Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
28/09/2024, 09:23
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-28_23ea4da0a176f01193ce284d87c3dff3_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-28_23ea4da0a176f01193ce284d87c3dff3_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-28_23ea4da0a176f01193ce284d87c3dff3_mafia.exe
-
Size
529KB
-
MD5
23ea4da0a176f01193ce284d87c3dff3
-
SHA1
e2a1e13a895ba7fe1ac1b7143b2a471fdea14a97
-
SHA256
96b584c628680b8be3b5b87092c6870869966c16b28439f3a6629f176bffd5b6
-
SHA512
d675193b3748bc907890ceb854c4ca89ef1af5fe2294a4c83f9de2c309844ea943925adf2b548899f7922d490c1b38f7f55eb66b86ec523403a93becf4b2a180
-
SSDEEP
12288:NU5rCOTeij18jm8jz+z1sNvVRcZKo+2TZwlH4Hp:NUQOJjTme0V6ZKo+2TSlH4Hp
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4760 B258.tmp 3880 B2E5.tmp 2972 B362.tmp 4228 B3DF.tmp 4676 B44C.tmp 4484 B4C9.tmp 1440 B527.tmp 3452 B5A4.tmp 1548 B5F2.tmp 4256 B640.tmp 3632 B68E.tmp 2876 B70B.tmp 4172 B759.tmp 1012 B7A7.tmp 3436 B7F6.tmp 2360 B853.tmp 4992 B8A1.tmp 2176 B8F0.tmp 3876 B96D.tmp 1460 B9CA.tmp 236 BA47.tmp 3660 BAB5.tmp 3636 BB12.tmp 232 BB70.tmp 2232 BBDE.tmp 3316 BC4B.tmp 3692 BC99.tmp 2436 BD06.tmp 1052 BD55.tmp 1236 BDB2.tmp 4972 BE10.tmp 4108 BE8D.tmp 4384 BF0A.tmp 5100 BF58.tmp 4456 BFA6.tmp 2284 BFF4.tmp 3764 C052.tmp 3000 C0A0.tmp 4428 C0EE.tmp 1640 C14C.tmp 4092 C19A.tmp 932 C1E8.tmp 4744 C246.tmp 4336 C2A4.tmp 1784 C2F2.tmp 1312 C350.tmp 4508 C39E.tmp 2964 C3FC.tmp 848 C44A.tmp 1636 C4A8.tmp 2756 C4F6.tmp 3872 C553.tmp 764 C5A2.tmp 3828 C5FF.tmp 1444 C64D.tmp 2240 C6AB.tmp 3628 C709.tmp 2236 C767.tmp 4460 C7B5.tmp 4892 C803.tmp 3924 C851.tmp 4864 C8AF.tmp 4344 C90D.tmp 1560 C95B.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 412B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F29.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A023.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 945B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 961.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F56.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B169.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2AB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E10.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D646.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 664.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C60A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9025.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFDC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECCC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F29D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2104 wrote to memory of 4760 2104 2024-09-28_23ea4da0a176f01193ce284d87c3dff3_mafia.exe 82 PID 2104 wrote to memory of 4760 2104 2024-09-28_23ea4da0a176f01193ce284d87c3dff3_mafia.exe 82 PID 2104 wrote to memory of 4760 2104 2024-09-28_23ea4da0a176f01193ce284d87c3dff3_mafia.exe 82 PID 4760 wrote to memory of 3880 4760 B258.tmp 83 PID 4760 wrote to memory of 3880 4760 B258.tmp 83 PID 4760 wrote to memory of 3880 4760 B258.tmp 83 PID 3880 wrote to memory of 2972 3880 B2E5.tmp 84 PID 3880 wrote to memory of 2972 3880 B2E5.tmp 84 PID 3880 wrote to memory of 2972 3880 B2E5.tmp 84 PID 2972 wrote to memory of 4228 2972 B362.tmp 85 PID 2972 wrote to memory of 4228 2972 B362.tmp 85 PID 2972 wrote to memory of 4228 2972 B362.tmp 85 PID 4228 wrote to memory of 4676 4228 B3DF.tmp 86 PID 4228 wrote to memory of 4676 4228 B3DF.tmp 86 PID 4228 wrote to memory of 4676 4228 B3DF.tmp 86 PID 4676 wrote to memory of 4484 4676 B44C.tmp 87 PID 4676 wrote to memory of 4484 4676 B44C.tmp 87 PID 4676 wrote to memory of 4484 4676 B44C.tmp 87 PID 4484 wrote to memory of 1440 4484 B4C9.tmp 88 PID 4484 wrote to memory of 1440 4484 B4C9.tmp 88 PID 4484 wrote to memory of 1440 4484 B4C9.tmp 88 PID 1440 wrote to memory of 3452 1440 B527.tmp 89 PID 1440 wrote to memory of 3452 1440 B527.tmp 89 PID 1440 wrote to memory of 3452 1440 B527.tmp 89 PID 3452 wrote to memory of 1548 3452 B5A4.tmp 90 PID 3452 wrote to memory of 1548 3452 B5A4.tmp 90 PID 3452 wrote to memory of 1548 3452 B5A4.tmp 90 PID 1548 wrote to memory of 4256 1548 B5F2.tmp 91 PID 1548 wrote to memory of 4256 1548 B5F2.tmp 91 PID 1548 wrote to memory of 4256 1548 B5F2.tmp 91 PID 4256 wrote to memory of 3632 4256 B640.tmp 92 PID 4256 wrote to memory of 3632 4256 B640.tmp 92 PID 4256 wrote to memory of 3632 4256 B640.tmp 92 PID 3632 wrote to memory of 2876 3632 B68E.tmp 93 PID 3632 wrote to memory of 2876 3632 B68E.tmp 93 PID 3632 wrote to memory of 2876 3632 B68E.tmp 93 PID 2876 wrote to memory of 4172 2876 B70B.tmp 94 PID 2876 wrote to memory of 4172 2876 B70B.tmp 94 PID 2876 wrote to memory of 4172 2876 B70B.tmp 94 PID 4172 wrote to memory of 1012 4172 B759.tmp 95 PID 4172 wrote to memory of 1012 4172 B759.tmp 95 PID 4172 wrote to memory of 1012 4172 B759.tmp 95 PID 1012 wrote to memory of 3436 1012 B7A7.tmp 96 PID 1012 wrote to memory of 3436 1012 B7A7.tmp 96 PID 1012 wrote to memory of 3436 1012 B7A7.tmp 96 PID 3436 wrote to memory of 2360 3436 B7F6.tmp 97 PID 3436 wrote to memory of 2360 3436 B7F6.tmp 97 PID 3436 wrote to memory of 2360 3436 B7F6.tmp 97 PID 2360 wrote to memory of 4992 2360 B853.tmp 98 PID 2360 wrote to memory of 4992 2360 B853.tmp 98 PID 2360 wrote to memory of 4992 2360 B853.tmp 98 PID 4992 wrote to memory of 2176 4992 B8A1.tmp 99 PID 4992 wrote to memory of 2176 4992 B8A1.tmp 99 PID 4992 wrote to memory of 2176 4992 B8A1.tmp 99 PID 2176 wrote to memory of 3876 2176 B8F0.tmp 100 PID 2176 wrote to memory of 3876 2176 B8F0.tmp 100 PID 2176 wrote to memory of 3876 2176 B8F0.tmp 100 PID 3876 wrote to memory of 1460 3876 B96D.tmp 101 PID 3876 wrote to memory of 1460 3876 B96D.tmp 101 PID 3876 wrote to memory of 1460 3876 B96D.tmp 101 PID 1460 wrote to memory of 236 1460 B9CA.tmp 102 PID 1460 wrote to memory of 236 1460 B9CA.tmp 102 PID 1460 wrote to memory of 236 1460 B9CA.tmp 102 PID 236 wrote to memory of 3660 236 BA47.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-28_23ea4da0a176f01193ce284d87c3dff3_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-28_23ea4da0a176f01193ce284d87c3dff3_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\B258.tmp"C:\Users\Admin\AppData\Local\Temp\B258.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\B362.tmp"C:\Users\Admin\AppData\Local\Temp\B362.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\B44C.tmp"C:\Users\Admin\AppData\Local\Temp\B44C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\B4C9.tmp"C:\Users\Admin\AppData\Local\Temp\B4C9.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\B527.tmp"C:\Users\Admin\AppData\Local\Temp\B527.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\B640.tmp"C:\Users\Admin\AppData\Local\Temp\B640.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\B68E.tmp"C:\Users\Admin\AppData\Local\Temp\B68E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\B70B.tmp"C:\Users\Admin\AppData\Local\Temp\B70B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\B759.tmp"C:\Users\Admin\AppData\Local\Temp\B759.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\B7A7.tmp"C:\Users\Admin\AppData\Local\Temp\B7A7.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\B7F6.tmp"C:\Users\Admin\AppData\Local\Temp\B7F6.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\B853.tmp"C:\Users\Admin\AppData\Local\Temp\B853.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\B96D.tmp"C:\Users\Admin\AppData\Local\Temp\B96D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\BA47.tmp"C:\Users\Admin\AppData\Local\Temp\BA47.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:236 -
C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"23⤵
- Executes dropped EXE
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\BB12.tmp"C:\Users\Admin\AppData\Local\Temp\BB12.tmp"24⤵
- Executes dropped EXE
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\BB70.tmp"C:\Users\Admin\AppData\Local\Temp\BB70.tmp"25⤵
- Executes dropped EXE
PID:232 -
C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"26⤵
- Executes dropped EXE
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"27⤵
- Executes dropped EXE
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\BC99.tmp"C:\Users\Admin\AppData\Local\Temp\BC99.tmp"28⤵
- Executes dropped EXE
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\BD06.tmp"C:\Users\Admin\AppData\Local\Temp\BD06.tmp"29⤵
- Executes dropped EXE
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\BD55.tmp"C:\Users\Admin\AppData\Local\Temp\BD55.tmp"30⤵
- Executes dropped EXE
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\BDB2.tmp"C:\Users\Admin\AppData\Local\Temp\BDB2.tmp"31⤵
- Executes dropped EXE
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\BE10.tmp"C:\Users\Admin\AppData\Local\Temp\BE10.tmp"32⤵
- Executes dropped EXE
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"33⤵
- Executes dropped EXE
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\BF0A.tmp"C:\Users\Admin\AppData\Local\Temp\BF0A.tmp"34⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\BF58.tmp"C:\Users\Admin\AppData\Local\Temp\BF58.tmp"35⤵
- Executes dropped EXE
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"36⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"37⤵
- Executes dropped EXE
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\C052.tmp"C:\Users\Admin\AppData\Local\Temp\C052.tmp"38⤵
- Executes dropped EXE
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"39⤵
- Executes dropped EXE
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"40⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\C14C.tmp"C:\Users\Admin\AppData\Local\Temp\C14C.tmp"41⤵
- Executes dropped EXE
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\C19A.tmp"C:\Users\Admin\AppData\Local\Temp\C19A.tmp"42⤵
- Executes dropped EXE
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"43⤵
- Executes dropped EXE
PID:932 -
C:\Users\Admin\AppData\Local\Temp\C246.tmp"C:\Users\Admin\AppData\Local\Temp\C246.tmp"44⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\C2A4.tmp"C:\Users\Admin\AppData\Local\Temp\C2A4.tmp"45⤵
- Executes dropped EXE
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"46⤵
- Executes dropped EXE
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\C350.tmp"C:\Users\Admin\AppData\Local\Temp\C350.tmp"47⤵
- Executes dropped EXE
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\C39E.tmp"C:\Users\Admin\AppData\Local\Temp\C39E.tmp"48⤵
- Executes dropped EXE
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"49⤵
- Executes dropped EXE
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\C44A.tmp"C:\Users\Admin\AppData\Local\Temp\C44A.tmp"50⤵
- Executes dropped EXE
PID:848 -
C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"51⤵
- Executes dropped EXE
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"52⤵
- Executes dropped EXE
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\C553.tmp"C:\Users\Admin\AppData\Local\Temp\C553.tmp"53⤵
- Executes dropped EXE
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"54⤵
- Executes dropped EXE
PID:764 -
C:\Users\Admin\AppData\Local\Temp\C5FF.tmp"C:\Users\Admin\AppData\Local\Temp\C5FF.tmp"55⤵
- Executes dropped EXE
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\C64D.tmp"C:\Users\Admin\AppData\Local\Temp\C64D.tmp"56⤵
- Executes dropped EXE
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"57⤵
- Executes dropped EXE
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\C709.tmp"C:\Users\Admin\AppData\Local\Temp\C709.tmp"58⤵
- Executes dropped EXE
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\C767.tmp"C:\Users\Admin\AppData\Local\Temp\C767.tmp"59⤵
- Executes dropped EXE
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\C7B5.tmp"C:\Users\Admin\AppData\Local\Temp\C7B5.tmp"60⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\C803.tmp"C:\Users\Admin\AppData\Local\Temp\C803.tmp"61⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\C851.tmp"C:\Users\Admin\AppData\Local\Temp\C851.tmp"62⤵
- Executes dropped EXE
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\C8AF.tmp"C:\Users\Admin\AppData\Local\Temp\C8AF.tmp"63⤵
- Executes dropped EXE
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\C90D.tmp"C:\Users\Admin\AppData\Local\Temp\C90D.tmp"64⤵
- Executes dropped EXE
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\C95B.tmp"C:\Users\Admin\AppData\Local\Temp\C95B.tmp"65⤵
- Executes dropped EXE
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\C9A9.tmp"C:\Users\Admin\AppData\Local\Temp\C9A9.tmp"66⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\CA07.tmp"C:\Users\Admin\AppData\Local\Temp\CA07.tmp"67⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\CA64.tmp"C:\Users\Admin\AppData\Local\Temp\CA64.tmp"68⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\CAB2.tmp"C:\Users\Admin\AppData\Local\Temp\CAB2.tmp"69⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\CB01.tmp"C:\Users\Admin\AppData\Local\Temp\CB01.tmp"70⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\CB4F.tmp"C:\Users\Admin\AppData\Local\Temp\CB4F.tmp"71⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\CBAC.tmp"C:\Users\Admin\AppData\Local\Temp\CBAC.tmp"72⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\CBFB.tmp"C:\Users\Admin\AppData\Local\Temp\CBFB.tmp"73⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\CC49.tmp"C:\Users\Admin\AppData\Local\Temp\CC49.tmp"74⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\CCA6.tmp"C:\Users\Admin\AppData\Local\Temp\CCA6.tmp"75⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\CCF5.tmp"C:\Users\Admin\AppData\Local\Temp\CCF5.tmp"76⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\CD43.tmp"C:\Users\Admin\AppData\Local\Temp\CD43.tmp"77⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\CD91.tmp"C:\Users\Admin\AppData\Local\Temp\CD91.tmp"78⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\CDDF.tmp"C:\Users\Admin\AppData\Local\Temp\CDDF.tmp"79⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\CE2D.tmp"C:\Users\Admin\AppData\Local\Temp\CE2D.tmp"80⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\CE8B.tmp"C:\Users\Admin\AppData\Local\Temp\CE8B.tmp"81⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\CEE9.tmp"C:\Users\Admin\AppData\Local\Temp\CEE9.tmp"82⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\CF37.tmp"C:\Users\Admin\AppData\Local\Temp\CF37.tmp"83⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\CF94.tmp"C:\Users\Admin\AppData\Local\Temp\CF94.tmp"84⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\CFE3.tmp"C:\Users\Admin\AppData\Local\Temp\CFE3.tmp"85⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\D040.tmp"C:\Users\Admin\AppData\Local\Temp\D040.tmp"86⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\D08E.tmp"C:\Users\Admin\AppData\Local\Temp\D08E.tmp"87⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\D0DD.tmp"C:\Users\Admin\AppData\Local\Temp\D0DD.tmp"88⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\D12B.tmp"C:\Users\Admin\AppData\Local\Temp\D12B.tmp"89⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\D179.tmp"C:\Users\Admin\AppData\Local\Temp\D179.tmp"90⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"91⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\D215.tmp"C:\Users\Admin\AppData\Local\Temp\D215.tmp"92⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\D263.tmp"C:\Users\Admin\AppData\Local\Temp\D263.tmp"93⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\D2B1.tmp"C:\Users\Admin\AppData\Local\Temp\D2B1.tmp"94⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\D2FF.tmp"C:\Users\Admin\AppData\Local\Temp\D2FF.tmp"95⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\D35D.tmp"C:\Users\Admin\AppData\Local\Temp\D35D.tmp"96⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\D3AB.tmp"C:\Users\Admin\AppData\Local\Temp\D3AB.tmp"97⤵
- System Location Discovery: System Language Discovery
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\D3F9.tmp"C:\Users\Admin\AppData\Local\Temp\D3F9.tmp"98⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\D448.tmp"C:\Users\Admin\AppData\Local\Temp\D448.tmp"99⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\D496.tmp"C:\Users\Admin\AppData\Local\Temp\D496.tmp"100⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\D4E4.tmp"C:\Users\Admin\AppData\Local\Temp\D4E4.tmp"101⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\D542.tmp"C:\Users\Admin\AppData\Local\Temp\D542.tmp"102⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\D590.tmp"C:\Users\Admin\AppData\Local\Temp\D590.tmp"103⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\D5DE.tmp"C:\Users\Admin\AppData\Local\Temp\D5DE.tmp"104⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\D62C.tmp"C:\Users\Admin\AppData\Local\Temp\D62C.tmp"105⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\D67A.tmp"C:\Users\Admin\AppData\Local\Temp\D67A.tmp"106⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\D6C8.tmp"C:\Users\Admin\AppData\Local\Temp\D6C8.tmp"107⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\D716.tmp"C:\Users\Admin\AppData\Local\Temp\D716.tmp"108⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\D764.tmp"C:\Users\Admin\AppData\Local\Temp\D764.tmp"109⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\D7B3.tmp"C:\Users\Admin\AppData\Local\Temp\D7B3.tmp"110⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\D810.tmp"C:\Users\Admin\AppData\Local\Temp\D810.tmp"111⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\D86E.tmp"C:\Users\Admin\AppData\Local\Temp\D86E.tmp"112⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\D8BC.tmp"C:\Users\Admin\AppData\Local\Temp\D8BC.tmp"113⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\D91A.tmp"C:\Users\Admin\AppData\Local\Temp\D91A.tmp"114⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\D978.tmp"C:\Users\Admin\AppData\Local\Temp\D978.tmp"115⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\D9D5.tmp"C:\Users\Admin\AppData\Local\Temp\D9D5.tmp"116⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\DA33.tmp"C:\Users\Admin\AppData\Local\Temp\DA33.tmp"117⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\DA91.tmp"C:\Users\Admin\AppData\Local\Temp\DA91.tmp"118⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\DAEF.tmp"C:\Users\Admin\AppData\Local\Temp\DAEF.tmp"119⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\DB4C.tmp"C:\Users\Admin\AppData\Local\Temp\DB4C.tmp"120⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\DB9B.tmp"C:\Users\Admin\AppData\Local\Temp\DB9B.tmp"121⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\DBE9.tmp"C:\Users\Admin\AppData\Local\Temp\DBE9.tmp"122⤵PID:2756
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-