Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08/09/2024, 03:23
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-08_f8dde080f212ba8bca4255c7d0aa56af_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-08_f8dde080f212ba8bca4255c7d0aa56af_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-08_f8dde080f212ba8bca4255c7d0aa56af_mafia.exe
-
Size
527KB
-
MD5
f8dde080f212ba8bca4255c7d0aa56af
-
SHA1
ee05047f89553bb7db4d563642a81d8acf983cdb
-
SHA256
7b51b9d3446aee657da73852b3ce922040e7c5fdde92062a0b915be7bb60108d
-
SHA512
a32fbf3c270f291d3338d2000b4964bbeae8e2a8b64f5033877bb29d10a837b00c307945d9b6ae7520bdeb36d9c0185b45616d92ca104b1f24207d769a5d10d3
-
SSDEEP
6144:yorf3lPvovsgZnqG2C7mOTeiLRDYsFM61cpt0a6F/gvhD7gBXMURqtp0yzGvNgs0:fU5rCOTeidLmQM2azmRq+vNpDZu
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 5168 C5A3.tmp 1512 C62F.tmp 5408 C69D.tmp 3900 C71A.tmp 5536 C797.tmp 5680 C804.tmp 4684 C871.tmp 5584 C8CF.tmp 2408 C92D.tmp 5184 C9AA.tmp 4888 CA08.tmp 2632 CA75.tmp 6100 CB02.tmp 5864 CB5F.tmp 5924 CBDC.tmp 5960 CC3A.tmp 6008 CC98.tmp 5888 CCE6.tmp 5868 CD34.tmp 5840 CD92.tmp 5516 CDE0.tmp 1548 CE6D.tmp 844 CECA.tmp 3600 CF28.tmp 2012 CFA5.tmp 2668 D022.tmp 1720 D080.tmp 4004 D0DE.tmp 1812 D15B.tmp 3804 D1D8.tmp 2660 D235.tmp 5292 D2B2.tmp 1364 D310.tmp 1568 D36E.tmp 4752 D3CC.tmp 5452 D439.tmp 436 D487.tmp 5260 D4D5.tmp 760 D523.tmp 3040 D572.tmp 1420 D5CF.tmp 5432 D62D.tmp 1320 D68B.tmp 2688 D6E9.tmp 3676 D737.tmp 388 D785.tmp 836 D7D3.tmp 4288 D831.tmp 5000 D87F.tmp 4296 D8EC.tmp 1900 D94A.tmp 688 D998.tmp 2932 D9E6.tmp 1048 DA34.tmp 4804 DA82.tmp 5288 DAD1.tmp 5356 DB1F.tmp 4504 DB7C.tmp 1116 DBDA.tmp 4884 DC28.tmp 1532 DC86.tmp 5236 DCE4.tmp 5704 DD32.tmp 1740 DD80.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F686.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B736.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 219E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F04.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 967F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F086.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEB6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1634.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C773.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E512.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 440A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A94C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D0A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9372.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2651.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B041.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F132.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 755B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBD.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3556 wrote to memory of 5168 3556 2024-09-08_f8dde080f212ba8bca4255c7d0aa56af_mafia.exe 86 PID 3556 wrote to memory of 5168 3556 2024-09-08_f8dde080f212ba8bca4255c7d0aa56af_mafia.exe 86 PID 3556 wrote to memory of 5168 3556 2024-09-08_f8dde080f212ba8bca4255c7d0aa56af_mafia.exe 86 PID 5168 wrote to memory of 1512 5168 C5A3.tmp 87 PID 5168 wrote to memory of 1512 5168 C5A3.tmp 87 PID 5168 wrote to memory of 1512 5168 C5A3.tmp 87 PID 1512 wrote to memory of 5408 1512 C62F.tmp 88 PID 1512 wrote to memory of 5408 1512 C62F.tmp 88 PID 1512 wrote to memory of 5408 1512 C62F.tmp 88 PID 5408 wrote to memory of 3900 5408 C69D.tmp 89 PID 5408 wrote to memory of 3900 5408 C69D.tmp 89 PID 5408 wrote to memory of 3900 5408 C69D.tmp 89 PID 3900 wrote to memory of 5536 3900 C71A.tmp 90 PID 3900 wrote to memory of 5536 3900 C71A.tmp 90 PID 3900 wrote to memory of 5536 3900 C71A.tmp 90 PID 5536 wrote to memory of 5680 5536 C797.tmp 91 PID 5536 wrote to memory of 5680 5536 C797.tmp 91 PID 5536 wrote to memory of 5680 5536 C797.tmp 91 PID 5680 wrote to memory of 4684 5680 C804.tmp 92 PID 5680 wrote to memory of 4684 5680 C804.tmp 92 PID 5680 wrote to memory of 4684 5680 C804.tmp 92 PID 4684 wrote to memory of 5584 4684 C871.tmp 93 PID 4684 wrote to memory of 5584 4684 C871.tmp 93 PID 4684 wrote to memory of 5584 4684 C871.tmp 93 PID 5584 wrote to memory of 2408 5584 C8CF.tmp 94 PID 5584 wrote to memory of 2408 5584 C8CF.tmp 94 PID 5584 wrote to memory of 2408 5584 C8CF.tmp 94 PID 2408 wrote to memory of 5184 2408 C92D.tmp 95 PID 2408 wrote to memory of 5184 2408 C92D.tmp 95 PID 2408 wrote to memory of 5184 2408 C92D.tmp 95 PID 5184 wrote to memory of 4888 5184 C9AA.tmp 96 PID 5184 wrote to memory of 4888 5184 C9AA.tmp 96 PID 5184 wrote to memory of 4888 5184 C9AA.tmp 96 PID 4888 wrote to memory of 2632 4888 CA08.tmp 97 PID 4888 wrote to memory of 2632 4888 CA08.tmp 97 PID 4888 wrote to memory of 2632 4888 CA08.tmp 97 PID 2632 wrote to memory of 6100 2632 CA75.tmp 98 PID 2632 wrote to memory of 6100 2632 CA75.tmp 98 PID 2632 wrote to memory of 6100 2632 CA75.tmp 98 PID 6100 wrote to memory of 5864 6100 CB02.tmp 99 PID 6100 wrote to memory of 5864 6100 CB02.tmp 99 PID 6100 wrote to memory of 5864 6100 CB02.tmp 99 PID 5864 wrote to memory of 5924 5864 CB5F.tmp 100 PID 5864 wrote to memory of 5924 5864 CB5F.tmp 100 PID 5864 wrote to memory of 5924 5864 CB5F.tmp 100 PID 5924 wrote to memory of 5960 5924 CBDC.tmp 101 PID 5924 wrote to memory of 5960 5924 CBDC.tmp 101 PID 5924 wrote to memory of 5960 5924 CBDC.tmp 101 PID 5960 wrote to memory of 6008 5960 CC3A.tmp 102 PID 5960 wrote to memory of 6008 5960 CC3A.tmp 102 PID 5960 wrote to memory of 6008 5960 CC3A.tmp 102 PID 6008 wrote to memory of 5888 6008 CC98.tmp 103 PID 6008 wrote to memory of 5888 6008 CC98.tmp 103 PID 6008 wrote to memory of 5888 6008 CC98.tmp 103 PID 5888 wrote to memory of 5868 5888 CCE6.tmp 104 PID 5888 wrote to memory of 5868 5888 CCE6.tmp 104 PID 5888 wrote to memory of 5868 5888 CCE6.tmp 104 PID 5868 wrote to memory of 5840 5868 CD34.tmp 105 PID 5868 wrote to memory of 5840 5868 CD34.tmp 105 PID 5868 wrote to memory of 5840 5868 CD34.tmp 105 PID 5840 wrote to memory of 5516 5840 CD92.tmp 106 PID 5840 wrote to memory of 5516 5840 CD92.tmp 106 PID 5840 wrote to memory of 5516 5840 CD92.tmp 106 PID 5516 wrote to memory of 1548 5516 CDE0.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-08_f8dde080f212ba8bca4255c7d0aa56af_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-08_f8dde080f212ba8bca4255c7d0aa56af_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\C5A3.tmp"C:\Users\Admin\AppData\Local\Temp\C5A3.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5168 -
C:\Users\Admin\AppData\Local\Temp\C62F.tmp"C:\Users\Admin\AppData\Local\Temp\C62F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\C69D.tmp"C:\Users\Admin\AppData\Local\Temp\C69D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Users\Admin\AppData\Local\Temp\C71A.tmp"C:\Users\Admin\AppData\Local\Temp\C71A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\C797.tmp"C:\Users\Admin\AppData\Local\Temp\C797.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5536 -
C:\Users\Admin\AppData\Local\Temp\C804.tmp"C:\Users\Admin\AppData\Local\Temp\C804.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5680 -
C:\Users\Admin\AppData\Local\Temp\C871.tmp"C:\Users\Admin\AppData\Local\Temp\C871.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\C8CF.tmp"C:\Users\Admin\AppData\Local\Temp\C8CF.tmp"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Users\Admin\AppData\Local\Temp\C92D.tmp"C:\Users\Admin\AppData\Local\Temp\C92D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\C9AA.tmp"C:\Users\Admin\AppData\Local\Temp\C9AA.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5184 -
C:\Users\Admin\AppData\Local\Temp\CA08.tmp"C:\Users\Admin\AppData\Local\Temp\CA08.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\CA75.tmp"C:\Users\Admin\AppData\Local\Temp\CA75.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\CB02.tmp"C:\Users\Admin\AppData\Local\Temp\CB02.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6100 -
C:\Users\Admin\AppData\Local\Temp\CB5F.tmp"C:\Users\Admin\AppData\Local\Temp\CB5F.tmp"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\Users\Admin\AppData\Local\Temp\CBDC.tmp"C:\Users\Admin\AppData\Local\Temp\CBDC.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Users\Admin\AppData\Local\Temp\CC3A.tmp"C:\Users\Admin\AppData\Local\Temp\CC3A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Users\Admin\AppData\Local\Temp\CC98.tmp"C:\Users\Admin\AppData\Local\Temp\CC98.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\Users\Admin\AppData\Local\Temp\CCE6.tmp"C:\Users\Admin\AppData\Local\Temp\CCE6.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Users\Admin\AppData\Local\Temp\CD34.tmp"C:\Users\Admin\AppData\Local\Temp\CD34.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\Users\Admin\AppData\Local\Temp\CD92.tmp"C:\Users\Admin\AppData\Local\Temp\CD92.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Users\Admin\AppData\Local\Temp\CDE0.tmp"C:\Users\Admin\AppData\Local\Temp\CDE0.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\Users\Admin\AppData\Local\Temp\CE6D.tmp"C:\Users\Admin\AppData\Local\Temp\CE6D.tmp"23⤵
- Executes dropped EXE
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\CECA.tmp"C:\Users\Admin\AppData\Local\Temp\CECA.tmp"24⤵
- Executes dropped EXE
PID:844 -
C:\Users\Admin\AppData\Local\Temp\CF28.tmp"C:\Users\Admin\AppData\Local\Temp\CF28.tmp"25⤵
- Executes dropped EXE
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\CFA5.tmp"C:\Users\Admin\AppData\Local\Temp\CFA5.tmp"26⤵
- Executes dropped EXE
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\D022.tmp"C:\Users\Admin\AppData\Local\Temp\D022.tmp"27⤵
- Executes dropped EXE
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\D080.tmp"C:\Users\Admin\AppData\Local\Temp\D080.tmp"28⤵
- Executes dropped EXE
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\D0DE.tmp"C:\Users\Admin\AppData\Local\Temp\D0DE.tmp"29⤵
- Executes dropped EXE
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\D15B.tmp"C:\Users\Admin\AppData\Local\Temp\D15B.tmp"30⤵
- Executes dropped EXE
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\D1D8.tmp"C:\Users\Admin\AppData\Local\Temp\D1D8.tmp"31⤵
- Executes dropped EXE
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\D235.tmp"C:\Users\Admin\AppData\Local\Temp\D235.tmp"32⤵
- Executes dropped EXE
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\D2B2.tmp"C:\Users\Admin\AppData\Local\Temp\D2B2.tmp"33⤵
- Executes dropped EXE
PID:5292 -
C:\Users\Admin\AppData\Local\Temp\D310.tmp"C:\Users\Admin\AppData\Local\Temp\D310.tmp"34⤵
- Executes dropped EXE
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\D36E.tmp"C:\Users\Admin\AppData\Local\Temp\D36E.tmp"35⤵
- Executes dropped EXE
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\D3CC.tmp"C:\Users\Admin\AppData\Local\Temp\D3CC.tmp"36⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\D439.tmp"C:\Users\Admin\AppData\Local\Temp\D439.tmp"37⤵
- Executes dropped EXE
PID:5452 -
C:\Users\Admin\AppData\Local\Temp\D487.tmp"C:\Users\Admin\AppData\Local\Temp\D487.tmp"38⤵
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\D4D5.tmp"C:\Users\Admin\AppData\Local\Temp\D4D5.tmp"39⤵
- Executes dropped EXE
PID:5260 -
C:\Users\Admin\AppData\Local\Temp\D523.tmp"C:\Users\Admin\AppData\Local\Temp\D523.tmp"40⤵
- Executes dropped EXE
PID:760 -
C:\Users\Admin\AppData\Local\Temp\D572.tmp"C:\Users\Admin\AppData\Local\Temp\D572.tmp"41⤵
- Executes dropped EXE
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\D5CF.tmp"C:\Users\Admin\AppData\Local\Temp\D5CF.tmp"42⤵
- Executes dropped EXE
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\D62D.tmp"C:\Users\Admin\AppData\Local\Temp\D62D.tmp"43⤵
- Executes dropped EXE
PID:5432 -
C:\Users\Admin\AppData\Local\Temp\D68B.tmp"C:\Users\Admin\AppData\Local\Temp\D68B.tmp"44⤵
- Executes dropped EXE
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\D6E9.tmp"C:\Users\Admin\AppData\Local\Temp\D6E9.tmp"45⤵
- Executes dropped EXE
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\D737.tmp"C:\Users\Admin\AppData\Local\Temp\D737.tmp"46⤵
- Executes dropped EXE
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\D785.tmp"C:\Users\Admin\AppData\Local\Temp\D785.tmp"47⤵
- Executes dropped EXE
PID:388 -
C:\Users\Admin\AppData\Local\Temp\D7D3.tmp"C:\Users\Admin\AppData\Local\Temp\D7D3.tmp"48⤵
- Executes dropped EXE
PID:836 -
C:\Users\Admin\AppData\Local\Temp\D831.tmp"C:\Users\Admin\AppData\Local\Temp\D831.tmp"49⤵
- Executes dropped EXE
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\D87F.tmp"C:\Users\Admin\AppData\Local\Temp\D87F.tmp"50⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\D8EC.tmp"C:\Users\Admin\AppData\Local\Temp\D8EC.tmp"51⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\D94A.tmp"C:\Users\Admin\AppData\Local\Temp\D94A.tmp"52⤵
- Executes dropped EXE
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\D998.tmp"C:\Users\Admin\AppData\Local\Temp\D998.tmp"53⤵
- Executes dropped EXE
PID:688 -
C:\Users\Admin\AppData\Local\Temp\D9E6.tmp"C:\Users\Admin\AppData\Local\Temp\D9E6.tmp"54⤵
- Executes dropped EXE
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\DA34.tmp"C:\Users\Admin\AppData\Local\Temp\DA34.tmp"55⤵
- Executes dropped EXE
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\DA82.tmp"C:\Users\Admin\AppData\Local\Temp\DA82.tmp"56⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\DAD1.tmp"C:\Users\Admin\AppData\Local\Temp\DAD1.tmp"57⤵
- Executes dropped EXE
PID:5288 -
C:\Users\Admin\AppData\Local\Temp\DB1F.tmp"C:\Users\Admin\AppData\Local\Temp\DB1F.tmp"58⤵
- Executes dropped EXE
PID:5356 -
C:\Users\Admin\AppData\Local\Temp\DB7C.tmp"C:\Users\Admin\AppData\Local\Temp\DB7C.tmp"59⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\DBDA.tmp"C:\Users\Admin\AppData\Local\Temp\DBDA.tmp"60⤵
- Executes dropped EXE
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\DC28.tmp"C:\Users\Admin\AppData\Local\Temp\DC28.tmp"61⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\DC86.tmp"C:\Users\Admin\AppData\Local\Temp\DC86.tmp"62⤵
- Executes dropped EXE
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\DCE4.tmp"C:\Users\Admin\AppData\Local\Temp\DCE4.tmp"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5236 -
C:\Users\Admin\AppData\Local\Temp\DD32.tmp"C:\Users\Admin\AppData\Local\Temp\DD32.tmp"64⤵
- Executes dropped EXE
PID:5704 -
C:\Users\Admin\AppData\Local\Temp\DD80.tmp"C:\Users\Admin\AppData\Local\Temp\DD80.tmp"65⤵
- Executes dropped EXE
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\DDDE.tmp"C:\Users\Admin\AppData\Local\Temp\DDDE.tmp"66⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\DE2C.tmp"C:\Users\Admin\AppData\Local\Temp\DE2C.tmp"67⤵PID:5480
-
C:\Users\Admin\AppData\Local\Temp\DE7A.tmp"C:\Users\Admin\AppData\Local\Temp\DE7A.tmp"68⤵PID:5472
-
C:\Users\Admin\AppData\Local\Temp\DED8.tmp"C:\Users\Admin\AppData\Local\Temp\DED8.tmp"69⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\DF36.tmp"C:\Users\Admin\AppData\Local\Temp\DF36.tmp"70⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\DF93.tmp"C:\Users\Admin\AppData\Local\Temp\DF93.tmp"71⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\DFE1.tmp"C:\Users\Admin\AppData\Local\Temp\DFE1.tmp"72⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\E03F.tmp"C:\Users\Admin\AppData\Local\Temp\E03F.tmp"73⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\E08D.tmp"C:\Users\Admin\AppData\Local\Temp\E08D.tmp"74⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\E0EB.tmp"C:\Users\Admin\AppData\Local\Temp\E0EB.tmp"75⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\E149.tmp"C:\Users\Admin\AppData\Local\Temp\E149.tmp"76⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\E1A7.tmp"C:\Users\Admin\AppData\Local\Temp\E1A7.tmp"77⤵PID:5580
-
C:\Users\Admin\AppData\Local\Temp\E1F5.tmp"C:\Users\Admin\AppData\Local\Temp\E1F5.tmp"78⤵PID:5768
-
C:\Users\Admin\AppData\Local\Temp\E243.tmp"C:\Users\Admin\AppData\Local\Temp\E243.tmp"79⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\E2A1.tmp"C:\Users\Admin\AppData\Local\Temp\E2A1.tmp"80⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\E2FE.tmp"C:\Users\Admin\AppData\Local\Temp\E2FE.tmp"81⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\E34C.tmp"C:\Users\Admin\AppData\Local\Temp\E34C.tmp"82⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\E3AA.tmp"C:\Users\Admin\AppData\Local\Temp\E3AA.tmp"83⤵PID:5780
-
C:\Users\Admin\AppData\Local\Temp\E408.tmp"C:\Users\Admin\AppData\Local\Temp\E408.tmp"84⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\E466.tmp"C:\Users\Admin\AppData\Local\Temp\E466.tmp"85⤵PID:6040
-
C:\Users\Admin\AppData\Local\Temp\E4C3.tmp"C:\Users\Admin\AppData\Local\Temp\E4C3.tmp"86⤵PID:5156
-
C:\Users\Admin\AppData\Local\Temp\E512.tmp"C:\Users\Admin\AppData\Local\Temp\E512.tmp"87⤵
- System Location Discovery: System Language Discovery
PID:5532 -
C:\Users\Admin\AppData\Local\Temp\E560.tmp"C:\Users\Admin\AppData\Local\Temp\E560.tmp"88⤵PID:5528
-
C:\Users\Admin\AppData\Local\Temp\E5AE.tmp"C:\Users\Admin\AppData\Local\Temp\E5AE.tmp"89⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\E60C.tmp"C:\Users\Admin\AppData\Local\Temp\E60C.tmp"90⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\E669.tmp"C:\Users\Admin\AppData\Local\Temp\E669.tmp"91⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\E6C7.tmp"C:\Users\Admin\AppData\Local\Temp\E6C7.tmp"92⤵PID:5540
-
C:\Users\Admin\AppData\Local\Temp\E725.tmp"C:\Users\Admin\AppData\Local\Temp\E725.tmp"93⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\E783.tmp"C:\Users\Admin\AppData\Local\Temp\E783.tmp"94⤵PID:5656
-
C:\Users\Admin\AppData\Local\Temp\E7D1.tmp"C:\Users\Admin\AppData\Local\Temp\E7D1.tmp"95⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\E82E.tmp"C:\Users\Admin\AppData\Local\Temp\E82E.tmp"96⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\E88C.tmp"C:\Users\Admin\AppData\Local\Temp\E88C.tmp"97⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\E8DA.tmp"C:\Users\Admin\AppData\Local\Temp\E8DA.tmp"98⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\E938.tmp"C:\Users\Admin\AppData\Local\Temp\E938.tmp"99⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\E986.tmp"C:\Users\Admin\AppData\Local\Temp\E986.tmp"100⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\E9E4.tmp"C:\Users\Admin\AppData\Local\Temp\E9E4.tmp"101⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\EA42.tmp"C:\Users\Admin\AppData\Local\Temp\EA42.tmp"102⤵PID:6028
-
C:\Users\Admin\AppData\Local\Temp\EA90.tmp"C:\Users\Admin\AppData\Local\Temp\EA90.tmp"103⤵PID:6084
-
C:\Users\Admin\AppData\Local\Temp\EADE.tmp"C:\Users\Admin\AppData\Local\Temp\EADE.tmp"104⤵PID:5944
-
C:\Users\Admin\AppData\Local\Temp\EB2C.tmp"C:\Users\Admin\AppData\Local\Temp\EB2C.tmp"105⤵PID:5924
-
C:\Users\Admin\AppData\Local\Temp\EB7A.tmp"C:\Users\Admin\AppData\Local\Temp\EB7A.tmp"106⤵PID:6108
-
C:\Users\Admin\AppData\Local\Temp\EBD8.tmp"C:\Users\Admin\AppData\Local\Temp\EBD8.tmp"107⤵PID:6088
-
C:\Users\Admin\AppData\Local\Temp\EC26.tmp"C:\Users\Admin\AppData\Local\Temp\EC26.tmp"108⤵PID:5844
-
C:\Users\Admin\AppData\Local\Temp\EC74.tmp"C:\Users\Admin\AppData\Local\Temp\EC74.tmp"109⤵PID:5904
-
C:\Users\Admin\AppData\Local\Temp\ECD2.tmp"C:\Users\Admin\AppData\Local\Temp\ECD2.tmp"110⤵PID:5868
-
C:\Users\Admin\AppData\Local\Temp\ED20.tmp"C:\Users\Admin\AppData\Local\Temp\ED20.tmp"111⤵PID:5840
-
C:\Users\Admin\AppData\Local\Temp\ED6E.tmp"C:\Users\Admin\AppData\Local\Temp\ED6E.tmp"112⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\EDCC.tmp"C:\Users\Admin\AppData\Local\Temp\EDCC.tmp"113⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\EE1A.tmp"C:\Users\Admin\AppData\Local\Temp\EE1A.tmp"114⤵PID:5132
-
C:\Users\Admin\AppData\Local\Temp\EE68.tmp"C:\Users\Admin\AppData\Local\Temp\EE68.tmp"115⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\EEB6.tmp"C:\Users\Admin\AppData\Local\Temp\EEB6.tmp"116⤵
- System Location Discovery: System Language Discovery
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\EF14.tmp"C:\Users\Admin\AppData\Local\Temp\EF14.tmp"117⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\EF62.tmp"C:\Users\Admin\AppData\Local\Temp\EF62.tmp"118⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\EFC0.tmp"C:\Users\Admin\AppData\Local\Temp\EFC0.tmp"119⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\F01E.tmp"C:\Users\Admin\AppData\Local\Temp\F01E.tmp"120⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\F06C.tmp"C:\Users\Admin\AppData\Local\Temp\F06C.tmp"121⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\F0BA.tmp"C:\Users\Admin\AppData\Local\Temp\F0BA.tmp"122⤵PID:2392
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-