Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/09/2024, 07:25
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-02_9a78f6b516909bfbc658d17ec3355f9e_mafia.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2024-09-02_9a78f6b516909bfbc658d17ec3355f9e_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-02_9a78f6b516909bfbc658d17ec3355f9e_mafia.exe
-
Size
527KB
-
MD5
9a78f6b516909bfbc658d17ec3355f9e
-
SHA1
648715e3b0c0bcdf245f416f65133d0e3fbea532
-
SHA256
5045a74dfd608b8dbf3ba3abc4bf55b0df1f563a2a72cea197909a87f4707040
-
SHA512
cf5e857fe4f705c114b9240f52fae7db4987a43cdfe8b8157d47e297e0e90f062fc045c69ea3abbb39df938a9ee7a1cf74492815c40dc07f7d9678fca97f5f14
-
SSDEEP
6144:yorf3lPvovsgZnqG2C7mOTeiLRDYi4/KRfSfReRVbTt2jc+feXBLLxRdvWTfWsHU:fU5rCOTeid34SzRB4jcAMLxRdvWTDZu
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1996 C5B1.tmp 1416 C61F.tmp 2000 C67C.tmp 2628 C709.tmp 1468 C767.tmp 3200 C7D4.tmp 540 C832.tmp 5048 C890.tmp 1052 C8ED.tmp 2072 C95B.tmp 3460 C9B8.tmp 1428 CA16.tmp 2672 CA64.tmp 3564 CAB2.tmp 3436 CB20.tmp 2640 CB6E.tmp 3696 CBDB.tmp 4664 CC39.tmp 2460 CC87.tmp 756 CCE5.tmp 4464 CD43.tmp 1100 CD91.tmp 1148 CDDF.tmp 1500 CE2D.tmp 4908 CE8B.tmp 2400 CEF8.tmp 2092 CF46.tmp 960 CFA4.tmp 2496 CFF2.tmp 5036 D07F.tmp 4796 D0DD.tmp 1412 D13A.tmp 2664 D198.tmp 688 D1E6.tmp 3792 D234.tmp 640 D282.tmp 1952 D2C1.tmp 2528 D30F.tmp 2560 D37C.tmp 1156 D3F9.tmp 2960 D467.tmp 3232 D4D4.tmp 3632 D542.tmp 4684 D59F.tmp 1304 D60D.tmp 3320 D699.tmp 264 D6F7.tmp 4128 D745.tmp 4972 D7A3.tmp 3168 D801.tmp 336 D87E.tmp 3640 D8DB.tmp 1120 D91A.tmp 5068 D968.tmp 3292 D9B6.tmp 2212 DA04.tmp 1232 DA52.tmp 1976 DAA1.tmp 1468 DAEF.tmp 2176 DB3D.tmp 3164 DB8B.tmp 4088 DBE9.tmp 4104 DC37.tmp 3904 DC95.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 700B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFA4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6869.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A071.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D37C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B198.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C658.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F48.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 584.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C89.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C86C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 243C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1539.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FACB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E395.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D24F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 395.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D59F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 219.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B234.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAEF.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3592 wrote to memory of 1996 3592 2024-09-02_9a78f6b516909bfbc658d17ec3355f9e_mafia.exe 84 PID 3592 wrote to memory of 1996 3592 2024-09-02_9a78f6b516909bfbc658d17ec3355f9e_mafia.exe 84 PID 3592 wrote to memory of 1996 3592 2024-09-02_9a78f6b516909bfbc658d17ec3355f9e_mafia.exe 84 PID 1996 wrote to memory of 1416 1996 C5B1.tmp 86 PID 1996 wrote to memory of 1416 1996 C5B1.tmp 86 PID 1996 wrote to memory of 1416 1996 C5B1.tmp 86 PID 1416 wrote to memory of 2000 1416 C61F.tmp 87 PID 1416 wrote to memory of 2000 1416 C61F.tmp 87 PID 1416 wrote to memory of 2000 1416 C61F.tmp 87 PID 2000 wrote to memory of 2628 2000 C67C.tmp 89 PID 2000 wrote to memory of 2628 2000 C67C.tmp 89 PID 2000 wrote to memory of 2628 2000 C67C.tmp 89 PID 2628 wrote to memory of 1468 2628 C709.tmp 90 PID 2628 wrote to memory of 1468 2628 C709.tmp 90 PID 2628 wrote to memory of 1468 2628 C709.tmp 90 PID 1468 wrote to memory of 3200 1468 C767.tmp 91 PID 1468 wrote to memory of 3200 1468 C767.tmp 91 PID 1468 wrote to memory of 3200 1468 C767.tmp 91 PID 3200 wrote to memory of 540 3200 C7D4.tmp 92 PID 3200 wrote to memory of 540 3200 C7D4.tmp 92 PID 3200 wrote to memory of 540 3200 C7D4.tmp 92 PID 540 wrote to memory of 5048 540 C832.tmp 93 PID 540 wrote to memory of 5048 540 C832.tmp 93 PID 540 wrote to memory of 5048 540 C832.tmp 93 PID 5048 wrote to memory of 1052 5048 C890.tmp 94 PID 5048 wrote to memory of 1052 5048 C890.tmp 94 PID 5048 wrote to memory of 1052 5048 C890.tmp 94 PID 1052 wrote to memory of 2072 1052 C8ED.tmp 95 PID 1052 wrote to memory of 2072 1052 C8ED.tmp 95 PID 1052 wrote to memory of 2072 1052 C8ED.tmp 95 PID 2072 wrote to memory of 3460 2072 C95B.tmp 96 PID 2072 wrote to memory of 3460 2072 C95B.tmp 96 PID 2072 wrote to memory of 3460 2072 C95B.tmp 96 PID 3460 wrote to memory of 1428 3460 C9B8.tmp 97 PID 3460 wrote to memory of 1428 3460 C9B8.tmp 97 PID 3460 wrote to memory of 1428 3460 C9B8.tmp 97 PID 1428 wrote to memory of 2672 1428 CA16.tmp 98 PID 1428 wrote to memory of 2672 1428 CA16.tmp 98 PID 1428 wrote to memory of 2672 1428 CA16.tmp 98 PID 2672 wrote to memory of 3564 2672 CA64.tmp 99 PID 2672 wrote to memory of 3564 2672 CA64.tmp 99 PID 2672 wrote to memory of 3564 2672 CA64.tmp 99 PID 3564 wrote to memory of 3436 3564 CAB2.tmp 100 PID 3564 wrote to memory of 3436 3564 CAB2.tmp 100 PID 3564 wrote to memory of 3436 3564 CAB2.tmp 100 PID 3436 wrote to memory of 2640 3436 CB20.tmp 101 PID 3436 wrote to memory of 2640 3436 CB20.tmp 101 PID 3436 wrote to memory of 2640 3436 CB20.tmp 101 PID 2640 wrote to memory of 3696 2640 CB6E.tmp 102 PID 2640 wrote to memory of 3696 2640 CB6E.tmp 102 PID 2640 wrote to memory of 3696 2640 CB6E.tmp 102 PID 3696 wrote to memory of 4664 3696 CBDB.tmp 104 PID 3696 wrote to memory of 4664 3696 CBDB.tmp 104 PID 3696 wrote to memory of 4664 3696 CBDB.tmp 104 PID 4664 wrote to memory of 2460 4664 CC39.tmp 105 PID 4664 wrote to memory of 2460 4664 CC39.tmp 105 PID 4664 wrote to memory of 2460 4664 CC39.tmp 105 PID 2460 wrote to memory of 756 2460 CC87.tmp 106 PID 2460 wrote to memory of 756 2460 CC87.tmp 106 PID 2460 wrote to memory of 756 2460 CC87.tmp 106 PID 756 wrote to memory of 4464 756 CCE5.tmp 107 PID 756 wrote to memory of 4464 756 CCE5.tmp 107 PID 756 wrote to memory of 4464 756 CCE5.tmp 107 PID 4464 wrote to memory of 1100 4464 CD43.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-02_9a78f6b516909bfbc658d17ec3355f9e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-02_9a78f6b516909bfbc658d17ec3355f9e_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\C5B1.tmp"C:\Users\Admin\AppData\Local\Temp\C5B1.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\C61F.tmp"C:\Users\Admin\AppData\Local\Temp\C61F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\C67C.tmp"C:\Users\Admin\AppData\Local\Temp\C67C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\C709.tmp"C:\Users\Admin\AppData\Local\Temp\C709.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\C767.tmp"C:\Users\Admin\AppData\Local\Temp\C767.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\C7D4.tmp"C:\Users\Admin\AppData\Local\Temp\C7D4.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\C832.tmp"C:\Users\Admin\AppData\Local\Temp\C832.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\AppData\Local\Temp\C890.tmp"C:\Users\Admin\AppData\Local\Temp\C890.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\C8ED.tmp"C:\Users\Admin\AppData\Local\Temp\C8ED.tmp"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\C95B.tmp"C:\Users\Admin\AppData\Local\Temp\C95B.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\C9B8.tmp"C:\Users\Admin\AppData\Local\Temp\C9B8.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\CA16.tmp"C:\Users\Admin\AppData\Local\Temp\CA16.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\CA64.tmp"C:\Users\Admin\AppData\Local\Temp\CA64.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\CAB2.tmp"C:\Users\Admin\AppData\Local\Temp\CAB2.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\CB20.tmp"C:\Users\Admin\AppData\Local\Temp\CB20.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\CB6E.tmp"C:\Users\Admin\AppData\Local\Temp\CB6E.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\CBDB.tmp"C:\Users\Admin\AppData\Local\Temp\CBDB.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\CC39.tmp"C:\Users\Admin\AppData\Local\Temp\CC39.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\CC87.tmp"C:\Users\Admin\AppData\Local\Temp\CC87.tmp"20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\CCE5.tmp"C:\Users\Admin\AppData\Local\Temp\CCE5.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\CD43.tmp"C:\Users\Admin\AppData\Local\Temp\CD43.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\CD91.tmp"C:\Users\Admin\AppData\Local\Temp\CD91.tmp"23⤵
- Executes dropped EXE
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\CDDF.tmp"C:\Users\Admin\AppData\Local\Temp\CDDF.tmp"24⤵
- Executes dropped EXE
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\CE2D.tmp"C:\Users\Admin\AppData\Local\Temp\CE2D.tmp"25⤵
- Executes dropped EXE
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\CE8B.tmp"C:\Users\Admin\AppData\Local\Temp\CE8B.tmp"26⤵
- Executes dropped EXE
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\CEF8.tmp"C:\Users\Admin\AppData\Local\Temp\CEF8.tmp"27⤵
- Executes dropped EXE
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\CF46.tmp"C:\Users\Admin\AppData\Local\Temp\CF46.tmp"28⤵
- Executes dropped EXE
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\CFA4.tmp"C:\Users\Admin\AppData\Local\Temp\CFA4.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:960 -
C:\Users\Admin\AppData\Local\Temp\CFF2.tmp"C:\Users\Admin\AppData\Local\Temp\CFF2.tmp"30⤵
- Executes dropped EXE
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\D07F.tmp"C:\Users\Admin\AppData\Local\Temp\D07F.tmp"31⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\D0DD.tmp"C:\Users\Admin\AppData\Local\Temp\D0DD.tmp"32⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\D13A.tmp"C:\Users\Admin\AppData\Local\Temp\D13A.tmp"33⤵
- Executes dropped EXE
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\D198.tmp"C:\Users\Admin\AppData\Local\Temp\D198.tmp"34⤵
- Executes dropped EXE
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\D1E6.tmp"C:\Users\Admin\AppData\Local\Temp\D1E6.tmp"35⤵
- Executes dropped EXE
PID:688 -
C:\Users\Admin\AppData\Local\Temp\D234.tmp"C:\Users\Admin\AppData\Local\Temp\D234.tmp"36⤵
- Executes dropped EXE
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\D282.tmp"C:\Users\Admin\AppData\Local\Temp\D282.tmp"37⤵
- Executes dropped EXE
PID:640 -
C:\Users\Admin\AppData\Local\Temp\D2C1.tmp"C:\Users\Admin\AppData\Local\Temp\D2C1.tmp"38⤵
- Executes dropped EXE
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\D30F.tmp"C:\Users\Admin\AppData\Local\Temp\D30F.tmp"39⤵
- Executes dropped EXE
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\D37C.tmp"C:\Users\Admin\AppData\Local\Temp\D37C.tmp"40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\D3F9.tmp"C:\Users\Admin\AppData\Local\Temp\D3F9.tmp"41⤵
- Executes dropped EXE
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\D467.tmp"C:\Users\Admin\AppData\Local\Temp\D467.tmp"42⤵
- Executes dropped EXE
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\D4D4.tmp"C:\Users\Admin\AppData\Local\Temp\D4D4.tmp"43⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\D542.tmp"C:\Users\Admin\AppData\Local\Temp\D542.tmp"44⤵
- Executes dropped EXE
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\D59F.tmp"C:\Users\Admin\AppData\Local\Temp\D59F.tmp"45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\D60D.tmp"C:\Users\Admin\AppData\Local\Temp\D60D.tmp"46⤵
- Executes dropped EXE
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\D699.tmp"C:\Users\Admin\AppData\Local\Temp\D699.tmp"47⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\D6F7.tmp"C:\Users\Admin\AppData\Local\Temp\D6F7.tmp"48⤵
- Executes dropped EXE
PID:264 -
C:\Users\Admin\AppData\Local\Temp\D745.tmp"C:\Users\Admin\AppData\Local\Temp\D745.tmp"49⤵
- Executes dropped EXE
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\D7A3.tmp"C:\Users\Admin\AppData\Local\Temp\D7A3.tmp"50⤵
- Executes dropped EXE
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\D801.tmp"C:\Users\Admin\AppData\Local\Temp\D801.tmp"51⤵
- Executes dropped EXE
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\D87E.tmp"C:\Users\Admin\AppData\Local\Temp\D87E.tmp"52⤵
- Executes dropped EXE
PID:336 -
C:\Users\Admin\AppData\Local\Temp\D8DB.tmp"C:\Users\Admin\AppData\Local\Temp\D8DB.tmp"53⤵
- Executes dropped EXE
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\D91A.tmp"C:\Users\Admin\AppData\Local\Temp\D91A.tmp"54⤵
- Executes dropped EXE
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\D968.tmp"C:\Users\Admin\AppData\Local\Temp\D968.tmp"55⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\D9B6.tmp"C:\Users\Admin\AppData\Local\Temp\D9B6.tmp"56⤵
- Executes dropped EXE
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\DA04.tmp"C:\Users\Admin\AppData\Local\Temp\DA04.tmp"57⤵
- Executes dropped EXE
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\DA52.tmp"C:\Users\Admin\AppData\Local\Temp\DA52.tmp"58⤵
- Executes dropped EXE
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\DAA1.tmp"C:\Users\Admin\AppData\Local\Temp\DAA1.tmp"59⤵
- Executes dropped EXE
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\DAEF.tmp"C:\Users\Admin\AppData\Local\Temp\DAEF.tmp"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\DB3D.tmp"C:\Users\Admin\AppData\Local\Temp\DB3D.tmp"61⤵
- Executes dropped EXE
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\DB8B.tmp"C:\Users\Admin\AppData\Local\Temp\DB8B.tmp"62⤵
- Executes dropped EXE
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\DBE9.tmp"C:\Users\Admin\AppData\Local\Temp\DBE9.tmp"63⤵
- Executes dropped EXE
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\DC37.tmp"C:\Users\Admin\AppData\Local\Temp\DC37.tmp"64⤵
- Executes dropped EXE
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\DC95.tmp"C:\Users\Admin\AppData\Local\Temp\DC95.tmp"65⤵
- Executes dropped EXE
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\DCE3.tmp"C:\Users\Admin\AppData\Local\Temp\DCE3.tmp"66⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\DD31.tmp"C:\Users\Admin\AppData\Local\Temp\DD31.tmp"67⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\DD7F.tmp"C:\Users\Admin\AppData\Local\Temp\DD7F.tmp"68⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\DDCD.tmp"C:\Users\Admin\AppData\Local\Temp\DDCD.tmp"69⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\DE1B.tmp"C:\Users\Admin\AppData\Local\Temp\DE1B.tmp"70⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\DE69.tmp"C:\Users\Admin\AppData\Local\Temp\DE69.tmp"71⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\DEB7.tmp"C:\Users\Admin\AppData\Local\Temp\DEB7.tmp"72⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\DEF6.tmp"C:\Users\Admin\AppData\Local\Temp\DEF6.tmp"73⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\DF44.tmp"C:\Users\Admin\AppData\Local\Temp\DF44.tmp"74⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\DF92.tmp"C:\Users\Admin\AppData\Local\Temp\DF92.tmp"75⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\DFE0.tmp"C:\Users\Admin\AppData\Local\Temp\DFE0.tmp"76⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\E02E.tmp"C:\Users\Admin\AppData\Local\Temp\E02E.tmp"77⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\E06D.tmp"C:\Users\Admin\AppData\Local\Temp\E06D.tmp"78⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\E0BB.tmp"C:\Users\Admin\AppData\Local\Temp\E0BB.tmp"79⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\E109.tmp"C:\Users\Admin\AppData\Local\Temp\E109.tmp"80⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\E167.tmp"C:\Users\Admin\AppData\Local\Temp\E167.tmp"81⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\E1B5.tmp"C:\Users\Admin\AppData\Local\Temp\E1B5.tmp"82⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\E203.tmp"C:\Users\Admin\AppData\Local\Temp\E203.tmp"83⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\E251.tmp"C:\Users\Admin\AppData\Local\Temp\E251.tmp"84⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\E29F.tmp"C:\Users\Admin\AppData\Local\Temp\E29F.tmp"85⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\E2EE.tmp"C:\Users\Admin\AppData\Local\Temp\E2EE.tmp"86⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\E33C.tmp"C:\Users\Admin\AppData\Local\Temp\E33C.tmp"87⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\E38A.tmp"C:\Users\Admin\AppData\Local\Temp\E38A.tmp"88⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\E3C8.tmp"C:\Users\Admin\AppData\Local\Temp\E3C8.tmp"89⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\E416.tmp"C:\Users\Admin\AppData\Local\Temp\E416.tmp"90⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\E465.tmp"C:\Users\Admin\AppData\Local\Temp\E465.tmp"91⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\E4B3.tmp"C:\Users\Admin\AppData\Local\Temp\E4B3.tmp"92⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\E501.tmp"C:\Users\Admin\AppData\Local\Temp\E501.tmp"93⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\E54F.tmp"C:\Users\Admin\AppData\Local\Temp\E54F.tmp"94⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\E59D.tmp"C:\Users\Admin\AppData\Local\Temp\E59D.tmp"95⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\E5EB.tmp"C:\Users\Admin\AppData\Local\Temp\E5EB.tmp"96⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\E649.tmp"C:\Users\Admin\AppData\Local\Temp\E649.tmp"97⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\E697.tmp"C:\Users\Admin\AppData\Local\Temp\E697.tmp"98⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\E6E5.tmp"C:\Users\Admin\AppData\Local\Temp\E6E5.tmp"99⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\E743.tmp"C:\Users\Admin\AppData\Local\Temp\E743.tmp"100⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\E791.tmp"C:\Users\Admin\AppData\Local\Temp\E791.tmp"101⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\E7D0.tmp"C:\Users\Admin\AppData\Local\Temp\E7D0.tmp"102⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\E81E.tmp"C:\Users\Admin\AppData\Local\Temp\E81E.tmp"103⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\E87B.tmp"C:\Users\Admin\AppData\Local\Temp\E87B.tmp"104⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\E8CA.tmp"C:\Users\Admin\AppData\Local\Temp\E8CA.tmp"105⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\E918.tmp"C:\Users\Admin\AppData\Local\Temp\E918.tmp"106⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\E966.tmp"C:\Users\Admin\AppData\Local\Temp\E966.tmp"107⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\E9C4.tmp"C:\Users\Admin\AppData\Local\Temp\E9C4.tmp"108⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\EA12.tmp"C:\Users\Admin\AppData\Local\Temp\EA12.tmp"109⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\EA60.tmp"C:\Users\Admin\AppData\Local\Temp\EA60.tmp"110⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\EAAE.tmp"C:\Users\Admin\AppData\Local\Temp\EAAE.tmp"111⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\EAEC.tmp"C:\Users\Admin\AppData\Local\Temp\EAEC.tmp"112⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\EB3B.tmp"C:\Users\Admin\AppData\Local\Temp\EB3B.tmp"113⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\EB89.tmp"C:\Users\Admin\AppData\Local\Temp\EB89.tmp"114⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\EBD7.tmp"C:\Users\Admin\AppData\Local\Temp\EBD7.tmp"115⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\EC25.tmp"C:\Users\Admin\AppData\Local\Temp\EC25.tmp"116⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\EC73.tmp"C:\Users\Admin\AppData\Local\Temp\EC73.tmp"117⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\ECC1.tmp"C:\Users\Admin\AppData\Local\Temp\ECC1.tmp"118⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\ED1F.tmp"C:\Users\Admin\AppData\Local\Temp\ED1F.tmp"119⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\ED6D.tmp"C:\Users\Admin\AppData\Local\Temp\ED6D.tmp"120⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"121⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\EE09.tmp"C:\Users\Admin\AppData\Local\Temp\EE09.tmp"122⤵PID:4028
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-