Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01/10/2024, 09:30
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-01_317a6faa730c36bb77fcaf680ac39216_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-01_317a6faa730c36bb77fcaf680ac39216_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-10-01_317a6faa730c36bb77fcaf680ac39216_mafia.exe
-
Size
536KB
-
MD5
317a6faa730c36bb77fcaf680ac39216
-
SHA1
24e797befc5b62e0cc973bcf3e553f65a0ae7352
-
SHA256
eaf4f8a336db5e027e1f8b62f0cd913ccec22c5247d3b31a848f6be6a3e394bb
-
SHA512
617a5a1ec6e900894dd8368f4a0cb18bb0c7673b4012100059e7eefe43e4192c7211d240e167d96d7998c1d00ed0fc1a962e0df8075c314ed4e4440b8646d509
-
SSDEEP
12288:wU5rCOTeiUfv90qkcRj5qzK0rkIZxVJ0ZT9:wUQOJUfV0YoK0rkIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2756 83B7.tmp 4232 8482.tmp 4456 84FF.tmp 4932 85AB.tmp 2016 8628.tmp 4076 86E3.tmp 5096 879F.tmp 3560 881C.tmp 3208 8899.tmp 4436 8906.tmp 3328 89A2.tmp 3488 8A1F.tmp 4476 8ABB.tmp 3936 8B48.tmp 4356 8BE4.tmp 4836 8C71.tmp 1660 8D0D.tmp 3076 8DB9.tmp 3988 8E46.tmp 556 8EF2.tmp 4680 8F7E.tmp 4368 8FFB.tmp 4140 9097.tmp 3964 9124.tmp 3984 91A1.tmp 1544 920E.tmp 5004 92AB.tmp 3184 9337.tmp 4756 93C4.tmp 2576 9460.tmp 5048 94FC.tmp 3360 9599.tmp 4484 9616.tmp 5104 9683.tmp 1204 96F0.tmp 1956 977D.tmp 2448 980A.tmp 2520 9887.tmp 2092 98F4.tmp 3400 9971.tmp 2904 99EE.tmp 2956 9A2D.tmp 3504 9AAA.tmp 2568 9B17.tmp 4956 9B94.tmp 2232 9BF2.tmp 4004 9C5F.tmp 2612 9CCC.tmp 4396 9D2A.tmp 2496 9D88.tmp 3328 9DE6.tmp 3980 9E34.tmp 5068 9E92.tmp 3752 9EE0.tmp 3804 9F2E.tmp 3068 9F6C.tmp 112 9FCA.tmp 4560 A028.tmp 5072 A076.tmp 396 A0C4.tmp 1148 A122.tmp 2488 A170.tmp 3188 A1BE.tmp 1100 A1FD.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9594.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A393.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4541.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 651E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C99.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDCD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F482.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA88.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C014.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C93B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A822.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E06D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D021.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CCC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E22.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 777D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8131.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 338E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D78.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4132 wrote to memory of 2756 4132 2024-10-01_317a6faa730c36bb77fcaf680ac39216_mafia.exe 82 PID 4132 wrote to memory of 2756 4132 2024-10-01_317a6faa730c36bb77fcaf680ac39216_mafia.exe 82 PID 4132 wrote to memory of 2756 4132 2024-10-01_317a6faa730c36bb77fcaf680ac39216_mafia.exe 82 PID 2756 wrote to memory of 4232 2756 83B7.tmp 83 PID 2756 wrote to memory of 4232 2756 83B7.tmp 83 PID 2756 wrote to memory of 4232 2756 83B7.tmp 83 PID 4232 wrote to memory of 4456 4232 8482.tmp 84 PID 4232 wrote to memory of 4456 4232 8482.tmp 84 PID 4232 wrote to memory of 4456 4232 8482.tmp 84 PID 4456 wrote to memory of 4932 4456 84FF.tmp 85 PID 4456 wrote to memory of 4932 4456 84FF.tmp 85 PID 4456 wrote to memory of 4932 4456 84FF.tmp 85 PID 4932 wrote to memory of 2016 4932 85AB.tmp 86 PID 4932 wrote to memory of 2016 4932 85AB.tmp 86 PID 4932 wrote to memory of 2016 4932 85AB.tmp 86 PID 2016 wrote to memory of 4076 2016 8628.tmp 87 PID 2016 wrote to memory of 4076 2016 8628.tmp 87 PID 2016 wrote to memory of 4076 2016 8628.tmp 87 PID 4076 wrote to memory of 5096 4076 86E3.tmp 88 PID 4076 wrote to memory of 5096 4076 86E3.tmp 88 PID 4076 wrote to memory of 5096 4076 86E3.tmp 88 PID 5096 wrote to memory of 3560 5096 879F.tmp 89 PID 5096 wrote to memory of 3560 5096 879F.tmp 89 PID 5096 wrote to memory of 3560 5096 879F.tmp 89 PID 3560 wrote to memory of 3208 3560 881C.tmp 90 PID 3560 wrote to memory of 3208 3560 881C.tmp 90 PID 3560 wrote to memory of 3208 3560 881C.tmp 90 PID 3208 wrote to memory of 4436 3208 8899.tmp 91 PID 3208 wrote to memory of 4436 3208 8899.tmp 91 PID 3208 wrote to memory of 4436 3208 8899.tmp 91 PID 4436 wrote to memory of 3328 4436 8906.tmp 92 PID 4436 wrote to memory of 3328 4436 8906.tmp 92 PID 4436 wrote to memory of 3328 4436 8906.tmp 92 PID 3328 wrote to memory of 3488 3328 89A2.tmp 93 PID 3328 wrote to memory of 3488 3328 89A2.tmp 93 PID 3328 wrote to memory of 3488 3328 89A2.tmp 93 PID 3488 wrote to memory of 4476 3488 8A1F.tmp 94 PID 3488 wrote to memory of 4476 3488 8A1F.tmp 94 PID 3488 wrote to memory of 4476 3488 8A1F.tmp 94 PID 4476 wrote to memory of 3936 4476 8ABB.tmp 95 PID 4476 wrote to memory of 3936 4476 8ABB.tmp 95 PID 4476 wrote to memory of 3936 4476 8ABB.tmp 95 PID 3936 wrote to memory of 4356 3936 8B48.tmp 96 PID 3936 wrote to memory of 4356 3936 8B48.tmp 96 PID 3936 wrote to memory of 4356 3936 8B48.tmp 96 PID 4356 wrote to memory of 4836 4356 8BE4.tmp 97 PID 4356 wrote to memory of 4836 4356 8BE4.tmp 97 PID 4356 wrote to memory of 4836 4356 8BE4.tmp 97 PID 4836 wrote to memory of 1660 4836 8C71.tmp 98 PID 4836 wrote to memory of 1660 4836 8C71.tmp 98 PID 4836 wrote to memory of 1660 4836 8C71.tmp 98 PID 1660 wrote to memory of 3076 1660 8D0D.tmp 99 PID 1660 wrote to memory of 3076 1660 8D0D.tmp 99 PID 1660 wrote to memory of 3076 1660 8D0D.tmp 99 PID 3076 wrote to memory of 3988 3076 8DB9.tmp 100 PID 3076 wrote to memory of 3988 3076 8DB9.tmp 100 PID 3076 wrote to memory of 3988 3076 8DB9.tmp 100 PID 3988 wrote to memory of 556 3988 8E46.tmp 101 PID 3988 wrote to memory of 556 3988 8E46.tmp 101 PID 3988 wrote to memory of 556 3988 8E46.tmp 101 PID 556 wrote to memory of 4680 556 8EF2.tmp 102 PID 556 wrote to memory of 4680 556 8EF2.tmp 102 PID 556 wrote to memory of 4680 556 8EF2.tmp 102 PID 4680 wrote to memory of 4368 4680 8F7E.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-01_317a6faa730c36bb77fcaf680ac39216_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-01_317a6faa730c36bb77fcaf680ac39216_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\83B7.tmp"C:\Users\Admin\AppData\Local\Temp\83B7.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\8482.tmp"C:\Users\Admin\AppData\Local\Temp\8482.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\84FF.tmp"C:\Users\Admin\AppData\Local\Temp\84FF.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\85AB.tmp"C:\Users\Admin\AppData\Local\Temp\85AB.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\8628.tmp"C:\Users\Admin\AppData\Local\Temp\8628.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\86E3.tmp"C:\Users\Admin\AppData\Local\Temp\86E3.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\879F.tmp"C:\Users\Admin\AppData\Local\Temp\879F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\881C.tmp"C:\Users\Admin\AppData\Local\Temp\881C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\8899.tmp"C:\Users\Admin\AppData\Local\Temp\8899.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\8906.tmp"C:\Users\Admin\AppData\Local\Temp\8906.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\89A2.tmp"C:\Users\Admin\AppData\Local\Temp\89A2.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\8B48.tmp"C:\Users\Admin\AppData\Local\Temp\8B48.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\8C71.tmp"C:\Users\Admin\AppData\Local\Temp\8C71.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\8E46.tmp"C:\Users\Admin\AppData\Local\Temp\8E46.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"23⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\9097.tmp"C:\Users\Admin\AppData\Local\Temp\9097.tmp"24⤵
- Executes dropped EXE
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\9124.tmp"C:\Users\Admin\AppData\Local\Temp\9124.tmp"25⤵
- Executes dropped EXE
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\91A1.tmp"C:\Users\Admin\AppData\Local\Temp\91A1.tmp"26⤵
- Executes dropped EXE
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\920E.tmp"C:\Users\Admin\AppData\Local\Temp\920E.tmp"27⤵
- Executes dropped EXE
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\92AB.tmp"C:\Users\Admin\AppData\Local\Temp\92AB.tmp"28⤵
- Executes dropped EXE
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\9337.tmp"C:\Users\Admin\AppData\Local\Temp\9337.tmp"29⤵
- Executes dropped EXE
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\93C4.tmp"C:\Users\Admin\AppData\Local\Temp\93C4.tmp"30⤵
- Executes dropped EXE
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\9460.tmp"C:\Users\Admin\AppData\Local\Temp\9460.tmp"31⤵
- Executes dropped EXE
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\94FC.tmp"C:\Users\Admin\AppData\Local\Temp\94FC.tmp"32⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\9599.tmp"C:\Users\Admin\AppData\Local\Temp\9599.tmp"33⤵
- Executes dropped EXE
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\9616.tmp"C:\Users\Admin\AppData\Local\Temp\9616.tmp"34⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\9683.tmp"C:\Users\Admin\AppData\Local\Temp\9683.tmp"35⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\96F0.tmp"C:\Users\Admin\AppData\Local\Temp\96F0.tmp"36⤵
- Executes dropped EXE
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\977D.tmp"C:\Users\Admin\AppData\Local\Temp\977D.tmp"37⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\980A.tmp"C:\Users\Admin\AppData\Local\Temp\980A.tmp"38⤵
- Executes dropped EXE
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\9887.tmp"C:\Users\Admin\AppData\Local\Temp\9887.tmp"39⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\98F4.tmp"C:\Users\Admin\AppData\Local\Temp\98F4.tmp"40⤵
- Executes dropped EXE
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\9971.tmp"C:\Users\Admin\AppData\Local\Temp\9971.tmp"41⤵
- Executes dropped EXE
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\99EE.tmp"C:\Users\Admin\AppData\Local\Temp\99EE.tmp"42⤵
- Executes dropped EXE
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"43⤵
- Executes dropped EXE
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"44⤵
- Executes dropped EXE
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\9B17.tmp"C:\Users\Admin\AppData\Local\Temp\9B17.tmp"45⤵
- Executes dropped EXE
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\9B94.tmp"C:\Users\Admin\AppData\Local\Temp\9B94.tmp"46⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"47⤵
- Executes dropped EXE
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"48⤵
- Executes dropped EXE
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"50⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\9D88.tmp"C:\Users\Admin\AppData\Local\Temp\9D88.tmp"51⤵
- Executes dropped EXE
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"52⤵
- Executes dropped EXE
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\9E34.tmp"C:\Users\Admin\AppData\Local\Temp\9E34.tmp"53⤵
- Executes dropped EXE
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\9E92.tmp"C:\Users\Admin\AppData\Local\Temp\9E92.tmp"54⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"55⤵
- Executes dropped EXE
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"56⤵
- Executes dropped EXE
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"57⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"58⤵
- Executes dropped EXE
PID:112 -
C:\Users\Admin\AppData\Local\Temp\A028.tmp"C:\Users\Admin\AppData\Local\Temp\A028.tmp"59⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\A076.tmp"C:\Users\Admin\AppData\Local\Temp\A076.tmp"60⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"61⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\A122.tmp"C:\Users\Admin\AppData\Local\Temp\A122.tmp"62⤵
- Executes dropped EXE
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\A170.tmp"C:\Users\Admin\AppData\Local\Temp\A170.tmp"63⤵
- Executes dropped EXE
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"64⤵
- Executes dropped EXE
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"65⤵
- Executes dropped EXE
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\A24B.tmp"C:\Users\Admin\AppData\Local\Temp\A24B.tmp"66⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\A299.tmp"C:\Users\Admin\AppData\Local\Temp\A299.tmp"67⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"68⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\A345.tmp"C:\Users\Admin\AppData\Local\Temp\A345.tmp"69⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\A393.tmp"C:\Users\Admin\AppData\Local\Temp\A393.tmp"70⤵
- System Location Discovery: System Language Discovery
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"71⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\A44E.tmp"C:\Users\Admin\AppData\Local\Temp\A44E.tmp"72⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\A49C.tmp"C:\Users\Admin\AppData\Local\Temp\A49C.tmp"73⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"74⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\A548.tmp"C:\Users\Admin\AppData\Local\Temp\A548.tmp"75⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\A596.tmp"C:\Users\Admin\AppData\Local\Temp\A596.tmp"76⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"77⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\A652.tmp"C:\Users\Admin\AppData\Local\Temp\A652.tmp"78⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"79⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"80⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\A74C.tmp"C:\Users\Admin\AppData\Local\Temp\A74C.tmp"81⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\A79A.tmp"C:\Users\Admin\AppData\Local\Temp\A79A.tmp"82⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"83⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\A846.tmp"C:\Users\Admin\AppData\Local\Temp\A846.tmp"84⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\A894.tmp"C:\Users\Admin\AppData\Local\Temp\A894.tmp"85⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"86⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\A930.tmp"C:\Users\Admin\AppData\Local\Temp\A930.tmp"87⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\A97E.tmp"C:\Users\Admin\AppData\Local\Temp\A97E.tmp"88⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"89⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"90⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\AA88.tmp"C:\Users\Admin\AppData\Local\Temp\AA88.tmp"91⤵
- System Location Discovery: System Language Discovery
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"92⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\AB24.tmp"C:\Users\Admin\AppData\Local\Temp\AB24.tmp"93⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\AB82.tmp"C:\Users\Admin\AppData\Local\Temp\AB82.tmp"94⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"95⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"96⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"97⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"98⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\AD38.tmp"C:\Users\Admin\AppData\Local\Temp\AD38.tmp"99⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\AD86.tmp"C:\Users\Admin\AppData\Local\Temp\AD86.tmp"100⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"101⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\AE41.tmp"C:\Users\Admin\AppData\Local\Temp\AE41.tmp"102⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"103⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"104⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"105⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"106⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"107⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\B035.tmp"C:\Users\Admin\AppData\Local\Temp\B035.tmp"108⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\B093.tmp"C:\Users\Admin\AppData\Local\Temp\B093.tmp"109⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"110⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\B13F.tmp"C:\Users\Admin\AppData\Local\Temp\B13F.tmp"111⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\B18D.tmp"C:\Users\Admin\AppData\Local\Temp\B18D.tmp"112⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"113⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\B248.tmp"C:\Users\Admin\AppData\Local\Temp\B248.tmp"114⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\B297.tmp"C:\Users\Admin\AppData\Local\Temp\B297.tmp"115⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"116⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\B352.tmp"C:\Users\Admin\AppData\Local\Temp\B352.tmp"117⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"118⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"119⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\B44C.tmp"C:\Users\Admin\AppData\Local\Temp\B44C.tmp"120⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\B49A.tmp"C:\Users\Admin\AppData\Local\Temp\B49A.tmp"121⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"122⤵PID:628
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-