Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01/09/2024, 13:35
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-01_71fa88eb81c3df4dc1ed1b247b9a0dc3_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-09-01_71fa88eb81c3df4dc1ed1b247b9a0dc3_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-01_71fa88eb81c3df4dc1ed1b247b9a0dc3_mafia.exe
-
Size
487KB
-
MD5
71fa88eb81c3df4dc1ed1b247b9a0dc3
-
SHA1
0f48a12ba64cce06b3231a79c2620c1f98ec77bb
-
SHA256
825fa50665ba344d40e79c941f8e450900b71f32224574b592795d1159de9f48
-
SHA512
bfbc97ee6f3b7924cb8ebfacdee4d7e62f09f0c99238a68443e09094354ba48a46b9f536bfa928b5eda160b3d26ba34b340c094c8fc20f2a001afc9eaa6c33dc
-
SSDEEP
6144:zorf3lPvovsgZnqG2C7mOTeiLxDxAs4LzzQm60cRpMCepKFx4tjsiPvW6IRmsH39:yU5rCOTeiN23QmTHfKHiYovjIpbZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1064 1661.tmp 620 16CF.tmp 4924 174C.tmp 2752 17AA.tmp 3192 1817.tmp 688 1884.tmp 2716 18E2.tmp 2300 1940.tmp 1864 198E.tmp 4512 19EC.tmp 1568 1A49.tmp 2084 1AA7.tmp 3504 1B24.tmp 4000 1B92.tmp 3872 1BEF.tmp 1796 1C4D.tmp 1048 1C9B.tmp 228 1CE9.tmp 3656 1D47.tmp 4484 1DD4.tmp 3728 1E22.tmp 1056 1E9F.tmp 4460 1F1C.tmp 4864 1F5A.tmp 2708 1FA8.tmp 1800 1FF7.tmp 4392 2045.tmp 4920 2093.tmp 1256 20F1.tmp 3576 213F.tmp 1388 217D.tmp 1760 21EB.tmp 4800 2239.tmp 1512 2287.tmp 3560 22D5.tmp 1064 2323.tmp 4020 2381.tmp 1032 23CF.tmp 4044 241D.tmp 2752 246B.tmp 1748 24C9.tmp 1236 2527.tmp 4064 2575.tmp 4876 25C3.tmp 3236 2611.tmp 2164 265F.tmp 1404 26BD.tmp 2208 270B.tmp 4040 2759.tmp 4208 27A7.tmp 5044 27F5.tmp 3688 2863.tmp 2088 28B1.tmp 4220 290F.tmp 60 296C.tmp 804 29CA.tmp 3700 2A28.tmp 800 2A86.tmp 888 2AD4.tmp 3052 2B32.tmp 976 2B8F.tmp 3024 2BED.tmp 384 2C4B.tmp 4412 2C99.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1661.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CD5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 454C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D54C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 248.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3524.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3908.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7059.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFF9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A841.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E809.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 911F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 160F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C36.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ABD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 342A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F22.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 797.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1284.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C9B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F72C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 314C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14E.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 440 wrote to memory of 1064 440 2024-09-01_71fa88eb81c3df4dc1ed1b247b9a0dc3_mafia.exe 84 PID 440 wrote to memory of 1064 440 2024-09-01_71fa88eb81c3df4dc1ed1b247b9a0dc3_mafia.exe 84 PID 440 wrote to memory of 1064 440 2024-09-01_71fa88eb81c3df4dc1ed1b247b9a0dc3_mafia.exe 84 PID 1064 wrote to memory of 620 1064 1661.tmp 85 PID 1064 wrote to memory of 620 1064 1661.tmp 85 PID 1064 wrote to memory of 620 1064 1661.tmp 85 PID 620 wrote to memory of 4924 620 16CF.tmp 86 PID 620 wrote to memory of 4924 620 16CF.tmp 86 PID 620 wrote to memory of 4924 620 16CF.tmp 86 PID 4924 wrote to memory of 2752 4924 174C.tmp 88 PID 4924 wrote to memory of 2752 4924 174C.tmp 88 PID 4924 wrote to memory of 2752 4924 174C.tmp 88 PID 2752 wrote to memory of 3192 2752 17AA.tmp 90 PID 2752 wrote to memory of 3192 2752 17AA.tmp 90 PID 2752 wrote to memory of 3192 2752 17AA.tmp 90 PID 3192 wrote to memory of 688 3192 1817.tmp 92 PID 3192 wrote to memory of 688 3192 1817.tmp 92 PID 3192 wrote to memory of 688 3192 1817.tmp 92 PID 688 wrote to memory of 2716 688 1884.tmp 93 PID 688 wrote to memory of 2716 688 1884.tmp 93 PID 688 wrote to memory of 2716 688 1884.tmp 93 PID 2716 wrote to memory of 2300 2716 18E2.tmp 94 PID 2716 wrote to memory of 2300 2716 18E2.tmp 94 PID 2716 wrote to memory of 2300 2716 18E2.tmp 94 PID 2300 wrote to memory of 1864 2300 1940.tmp 95 PID 2300 wrote to memory of 1864 2300 1940.tmp 95 PID 2300 wrote to memory of 1864 2300 1940.tmp 95 PID 1864 wrote to memory of 4512 1864 198E.tmp 96 PID 1864 wrote to memory of 4512 1864 198E.tmp 96 PID 1864 wrote to memory of 4512 1864 198E.tmp 96 PID 4512 wrote to memory of 1568 4512 19EC.tmp 97 PID 4512 wrote to memory of 1568 4512 19EC.tmp 97 PID 4512 wrote to memory of 1568 4512 19EC.tmp 97 PID 1568 wrote to memory of 2084 1568 1A49.tmp 98 PID 1568 wrote to memory of 2084 1568 1A49.tmp 98 PID 1568 wrote to memory of 2084 1568 1A49.tmp 98 PID 2084 wrote to memory of 3504 2084 1AA7.tmp 99 PID 2084 wrote to memory of 3504 2084 1AA7.tmp 99 PID 2084 wrote to memory of 3504 2084 1AA7.tmp 99 PID 3504 wrote to memory of 4000 3504 1B24.tmp 100 PID 3504 wrote to memory of 4000 3504 1B24.tmp 100 PID 3504 wrote to memory of 4000 3504 1B24.tmp 100 PID 4000 wrote to memory of 3872 4000 1B92.tmp 101 PID 4000 wrote to memory of 3872 4000 1B92.tmp 101 PID 4000 wrote to memory of 3872 4000 1B92.tmp 101 PID 3872 wrote to memory of 1796 3872 1BEF.tmp 102 PID 3872 wrote to memory of 1796 3872 1BEF.tmp 102 PID 3872 wrote to memory of 1796 3872 1BEF.tmp 102 PID 1796 wrote to memory of 1048 1796 1C4D.tmp 103 PID 1796 wrote to memory of 1048 1796 1C4D.tmp 103 PID 1796 wrote to memory of 1048 1796 1C4D.tmp 103 PID 1048 wrote to memory of 228 1048 1C9B.tmp 104 PID 1048 wrote to memory of 228 1048 1C9B.tmp 104 PID 1048 wrote to memory of 228 1048 1C9B.tmp 104 PID 228 wrote to memory of 3656 228 1CE9.tmp 106 PID 228 wrote to memory of 3656 228 1CE9.tmp 106 PID 228 wrote to memory of 3656 228 1CE9.tmp 106 PID 3656 wrote to memory of 4484 3656 1D47.tmp 107 PID 3656 wrote to memory of 4484 3656 1D47.tmp 107 PID 3656 wrote to memory of 4484 3656 1D47.tmp 107 PID 4484 wrote to memory of 3728 4484 1DD4.tmp 108 PID 4484 wrote to memory of 3728 4484 1DD4.tmp 108 PID 4484 wrote to memory of 3728 4484 1DD4.tmp 108 PID 3728 wrote to memory of 1056 3728 1E22.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-01_71fa88eb81c3df4dc1ed1b247b9a0dc3_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-01_71fa88eb81c3df4dc1ed1b247b9a0dc3_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Users\Admin\AppData\Local\Temp\1661.tmp"C:\Users\Admin\AppData\Local\Temp\1661.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\16CF.tmp"C:\Users\Admin\AppData\Local\Temp\16CF.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Users\Admin\AppData\Local\Temp\174C.tmp"C:\Users\Admin\AppData\Local\Temp\174C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\17AA.tmp"C:\Users\Admin\AppData\Local\Temp\17AA.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\1817.tmp"C:\Users\Admin\AppData\Local\Temp\1817.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\1884.tmp"C:\Users\Admin\AppData\Local\Temp\1884.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Users\Admin\AppData\Local\Temp\18E2.tmp"C:\Users\Admin\AppData\Local\Temp\18E2.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\1940.tmp"C:\Users\Admin\AppData\Local\Temp\1940.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\198E.tmp"C:\Users\Admin\AppData\Local\Temp\198E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\19EC.tmp"C:\Users\Admin\AppData\Local\Temp\19EC.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\1A49.tmp"C:\Users\Admin\AppData\Local\Temp\1A49.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\1AA7.tmp"C:\Users\Admin\AppData\Local\Temp\1AA7.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\1B24.tmp"C:\Users\Admin\AppData\Local\Temp\1B24.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\1B92.tmp"C:\Users\Admin\AppData\Local\Temp\1B92.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\1BEF.tmp"C:\Users\Admin\AppData\Local\Temp\1BEF.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\1C4D.tmp"C:\Users\Admin\AppData\Local\Temp\1C4D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\1C9B.tmp"C:\Users\Admin\AppData\Local\Temp\1C9B.tmp"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\1CE9.tmp"C:\Users\Admin\AppData\Local\Temp\1CE9.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Users\Admin\AppData\Local\Temp\1D47.tmp"C:\Users\Admin\AppData\Local\Temp\1D47.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\1DD4.tmp"C:\Users\Admin\AppData\Local\Temp\1DD4.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\1E22.tmp"C:\Users\Admin\AppData\Local\Temp\1E22.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\1E9F.tmp"C:\Users\Admin\AppData\Local\Temp\1E9F.tmp"23⤵
- Executes dropped EXE
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\1F1C.tmp"C:\Users\Admin\AppData\Local\Temp\1F1C.tmp"24⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\1F5A.tmp"C:\Users\Admin\AppData\Local\Temp\1F5A.tmp"25⤵
- Executes dropped EXE
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\1FA8.tmp"C:\Users\Admin\AppData\Local\Temp\1FA8.tmp"26⤵
- Executes dropped EXE
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\1FF7.tmp"C:\Users\Admin\AppData\Local\Temp\1FF7.tmp"27⤵
- Executes dropped EXE
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\2045.tmp"C:\Users\Admin\AppData\Local\Temp\2045.tmp"28⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\2093.tmp"C:\Users\Admin\AppData\Local\Temp\2093.tmp"29⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\20F1.tmp"C:\Users\Admin\AppData\Local\Temp\20F1.tmp"30⤵
- Executes dropped EXE
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\213F.tmp"C:\Users\Admin\AppData\Local\Temp\213F.tmp"31⤵
- Executes dropped EXE
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\217D.tmp"C:\Users\Admin\AppData\Local\Temp\217D.tmp"32⤵
- Executes dropped EXE
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\21EB.tmp"C:\Users\Admin\AppData\Local\Temp\21EB.tmp"33⤵
- Executes dropped EXE
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\2239.tmp"C:\Users\Admin\AppData\Local\Temp\2239.tmp"34⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\2287.tmp"C:\Users\Admin\AppData\Local\Temp\2287.tmp"35⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\22D5.tmp"C:\Users\Admin\AppData\Local\Temp\22D5.tmp"36⤵
- Executes dropped EXE
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\2323.tmp"C:\Users\Admin\AppData\Local\Temp\2323.tmp"37⤵
- Executes dropped EXE
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\2381.tmp"C:\Users\Admin\AppData\Local\Temp\2381.tmp"38⤵
- Executes dropped EXE
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\23CF.tmp"C:\Users\Admin\AppData\Local\Temp\23CF.tmp"39⤵
- Executes dropped EXE
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\241D.tmp"C:\Users\Admin\AppData\Local\Temp\241D.tmp"40⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\246B.tmp"C:\Users\Admin\AppData\Local\Temp\246B.tmp"41⤵
- Executes dropped EXE
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\24C9.tmp"C:\Users\Admin\AppData\Local\Temp\24C9.tmp"42⤵
- Executes dropped EXE
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\2527.tmp"C:\Users\Admin\AppData\Local\Temp\2527.tmp"43⤵
- Executes dropped EXE
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\2575.tmp"C:\Users\Admin\AppData\Local\Temp\2575.tmp"44⤵
- Executes dropped EXE
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\25C3.tmp"C:\Users\Admin\AppData\Local\Temp\25C3.tmp"45⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\2611.tmp"C:\Users\Admin\AppData\Local\Temp\2611.tmp"46⤵
- Executes dropped EXE
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\265F.tmp"C:\Users\Admin\AppData\Local\Temp\265F.tmp"47⤵
- Executes dropped EXE
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\26BD.tmp"C:\Users\Admin\AppData\Local\Temp\26BD.tmp"48⤵
- Executes dropped EXE
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\270B.tmp"C:\Users\Admin\AppData\Local\Temp\270B.tmp"49⤵
- Executes dropped EXE
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\2759.tmp"C:\Users\Admin\AppData\Local\Temp\2759.tmp"50⤵
- Executes dropped EXE
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\27A7.tmp"C:\Users\Admin\AppData\Local\Temp\27A7.tmp"51⤵
- Executes dropped EXE
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\27F5.tmp"C:\Users\Admin\AppData\Local\Temp\27F5.tmp"52⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\2863.tmp"C:\Users\Admin\AppData\Local\Temp\2863.tmp"53⤵
- Executes dropped EXE
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\28B1.tmp"C:\Users\Admin\AppData\Local\Temp\28B1.tmp"54⤵
- Executes dropped EXE
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\290F.tmp"C:\Users\Admin\AppData\Local\Temp\290F.tmp"55⤵
- Executes dropped EXE
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\296C.tmp"C:\Users\Admin\AppData\Local\Temp\296C.tmp"56⤵
- Executes dropped EXE
PID:60 -
C:\Users\Admin\AppData\Local\Temp\29CA.tmp"C:\Users\Admin\AppData\Local\Temp\29CA.tmp"57⤵
- Executes dropped EXE
PID:804 -
C:\Users\Admin\AppData\Local\Temp\2A28.tmp"C:\Users\Admin\AppData\Local\Temp\2A28.tmp"58⤵
- Executes dropped EXE
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\2A86.tmp"C:\Users\Admin\AppData\Local\Temp\2A86.tmp"59⤵
- Executes dropped EXE
PID:800 -
C:\Users\Admin\AppData\Local\Temp\2AD4.tmp"C:\Users\Admin\AppData\Local\Temp\2AD4.tmp"60⤵
- Executes dropped EXE
PID:888 -
C:\Users\Admin\AppData\Local\Temp\2B32.tmp"C:\Users\Admin\AppData\Local\Temp\2B32.tmp"61⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\2B8F.tmp"C:\Users\Admin\AppData\Local\Temp\2B8F.tmp"62⤵
- Executes dropped EXE
PID:976 -
C:\Users\Admin\AppData\Local\Temp\2BED.tmp"C:\Users\Admin\AppData\Local\Temp\2BED.tmp"63⤵
- Executes dropped EXE
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\2C4B.tmp"C:\Users\Admin\AppData\Local\Temp\2C4B.tmp"64⤵
- Executes dropped EXE
PID:384 -
C:\Users\Admin\AppData\Local\Temp\2C99.tmp"C:\Users\Admin\AppData\Local\Temp\2C99.tmp"65⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\2CE7.tmp"C:\Users\Admin\AppData\Local\Temp\2CE7.tmp"66⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\2D45.tmp"C:\Users\Admin\AppData\Local\Temp\2D45.tmp"67⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\2DA3.tmp"C:\Users\Admin\AppData\Local\Temp\2DA3.tmp"68⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\2E00.tmp"C:\Users\Admin\AppData\Local\Temp\2E00.tmp"69⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\2E5E.tmp"C:\Users\Admin\AppData\Local\Temp\2E5E.tmp"70⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\2EBC.tmp"C:\Users\Admin\AppData\Local\Temp\2EBC.tmp"71⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\2F1A.tmp"C:\Users\Admin\AppData\Local\Temp\2F1A.tmp"72⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\2F77.tmp"C:\Users\Admin\AppData\Local\Temp\2F77.tmp"73⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\2FD5.tmp"C:\Users\Admin\AppData\Local\Temp\2FD5.tmp"74⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\3033.tmp"C:\Users\Admin\AppData\Local\Temp\3033.tmp"75⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\3091.tmp"C:\Users\Admin\AppData\Local\Temp\3091.tmp"76⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\30EE.tmp"C:\Users\Admin\AppData\Local\Temp\30EE.tmp"77⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\314C.tmp"C:\Users\Admin\AppData\Local\Temp\314C.tmp"78⤵
- System Location Discovery: System Language Discovery
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\31AA.tmp"C:\Users\Admin\AppData\Local\Temp\31AA.tmp"79⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\3208.tmp"C:\Users\Admin\AppData\Local\Temp\3208.tmp"80⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\3265.tmp"C:\Users\Admin\AppData\Local\Temp\3265.tmp"81⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\32C3.tmp"C:\Users\Admin\AppData\Local\Temp\32C3.tmp"82⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\3311.tmp"C:\Users\Admin\AppData\Local\Temp\3311.tmp"83⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\336F.tmp"C:\Users\Admin\AppData\Local\Temp\336F.tmp"84⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\33CD.tmp"C:\Users\Admin\AppData\Local\Temp\33CD.tmp"85⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\342A.tmp"C:\Users\Admin\AppData\Local\Temp\342A.tmp"86⤵
- System Location Discovery: System Language Discovery
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\3479.tmp"C:\Users\Admin\AppData\Local\Temp\3479.tmp"87⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\34D6.tmp"C:\Users\Admin\AppData\Local\Temp\34D6.tmp"88⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\3524.tmp"C:\Users\Admin\AppData\Local\Temp\3524.tmp"89⤵
- System Location Discovery: System Language Discovery
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\3573.tmp"C:\Users\Admin\AppData\Local\Temp\3573.tmp"90⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\35C1.tmp"C:\Users\Admin\AppData\Local\Temp\35C1.tmp"91⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\362E.tmp"C:\Users\Admin\AppData\Local\Temp\362E.tmp"92⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\366D.tmp"C:\Users\Admin\AppData\Local\Temp\366D.tmp"93⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\36BB.tmp"C:\Users\Admin\AppData\Local\Temp\36BB.tmp"94⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\3718.tmp"C:\Users\Admin\AppData\Local\Temp\3718.tmp"95⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\3776.tmp"C:\Users\Admin\AppData\Local\Temp\3776.tmp"96⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\37D4.tmp"C:\Users\Admin\AppData\Local\Temp\37D4.tmp"97⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\3832.tmp"C:\Users\Admin\AppData\Local\Temp\3832.tmp"98⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\3880.tmp"C:\Users\Admin\AppData\Local\Temp\3880.tmp"99⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\38CE.tmp"C:\Users\Admin\AppData\Local\Temp\38CE.tmp"100⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\391C.tmp"C:\Users\Admin\AppData\Local\Temp\391C.tmp"101⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\397A.tmp"C:\Users\Admin\AppData\Local\Temp\397A.tmp"102⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\39D8.tmp"C:\Users\Admin\AppData\Local\Temp\39D8.tmp"103⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\3A26.tmp"C:\Users\Admin\AppData\Local\Temp\3A26.tmp"104⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\3A83.tmp"C:\Users\Admin\AppData\Local\Temp\3A83.tmp"105⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\3AE1.tmp"C:\Users\Admin\AppData\Local\Temp\3AE1.tmp"106⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\3B3F.tmp"C:\Users\Admin\AppData\Local\Temp\3B3F.tmp"107⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\3B8D.tmp"C:\Users\Admin\AppData\Local\Temp\3B8D.tmp"108⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\3BEB.tmp"C:\Users\Admin\AppData\Local\Temp\3BEB.tmp"109⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\3C39.tmp"C:\Users\Admin\AppData\Local\Temp\3C39.tmp"110⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\3C87.tmp"C:\Users\Admin\AppData\Local\Temp\3C87.tmp"111⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\3CD5.tmp"C:\Users\Admin\AppData\Local\Temp\3CD5.tmp"112⤵
- System Location Discovery: System Language Discovery
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\3D23.tmp"C:\Users\Admin\AppData\Local\Temp\3D23.tmp"113⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\3D81.tmp"C:\Users\Admin\AppData\Local\Temp\3D81.tmp"114⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\3DDF.tmp"C:\Users\Admin\AppData\Local\Temp\3DDF.tmp"115⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\3E2D.tmp"C:\Users\Admin\AppData\Local\Temp\3E2D.tmp"116⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\3E8B.tmp"C:\Users\Admin\AppData\Local\Temp\3E8B.tmp"117⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\3ED9.tmp"C:\Users\Admin\AppData\Local\Temp\3ED9.tmp"118⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\3F27.tmp"C:\Users\Admin\AppData\Local\Temp\3F27.tmp"119⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\3F75.tmp"C:\Users\Admin\AppData\Local\Temp\3F75.tmp"120⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\3FC3.tmp"C:\Users\Admin\AppData\Local\Temp\3FC3.tmp"121⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\4021.tmp"C:\Users\Admin\AppData\Local\Temp\4021.tmp"122⤵PID:2176
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-