Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27/09/2024, 10:31
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-27_8507051dda0c13623d976e8e3c03c0c6_mafia.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-09-27_8507051dda0c13623d976e8e3c03c0c6_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-27_8507051dda0c13623d976e8e3c03c0c6_mafia.exe
-
Size
529KB
-
MD5
8507051dda0c13623d976e8e3c03c0c6
-
SHA1
7536249fa4ac2e4e3d5dc2951f11a22537809d85
-
SHA256
144f76faa5c71d9b911379164e784bc5a92b181b02f99d3086c20ab4799a71c4
-
SHA512
80b5d599bf54e895734dc21c52238ebbed906758bee3e39b042903ccd994a92fef9a019d06810fd9768686119913a38fa5ad4239ba4c10b8571cd466d635ab9f
-
SSDEEP
12288:NU5rCOTeijBYYjuVc2oGnOrptBaTZwlH4Hp:NUQOJjBYwD8nOlCTSlH4Hp
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3828 BD45.tmp 2924 BDD2.tmp 4400 BE7D.tmp 2976 BF29.tmp 1584 BFB6.tmp 1928 C014.tmp 1876 C081.tmp 3332 C0DF.tmp 992 C14C.tmp 4884 C1AA.tmp 2900 C208.tmp 3932 C256.tmp 2916 C2E2.tmp 228 C35F.tmp 4088 C3CD.tmp 2904 C44A.tmp 4544 C4B7.tmp 3180 C534.tmp 4932 C5C1.tmp 3508 C63E.tmp 3772 C6BB.tmp 2380 C728.tmp 696 C786.tmp 1824 C7E4.tmp 5088 C832.tmp 776 C8BE.tmp 4140 C93B.tmp 1416 C999.tmp 1236 C9F7.tmp 1044 CA55.tmp 1984 CAB2.tmp 3500 CB10.tmp 5116 CB7E.tmp 3900 CBCC.tmp 2584 CC29.tmp 628 CC78.tmp 3260 CCD5.tmp 4264 CD23.tmp 4224 CD81.tmp 1144 CDDF.tmp 3884 CE2D.tmp 1700 CE8B.tmp 4764 CED9.tmp 1564 CF27.tmp 5020 CF85.tmp 748 CFD3.tmp 1036 D021.tmp 1644 D07F.tmp 4276 D0DD.tmp 2968 D13A.tmp 2876 D198.tmp 2508 D1F6.tmp 3228 D254.tmp 4768 D2B1.tmp 3232 D30F.tmp 4100 D35D.tmp 4892 D3AB.tmp 2308 D3F9.tmp 4468 D448.tmp 3908 D4A5.tmp 4384 D4F3.tmp 396 D551.tmp 2244 D5BF.tmp 432 D61C.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F02C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CDA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9863.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F661.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B939.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 298C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB0E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3004.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECAD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C786.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC42.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E375.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E412.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8826.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CABD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F4F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B205.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4263.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B88D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C270.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16BF.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4916 wrote to memory of 3828 4916 2024-09-27_8507051dda0c13623d976e8e3c03c0c6_mafia.exe 82 PID 4916 wrote to memory of 3828 4916 2024-09-27_8507051dda0c13623d976e8e3c03c0c6_mafia.exe 82 PID 4916 wrote to memory of 3828 4916 2024-09-27_8507051dda0c13623d976e8e3c03c0c6_mafia.exe 82 PID 3828 wrote to memory of 2924 3828 BD45.tmp 83 PID 3828 wrote to memory of 2924 3828 BD45.tmp 83 PID 3828 wrote to memory of 2924 3828 BD45.tmp 83 PID 2924 wrote to memory of 4400 2924 BDD2.tmp 84 PID 2924 wrote to memory of 4400 2924 BDD2.tmp 84 PID 2924 wrote to memory of 4400 2924 BDD2.tmp 84 PID 4400 wrote to memory of 2976 4400 BE7D.tmp 85 PID 4400 wrote to memory of 2976 4400 BE7D.tmp 85 PID 4400 wrote to memory of 2976 4400 BE7D.tmp 85 PID 2976 wrote to memory of 1584 2976 BF29.tmp 86 PID 2976 wrote to memory of 1584 2976 BF29.tmp 86 PID 2976 wrote to memory of 1584 2976 BF29.tmp 86 PID 1584 wrote to memory of 1928 1584 BFB6.tmp 87 PID 1584 wrote to memory of 1928 1584 BFB6.tmp 87 PID 1584 wrote to memory of 1928 1584 BFB6.tmp 87 PID 1928 wrote to memory of 1876 1928 C014.tmp 88 PID 1928 wrote to memory of 1876 1928 C014.tmp 88 PID 1928 wrote to memory of 1876 1928 C014.tmp 88 PID 1876 wrote to memory of 3332 1876 C081.tmp 89 PID 1876 wrote to memory of 3332 1876 C081.tmp 89 PID 1876 wrote to memory of 3332 1876 C081.tmp 89 PID 3332 wrote to memory of 992 3332 C0DF.tmp 90 PID 3332 wrote to memory of 992 3332 C0DF.tmp 90 PID 3332 wrote to memory of 992 3332 C0DF.tmp 90 PID 992 wrote to memory of 4884 992 C14C.tmp 91 PID 992 wrote to memory of 4884 992 C14C.tmp 91 PID 992 wrote to memory of 4884 992 C14C.tmp 91 PID 4884 wrote to memory of 2900 4884 C1AA.tmp 92 PID 4884 wrote to memory of 2900 4884 C1AA.tmp 92 PID 4884 wrote to memory of 2900 4884 C1AA.tmp 92 PID 2900 wrote to memory of 3932 2900 C208.tmp 93 PID 2900 wrote to memory of 3932 2900 C208.tmp 93 PID 2900 wrote to memory of 3932 2900 C208.tmp 93 PID 3932 wrote to memory of 2916 3932 C256.tmp 94 PID 3932 wrote to memory of 2916 3932 C256.tmp 94 PID 3932 wrote to memory of 2916 3932 C256.tmp 94 PID 2916 wrote to memory of 228 2916 C2E2.tmp 95 PID 2916 wrote to memory of 228 2916 C2E2.tmp 95 PID 2916 wrote to memory of 228 2916 C2E2.tmp 95 PID 228 wrote to memory of 4088 228 C35F.tmp 96 PID 228 wrote to memory of 4088 228 C35F.tmp 96 PID 228 wrote to memory of 4088 228 C35F.tmp 96 PID 4088 wrote to memory of 2904 4088 C3CD.tmp 97 PID 4088 wrote to memory of 2904 4088 C3CD.tmp 97 PID 4088 wrote to memory of 2904 4088 C3CD.tmp 97 PID 2904 wrote to memory of 4544 2904 C44A.tmp 98 PID 2904 wrote to memory of 4544 2904 C44A.tmp 98 PID 2904 wrote to memory of 4544 2904 C44A.tmp 98 PID 4544 wrote to memory of 3180 4544 C4B7.tmp 99 PID 4544 wrote to memory of 3180 4544 C4B7.tmp 99 PID 4544 wrote to memory of 3180 4544 C4B7.tmp 99 PID 3180 wrote to memory of 4932 3180 C534.tmp 100 PID 3180 wrote to memory of 4932 3180 C534.tmp 100 PID 3180 wrote to memory of 4932 3180 C534.tmp 100 PID 4932 wrote to memory of 3508 4932 C5C1.tmp 101 PID 4932 wrote to memory of 3508 4932 C5C1.tmp 101 PID 4932 wrote to memory of 3508 4932 C5C1.tmp 101 PID 3508 wrote to memory of 3772 3508 C63E.tmp 102 PID 3508 wrote to memory of 3772 3508 C63E.tmp 102 PID 3508 wrote to memory of 3772 3508 C63E.tmp 102 PID 3772 wrote to memory of 2380 3772 C6BB.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-27_8507051dda0c13623d976e8e3c03c0c6_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-27_8507051dda0c13623d976e8e3c03c0c6_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\BD45.tmp"C:\Users\Admin\AppData\Local\Temp\BD45.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\BE7D.tmp"C:\Users\Admin\AppData\Local\Temp\BE7D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\BF29.tmp"C:\Users\Admin\AppData\Local\Temp\BF29.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\BFB6.tmp"C:\Users\Admin\AppData\Local\Temp\BFB6.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\C014.tmp"C:\Users\Admin\AppData\Local\Temp\C014.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\C081.tmp"C:\Users\Admin\AppData\Local\Temp\C081.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\C14C.tmp"C:\Users\Admin\AppData\Local\Temp\C14C.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\C208.tmp"C:\Users\Admin\AppData\Local\Temp\C208.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\C256.tmp"C:\Users\Admin\AppData\Local\Temp\C256.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\C35F.tmp"C:\Users\Admin\AppData\Local\Temp\C35F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\C44A.tmp"C:\Users\Admin\AppData\Local\Temp\C44A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\C4B7.tmp"C:\Users\Admin\AppData\Local\Temp\C4B7.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\C534.tmp"C:\Users\Admin\AppData\Local\Temp\C534.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\C63E.tmp"C:\Users\Admin\AppData\Local\Temp\C63E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\C728.tmp"C:\Users\Admin\AppData\Local\Temp\C728.tmp"23⤵
- Executes dropped EXE
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\C786.tmp"C:\Users\Admin\AppData\Local\Temp\C786.tmp"24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:696 -
C:\Users\Admin\AppData\Local\Temp\C7E4.tmp"C:\Users\Admin\AppData\Local\Temp\C7E4.tmp"25⤵
- Executes dropped EXE
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\C832.tmp"C:\Users\Admin\AppData\Local\Temp\C832.tmp"26⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"27⤵
- Executes dropped EXE
PID:776 -
C:\Users\Admin\AppData\Local\Temp\C93B.tmp"C:\Users\Admin\AppData\Local\Temp\C93B.tmp"28⤵
- Executes dropped EXE
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\C999.tmp"C:\Users\Admin\AppData\Local\Temp\C999.tmp"29⤵
- Executes dropped EXE
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\C9F7.tmp"C:\Users\Admin\AppData\Local\Temp\C9F7.tmp"30⤵
- Executes dropped EXE
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\CA55.tmp"C:\Users\Admin\AppData\Local\Temp\CA55.tmp"31⤵
- Executes dropped EXE
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\CAB2.tmp"C:\Users\Admin\AppData\Local\Temp\CAB2.tmp"32⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\CB10.tmp"C:\Users\Admin\AppData\Local\Temp\CB10.tmp"33⤵
- Executes dropped EXE
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\CB7E.tmp"C:\Users\Admin\AppData\Local\Temp\CB7E.tmp"34⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\CBCC.tmp"C:\Users\Admin\AppData\Local\Temp\CBCC.tmp"35⤵
- Executes dropped EXE
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\CC29.tmp"C:\Users\Admin\AppData\Local\Temp\CC29.tmp"36⤵
- Executes dropped EXE
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\CC78.tmp"C:\Users\Admin\AppData\Local\Temp\CC78.tmp"37⤵
- Executes dropped EXE
PID:628 -
C:\Users\Admin\AppData\Local\Temp\CCD5.tmp"C:\Users\Admin\AppData\Local\Temp\CCD5.tmp"38⤵
- Executes dropped EXE
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\CD23.tmp"C:\Users\Admin\AppData\Local\Temp\CD23.tmp"39⤵
- Executes dropped EXE
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\CD81.tmp"C:\Users\Admin\AppData\Local\Temp\CD81.tmp"40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\CDDF.tmp"C:\Users\Admin\AppData\Local\Temp\CDDF.tmp"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\CE2D.tmp"C:\Users\Admin\AppData\Local\Temp\CE2D.tmp"42⤵
- Executes dropped EXE
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\CE8B.tmp"C:\Users\Admin\AppData\Local\Temp\CE8B.tmp"43⤵
- Executes dropped EXE
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\CED9.tmp"C:\Users\Admin\AppData\Local\Temp\CED9.tmp"44⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\CF27.tmp"C:\Users\Admin\AppData\Local\Temp\CF27.tmp"45⤵
- Executes dropped EXE
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\CF85.tmp"C:\Users\Admin\AppData\Local\Temp\CF85.tmp"46⤵
- Executes dropped EXE
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\CFD3.tmp"C:\Users\Admin\AppData\Local\Temp\CFD3.tmp"47⤵
- Executes dropped EXE
PID:748 -
C:\Users\Admin\AppData\Local\Temp\D021.tmp"C:\Users\Admin\AppData\Local\Temp\D021.tmp"48⤵
- Executes dropped EXE
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\D07F.tmp"C:\Users\Admin\AppData\Local\Temp\D07F.tmp"49⤵
- Executes dropped EXE
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\D0DD.tmp"C:\Users\Admin\AppData\Local\Temp\D0DD.tmp"50⤵
- Executes dropped EXE
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\D13A.tmp"C:\Users\Admin\AppData\Local\Temp\D13A.tmp"51⤵
- Executes dropped EXE
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\D198.tmp"C:\Users\Admin\AppData\Local\Temp\D198.tmp"52⤵
- Executes dropped EXE
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\D1F6.tmp"C:\Users\Admin\AppData\Local\Temp\D1F6.tmp"53⤵
- Executes dropped EXE
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\D254.tmp"C:\Users\Admin\AppData\Local\Temp\D254.tmp"54⤵
- Executes dropped EXE
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\D2B1.tmp"C:\Users\Admin\AppData\Local\Temp\D2B1.tmp"55⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\D30F.tmp"C:\Users\Admin\AppData\Local\Temp\D30F.tmp"56⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\D35D.tmp"C:\Users\Admin\AppData\Local\Temp\D35D.tmp"57⤵
- Executes dropped EXE
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\D3AB.tmp"C:\Users\Admin\AppData\Local\Temp\D3AB.tmp"58⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\D3F9.tmp"C:\Users\Admin\AppData\Local\Temp\D3F9.tmp"59⤵
- Executes dropped EXE
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\D448.tmp"C:\Users\Admin\AppData\Local\Temp\D448.tmp"60⤵
- Executes dropped EXE
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\D4A5.tmp"C:\Users\Admin\AppData\Local\Temp\D4A5.tmp"61⤵
- Executes dropped EXE
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\D4F3.tmp"C:\Users\Admin\AppData\Local\Temp\D4F3.tmp"62⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\D551.tmp"C:\Users\Admin\AppData\Local\Temp\D551.tmp"63⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\D5BF.tmp"C:\Users\Admin\AppData\Local\Temp\D5BF.tmp"64⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\D61C.tmp"C:\Users\Admin\AppData\Local\Temp\D61C.tmp"65⤵
- Executes dropped EXE
PID:432 -
C:\Users\Admin\AppData\Local\Temp\D66A.tmp"C:\Users\Admin\AppData\Local\Temp\D66A.tmp"66⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\D6C8.tmp"C:\Users\Admin\AppData\Local\Temp\D6C8.tmp"67⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\D716.tmp"C:\Users\Admin\AppData\Local\Temp\D716.tmp"68⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\D774.tmp"C:\Users\Admin\AppData\Local\Temp\D774.tmp"69⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\D7D2.tmp"C:\Users\Admin\AppData\Local\Temp\D7D2.tmp"70⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\D820.tmp"C:\Users\Admin\AppData\Local\Temp\D820.tmp"71⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\D87E.tmp"C:\Users\Admin\AppData\Local\Temp\D87E.tmp"72⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\D8CC.tmp"C:\Users\Admin\AppData\Local\Temp\D8CC.tmp"73⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\D91A.tmp"C:\Users\Admin\AppData\Local\Temp\D91A.tmp"74⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\D968.tmp"C:\Users\Admin\AppData\Local\Temp\D968.tmp"75⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\D9C6.tmp"C:\Users\Admin\AppData\Local\Temp\D9C6.tmp"76⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\DA14.tmp"C:\Users\Admin\AppData\Local\Temp\DA14.tmp"77⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\DA62.tmp"C:\Users\Admin\AppData\Local\Temp\DA62.tmp"78⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\DAB0.tmp"C:\Users\Admin\AppData\Local\Temp\DAB0.tmp"79⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\DB0E.tmp"C:\Users\Admin\AppData\Local\Temp\DB0E.tmp"80⤵
- System Location Discovery: System Language Discovery
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\DB5C.tmp"C:\Users\Admin\AppData\Local\Temp\DB5C.tmp"81⤵
- System Location Discovery: System Language Discovery
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\DBBA.tmp"C:\Users\Admin\AppData\Local\Temp\DBBA.tmp"82⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\DC18.tmp"C:\Users\Admin\AppData\Local\Temp\DC18.tmp"83⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\DC66.tmp"C:\Users\Admin\AppData\Local\Temp\DC66.tmp"84⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\DCC3.tmp"C:\Users\Admin\AppData\Local\Temp\DCC3.tmp"85⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\DD21.tmp"C:\Users\Admin\AppData\Local\Temp\DD21.tmp"86⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\DD7F.tmp"C:\Users\Admin\AppData\Local\Temp\DD7F.tmp"87⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\DDDD.tmp"C:\Users\Admin\AppData\Local\Temp\DDDD.tmp"88⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\DE2B.tmp"C:\Users\Admin\AppData\Local\Temp\DE2B.tmp"89⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\DE79.tmp"C:\Users\Admin\AppData\Local\Temp\DE79.tmp"90⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\DED7.tmp"C:\Users\Admin\AppData\Local\Temp\DED7.tmp"91⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\DF34.tmp"C:\Users\Admin\AppData\Local\Temp\DF34.tmp"92⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\DF92.tmp"C:\Users\Admin\AppData\Local\Temp\DF92.tmp"93⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\DFE0.tmp"C:\Users\Admin\AppData\Local\Temp\DFE0.tmp"94⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\E03E.tmp"C:\Users\Admin\AppData\Local\Temp\E03E.tmp"95⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\E09C.tmp"C:\Users\Admin\AppData\Local\Temp\E09C.tmp"96⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\E0EA.tmp"C:\Users\Admin\AppData\Local\Temp\E0EA.tmp"97⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\E148.tmp"C:\Users\Admin\AppData\Local\Temp\E148.tmp"98⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\E1A5.tmp"C:\Users\Admin\AppData\Local\Temp\E1A5.tmp"99⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\E203.tmp"C:\Users\Admin\AppData\Local\Temp\E203.tmp"100⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\E251.tmp"C:\Users\Admin\AppData\Local\Temp\E251.tmp"101⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\E29F.tmp"C:\Users\Admin\AppData\Local\Temp\E29F.tmp"102⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\E2FD.tmp"C:\Users\Admin\AppData\Local\Temp\E2FD.tmp"103⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\E35B.tmp"C:\Users\Admin\AppData\Local\Temp\E35B.tmp"104⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\E3B9.tmp"C:\Users\Admin\AppData\Local\Temp\E3B9.tmp"105⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\E426.tmp"C:\Users\Admin\AppData\Local\Temp\E426.tmp"106⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\E474.tmp"C:\Users\Admin\AppData\Local\Temp\E474.tmp"107⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\E4D2.tmp"C:\Users\Admin\AppData\Local\Temp\E4D2.tmp"108⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\E520.tmp"C:\Users\Admin\AppData\Local\Temp\E520.tmp"109⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\E57E.tmp"C:\Users\Admin\AppData\Local\Temp\E57E.tmp"110⤵PID:600
-
C:\Users\Admin\AppData\Local\Temp\E5DC.tmp"C:\Users\Admin\AppData\Local\Temp\E5DC.tmp"111⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\E639.tmp"C:\Users\Admin\AppData\Local\Temp\E639.tmp"112⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\E687.tmp"C:\Users\Admin\AppData\Local\Temp\E687.tmp"113⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\E6E5.tmp"C:\Users\Admin\AppData\Local\Temp\E6E5.tmp"114⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\E733.tmp"C:\Users\Admin\AppData\Local\Temp\E733.tmp"115⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\E791.tmp"C:\Users\Admin\AppData\Local\Temp\E791.tmp"116⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"117⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\E84D.tmp"C:\Users\Admin\AppData\Local\Temp\E84D.tmp"118⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\E89B.tmp"C:\Users\Admin\AppData\Local\Temp\E89B.tmp"119⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\E8F8.tmp"C:\Users\Admin\AppData\Local\Temp\E8F8.tmp"120⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\E956.tmp"C:\Users\Admin\AppData\Local\Temp\E956.tmp"121⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\E9B4.tmp"C:\Users\Admin\AppData\Local\Temp\E9B4.tmp"122⤵PID:4268
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-