.tmp 1160 AF7A.tmp 1420 AFD7.tmp 4916 B064.tmp 716 B0D1.tmp 2452 B14E.tmp 1444 B1CB.tmp 3496 B229.tmp 1528 B297.tmp 2108 B304.tmp 4160 B391.tmp 1544 B3EE.tmp 3416 B46B.tmp 4564 B4E8.tmp 8 B565.tmp 4856 B5D3.tmp 2604 B65F.tmp 2584 B6AD.tmp 2180 B71B.tmp 1680 B798.tmp 744 B815.tmp 508 B863.tmp 2748 B8D0.tmp 1916 B94D.tmp 3696 B9BB.tmp 512 BA18.tmp 1688 BA76.tmp 3192 BAE4.tmp 1568 BB61.tmp 1832 BBDE.tmp 4928 BC3B.tmp 2388 BD45.tmp 4048 BD93.tmp 2456 BDF1.tmp 1384 BE3F.tmp 1548 BE8D.tmp 2092 BEDB.tmp 1912 BF29.tmp 4664 BF87.tmp 1388 BFE5.tmp 2112 C043.tmp 1708 C0A0.tmp 1704 C0FE.tmp 4884 C15C.tmp 2476 C1BA.tmp 2788 C217.tmp 2744 C275.tmp 4932 C2D3.tmp 2616 C331.tmp 1528 C38E.tmp 2532 C3EC.tmp 2128 C43A.tmp 3364 C498.tmp 2836 C4E6.tmp 848 C544.tmp 1588 C5A2.tmp 2240 C5FF.tmp 3056 C65D.tmp 1240 C6BB.tmp 3968 C719.tmp 4420 C776.tmp 2312 C7D4.tmp 3944 C841.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B46B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B85E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EBC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F211.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D54C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9FE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C65D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D618.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F695.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F930.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6889.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C87B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 468A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 702A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 430F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 435D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 726C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B689.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F56.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E74E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB61.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C09C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3EAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63F5.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 448 wrote to memory of 1644 448 2024-08-29_1bea53c4c433a343ce15329f7a69e353_mafia.exe 84 PID 448 wrote to memory of 1644 448 2024-08-29_1bea53c4c433a343ce15329f7a69e353_mafia.exe 84 PID 448 wrote to memory of 1644 448 2024-08-29_1bea53c4c433a343ce15329f7a69e353_mafia.exe 84 PID 1644 wrote to memory of 1764 1644 AE8F.tmp 85 PID 1644 wrote to memory of 1764 1644 AE8F.tmp 85 PID 1644 wrote to memory of 1764 1644 AE8F.tmp 85 PID 1764 wrote to memory of 1160 1764 AEFD.tmp 86 PID 1764 wrote to memory of 1160 1764 AEFD.tmp 86 PID 1764 wrote to memory of 1160 1764 AEFD.tmp 86 PID 1160 wrote to memory of 1420 1160 AF7A.tmp 88 PID 1160 wrote to memory of 1420 1160 AF7A.tmp 88 PID 1160 wrote to memory of 1420 1160 AF7A.tmp 88 PID 1420 wrote to memory of 4916 1420 AFD7.tmp 90 PID 1420 wrote to memory of 4916 1420 AFD7.tmp 90 PID 1420 wrote to memory of 4916 1420 AFD7.tmp 90 PID 4916 wrote to memory of 716 4916 B064.tmp 92 PID 4916 wrote to memory of 716 4916 B064.tmp 92 PID 4916 wrote to memory of 716 4916 B064.tmp 92 PID 716 wrote to memory of 2452 716 B0D1.tmp 93 PID 716 wrote to memory of 2452 716 B0D1.tmp 93 PID 716 wrote to memory of 2452 716 B0D1.tmp 93 PID 2452 wrote to memory of 1444 2452 B14E.tmp 94 PID 2452 wrote to memory of 1444 2452 B14E.tmp 94 PID 2452 wrote to memory of 1444 2452 B14E.tmp 94 PID 1444 wrote to memory of 3496 1444 B1CB.tmp 95 PID 1444 wrote to memory of 3496 1444 B1CB.tmp 95 PID 1444 wrote to memory of 3496 1444 B1CB.tmp 95 PID 3496 wrote to memory of 1528 3496 B229.tmp 96 PID 3496 wrote to memory of 1528 3496 B229.tmp 96 PID 3496 wrote to memory of 1528 3496 B229.tmp 96 PID 1528 wrote to memory of 2108 1528 B297.tmp 97 PID 1528 wrote to memory of 2108 1528 B297.tmp 97 PID 1528 wrote to memory of 2108 1528 B297.tmp 97 PID 2108 wrote to memory of 4160 2108 B304.tmp 98 PID 2108 wrote to memory of 4160 2108 B304.tmp 98 PID 2108 wrote to memory of 4160 2108 B304.tmp 98 PID 4160 wrote to memory of 1544 4160 B391.tmp 99 PID 4160 wrote to memory of 1544 4160 B391.tmp 99 PID 4160 wrote to memory of 1544 4160 B391.tmp 99 PID 1544 wrote to memory of 3416 1544 B3EE.tmp 100 PID 1544 wrote to memory of 3416 1544 B3EE.tmp 100 PID 1544 wrote to memory of 3416 1544 B3EE.tmp 100 PID 3416 wrote to memory of 4564 3416 B46B.tmp 101 PID 3416 wrote to memory of 4564 3416 B46B.tmp 101 PID 3416 wrote to memory of 4564 3416 B46B.tmp 101 PID 4564 wrote to memory of 8 4564 B4E8.tmp 102 PID 4564 wrote to memory of 8 4564 B4E8.tmp 102 PID 4564 wrote to memory of 8 4564 B4E8.tmp 102 PID 8 wrote to memory of 4856 8 B565.tmp 103 PID 8 wrote to memory of 4856 8 B565.tmp 103 PID 8 wrote to memory of 4856 8 B565.tmp 103 PID 4856 wrote to memory of 2604 4856 B5D3.tmp 104 PID 4856 wrote to memory of 2604 4856 B5D3.tmp 104 PID 4856 wrote to memory of 2604 4856 B5D3.tmp 104 PID 2604 wrote to memory of 2584 2604 B65F.tmp 105 PID 2604 wrote to memory of 2584 2604 B65F.tmp 105 PID 2604 wrote to memory of 2584 2604 B65F.tmp 105 PID 2584 wrote to memory of 2180 2584 B6AD.tmp 106 PID 2584 wrote to memory of 2180 2584 B6AD.tmp 106 PID 2584 wrote to memory of 2180 2584 B6AD.tmp 106 PID 2180 wrote to memory of 1680 2180 B71B.tmp 107 PID 2180 wrote to memory of 1680 2180 B71B.tmp 107 PID 2180 wrote to memory of 1680 2180 B71B.tmp 107 PID 1680 wrote to memory of 744 1680 B798.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-29_1bea53c4c433a343ce15329f7a69e353_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-29_1bea53c4c433a343ce15329f7a69e353_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\B064.tmp"C:\Users\Admin\AppData\Local\Temp\B064.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Users\Admin\AppData\Local\Temp\B14E.tmp"C:\Users\Admin\AppData\Local\Temp\B14E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\B229.tmp"C:\Users\Admin\AppData\Local\Temp\B229.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\B297.tmp"C:\Users\Admin\AppData\Local\Temp\B297.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\B304.tmp"C:\Users\Admin\AppData\Local\Temp\B304.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\B391.tmp"C:\Users\Admin\AppData\Local\Temp\B391.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\B46B.tmp"C:\Users\Admin\AppData\Local\Temp\B46B.tmp"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\B565.tmp"C:\Users\Admin\AppData\Local\Temp\B565.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\B5D3.tmp"C:\Users\Admin\AppData\Local\Temp\B5D3.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\B65F.tmp"C:\Users\Admin\AppData\Local\Temp\B65F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\B71B.tmp"C:\Users\Admin\AppData\Local\Temp\B71B.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\B798.tmp"C:\Users\Admin\AppData\Local\Temp\B798.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\B815.tmp"C:\Users\Admin\AppData\Local\Temp\B815.tmp"23⤵
- Executes dropped EXE
PID:744 -
C:\Users\Admin\AppData\Local\Temp\B863.tmp"C:\Users\Admin\AppData\Local\Temp\B863.tmp"24⤵
- Executes dropped EXE
PID:508 -
C:\Users\Admin\AppData\Local\Temp\B8D0.tmp"C:\Users\Admin\AppData\Local\Temp\B8D0.tmp"25⤵
- Executes dropped EXE
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\B94D.tmp"C:\Users\Admin\AppData\Local\Temp\B94D.tmp"26⤵
- Executes dropped EXE
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"27⤵
- Executes dropped EXE
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\BA18.tmp"C:\Users\Admin\AppData\Local\Temp\BA18.tmp"28⤵
- Executes dropped EXE
PID:512 -
C:\Users\Admin\AppData\Local\Temp\BA76.tmp"C:\Users\Admin\AppData\Local\Temp\BA76.tmp"29⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"30⤵
- Executes dropped EXE
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\BB61.tmp"C:\Users\Admin\AppData\Local\Temp\BB61.tmp"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"32⤵
- Executes dropped EXE
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"33⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\BD45.tmp"C:\Users\Admin\AppData\Local\Temp\BD45.tmp"34⤵
- Executes dropped EXE
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\BD93.tmp"C:\Users\Admin\AppData\Local\Temp\BD93.tmp"35⤵
- Executes dropped EXE
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\BDF1.tmp"C:\Users\Admin\AppData\Local\Temp\BDF1.tmp"36⤵
- Executes dropped EXE
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"37⤵
- Executes dropped EXE
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"38⤵
- Executes dropped EXE
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"39⤵
- Executes dropped EXE
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\BF29.tmp"C:\Users\Admin\AppData\Local\Temp\BF29.tmp"40⤵
- Executes dropped EXE
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\BF87.tmp"C:\Users\Admin\AppData\Local\Temp\BF87.tmp"41⤵
- Executes dropped EXE
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"42⤵
- Executes dropped EXE
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\C043.tmp"C:\Users\Admin\AppData\Local\Temp\C043.tmp"43⤵
- Executes dropped EXE
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"44⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"45⤵
- Executes dropped EXE
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\C15C.tmp"C:\Users\Admin\AppData\Local\Temp\C15C.tmp"46⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"47⤵
- Executes dropped EXE
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\C217.tmp"C:\Users\Admin\AppData\Local\Temp\C217.tmp"48⤵
- Executes dropped EXE
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\C275.tmp"C:\Users\Admin\AppData\Local\Temp\C275.tmp"49⤵
- Executes dropped EXE
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"50⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\C331.tmp"C:\Users\Admin\AppData\Local\Temp\C331.tmp"51⤵
- Executes dropped EXE
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\C38E.tmp"C:\Users\Admin\AppData\Local\Temp\C38E.tmp"52⤵
- Executes dropped EXE
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"53⤵
- Executes dropped EXE
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\C43A.tmp"C:\Users\Admin\AppData\Local\Temp\C43A.tmp"54⤵
- Executes dropped EXE
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\C498.tmp"C:\Users\Admin\AppData\Local\Temp\C498.tmp"55⤵
- Executes dropped EXE
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\C4E6.tmp"C:\Users\Admin\AppData\Local\Temp\C4E6.tmp"56⤵
- Executes dropped EXE
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\C544.tmp"C:\Users\Admin\AppData\Local\Temp\C544.tmp"57⤵
- Executes dropped EXE
PID:848 -
C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"58⤵
- Executes dropped EXE
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\C5FF.tmp"C:\Users\Admin\AppData\Local\Temp\C5FF.tmp"59⤵
- Executes dropped EXE
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\C65D.tmp"C:\Users\Admin\AppData\Local\Temp\C65D.tmp"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"61⤵
- Executes dropped EXE
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\C719.tmp"C:\Users\Admin\AppData\Local\Temp\C719.tmp"62⤵
- Executes dropped EXE
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\C776.tmp"C:\Users\Admin\AppData\Local\Temp\C776.tmp"63⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\C7D4.tmp"C:\Users\Admin\AppData\Local\Temp\C7D4.tmp"64⤵
- Executes dropped EXE
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\C841.tmp"C:\Users\Admin\AppData\Local\Temp\C841.tmp"65⤵
- Executes dropped EXE
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\C89F.tmp"C:\Users\Admin\AppData\Local\Temp\C89F.tmp"66⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\C90D.tmp"C:\Users\Admin\AppData\Local\Temp\C90D.tmp"67⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\C96A.tmp"C:\Users\Admin\AppData\Local\Temp\C96A.tmp"68⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\C9C8.tmp"C:\Users\Admin\AppData\Local\Temp\C9C8.tmp"69⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\CA16.tmp"C:\Users\Admin\AppData\Local\Temp\CA16.tmp"70⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\CA74.tmp"C:\Users\Admin\AppData\Local\Temp\CA74.tmp"71⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\CAD2.tmp"C:\Users\Admin\AppData\Local\Temp\CAD2.tmp"72⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\CB2F.tmp"C:\Users\Admin\AppData\Local\Temp\CB2F.tmp"73⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\CB8D.tmp"C:\Users\Admin\AppData\Local\Temp\CB8D.tmp"74⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\CBEB.tmp"C:\Users\Admin\AppData\Local\Temp\CBEB.tmp"75⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\CC49.tmp"C:\Users\Admin\AppData\Local\Temp\CC49.tmp"76⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\CCA6.tmp"C:\Users\Admin\AppData\Local\Temp\CCA6.tmp"77⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\CD14.tmp"C:\Users\Admin\AppData\Local\Temp\CD14.tmp"78⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\CD72.tmp"C:\Users\Admin\AppData\Local\Temp\CD72.tmp"79⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\CDC0.tmp"C:\Users\Admin\AppData\Local\Temp\CDC0.tmp"80⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\CE1D.tmp"C:\Users\Admin\AppData\Local\Temp\CE1D.tmp"81⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\CE6C.tmp"C:\Users\Admin\AppData\Local\Temp\CE6C.tmp"82⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\CEC9.tmp"C:\Users\Admin\AppData\Local\Temp\CEC9.tmp"83⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\CF27.tmp"C:\Users\Admin\AppData\Local\Temp\CF27.tmp"84⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\CF85.tmp"C:\Users\Admin\AppData\Local\Temp\CF85.tmp"85⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\CFE3.tmp"C:\Users\Admin\AppData\Local\Temp\CFE3.tmp"86⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\D040.tmp"C:\Users\Admin\AppData\Local\Temp\D040.tmp"87⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"88⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\D10B.tmp"C:\Users\Admin\AppData\Local\Temp\D10B.tmp"89⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\D169.tmp"C:\Users\Admin\AppData\Local\Temp\D169.tmp"90⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"91⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\D225.tmp"C:\Users\Admin\AppData\Local\Temp\D225.tmp"92⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\D292.tmp"C:\Users\Admin\AppData\Local\Temp\D292.tmp"93⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\D2F0.tmp"C:\Users\Admin\AppData\Local\Temp\D2F0.tmp"94⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\D34E.tmp"C:\Users\Admin\AppData\Local\Temp\D34E.tmp"95⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\D3AB.tmp"C:\Users\Admin\AppData\Local\Temp\D3AB.tmp"96⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\D409.tmp"C:\Users\Admin\AppData\Local\Temp\D409.tmp"97⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\D467.tmp"C:\Users\Admin\AppData\Local\Temp\D467.tmp"98⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\D4C5.tmp"C:\Users\Admin\AppData\Local\Temp\D4C5.tmp"99⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\D522.tmp"C:\Users\Admin\AppData\Local\Temp\D522.tmp"100⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\D580.tmp"C:\Users\Admin\AppData\Local\Temp\D580.tmp"101⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\D5DE.tmp"C:\Users\Admin\AppData\Local\Temp\D5DE.tmp"102⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\D62C.tmp"C:\Users\Admin\AppData\Local\Temp\D62C.tmp"103⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\D67A.tmp"C:\Users\Admin\AppData\Local\Temp\D67A.tmp"104⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\D6D8.tmp"C:\Users\Admin\AppData\Local\Temp\D6D8.tmp"105⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\D736.tmp"C:\Users\Admin\AppData\Local\Temp\D736.tmp"106⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\D793.tmp"C:\Users\Admin\AppData\Local\Temp\D793.tmp"107⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\D7E1.tmp"C:\Users\Admin\AppData\Local\Temp\D7E1.tmp"108⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\D83F.tmp"C:\Users\Admin\AppData\Local\Temp\D83F.tmp"109⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\D88D.tmp"C:\Users\Admin\AppData\Local\Temp\D88D.tmp"110⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\D8EB.tmp"C:\Users\Admin\AppData\Local\Temp\D8EB.tmp"111⤵
- System Location Discovery: System Language Discovery
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\D939.tmp"C:\Users\Admin\AppData\Local\Temp\D939.tmp"112⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\D987.tmp"C:\Users\Admin\AppData\Local\Temp\D987.tmp"113⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\D9D5.tmp"C:\Users\Admin\AppData\Local\Temp\D9D5.tmp"114⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\DA33.tmp"C:\Users\Admin\AppData\Local\Temp\DA33.tmp"115⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\DA81.tmp"C:\Users\Admin\AppData\Local\Temp\DA81.tmp"116⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\DACF.tmp"C:\Users\Admin\AppData\Local\Temp\DACF.tmp"117⤵PID:508
-
C:\Users\Admin\AppData\Local\Temp\DB2D.tmp"C:\Users\Admin\AppData\Local\Temp\DB2D.tmp"118⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\DB7B.tmp"C:\Users\Admin\AppData\Local\Temp\DB7B.tmp"119⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\DBC9.tmp"C:\Users\Admin\AppData\Local\Temp\DBC9.tmp"120⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\DC18.tmp"C:\Users\Admin\AppData\Local\Temp\DC18.tmp"121⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\DC66.tmp"C:\Users\Admin\AppData\Local\Temp\DC66.tmp"122⤵PID:1272
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-