Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system -
submitted
27/09/2024, 11:08
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-27_6035bbb4f84e08ea8c1b8ef828107cdb_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-27_6035bbb4f84e08ea8c1b8ef828107cdb_mafia.exe
Resource
win10v2004-20240910-en
General
-
Target
2024-09-27_6035bbb4f84e08ea8c1b8ef828107cdb_mafia.exe
-
Size
486KB
-
MD5
6035bbb4f84e08ea8c1b8ef828107cdb
-
SHA1
1409a6c4e3c61a033bf128df461318ddd260822d
-
SHA256
a445cb4e833d57080100d0b23caa369a70a12594cc4389898fa68f076d7e029d
-
SHA512
4991611858ce58e3a61dcad4bb385fa12a31ad322eb594b92248b4a6d508f73b35b1cc0f8d818f59c97963119f45e542c9d083f117cbf25d3363e8de2f6111f3
-
SSDEEP
12288:/U5rCOTeiDqpTvNwGWaGxl6vFGGHv7fNZ:/UQOJDqpNKaGxyzjN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4604 904.tmp 3540 961.tmp 2788 9DE.tmp 3600 A3C.tmp 3632 AA9.tmp 4052 B07.tmp 3528 B75.tmp 1948 BF2.tmp 1256 C4F.tmp 4580 CAD.tmp 2648 D0B.tmp 3736 D59.tmp 3776 DD6.tmp 4508 E43.tmp 3208 EC0.tmp 1368 F0E.tmp 4504 F9B.tmp 456 FE9.tmp 4316 1047.tmp 212 1095.tmp 2432 1112.tmp 1344 1160.tmp 1636 11AE.tmp 1200 11FC.tmp 4520 124B.tmp 1384 12B8.tmp 372 1316.tmp 1708 1373.tmp 576 13E1.tmp 2008 145E.tmp 1128 14CB.tmp 4408 1519.tmp 4880 1587.tmp 4836 15D5.tmp 4296 1623.tmp 1308 1671.tmp 1288 16CF.tmp 3376 172D.tmp 4192 177B.tmp 2220 17C9.tmp 2388 1827.tmp 5012 1875.tmp 4680 18D2.tmp 4540 1921.tmp 2788 196F.tmp 4124 19BD.tmp 4496 1A0B.tmp 2028 1A59.tmp 4596 1AB7.tmp 1832 1B05.tmp 1360 1B63.tmp 1144 1BC0.tmp 2376 1C1E.tmp 4128 1C6C.tmp 2128 1CCA.tmp 1892 1D28.tmp 4668 1D86.tmp 2648 1DE3.tmp 4632 1E31.tmp 3224 1E8F.tmp 3776 1EDD.tmp 912 1F3B.tmp 1352 1F89.tmp 5056 1FE7.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5589.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4FFB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A330.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 242D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D184.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 961.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7654.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5668.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F44E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DA2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 451D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 359D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E2E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4652 wrote to memory of 4604 4652 2024-09-27_6035bbb4f84e08ea8c1b8ef828107cdb_mafia.exe 84 PID 4652 wrote to memory of 4604 4652 2024-09-27_6035bbb4f84e08ea8c1b8ef828107cdb_mafia.exe 84 PID 4652 wrote to memory of 4604 4652 2024-09-27_6035bbb4f84e08ea8c1b8ef828107cdb_mafia.exe 84 PID 4604 wrote to memory of 3540 4604 904.tmp 85 PID 4604 wrote to memory of 3540 4604 904.tmp 85 PID 4604 wrote to memory of 3540 4604 904.tmp 85 PID 3540 wrote to memory of 2788 3540 961.tmp 87 PID 3540 wrote to memory of 2788 3540 961.tmp 87 PID 3540 wrote to memory of 2788 3540 961.tmp 87 PID 2788 wrote to memory of 3600 2788 9DE.tmp 88 PID 2788 wrote to memory of 3600 2788 9DE.tmp 88 PID 2788 wrote to memory of 3600 2788 9DE.tmp 88 PID 3600 wrote to memory of 3632 3600 A3C.tmp 89 PID 3600 wrote to memory of 3632 3600 A3C.tmp 89 PID 3600 wrote to memory of 3632 3600 A3C.tmp 89 PID 3632 wrote to memory of 4052 3632 AA9.tmp 91 PID 3632 wrote to memory of 4052 3632 AA9.tmp 91 PID 3632 wrote to memory of 4052 3632 AA9.tmp 91 PID 4052 wrote to memory of 3528 4052 B07.tmp 92 PID 4052 wrote to memory of 3528 4052 B07.tmp 92 PID 4052 wrote to memory of 3528 4052 B07.tmp 92 PID 3528 wrote to memory of 1948 3528 B75.tmp 93 PID 3528 wrote to memory of 1948 3528 B75.tmp 93 PID 3528 wrote to memory of 1948 3528 B75.tmp 93 PID 1948 wrote to memory of 1256 1948 BF2.tmp 94 PID 1948 wrote to memory of 1256 1948 BF2.tmp 94 PID 1948 wrote to memory of 1256 1948 BF2.tmp 94 PID 1256 wrote to memory of 4580 1256 C4F.tmp 95 PID 1256 wrote to memory of 4580 1256 C4F.tmp 95 PID 1256 wrote to memory of 4580 1256 C4F.tmp 95 PID 4580 wrote to memory of 2648 4580 CAD.tmp 96 PID 4580 wrote to memory of 2648 4580 CAD.tmp 96 PID 4580 wrote to memory of 2648 4580 CAD.tmp 96 PID 2648 wrote to memory of 3736 2648 D0B.tmp 97 PID 2648 wrote to memory of 3736 2648 D0B.tmp 97 PID 2648 wrote to memory of 3736 2648 D0B.tmp 97 PID 3736 wrote to memory of 3776 3736 D59.tmp 98 PID 3736 wrote to memory of 3776 3736 D59.tmp 98 PID 3736 wrote to memory of 3776 3736 D59.tmp 98 PID 3776 wrote to memory of 4508 3776 DD6.tmp 99 PID 3776 wrote to memory of 4508 3776 DD6.tmp 99 PID 3776 wrote to memory of 4508 3776 DD6.tmp 99 PID 4508 wrote to memory of 3208 4508 E43.tmp 100 PID 4508 wrote to memory of 3208 4508 E43.tmp 100 PID 4508 wrote to memory of 3208 4508 E43.tmp 100 PID 3208 wrote to memory of 1368 3208 EC0.tmp 101 PID 3208 wrote to memory of 1368 3208 EC0.tmp 101 PID 3208 wrote to memory of 1368 3208 EC0.tmp 101 PID 1368 wrote to memory of 4504 1368 F0E.tmp 102 PID 1368 wrote to memory of 4504 1368 F0E.tmp 102 PID 1368 wrote to memory of 4504 1368 F0E.tmp 102 PID 4504 wrote to memory of 456 4504 F9B.tmp 103 PID 4504 wrote to memory of 456 4504 F9B.tmp 103 PID 4504 wrote to memory of 456 4504 F9B.tmp 103 PID 456 wrote to memory of 4316 456 FE9.tmp 104 PID 456 wrote to memory of 4316 456 FE9.tmp 104 PID 456 wrote to memory of 4316 456 FE9.tmp 104 PID 4316 wrote to memory of 212 4316 1047.tmp 105 PID 4316 wrote to memory of 212 4316 1047.tmp 105 PID 4316 wrote to memory of 212 4316 1047.tmp 105 PID 212 wrote to memory of 2432 212 1095.tmp 106 PID 212 wrote to memory of 2432 212 1095.tmp 106 PID 212 wrote to memory of 2432 212 1095.tmp 106 PID 2432 wrote to memory of 1344 2432 1112.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-27_6035bbb4f84e08ea8c1b8ef828107cdb_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-27_6035bbb4f84e08ea8c1b8ef828107cdb_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\904.tmp"C:\Users\Admin\AppData\Local\Temp\904.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\961.tmp"C:\Users\Admin\AppData\Local\Temp\961.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\9DE.tmp"C:\Users\Admin\AppData\Local\Temp\9DE.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\A3C.tmp"C:\Users\Admin\AppData\Local\Temp\A3C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\AA9.tmp"C:\Users\Admin\AppData\Local\Temp\AA9.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\B07.tmp"C:\Users\Admin\AppData\Local\Temp\B07.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\B75.tmp"C:\Users\Admin\AppData\Local\Temp\B75.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\BF2.tmp"C:\Users\Admin\AppData\Local\Temp\BF2.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\C4F.tmp"C:\Users\Admin\AppData\Local\Temp\C4F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\CAD.tmp"C:\Users\Admin\AppData\Local\Temp\CAD.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\D0B.tmp"C:\Users\Admin\AppData\Local\Temp\D0B.tmp"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\D59.tmp"C:\Users\Admin\AppData\Local\Temp\D59.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\DD6.tmp"C:\Users\Admin\AppData\Local\Temp\DD6.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\E43.tmp"C:\Users\Admin\AppData\Local\Temp\E43.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\EC0.tmp"C:\Users\Admin\AppData\Local\Temp\EC0.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\F0E.tmp"C:\Users\Admin\AppData\Local\Temp\F0E.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\F9B.tmp"C:\Users\Admin\AppData\Local\Temp\F9B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\FE9.tmp"C:\Users\Admin\AppData\Local\Temp\FE9.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Users\Admin\AppData\Local\Temp\1047.tmp"C:\Users\Admin\AppData\Local\Temp\1047.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\1095.tmp"C:\Users\Admin\AppData\Local\Temp\1095.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Users\Admin\AppData\Local\Temp\1112.tmp"C:\Users\Admin\AppData\Local\Temp\1112.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\1160.tmp"C:\Users\Admin\AppData\Local\Temp\1160.tmp"23⤵
- Executes dropped EXE
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\11AE.tmp"C:\Users\Admin\AppData\Local\Temp\11AE.tmp"24⤵
- Executes dropped EXE
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\11FC.tmp"C:\Users\Admin\AppData\Local\Temp\11FC.tmp"25⤵
- Executes dropped EXE
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\124B.tmp"C:\Users\Admin\AppData\Local\Temp\124B.tmp"26⤵
- Executes dropped EXE
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\12B8.tmp"C:\Users\Admin\AppData\Local\Temp\12B8.tmp"27⤵
- Executes dropped EXE
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\1316.tmp"C:\Users\Admin\AppData\Local\Temp\1316.tmp"28⤵
- Executes dropped EXE
PID:372 -
C:\Users\Admin\AppData\Local\Temp\1373.tmp"C:\Users\Admin\AppData\Local\Temp\1373.tmp"29⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\13E1.tmp"C:\Users\Admin\AppData\Local\Temp\13E1.tmp"30⤵
- Executes dropped EXE
PID:576 -
C:\Users\Admin\AppData\Local\Temp\145E.tmp"C:\Users\Admin\AppData\Local\Temp\145E.tmp"31⤵
- Executes dropped EXE
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\14CB.tmp"C:\Users\Admin\AppData\Local\Temp\14CB.tmp"32⤵
- Executes dropped EXE
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\1519.tmp"C:\Users\Admin\AppData\Local\Temp\1519.tmp"33⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\1587.tmp"C:\Users\Admin\AppData\Local\Temp\1587.tmp"34⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\15D5.tmp"C:\Users\Admin\AppData\Local\Temp\15D5.tmp"35⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\1623.tmp"C:\Users\Admin\AppData\Local\Temp\1623.tmp"36⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\1671.tmp"C:\Users\Admin\AppData\Local\Temp\1671.tmp"37⤵
- Executes dropped EXE
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\16CF.tmp"C:\Users\Admin\AppData\Local\Temp\16CF.tmp"38⤵
- Executes dropped EXE
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\172D.tmp"C:\Users\Admin\AppData\Local\Temp\172D.tmp"39⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\177B.tmp"C:\Users\Admin\AppData\Local\Temp\177B.tmp"40⤵
- Executes dropped EXE
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\17C9.tmp"C:\Users\Admin\AppData\Local\Temp\17C9.tmp"41⤵
- Executes dropped EXE
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\1827.tmp"C:\Users\Admin\AppData\Local\Temp\1827.tmp"42⤵
- Executes dropped EXE
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\1875.tmp"C:\Users\Admin\AppData\Local\Temp\1875.tmp"43⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\18D2.tmp"C:\Users\Admin\AppData\Local\Temp\18D2.tmp"44⤵
- Executes dropped EXE
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\1921.tmp"C:\Users\Admin\AppData\Local\Temp\1921.tmp"45⤵
- Executes dropped EXE
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\196F.tmp"C:\Users\Admin\AppData\Local\Temp\196F.tmp"46⤵
- Executes dropped EXE
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\19BD.tmp"C:\Users\Admin\AppData\Local\Temp\19BD.tmp"47⤵
- Executes dropped EXE
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\1A0B.tmp"C:\Users\Admin\AppData\Local\Temp\1A0B.tmp"48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\1A59.tmp"C:\Users\Admin\AppData\Local\Temp\1A59.tmp"49⤵
- Executes dropped EXE
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\1AB7.tmp"C:\Users\Admin\AppData\Local\Temp\1AB7.tmp"50⤵
- Executes dropped EXE
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\1B05.tmp"C:\Users\Admin\AppData\Local\Temp\1B05.tmp"51⤵
- Executes dropped EXE
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\1B63.tmp"C:\Users\Admin\AppData\Local\Temp\1B63.tmp"52⤵
- Executes dropped EXE
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\1BC0.tmp"C:\Users\Admin\AppData\Local\Temp\1BC0.tmp"53⤵
- Executes dropped EXE
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\1C1E.tmp"C:\Users\Admin\AppData\Local\Temp\1C1E.tmp"54⤵
- Executes dropped EXE
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\1C6C.tmp"C:\Users\Admin\AppData\Local\Temp\1C6C.tmp"55⤵
- Executes dropped EXE
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\1CCA.tmp"C:\Users\Admin\AppData\Local\Temp\1CCA.tmp"56⤵
- Executes dropped EXE
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\1D28.tmp"C:\Users\Admin\AppData\Local\Temp\1D28.tmp"57⤵
- Executes dropped EXE
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\1D86.tmp"C:\Users\Admin\AppData\Local\Temp\1D86.tmp"58⤵
- Executes dropped EXE
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\1DE3.tmp"C:\Users\Admin\AppData\Local\Temp\1DE3.tmp"59⤵
- Executes dropped EXE
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\1E31.tmp"C:\Users\Admin\AppData\Local\Temp\1E31.tmp"60⤵
- Executes dropped EXE
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\1E8F.tmp"C:\Users\Admin\AppData\Local\Temp\1E8F.tmp"61⤵
- Executes dropped EXE
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\1EDD.tmp"C:\Users\Admin\AppData\Local\Temp\1EDD.tmp"62⤵
- Executes dropped EXE
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\1F3B.tmp"C:\Users\Admin\AppData\Local\Temp\1F3B.tmp"63⤵
- Executes dropped EXE
PID:912 -
C:\Users\Admin\AppData\Local\Temp\1F89.tmp"C:\Users\Admin\AppData\Local\Temp\1F89.tmp"64⤵
- Executes dropped EXE
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\1FE7.tmp"C:\Users\Admin\AppData\Local\Temp\1FE7.tmp"65⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\2045.tmp"C:\Users\Admin\AppData\Local\Temp\2045.tmp"66⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\20A2.tmp"C:\Users\Admin\AppData\Local\Temp\20A2.tmp"67⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\20F1.tmp"C:\Users\Admin\AppData\Local\Temp\20F1.tmp"68⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\213F.tmp"C:\Users\Admin\AppData\Local\Temp\213F.tmp"69⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\218D.tmp"C:\Users\Admin\AppData\Local\Temp\218D.tmp"70⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\21DB.tmp"C:\Users\Admin\AppData\Local\Temp\21DB.tmp"71⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\2229.tmp"C:\Users\Admin\AppData\Local\Temp\2229.tmp"72⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\2287.tmp"C:\Users\Admin\AppData\Local\Temp\2287.tmp"73⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\22E5.tmp"C:\Users\Admin\AppData\Local\Temp\22E5.tmp"74⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\2342.tmp"C:\Users\Admin\AppData\Local\Temp\2342.tmp"75⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\2390.tmp"C:\Users\Admin\AppData\Local\Temp\2390.tmp"76⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\23DF.tmp"C:\Users\Admin\AppData\Local\Temp\23DF.tmp"77⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\242D.tmp"C:\Users\Admin\AppData\Local\Temp\242D.tmp"78⤵
- System Location Discovery: System Language Discovery
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\248A.tmp"C:\Users\Admin\AppData\Local\Temp\248A.tmp"79⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\24E8.tmp"C:\Users\Admin\AppData\Local\Temp\24E8.tmp"80⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\2546.tmp"C:\Users\Admin\AppData\Local\Temp\2546.tmp"81⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\25A4.tmp"C:\Users\Admin\AppData\Local\Temp\25A4.tmp"82⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\2601.tmp"C:\Users\Admin\AppData\Local\Temp\2601.tmp"83⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\265F.tmp"C:\Users\Admin\AppData\Local\Temp\265F.tmp"84⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\26BD.tmp"C:\Users\Admin\AppData\Local\Temp\26BD.tmp"85⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\271B.tmp"C:\Users\Admin\AppData\Local\Temp\271B.tmp"86⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\2778.tmp"C:\Users\Admin\AppData\Local\Temp\2778.tmp"87⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\27D6.tmp"C:\Users\Admin\AppData\Local\Temp\27D6.tmp"88⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\2834.tmp"C:\Users\Admin\AppData\Local\Temp\2834.tmp"89⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\2892.tmp"C:\Users\Admin\AppData\Local\Temp\2892.tmp"90⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\28EF.tmp"C:\Users\Admin\AppData\Local\Temp\28EF.tmp"91⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\294D.tmp"C:\Users\Admin\AppData\Local\Temp\294D.tmp"92⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\29AB.tmp"C:\Users\Admin\AppData\Local\Temp\29AB.tmp"93⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\2A09.tmp"C:\Users\Admin\AppData\Local\Temp\2A09.tmp"94⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\2A66.tmp"C:\Users\Admin\AppData\Local\Temp\2A66.tmp"95⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\2AC4.tmp"C:\Users\Admin\AppData\Local\Temp\2AC4.tmp"96⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\2B22.tmp"C:\Users\Admin\AppData\Local\Temp\2B22.tmp"97⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\2B80.tmp"C:\Users\Admin\AppData\Local\Temp\2B80.tmp"98⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\2BDD.tmp"C:\Users\Admin\AppData\Local\Temp\2BDD.tmp"99⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\2C3B.tmp"C:\Users\Admin\AppData\Local\Temp\2C3B.tmp"100⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\2CA9.tmp"C:\Users\Admin\AppData\Local\Temp\2CA9.tmp"101⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\2D06.tmp"C:\Users\Admin\AppData\Local\Temp\2D06.tmp"102⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\2D64.tmp"C:\Users\Admin\AppData\Local\Temp\2D64.tmp"103⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\2DC2.tmp"C:\Users\Admin\AppData\Local\Temp\2DC2.tmp"104⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\2E20.tmp"C:\Users\Admin\AppData\Local\Temp\2E20.tmp"105⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\2E8D.tmp"C:\Users\Admin\AppData\Local\Temp\2E8D.tmp"106⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\2EDB.tmp"C:\Users\Admin\AppData\Local\Temp\2EDB.tmp"107⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\2F39.tmp"C:\Users\Admin\AppData\Local\Temp\2F39.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\2F87.tmp"C:\Users\Admin\AppData\Local\Temp\2F87.tmp"109⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\2FD5.tmp"C:\Users\Admin\AppData\Local\Temp\2FD5.tmp"110⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\3033.tmp"C:\Users\Admin\AppData\Local\Temp\3033.tmp"111⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\3081.tmp"C:\Users\Admin\AppData\Local\Temp\3081.tmp"112⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\30CF.tmp"C:\Users\Admin\AppData\Local\Temp\30CF.tmp"113⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\312D.tmp"C:\Users\Admin\AppData\Local\Temp\312D.tmp"114⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\318B.tmp"C:\Users\Admin\AppData\Local\Temp\318B.tmp"115⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\31E8.tmp"C:\Users\Admin\AppData\Local\Temp\31E8.tmp"116⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\3246.tmp"C:\Users\Admin\AppData\Local\Temp\3246.tmp"117⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\32B3.tmp"C:\Users\Admin\AppData\Local\Temp\32B3.tmp"118⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\3302.tmp"C:\Users\Admin\AppData\Local\Temp\3302.tmp"119⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\335F.tmp"C:\Users\Admin\AppData\Local\Temp\335F.tmp"120⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\33BD.tmp"C:\Users\Admin\AppData\Local\Temp\33BD.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:948 -
C:\Users\Admin\AppData\Local\Temp\341B.tmp"C:\Users\Admin\AppData\Local\Temp\341B.tmp"122⤵PID:1160
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-