Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
09/09/2024, 20:48
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-09_7309c6224c751f65250f1ba1d4d421aa_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-09_7309c6224c751f65250f1ba1d4d421aa_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-09_7309c6224c751f65250f1ba1d4d421aa_mafia.exe
-
Size
486KB
-
MD5
7309c6224c751f65250f1ba1d4d421aa
-
SHA1
564c03a5f4e69e75c423c1046ad323fa957d1a04
-
SHA256
878b351fcd66f608163a57012cc42a0b5a73df15ae1b73584711ebc760814277
-
SHA512
32e727a4e78254a647ff511c9b9bbdca4de307557f109c00f7a348d16edf30c85cfe577e297f9f1a3b586f5a006f8bdca4076e6f8825132495b5e2298ad7cb52
-
SSDEEP
12288:/U5rCOTeiDUahphff/NQyjlSIyx9cKj7UNZ:/UQOJDvhzjAjx9ceUN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3000 9896.tmp 3320 9904.tmp 4112 9971.tmp 3448 99DE.tmp 3120 9A3C.tmp 3708 9A8A.tmp 2204 9AE8.tmp 4392 9B36.tmp 2968 9B84.tmp 4312 9BE2.tmp 2120 9C30.tmp 1912 9C8E.tmp 2548 9CFB.tmp 960 9D69.tmp 884 9DC6.tmp 4724 9E24.tmp 2740 9E92.tmp 1252 9EEF.tmp 376 9F5D.tmp 3980 A122.tmp 1520 A19F.tmp 1612 A1ED.tmp 4592 A22B.tmp 4008 A2A8.tmp 896 A306.tmp 4792 A354.tmp 920 A3A2.tmp 3680 A3F1.tmp 1228 A46E.tmp 2920 A4DB.tmp 5040 A539.tmp 3568 A587.tmp 2916 A5E5.tmp 1352 A633.tmp 3660 A681.tmp 2820 A6DF.tmp 3656 A73C.tmp 2472 A78A.tmp 344 A7F8.tmp 4868 A846.tmp 3388 A894.tmp 3224 A8E2.tmp 1416 A930.tmp 716 A97E.tmp 4352 A9BD.tmp 4692 AA1B.tmp 3204 AA69.tmp 4824 AAB7.tmp 1696 AB05.tmp 448 AB63.tmp 1392 ABB1.tmp 2980 ABFF.tmp 660 AC4D.tmp 2356 ACAB.tmp 2104 ACF9.tmp 3516 AD47.tmp 4488 ADA5.tmp 2252 ADF3.tmp 3464 AE41.tmp 3784 AE8F.tmp 4260 AEDD.tmp 2868 AF3B.tmp 4308 AFA9.tmp 1780 AFF7.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 124.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 292E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C488.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2323.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 685A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1306.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C157.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B87D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E92.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C5C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D273.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84CB.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1932 wrote to memory of 3000 1932 2024-09-09_7309c6224c751f65250f1ba1d4d421aa_mafia.exe 83 PID 1932 wrote to memory of 3000 1932 2024-09-09_7309c6224c751f65250f1ba1d4d421aa_mafia.exe 83 PID 1932 wrote to memory of 3000 1932 2024-09-09_7309c6224c751f65250f1ba1d4d421aa_mafia.exe 83 PID 3000 wrote to memory of 3320 3000 9896.tmp 85 PID 3000 wrote to memory of 3320 3000 9896.tmp 85 PID 3000 wrote to memory of 3320 3000 9896.tmp 85 PID 3320 wrote to memory of 4112 3320 9904.tmp 87 PID 3320 wrote to memory of 4112 3320 9904.tmp 87 PID 3320 wrote to memory of 4112 3320 9904.tmp 87 PID 4112 wrote to memory of 3448 4112 9971.tmp 89 PID 4112 wrote to memory of 3448 4112 9971.tmp 89 PID 4112 wrote to memory of 3448 4112 9971.tmp 89 PID 3448 wrote to memory of 3120 3448 99DE.tmp 90 PID 3448 wrote to memory of 3120 3448 99DE.tmp 90 PID 3448 wrote to memory of 3120 3448 99DE.tmp 90 PID 3120 wrote to memory of 3708 3120 9A3C.tmp 91 PID 3120 wrote to memory of 3708 3120 9A3C.tmp 91 PID 3120 wrote to memory of 3708 3120 9A3C.tmp 91 PID 3708 wrote to memory of 2204 3708 9A8A.tmp 92 PID 3708 wrote to memory of 2204 3708 9A8A.tmp 92 PID 3708 wrote to memory of 2204 3708 9A8A.tmp 92 PID 2204 wrote to memory of 4392 2204 9AE8.tmp 93 PID 2204 wrote to memory of 4392 2204 9AE8.tmp 93 PID 2204 wrote to memory of 4392 2204 9AE8.tmp 93 PID 4392 wrote to memory of 2968 4392 9B36.tmp 94 PID 4392 wrote to memory of 2968 4392 9B36.tmp 94 PID 4392 wrote to memory of 2968 4392 9B36.tmp 94 PID 2968 wrote to memory of 4312 2968 9B84.tmp 95 PID 2968 wrote to memory of 4312 2968 9B84.tmp 95 PID 2968 wrote to memory of 4312 2968 9B84.tmp 95 PID 4312 wrote to memory of 2120 4312 9BE2.tmp 96 PID 4312 wrote to memory of 2120 4312 9BE2.tmp 96 PID 4312 wrote to memory of 2120 4312 9BE2.tmp 96 PID 2120 wrote to memory of 1912 2120 9C30.tmp 97 PID 2120 wrote to memory of 1912 2120 9C30.tmp 97 PID 2120 wrote to memory of 1912 2120 9C30.tmp 97 PID 1912 wrote to memory of 2548 1912 9C8E.tmp 98 PID 1912 wrote to memory of 2548 1912 9C8E.tmp 98 PID 1912 wrote to memory of 2548 1912 9C8E.tmp 98 PID 2548 wrote to memory of 960 2548 9CFB.tmp 99 PID 2548 wrote to memory of 960 2548 9CFB.tmp 99 PID 2548 wrote to memory of 960 2548 9CFB.tmp 99 PID 960 wrote to memory of 884 960 9D69.tmp 100 PID 960 wrote to memory of 884 960 9D69.tmp 100 PID 960 wrote to memory of 884 960 9D69.tmp 100 PID 884 wrote to memory of 4724 884 9DC6.tmp 101 PID 884 wrote to memory of 4724 884 9DC6.tmp 101 PID 884 wrote to memory of 4724 884 9DC6.tmp 101 PID 4724 wrote to memory of 2740 4724 9E24.tmp 102 PID 4724 wrote to memory of 2740 4724 9E24.tmp 102 PID 4724 wrote to memory of 2740 4724 9E24.tmp 102 PID 2740 wrote to memory of 1252 2740 9E92.tmp 103 PID 2740 wrote to memory of 1252 2740 9E92.tmp 103 PID 2740 wrote to memory of 1252 2740 9E92.tmp 103 PID 1252 wrote to memory of 376 1252 9EEF.tmp 104 PID 1252 wrote to memory of 376 1252 9EEF.tmp 104 PID 1252 wrote to memory of 376 1252 9EEF.tmp 104 PID 376 wrote to memory of 3980 376 9F5D.tmp 106 PID 376 wrote to memory of 3980 376 9F5D.tmp 106 PID 376 wrote to memory of 3980 376 9F5D.tmp 106 PID 3980 wrote to memory of 1520 3980 A122.tmp 107 PID 3980 wrote to memory of 1520 3980 A122.tmp 107 PID 3980 wrote to memory of 1520 3980 A122.tmp 107 PID 1520 wrote to memory of 1612 1520 A19F.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-09_7309c6224c751f65250f1ba1d4d421aa_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-09_7309c6224c751f65250f1ba1d4d421aa_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\9896.tmp"C:\Users\Admin\AppData\Local\Temp\9896.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\9904.tmp"C:\Users\Admin\AppData\Local\Temp\9904.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\9971.tmp"C:\Users\Admin\AppData\Local\Temp\9971.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\99DE.tmp"C:\Users\Admin\AppData\Local\Temp\99DE.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\9C30.tmp"C:\Users\Admin\AppData\Local\Temp\9C30.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\9D69.tmp"C:\Users\Admin\AppData\Local\Temp\9D69.tmp"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Users\Admin\AppData\Local\Temp\9E24.tmp"C:\Users\Admin\AppData\Local\Temp\9E24.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\9E92.tmp"C:\Users\Admin\AppData\Local\Temp\9E92.tmp"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Users\Admin\AppData\Local\Temp\A122.tmp"C:\Users\Admin\AppData\Local\Temp\A122.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\A19F.tmp"C:\Users\Admin\AppData\Local\Temp\A19F.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"23⤵
- Executes dropped EXE
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\A22B.tmp"C:\Users\Admin\AppData\Local\Temp\A22B.tmp"24⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"25⤵
- Executes dropped EXE
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\A306.tmp"C:\Users\Admin\AppData\Local\Temp\A306.tmp"26⤵
- Executes dropped EXE
PID:896 -
C:\Users\Admin\AppData\Local\Temp\A354.tmp"C:\Users\Admin\AppData\Local\Temp\A354.tmp"27⤵
- Executes dropped EXE
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"28⤵
- Executes dropped EXE
PID:920 -
C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"29⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\A46E.tmp"C:\Users\Admin\AppData\Local\Temp\A46E.tmp"30⤵
- Executes dropped EXE
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"31⤵
- Executes dropped EXE
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\A539.tmp"C:\Users\Admin\AppData\Local\Temp\A539.tmp"32⤵
- Executes dropped EXE
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\A587.tmp"C:\Users\Admin\AppData\Local\Temp\A587.tmp"33⤵
- Executes dropped EXE
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"34⤵
- Executes dropped EXE
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\A633.tmp"C:\Users\Admin\AppData\Local\Temp\A633.tmp"35⤵
- Executes dropped EXE
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\A681.tmp"C:\Users\Admin\AppData\Local\Temp\A681.tmp"36⤵
- Executes dropped EXE
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"37⤵
- Executes dropped EXE
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\A73C.tmp"C:\Users\Admin\AppData\Local\Temp\A73C.tmp"38⤵
- Executes dropped EXE
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\A78A.tmp"C:\Users\Admin\AppData\Local\Temp\A78A.tmp"39⤵
- Executes dropped EXE
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"40⤵
- Executes dropped EXE
PID:344 -
C:\Users\Admin\AppData\Local\Temp\A846.tmp"C:\Users\Admin\AppData\Local\Temp\A846.tmp"41⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\A894.tmp"C:\Users\Admin\AppData\Local\Temp\A894.tmp"42⤵
- Executes dropped EXE
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"43⤵
- Executes dropped EXE
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\A930.tmp"C:\Users\Admin\AppData\Local\Temp\A930.tmp"44⤵
- Executes dropped EXE
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\A97E.tmp"C:\Users\Admin\AppData\Local\Temp\A97E.tmp"45⤵
- Executes dropped EXE
PID:716 -
C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"46⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"47⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\AA69.tmp"C:\Users\Admin\AppData\Local\Temp\AA69.tmp"48⤵
- Executes dropped EXE
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"49⤵
- Executes dropped EXE
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\AB05.tmp"C:\Users\Admin\AppData\Local\Temp\AB05.tmp"50⤵
- Executes dropped EXE
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\AB63.tmp"C:\Users\Admin\AppData\Local\Temp\AB63.tmp"51⤵
- Executes dropped EXE
PID:448 -
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"52⤵
- Executes dropped EXE
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"53⤵
- Executes dropped EXE
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"54⤵
- Executes dropped EXE
PID:660 -
C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"55⤵
- Executes dropped EXE
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"56⤵
- Executes dropped EXE
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\AD47.tmp"C:\Users\Admin\AppData\Local\Temp\AD47.tmp"57⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"58⤵
- Executes dropped EXE
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"59⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\AE41.tmp"C:\Users\Admin\AppData\Local\Temp\AE41.tmp"60⤵
- Executes dropped EXE
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"61⤵
- Executes dropped EXE
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"62⤵
- Executes dropped EXE
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"63⤵
- Executes dropped EXE
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"64⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"65⤵
- Executes dropped EXE
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\B045.tmp"C:\Users\Admin\AppData\Local\Temp\B045.tmp"66⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"67⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\B0F1.tmp"C:\Users\Admin\AppData\Local\Temp\B0F1.tmp"68⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\B14E.tmp"C:\Users\Admin\AppData\Local\Temp\B14E.tmp"69⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\B19D.tmp"C:\Users\Admin\AppData\Local\Temp\B19D.tmp"70⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"71⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\B248.tmp"C:\Users\Admin\AppData\Local\Temp\B248.tmp"72⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\B2A6.tmp"C:\Users\Admin\AppData\Local\Temp\B2A6.tmp"73⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\B304.tmp"C:\Users\Admin\AppData\Local\Temp\B304.tmp"74⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\B362.tmp"C:\Users\Admin\AppData\Local\Temp\B362.tmp"75⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"76⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\B40E.tmp"C:\Users\Admin\AppData\Local\Temp\B40E.tmp"77⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\B45C.tmp"C:\Users\Admin\AppData\Local\Temp\B45C.tmp"78⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"79⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"80⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\B546.tmp"C:\Users\Admin\AppData\Local\Temp\B546.tmp"81⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"82⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\B602.tmp"C:\Users\Admin\AppData\Local\Temp\B602.tmp"83⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\B65F.tmp"C:\Users\Admin\AppData\Local\Temp\B65F.tmp"84⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"85⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\B71B.tmp"C:\Users\Admin\AppData\Local\Temp\B71B.tmp"86⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\B779.tmp"C:\Users\Admin\AppData\Local\Temp\B779.tmp"87⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"88⤵
- System Location Discovery: System Language Discovery
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\B815.tmp"C:\Users\Admin\AppData\Local\Temp\B815.tmp"89⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\B873.tmp"C:\Users\Admin\AppData\Local\Temp\B873.tmp"90⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"91⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\B90F.tmp"C:\Users\Admin\AppData\Local\Temp\B90F.tmp"92⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\B96D.tmp"C:\Users\Admin\AppData\Local\Temp\B96D.tmp"93⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"94⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\BA28.tmp"C:\Users\Admin\AppData\Local\Temp\BA28.tmp"95⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\BA76.tmp"C:\Users\Admin\AppData\Local\Temp\BA76.tmp"96⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"97⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\BB22.tmp"C:\Users\Admin\AppData\Local\Temp\BB22.tmp"98⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\BB80.tmp"C:\Users\Admin\AppData\Local\Temp\BB80.tmp"99⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"100⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"101⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\BC89.tmp"C:\Users\Admin\AppData\Local\Temp\BC89.tmp"102⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\BCD8.tmp"C:\Users\Admin\AppData\Local\Temp\BCD8.tmp"103⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\BD26.tmp"C:\Users\Admin\AppData\Local\Temp\BD26.tmp"104⤵
- System Location Discovery: System Language Discovery
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\BD74.tmp"C:\Users\Admin\AppData\Local\Temp\BD74.tmp"105⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"106⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\BE10.tmp"C:\Users\Admin\AppData\Local\Temp\BE10.tmp"107⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\BE5E.tmp"C:\Users\Admin\AppData\Local\Temp\BE5E.tmp"108⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\BEBC.tmp"C:\Users\Admin\AppData\Local\Temp\BEBC.tmp"109⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\BF0A.tmp"C:\Users\Admin\AppData\Local\Temp\BF0A.tmp"110⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\BF68.tmp"C:\Users\Admin\AppData\Local\Temp\BF68.tmp"111⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\BFB6.tmp"C:\Users\Admin\AppData\Local\Temp\BFB6.tmp"112⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\C004.tmp"C:\Users\Admin\AppData\Local\Temp\C004.tmp"113⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\C052.tmp"C:\Users\Admin\AppData\Local\Temp\C052.tmp"114⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"115⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\C10E.tmp"C:\Users\Admin\AppData\Local\Temp\C10E.tmp"116⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\C16B.tmp"C:\Users\Admin\AppData\Local\Temp\C16B.tmp"117⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"118⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\C227.tmp"C:\Users\Admin\AppData\Local\Temp\C227.tmp"119⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\C285.tmp"C:\Users\Admin\AppData\Local\Temp\C285.tmp"120⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"121⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\C331.tmp"C:\Users\Admin\AppData\Local\Temp\C331.tmp"122⤵PID:1780
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-