Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29/08/2024, 16:49
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-29_2764e31562c419a0d5b5d0668121078a_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-08-29_2764e31562c419a0d5b5d0668121078a_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-29_2764e31562c419a0d5b5d0668121078a_mafia.exe
-
Size
712KB
-
MD5
2764e31562c419a0d5b5d0668121078a
-
SHA1
ddf9f941b36805782bfc202628a6d737133556e7
-
SHA256
735eeae3be05b17241931d898d4d5e990f8970baced6befdee8036c045bbe681
-
SHA512
34137dc45203d5ee6a7a424081eddbb3e3a33aab4c1b8e90345c080e0f000bdba1699343c0ffba98c795f211af0280df43a45fd5b545b54fd1dc004808523a08
-
SSDEEP
12288:FU5rCOTeiD7BAXx/Wa7wjp7QCyQ5+wuyNZdCvq5TJLCvY90D8/LVBlVk736Y79G5:FUQOJDCXx/WcwjpMtQgwuyNnCvq5TJLT
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2756 BD26.tmp 3372 BD93.tmp 4912 BE00.tmp 3552 BECC.tmp 1964 BF58.tmp 1672 BFF4.tmp 1512 C071.tmp 1312 C0CF.tmp 4520 C15C.tmp 2204 C1C9.tmp 3320 C246.tmp 856 C2C3.tmp 4140 C350.tmp 4724 C3CD.tmp 4576 C459.tmp 4888 C4C7.tmp 3616 C534.tmp 1384 C5A2.tmp 2972 C62E.tmp 2608 C68C.tmp 4192 C6DA.tmp 4872 C738.tmp 2228 C7B5.tmp 2324 C832.tmp 2488 C8CE.tmp 412 C93B.tmp 2676 C9B8.tmp 4100 CA26.tmp 2208 CAE1.tmp 1720 CB7E.tmp 5016 CC1A.tmp 4152 CCB6.tmp 4416 CD43.tmp 4396 CDA0.tmp 1192 CDFE.tmp 1660 CE5C.tmp 3676 CEBA.tmp 4380 CF08.tmp 3372 CF66.tmp 4532 CFC3.tmp 672 D011.tmp 3552 D06F.tmp 3700 D0CD.tmp 2728 D12B.tmp 3468 D188.tmp 804 D1E6.tmp 548 D244.tmp 4456 D2A2.tmp 1372 D2FF.tmp 3064 D35D.tmp 3040 D3AB.tmp 4028 D409.tmp 696 D467.tmp 4040 D4B5.tmp 776 D513.tmp 3324 D561.tmp 1236 D5BF.tmp 1080 D61C.tmp 4964 D67A.tmp 4888 D6D8.tmp 3432 D726.tmp 2584 D793.tmp 1384 D7F1.tmp 3260 D85E.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D76.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C426.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A42A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 882.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D85E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AED9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 110D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9601.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD4E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5484.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A999.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2536.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E4E.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5000 wrote to memory of 2756 5000 2024-08-29_2764e31562c419a0d5b5d0668121078a_mafia.exe 86 PID 5000 wrote to memory of 2756 5000 2024-08-29_2764e31562c419a0d5b5d0668121078a_mafia.exe 86 PID 5000 wrote to memory of 2756 5000 2024-08-29_2764e31562c419a0d5b5d0668121078a_mafia.exe 86 PID 2756 wrote to memory of 3372 2756 BD26.tmp 87 PID 2756 wrote to memory of 3372 2756 BD26.tmp 87 PID 2756 wrote to memory of 3372 2756 BD26.tmp 87 PID 3372 wrote to memory of 4912 3372 BD93.tmp 88 PID 3372 wrote to memory of 4912 3372 BD93.tmp 88 PID 3372 wrote to memory of 4912 3372 BD93.tmp 88 PID 4912 wrote to memory of 3552 4912 BE00.tmp 90 PID 4912 wrote to memory of 3552 4912 BE00.tmp 90 PID 4912 wrote to memory of 3552 4912 BE00.tmp 90 PID 3552 wrote to memory of 1964 3552 BECC.tmp 92 PID 3552 wrote to memory of 1964 3552 BECC.tmp 92 PID 3552 wrote to memory of 1964 3552 BECC.tmp 92 PID 1964 wrote to memory of 1672 1964 BF58.tmp 94 PID 1964 wrote to memory of 1672 1964 BF58.tmp 94 PID 1964 wrote to memory of 1672 1964 BF58.tmp 94 PID 1672 wrote to memory of 1512 1672 BFF4.tmp 95 PID 1672 wrote to memory of 1512 1672 BFF4.tmp 95 PID 1672 wrote to memory of 1512 1672 BFF4.tmp 95 PID 1512 wrote to memory of 1312 1512 C071.tmp 96 PID 1512 wrote to memory of 1312 1512 C071.tmp 96 PID 1512 wrote to memory of 1312 1512 C071.tmp 96 PID 1312 wrote to memory of 4520 1312 C0CF.tmp 97 PID 1312 wrote to memory of 4520 1312 C0CF.tmp 97 PID 1312 wrote to memory of 4520 1312 C0CF.tmp 97 PID 4520 wrote to memory of 2204 4520 C15C.tmp 98 PID 4520 wrote to memory of 2204 4520 C15C.tmp 98 PID 4520 wrote to memory of 2204 4520 C15C.tmp 98 PID 2204 wrote to memory of 3320 2204 C1C9.tmp 99 PID 2204 wrote to memory of 3320 2204 C1C9.tmp 99 PID 2204 wrote to memory of 3320 2204 C1C9.tmp 99 PID 3320 wrote to memory of 856 3320 C246.tmp 100 PID 3320 wrote to memory of 856 3320 C246.tmp 100 PID 3320 wrote to memory of 856 3320 C246.tmp 100 PID 856 wrote to memory of 4140 856 C2C3.tmp 101 PID 856 wrote to memory of 4140 856 C2C3.tmp 101 PID 856 wrote to memory of 4140 856 C2C3.tmp 101 PID 4140 wrote to memory of 4724 4140 C350.tmp 102 PID 4140 wrote to memory of 4724 4140 C350.tmp 102 PID 4140 wrote to memory of 4724 4140 C350.tmp 102 PID 4724 wrote to memory of 4576 4724 C3CD.tmp 103 PID 4724 wrote to memory of 4576 4724 C3CD.tmp 103 PID 4724 wrote to memory of 4576 4724 C3CD.tmp 103 PID 4576 wrote to memory of 4888 4576 C459.tmp 104 PID 4576 wrote to memory of 4888 4576 C459.tmp 104 PID 4576 wrote to memory of 4888 4576 C459.tmp 104 PID 4888 wrote to memory of 3616 4888 C4C7.tmp 107 PID 4888 wrote to memory of 3616 4888 C4C7.tmp 107 PID 4888 wrote to memory of 3616 4888 C4C7.tmp 107 PID 3616 wrote to memory of 1384 3616 C534.tmp 108 PID 3616 wrote to memory of 1384 3616 C534.tmp 108 PID 3616 wrote to memory of 1384 3616 C534.tmp 108 PID 1384 wrote to memory of 2972 1384 C5A2.tmp 109 PID 1384 wrote to memory of 2972 1384 C5A2.tmp 109 PID 1384 wrote to memory of 2972 1384 C5A2.tmp 109 PID 2972 wrote to memory of 2608 2972 C62E.tmp 110 PID 2972 wrote to memory of 2608 2972 C62E.tmp 110 PID 2972 wrote to memory of 2608 2972 C62E.tmp 110 PID 2608 wrote to memory of 4192 2608 C68C.tmp 111 PID 2608 wrote to memory of 4192 2608 C68C.tmp 111 PID 2608 wrote to memory of 4192 2608 C68C.tmp 111 PID 4192 wrote to memory of 4872 4192 C6DA.tmp 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-29_2764e31562c419a0d5b5d0668121078a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-29_2764e31562c419a0d5b5d0668121078a_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\BD26.tmp"C:\Users\Admin\AppData\Local\Temp\BD26.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\BD93.tmp"C:\Users\Admin\AppData\Local\Temp\BD93.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\BE00.tmp"C:\Users\Admin\AppData\Local\Temp\BE00.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\BECC.tmp"C:\Users\Admin\AppData\Local\Temp\BECC.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\BF58.tmp"C:\Users\Admin\AppData\Local\Temp\BF58.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\C071.tmp"C:\Users\Admin\AppData\Local\Temp\C071.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\C15C.tmp"C:\Users\Admin\AppData\Local\Temp\C15C.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\C246.tmp"C:\Users\Admin\AppData\Local\Temp\C246.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Users\Admin\AppData\Local\Temp\C350.tmp"C:\Users\Admin\AppData\Local\Temp\C350.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\C459.tmp"C:\Users\Admin\AppData\Local\Temp\C459.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\C4C7.tmp"C:\Users\Admin\AppData\Local\Temp\C4C7.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\C534.tmp"C:\Users\Admin\AppData\Local\Temp\C534.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\C62E.tmp"C:\Users\Admin\AppData\Local\Temp\C62E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\C68C.tmp"C:\Users\Admin\AppData\Local\Temp\C68C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\C6DA.tmp"C:\Users\Admin\AppData\Local\Temp\C6DA.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\C738.tmp"C:\Users\Admin\AppData\Local\Temp\C738.tmp"23⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\C7B5.tmp"C:\Users\Admin\AppData\Local\Temp\C7B5.tmp"24⤵
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\C832.tmp"C:\Users\Admin\AppData\Local\Temp\C832.tmp"25⤵
- Executes dropped EXE
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\C8CE.tmp"C:\Users\Admin\AppData\Local\Temp\C8CE.tmp"26⤵
- Executes dropped EXE
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\C93B.tmp"C:\Users\Admin\AppData\Local\Temp\C93B.tmp"27⤵
- Executes dropped EXE
PID:412 -
C:\Users\Admin\AppData\Local\Temp\C9B8.tmp"C:\Users\Admin\AppData\Local\Temp\C9B8.tmp"28⤵
- Executes dropped EXE
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\CA26.tmp"C:\Users\Admin\AppData\Local\Temp\CA26.tmp"29⤵
- Executes dropped EXE
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\CAE1.tmp"C:\Users\Admin\AppData\Local\Temp\CAE1.tmp"30⤵
- Executes dropped EXE
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\CB7E.tmp"C:\Users\Admin\AppData\Local\Temp\CB7E.tmp"31⤵
- Executes dropped EXE
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\CC1A.tmp"C:\Users\Admin\AppData\Local\Temp\CC1A.tmp"32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\CCB6.tmp"C:\Users\Admin\AppData\Local\Temp\CCB6.tmp"33⤵
- Executes dropped EXE
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\CD43.tmp"C:\Users\Admin\AppData\Local\Temp\CD43.tmp"34⤵
- Executes dropped EXE
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\CDA0.tmp"C:\Users\Admin\AppData\Local\Temp\CDA0.tmp"35⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\CDFE.tmp"C:\Users\Admin\AppData\Local\Temp\CDFE.tmp"36⤵
- Executes dropped EXE
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\CE5C.tmp"C:\Users\Admin\AppData\Local\Temp\CE5C.tmp"37⤵
- Executes dropped EXE
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\CEBA.tmp"C:\Users\Admin\AppData\Local\Temp\CEBA.tmp"38⤵
- Executes dropped EXE
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\CF08.tmp"C:\Users\Admin\AppData\Local\Temp\CF08.tmp"39⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\CF66.tmp"C:\Users\Admin\AppData\Local\Temp\CF66.tmp"40⤵
- Executes dropped EXE
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\CFC3.tmp"C:\Users\Admin\AppData\Local\Temp\CFC3.tmp"41⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\D011.tmp"C:\Users\Admin\AppData\Local\Temp\D011.tmp"42⤵
- Executes dropped EXE
PID:672 -
C:\Users\Admin\AppData\Local\Temp\D06F.tmp"C:\Users\Admin\AppData\Local\Temp\D06F.tmp"43⤵
- Executes dropped EXE
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\D0CD.tmp"C:\Users\Admin\AppData\Local\Temp\D0CD.tmp"44⤵
- Executes dropped EXE
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\D12B.tmp"C:\Users\Admin\AppData\Local\Temp\D12B.tmp"45⤵
- Executes dropped EXE
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\D188.tmp"C:\Users\Admin\AppData\Local\Temp\D188.tmp"46⤵
- Executes dropped EXE
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\D1E6.tmp"C:\Users\Admin\AppData\Local\Temp\D1E6.tmp"47⤵
- Executes dropped EXE
PID:804 -
C:\Users\Admin\AppData\Local\Temp\D244.tmp"C:\Users\Admin\AppData\Local\Temp\D244.tmp"48⤵
- Executes dropped EXE
PID:548 -
C:\Users\Admin\AppData\Local\Temp\D2A2.tmp"C:\Users\Admin\AppData\Local\Temp\D2A2.tmp"49⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\D2FF.tmp"C:\Users\Admin\AppData\Local\Temp\D2FF.tmp"50⤵
- Executes dropped EXE
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\D35D.tmp"C:\Users\Admin\AppData\Local\Temp\D35D.tmp"51⤵
- Executes dropped EXE
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\D3AB.tmp"C:\Users\Admin\AppData\Local\Temp\D3AB.tmp"52⤵
- Executes dropped EXE
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\D409.tmp"C:\Users\Admin\AppData\Local\Temp\D409.tmp"53⤵
- Executes dropped EXE
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\D467.tmp"C:\Users\Admin\AppData\Local\Temp\D467.tmp"54⤵
- Executes dropped EXE
PID:696 -
C:\Users\Admin\AppData\Local\Temp\D4B5.tmp"C:\Users\Admin\AppData\Local\Temp\D4B5.tmp"55⤵
- Executes dropped EXE
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\D513.tmp"C:\Users\Admin\AppData\Local\Temp\D513.tmp"56⤵
- Executes dropped EXE
PID:776 -
C:\Users\Admin\AppData\Local\Temp\D561.tmp"C:\Users\Admin\AppData\Local\Temp\D561.tmp"57⤵
- Executes dropped EXE
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\D5BF.tmp"C:\Users\Admin\AppData\Local\Temp\D5BF.tmp"58⤵
- Executes dropped EXE
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\D61C.tmp"C:\Users\Admin\AppData\Local\Temp\D61C.tmp"59⤵
- Executes dropped EXE
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\D67A.tmp"C:\Users\Admin\AppData\Local\Temp\D67A.tmp"60⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\D6D8.tmp"C:\Users\Admin\AppData\Local\Temp\D6D8.tmp"61⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\D726.tmp"C:\Users\Admin\AppData\Local\Temp\D726.tmp"62⤵
- Executes dropped EXE
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\D793.tmp"C:\Users\Admin\AppData\Local\Temp\D793.tmp"63⤵
- Executes dropped EXE
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\D7F1.tmp"C:\Users\Admin\AppData\Local\Temp\D7F1.tmp"64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\D85E.tmp"C:\Users\Admin\AppData\Local\Temp\D85E.tmp"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\D8BC.tmp"C:\Users\Admin\AppData\Local\Temp\D8BC.tmp"66⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\D91A.tmp"C:\Users\Admin\AppData\Local\Temp\D91A.tmp"67⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\D978.tmp"C:\Users\Admin\AppData\Local\Temp\D978.tmp"68⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\D9D5.tmp"C:\Users\Admin\AppData\Local\Temp\D9D5.tmp"69⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\DA33.tmp"C:\Users\Admin\AppData\Local\Temp\DA33.tmp"70⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\DA91.tmp"C:\Users\Admin\AppData\Local\Temp\DA91.tmp"71⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\DAEF.tmp"C:\Users\Admin\AppData\Local\Temp\DAEF.tmp"72⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\DB4C.tmp"C:\Users\Admin\AppData\Local\Temp\DB4C.tmp"73⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\DBAA.tmp"C:\Users\Admin\AppData\Local\Temp\DBAA.tmp"74⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\DC08.tmp"C:\Users\Admin\AppData\Local\Temp\DC08.tmp"75⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\DC56.tmp"C:\Users\Admin\AppData\Local\Temp\DC56.tmp"76⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\DCB4.tmp"C:\Users\Admin\AppData\Local\Temp\DCB4.tmp"77⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\DD12.tmp"C:\Users\Admin\AppData\Local\Temp\DD12.tmp"78⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\DD60.tmp"C:\Users\Admin\AppData\Local\Temp\DD60.tmp"79⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\DDBD.tmp"C:\Users\Admin\AppData\Local\Temp\DDBD.tmp"80⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\DE1B.tmp"C:\Users\Admin\AppData\Local\Temp\DE1B.tmp"81⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\DE79.tmp"C:\Users\Admin\AppData\Local\Temp\DE79.tmp"82⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\DED7.tmp"C:\Users\Admin\AppData\Local\Temp\DED7.tmp"83⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\DF34.tmp"C:\Users\Admin\AppData\Local\Temp\DF34.tmp"84⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\DF92.tmp"C:\Users\Admin\AppData\Local\Temp\DF92.tmp"85⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"86⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\E04E.tmp"C:\Users\Admin\AppData\Local\Temp\E04E.tmp"87⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\E0AB.tmp"C:\Users\Admin\AppData\Local\Temp\E0AB.tmp"88⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\E0FA.tmp"C:\Users\Admin\AppData\Local\Temp\E0FA.tmp"89⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\E148.tmp"C:\Users\Admin\AppData\Local\Temp\E148.tmp"90⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\E196.tmp"C:\Users\Admin\AppData\Local\Temp\E196.tmp"91⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\E1E4.tmp"C:\Users\Admin\AppData\Local\Temp\E1E4.tmp"92⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\E242.tmp"C:\Users\Admin\AppData\Local\Temp\E242.tmp"93⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\E290.tmp"C:\Users\Admin\AppData\Local\Temp\E290.tmp"94⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\E2EE.tmp"C:\Users\Admin\AppData\Local\Temp\E2EE.tmp"95⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\E34B.tmp"C:\Users\Admin\AppData\Local\Temp\E34B.tmp"96⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\E3A9.tmp"C:\Users\Admin\AppData\Local\Temp\E3A9.tmp"97⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\E407.tmp"C:\Users\Admin\AppData\Local\Temp\E407.tmp"98⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\E465.tmp"C:\Users\Admin\AppData\Local\Temp\E465.tmp"99⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\E4B3.tmp"C:\Users\Admin\AppData\Local\Temp\E4B3.tmp"100⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\E510.tmp"C:\Users\Admin\AppData\Local\Temp\E510.tmp"101⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\E55F.tmp"C:\Users\Admin\AppData\Local\Temp\E55F.tmp"102⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\E5AD.tmp"C:\Users\Admin\AppData\Local\Temp\E5AD.tmp"103⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\E60A.tmp"C:\Users\Admin\AppData\Local\Temp\E60A.tmp"104⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\E659.tmp"C:\Users\Admin\AppData\Local\Temp\E659.tmp"105⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"106⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"107⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\E753.tmp"C:\Users\Admin\AppData\Local\Temp\E753.tmp"108⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"109⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\E80E.tmp"C:\Users\Admin\AppData\Local\Temp\E80E.tmp"110⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\E86C.tmp"C:\Users\Admin\AppData\Local\Temp\E86C.tmp"111⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\E8CA.tmp"C:\Users\Admin\AppData\Local\Temp\E8CA.tmp"112⤵
- System Location Discovery: System Language Discovery
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\E918.tmp"C:\Users\Admin\AppData\Local\Temp\E918.tmp"113⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\E975.tmp"C:\Users\Admin\AppData\Local\Temp\E975.tmp"114⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\E9D3.tmp"C:\Users\Admin\AppData\Local\Temp\E9D3.tmp"115⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\EA21.tmp"C:\Users\Admin\AppData\Local\Temp\EA21.tmp"116⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\EA7F.tmp"C:\Users\Admin\AppData\Local\Temp\EA7F.tmp"117⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\EADD.tmp"C:\Users\Admin\AppData\Local\Temp\EADD.tmp"118⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\EB2B.tmp"C:\Users\Admin\AppData\Local\Temp\EB2B.tmp"119⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\EB79.tmp"C:\Users\Admin\AppData\Local\Temp\EB79.tmp"120⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\EBC7.tmp"C:\Users\Admin\AppData\Local\Temp\EBC7.tmp"121⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\EC25.tmp"C:\Users\Admin\AppData\Local\Temp\EC25.tmp"122⤵PID:4856
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-