Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/09/2024, 06:37
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-02_8a1e70d3b70164431b7ff3a40cb22c26_mafia.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-09-02_8a1e70d3b70164431b7ff3a40cb22c26_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-02_8a1e70d3b70164431b7ff3a40cb22c26_mafia.exe
-
Size
486KB
-
MD5
8a1e70d3b70164431b7ff3a40cb22c26
-
SHA1
765849a25d3a59479c9b6451b5e9e872f43a394f
-
SHA256
f774ee1e4f67110c3e3ee294ca8a675df190f62736a2258ba2d593143b08eea9
-
SHA512
7c718737b53410aab14d5070743fee858071f42fa28199213ef9814bcd925a630d0257161a063773966f4f916960bdcc53e0f26318c86a042d18d2d79b4891e8
-
SSDEEP
12288:/U5rCOTeiDUEsz7Pf/oF/AsRhhSQosq8v25NZ:/UQOJDGz7P4F/xtSMq8SN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 748 A613.tmp 4960 A681.tmp 1452 A6DF.tmp 652 A75C.tmp 4256 A7D9.tmp 376 A836.tmp 2096 A884.tmp 2572 A8E2.tmp 512 A950.tmp 2968 A9BD.tmp 4124 AA0B.tmp 1464 AA78.tmp 552 AAE6.tmp 2392 AB63.tmp 3132 ABD0.tmp 1036 AC2E.tmp 1720 ACAB.tmp 3552 AD28.tmp 3980 AD76.tmp 1716 ADE3.tmp 4008 AE41.tmp 3456 AEBE.tmp 3252 AF3B.tmp 3900 AF99.tmp 432 B006.tmp 2372 B054.tmp 2432 B0D1.tmp 1196 B120.tmp 1020 B16E.tmp 4468 B1CB.tmp 1456 B229.tmp 2252 B297.tmp 2700 B314.tmp 3836 B362.tmp 3416 B3B0.tmp 5004 B40E.tmp 4940 B45C.tmp 3884 B4C9.tmp 4496 B517.tmp 2412 B575.tmp 3176 B5D3.tmp 4744 B630.tmp 3000 B68E.tmp 3168 B6EC.tmp 748 B74A.tmp 4960 B7A7.tmp 1236 B805.tmp 1044 B863.tmp 3576 B8C1.tmp 3192 B91E.tmp 2872 B97C.tmp 4464 B9DA.tmp 4344 BA38.tmp 1896 BA95.tmp 5032 BAF3.tmp 2608 BB41.tmp 2704 BB9F.tmp 400 BBED.tmp 1328 BC3B.tmp 5096 BC89.tmp 4576 BCE7.tmp 2848 BD35.tmp 4124 BD93.tmp 1464 BDF1.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FE7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2546.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C772.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB36.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F136.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 657B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E2AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E2CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2798.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5FCE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E51B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D87E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B863.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FF7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 538A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B006.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A572.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3200 wrote to memory of 748 3200 2024-09-02_8a1e70d3b70164431b7ff3a40cb22c26_mafia.exe 83 PID 3200 wrote to memory of 748 3200 2024-09-02_8a1e70d3b70164431b7ff3a40cb22c26_mafia.exe 83 PID 3200 wrote to memory of 748 3200 2024-09-02_8a1e70d3b70164431b7ff3a40cb22c26_mafia.exe 83 PID 748 wrote to memory of 4960 748 A613.tmp 85 PID 748 wrote to memory of 4960 748 A613.tmp 85 PID 748 wrote to memory of 4960 748 A613.tmp 85 PID 4960 wrote to memory of 1452 4960 A681.tmp 87 PID 4960 wrote to memory of 1452 4960 A681.tmp 87 PID 4960 wrote to memory of 1452 4960 A681.tmp 87 PID 1452 wrote to memory of 652 1452 A6DF.tmp 88 PID 1452 wrote to memory of 652 1452 A6DF.tmp 88 PID 1452 wrote to memory of 652 1452 A6DF.tmp 88 PID 652 wrote to memory of 4256 652 A75C.tmp 90 PID 652 wrote to memory of 4256 652 A75C.tmp 90 PID 652 wrote to memory of 4256 652 A75C.tmp 90 PID 4256 wrote to memory of 376 4256 A7D9.tmp 91 PID 4256 wrote to memory of 376 4256 A7D9.tmp 91 PID 4256 wrote to memory of 376 4256 A7D9.tmp 91 PID 376 wrote to memory of 2096 376 A836.tmp 92 PID 376 wrote to memory of 2096 376 A836.tmp 92 PID 376 wrote to memory of 2096 376 A836.tmp 92 PID 2096 wrote to memory of 2572 2096 A884.tmp 93 PID 2096 wrote to memory of 2572 2096 A884.tmp 93 PID 2096 wrote to memory of 2572 2096 A884.tmp 93 PID 2572 wrote to memory of 512 2572 A8E2.tmp 94 PID 2572 wrote to memory of 512 2572 A8E2.tmp 94 PID 2572 wrote to memory of 512 2572 A8E2.tmp 94 PID 512 wrote to memory of 2968 512 A950.tmp 95 PID 512 wrote to memory of 2968 512 A950.tmp 95 PID 512 wrote to memory of 2968 512 A950.tmp 95 PID 2968 wrote to memory of 4124 2968 A9BD.tmp 96 PID 2968 wrote to memory of 4124 2968 A9BD.tmp 96 PID 2968 wrote to memory of 4124 2968 A9BD.tmp 96 PID 4124 wrote to memory of 1464 4124 AA0B.tmp 97 PID 4124 wrote to memory of 1464 4124 AA0B.tmp 97 PID 4124 wrote to memory of 1464 4124 AA0B.tmp 97 PID 1464 wrote to memory of 552 1464 AA78.tmp 98 PID 1464 wrote to memory of 552 1464 AA78.tmp 98 PID 1464 wrote to memory of 552 1464 AA78.tmp 98 PID 552 wrote to memory of 2392 552 AAE6.tmp 99 PID 552 wrote to memory of 2392 552 AAE6.tmp 99 PID 552 wrote to memory of 2392 552 AAE6.tmp 99 PID 2392 wrote to memory of 3132 2392 AB63.tmp 100 PID 2392 wrote to memory of 3132 2392 AB63.tmp 100 PID 2392 wrote to memory of 3132 2392 AB63.tmp 100 PID 3132 wrote to memory of 1036 3132 ABD0.tmp 101 PID 3132 wrote to memory of 1036 3132 ABD0.tmp 101 PID 3132 wrote to memory of 1036 3132 ABD0.tmp 101 PID 1036 wrote to memory of 1720 1036 AC2E.tmp 102 PID 1036 wrote to memory of 1720 1036 AC2E.tmp 102 PID 1036 wrote to memory of 1720 1036 AC2E.tmp 102 PID 1720 wrote to memory of 3552 1720 ACAB.tmp 103 PID 1720 wrote to memory of 3552 1720 ACAB.tmp 103 PID 1720 wrote to memory of 3552 1720 ACAB.tmp 103 PID 3552 wrote to memory of 3980 3552 AD28.tmp 104 PID 3552 wrote to memory of 3980 3552 AD28.tmp 104 PID 3552 wrote to memory of 3980 3552 AD28.tmp 104 PID 3980 wrote to memory of 1716 3980 AD76.tmp 105 PID 3980 wrote to memory of 1716 3980 AD76.tmp 105 PID 3980 wrote to memory of 1716 3980 AD76.tmp 105 PID 1716 wrote to memory of 4008 1716 ADE3.tmp 106 PID 1716 wrote to memory of 4008 1716 ADE3.tmp 106 PID 1716 wrote to memory of 4008 1716 ADE3.tmp 106 PID 4008 wrote to memory of 3456 4008 AE41.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-02_8a1e70d3b70164431b7ff3a40cb22c26_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-02_8a1e70d3b70164431b7ff3a40cb22c26_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\A613.tmp"C:\Users\Admin\AppData\Local\Temp\A613.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Local\Temp\A681.tmp"C:\Users\Admin\AppData\Local\Temp\A681.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\A75C.tmp"C:\Users\Admin\AppData\Local\Temp\A75C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\A836.tmp"C:\Users\Admin\AppData\Local\Temp\A836.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Users\Admin\AppData\Local\Temp\A884.tmp"C:\Users\Admin\AppData\Local\Temp\A884.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\A950.tmp"C:\Users\Admin\AppData\Local\Temp\A950.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:512 -
C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\AA78.tmp"C:\Users\Admin\AppData\Local\Temp\AA78.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\AB63.tmp"C:\Users\Admin\AppData\Local\Temp\AB63.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\AD28.tmp"C:\Users\Admin\AppData\Local\Temp\AD28.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\AD76.tmp"C:\Users\Admin\AppData\Local\Temp\AD76.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\AE41.tmp"C:\Users\Admin\AppData\Local\Temp\AE41.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"23⤵
- Executes dropped EXE
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"24⤵
- Executes dropped EXE
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\AF99.tmp"C:\Users\Admin\AppData\Local\Temp\AF99.tmp"25⤵
- Executes dropped EXE
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\B006.tmp"C:\Users\Admin\AppData\Local\Temp\B006.tmp"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:432 -
C:\Users\Admin\AppData\Local\Temp\B054.tmp"C:\Users\Admin\AppData\Local\Temp\B054.tmp"27⤵
- Executes dropped EXE
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"28⤵
- Executes dropped EXE
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\B120.tmp"C:\Users\Admin\AppData\Local\Temp\B120.tmp"29⤵
- Executes dropped EXE
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\B16E.tmp"C:\Users\Admin\AppData\Local\Temp\B16E.tmp"30⤵
- Executes dropped EXE
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"31⤵
- Executes dropped EXE
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\B229.tmp"C:\Users\Admin\AppData\Local\Temp\B229.tmp"32⤵
- Executes dropped EXE
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\B297.tmp"C:\Users\Admin\AppData\Local\Temp\B297.tmp"33⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\B314.tmp"C:\Users\Admin\AppData\Local\Temp\B314.tmp"34⤵
- Executes dropped EXE
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\B362.tmp"C:\Users\Admin\AppData\Local\Temp\B362.tmp"35⤵
- Executes dropped EXE
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"36⤵
- Executes dropped EXE
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\B40E.tmp"C:\Users\Admin\AppData\Local\Temp\B40E.tmp"37⤵
- Executes dropped EXE
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\B45C.tmp"C:\Users\Admin\AppData\Local\Temp\B45C.tmp"38⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\B4C9.tmp"C:\Users\Admin\AppData\Local\Temp\B4C9.tmp"39⤵
- Executes dropped EXE
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\B517.tmp"C:\Users\Admin\AppData\Local\Temp\B517.tmp"40⤵
- Executes dropped EXE
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\B575.tmp"C:\Users\Admin\AppData\Local\Temp\B575.tmp"41⤵
- Executes dropped EXE
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\B5D3.tmp"C:\Users\Admin\AppData\Local\Temp\B5D3.tmp"42⤵
- Executes dropped EXE
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\B630.tmp"C:\Users\Admin\AppData\Local\Temp\B630.tmp"43⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\B68E.tmp"C:\Users\Admin\AppData\Local\Temp\B68E.tmp"44⤵
- Executes dropped EXE
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"45⤵
- Executes dropped EXE
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\B74A.tmp"C:\Users\Admin\AppData\Local\Temp\B74A.tmp"46⤵
- Executes dropped EXE
PID:748 -
C:\Users\Admin\AppData\Local\Temp\B7A7.tmp"C:\Users\Admin\AppData\Local\Temp\B7A7.tmp"47⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\B805.tmp"C:\Users\Admin\AppData\Local\Temp\B805.tmp"48⤵
- Executes dropped EXE
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\B863.tmp"C:\Users\Admin\AppData\Local\Temp\B863.tmp"49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"50⤵
- Executes dropped EXE
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\B91E.tmp"C:\Users\Admin\AppData\Local\Temp\B91E.tmp"51⤵
- Executes dropped EXE
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\B97C.tmp"C:\Users\Admin\AppData\Local\Temp\B97C.tmp"52⤵
- Executes dropped EXE
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"53⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\BA38.tmp"C:\Users\Admin\AppData\Local\Temp\BA38.tmp"54⤵
- Executes dropped EXE
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\BA95.tmp"C:\Users\Admin\AppData\Local\Temp\BA95.tmp"55⤵
- Executes dropped EXE
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\BAF3.tmp"C:\Users\Admin\AppData\Local\Temp\BAF3.tmp"56⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\BB41.tmp"C:\Users\Admin\AppData\Local\Temp\BB41.tmp"57⤵
- Executes dropped EXE
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"58⤵
- Executes dropped EXE
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\BBED.tmp"C:\Users\Admin\AppData\Local\Temp\BBED.tmp"59⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"60⤵
- Executes dropped EXE
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\BC89.tmp"C:\Users\Admin\AppData\Local\Temp\BC89.tmp"61⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"62⤵
- Executes dropped EXE
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\BD35.tmp"C:\Users\Admin\AppData\Local\Temp\BD35.tmp"63⤵
- Executes dropped EXE
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\BD93.tmp"C:\Users\Admin\AppData\Local\Temp\BD93.tmp"64⤵
- Executes dropped EXE
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\BDF1.tmp"C:\Users\Admin\AppData\Local\Temp\BDF1.tmp"65⤵
- Executes dropped EXE
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"66⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"67⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"68⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\BF58.tmp"C:\Users\Admin\AppData\Local\Temp\BF58.tmp"69⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\BFB6.tmp"C:\Users\Admin\AppData\Local\Temp\BFB6.tmp"70⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\C014.tmp"C:\Users\Admin\AppData\Local\Temp\C014.tmp"71⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\C071.tmp"C:\Users\Admin\AppData\Local\Temp\C071.tmp"72⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"73⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\C11D.tmp"C:\Users\Admin\AppData\Local\Temp\C11D.tmp"74⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\C17B.tmp"C:\Users\Admin\AppData\Local\Temp\C17B.tmp"75⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"76⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\C237.tmp"C:\Users\Admin\AppData\Local\Temp\C237.tmp"77⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\C294.tmp"C:\Users\Admin\AppData\Local\Temp\C294.tmp"78⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"79⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\C350.tmp"C:\Users\Admin\AppData\Local\Temp\C350.tmp"80⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\C3AE.tmp"C:\Users\Admin\AppData\Local\Temp\C3AE.tmp"81⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\C40B.tmp"C:\Users\Admin\AppData\Local\Temp\C40B.tmp"82⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\C469.tmp"C:\Users\Admin\AppData\Local\Temp\C469.tmp"83⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\C4C7.tmp"C:\Users\Admin\AppData\Local\Temp\C4C7.tmp"84⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\C525.tmp"C:\Users\Admin\AppData\Local\Temp\C525.tmp"85⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\C582.tmp"C:\Users\Admin\AppData\Local\Temp\C582.tmp"86⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\C5E0.tmp"C:\Users\Admin\AppData\Local\Temp\C5E0.tmp"87⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\C63E.tmp"C:\Users\Admin\AppData\Local\Temp\C63E.tmp"88⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\C69C.tmp"C:\Users\Admin\AppData\Local\Temp\C69C.tmp"89⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\C6F9.tmp"C:\Users\Admin\AppData\Local\Temp\C6F9.tmp"90⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\C757.tmp"C:\Users\Admin\AppData\Local\Temp\C757.tmp"91⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\C7B5.tmp"C:\Users\Admin\AppData\Local\Temp\C7B5.tmp"92⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\C813.tmp"C:\Users\Admin\AppData\Local\Temp\C813.tmp"93⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\C870.tmp"C:\Users\Admin\AppData\Local\Temp\C870.tmp"94⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\C8CE.tmp"C:\Users\Admin\AppData\Local\Temp\C8CE.tmp"95⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\C92C.tmp"C:\Users\Admin\AppData\Local\Temp\C92C.tmp"96⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\C98A.tmp"C:\Users\Admin\AppData\Local\Temp\C98A.tmp"97⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"98⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\CA45.tmp"C:\Users\Admin\AppData\Local\Temp\CA45.tmp"99⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\CA93.tmp"C:\Users\Admin\AppData\Local\Temp\CA93.tmp"100⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\CAE1.tmp"C:\Users\Admin\AppData\Local\Temp\CAE1.tmp"101⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\CB2F.tmp"C:\Users\Admin\AppData\Local\Temp\CB2F.tmp"102⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\CB8D.tmp"C:\Users\Admin\AppData\Local\Temp\CB8D.tmp"103⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\CBEB.tmp"C:\Users\Admin\AppData\Local\Temp\CBEB.tmp"104⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\CC49.tmp"C:\Users\Admin\AppData\Local\Temp\CC49.tmp"105⤵
- System Location Discovery: System Language Discovery
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\CC97.tmp"C:\Users\Admin\AppData\Local\Temp\CC97.tmp"106⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\CCF5.tmp"C:\Users\Admin\AppData\Local\Temp\CCF5.tmp"107⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\CD43.tmp"C:\Users\Admin\AppData\Local\Temp\CD43.tmp"108⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\CD91.tmp"C:\Users\Admin\AppData\Local\Temp\CD91.tmp"109⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\CDEF.tmp"C:\Users\Admin\AppData\Local\Temp\CDEF.tmp"110⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\CE3D.tmp"C:\Users\Admin\AppData\Local\Temp\CE3D.tmp"111⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\CE8B.tmp"C:\Users\Admin\AppData\Local\Temp\CE8B.tmp"112⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\CED9.tmp"C:\Users\Admin\AppData\Local\Temp\CED9.tmp"113⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\CF27.tmp"C:\Users\Admin\AppData\Local\Temp\CF27.tmp"114⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\CF75.tmp"C:\Users\Admin\AppData\Local\Temp\CF75.tmp"115⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\CFC3.tmp"C:\Users\Admin\AppData\Local\Temp\CFC3.tmp"116⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\D011.tmp"C:\Users\Admin\AppData\Local\Temp\D011.tmp"117⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\D060.tmp"C:\Users\Admin\AppData\Local\Temp\D060.tmp"118⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"119⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\D0FC.tmp"C:\Users\Admin\AppData\Local\Temp\D0FC.tmp"120⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\D14A.tmp"C:\Users\Admin\AppData\Local\Temp\D14A.tmp"121⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\D198.tmp"C:\Users\Admin\AppData\Local\Temp\D198.tmp"122⤵PID:2620
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-