Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2024, 13:44
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-04_e692c57e20350a0fee1111effbd920f6_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-04_e692c57e20350a0fee1111effbd920f6_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-10-04_e692c57e20350a0fee1111effbd920f6_mafia.exe
-
Size
541KB
-
MD5
e692c57e20350a0fee1111effbd920f6
-
SHA1
88c77efd63f602bd67bc687812733d64034a2d6f
-
SHA256
35c563c2f32b804634e5a74fa526f7cea654c3f96061120b238f6491f1150c52
-
SHA512
c9c118cd55236e93ac8af74b95f9cdc40775ce3e57cd74a7d990a1e0cbd3af399a6e2343473f08093c683efb44b11726b4114018db142c8081e4a9dc667f205d
-
SSDEEP
12288:UU5rCOTeifrVPRYT3YXAZ9rPLLQ+4uGFLrZa73ctO:UUQOJfrVpYT3nLfQ+4uG9rU73ctO
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4964 EF3C.tmp 1332 EFC9.tmp 4948 F065.tmp 3172 F111.tmp 5068 F19E.tmp 1564 F22A.tmp 3076 F2A7.tmp 1068 F334.tmp 1364 F3B1.tmp 984 F41E.tmp 4680 F48C.tmp 5004 F538.tmp 2992 F5D4.tmp 1528 F641.tmp 3240 F6CE.tmp 1016 F76A.tmp 3880 F806.tmp 4928 F8A3.tmp 4764 F93F.tmp 972 F9DB.tmp 696 FA77.tmp 1316 FB23.tmp 5044 FBB0.tmp 3408 FC4C.tmp 2180 FCE8.tmp 2328 FDA4.tmp 3916 FE40.tmp 4300 FEDC.tmp 2092 FF79.tmp 1584 15.tmp 4908 B1.tmp 536 13E.tmp 1968 1DA.tmp 1936 247.tmp 3188 296.tmp 1112 303.tmp 4836 370.tmp 4624 3CE.tmp 4000 41C.tmp 4444 47A.tmp 3032 4E7.tmp 2972 545.tmp 4332 5B2.tmp 2020 610.tmp 2196 65E.tmp 2860 6BC.tmp 1116 729.tmp 4808 797.tmp 780 814.tmp 2216 872.tmp 3076 8DF.tmp 4688 94C.tmp 1392 9AA.tmp 2456 A08.tmp 2704 A75.tmp 2316 AD3.tmp 3508 B21.tmp 3528 B7F.tmp 932 BCD.tmp 3148 C1B.tmp 4076 C88.tmp 972 CF6.tmp 3864 D44.tmp 4716 DA2.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7204.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A751.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F449.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7446.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 440E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 641A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 236C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BD8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 359C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D79.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6FE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D77A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9272.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 133F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6959.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2030.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6826.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8439.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA0E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1936.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 893A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DA.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2488 wrote to memory of 4964 2488 2024-10-04_e692c57e20350a0fee1111effbd920f6_mafia.exe 89 PID 2488 wrote to memory of 4964 2488 2024-10-04_e692c57e20350a0fee1111effbd920f6_mafia.exe 89 PID 2488 wrote to memory of 4964 2488 2024-10-04_e692c57e20350a0fee1111effbd920f6_mafia.exe 89 PID 4964 wrote to memory of 1332 4964 EF3C.tmp 90 PID 4964 wrote to memory of 1332 4964 EF3C.tmp 90 PID 4964 wrote to memory of 1332 4964 EF3C.tmp 90 PID 1332 wrote to memory of 4948 1332 EFC9.tmp 91 PID 1332 wrote to memory of 4948 1332 EFC9.tmp 91 PID 1332 wrote to memory of 4948 1332 EFC9.tmp 91 PID 4948 wrote to memory of 3172 4948 F065.tmp 92 PID 4948 wrote to memory of 3172 4948 F065.tmp 92 PID 4948 wrote to memory of 3172 4948 F065.tmp 92 PID 3172 wrote to memory of 5068 3172 F111.tmp 93 PID 3172 wrote to memory of 5068 3172 F111.tmp 93 PID 3172 wrote to memory of 5068 3172 F111.tmp 93 PID 5068 wrote to memory of 1564 5068 F19E.tmp 94 PID 5068 wrote to memory of 1564 5068 F19E.tmp 94 PID 5068 wrote to memory of 1564 5068 F19E.tmp 94 PID 1564 wrote to memory of 3076 1564 F22A.tmp 95 PID 1564 wrote to memory of 3076 1564 F22A.tmp 95 PID 1564 wrote to memory of 3076 1564 F22A.tmp 95 PID 3076 wrote to memory of 1068 3076 F2A7.tmp 96 PID 3076 wrote to memory of 1068 3076 F2A7.tmp 96 PID 3076 wrote to memory of 1068 3076 F2A7.tmp 96 PID 1068 wrote to memory of 1364 1068 F334.tmp 97 PID 1068 wrote to memory of 1364 1068 F334.tmp 97 PID 1068 wrote to memory of 1364 1068 F334.tmp 97 PID 1364 wrote to memory of 984 1364 F3B1.tmp 98 PID 1364 wrote to memory of 984 1364 F3B1.tmp 98 PID 1364 wrote to memory of 984 1364 F3B1.tmp 98 PID 984 wrote to memory of 4680 984 F41E.tmp 99 PID 984 wrote to memory of 4680 984 F41E.tmp 99 PID 984 wrote to memory of 4680 984 F41E.tmp 99 PID 4680 wrote to memory of 5004 4680 F48C.tmp 100 PID 4680 wrote to memory of 5004 4680 F48C.tmp 100 PID 4680 wrote to memory of 5004 4680 F48C.tmp 100 PID 5004 wrote to memory of 2992 5004 F538.tmp 101 PID 5004 wrote to memory of 2992 5004 F538.tmp 101 PID 5004 wrote to memory of 2992 5004 F538.tmp 101 PID 2992 wrote to memory of 1528 2992 F5D4.tmp 102 PID 2992 wrote to memory of 1528 2992 F5D4.tmp 102 PID 2992 wrote to memory of 1528 2992 F5D4.tmp 102 PID 1528 wrote to memory of 3240 1528 F641.tmp 103 PID 1528 wrote to memory of 3240 1528 F641.tmp 103 PID 1528 wrote to memory of 3240 1528 F641.tmp 103 PID 3240 wrote to memory of 1016 3240 F6CE.tmp 104 PID 3240 wrote to memory of 1016 3240 F6CE.tmp 104 PID 3240 wrote to memory of 1016 3240 F6CE.tmp 104 PID 1016 wrote to memory of 3880 1016 F76A.tmp 105 PID 1016 wrote to memory of 3880 1016 F76A.tmp 105 PID 1016 wrote to memory of 3880 1016 F76A.tmp 105 PID 3880 wrote to memory of 4928 3880 F806.tmp 106 PID 3880 wrote to memory of 4928 3880 F806.tmp 106 PID 3880 wrote to memory of 4928 3880 F806.tmp 106 PID 4928 wrote to memory of 4764 4928 F8A3.tmp 107 PID 4928 wrote to memory of 4764 4928 F8A3.tmp 107 PID 4928 wrote to memory of 4764 4928 F8A3.tmp 107 PID 4764 wrote to memory of 972 4764 F93F.tmp 108 PID 4764 wrote to memory of 972 4764 F93F.tmp 108 PID 4764 wrote to memory of 972 4764 F93F.tmp 108 PID 972 wrote to memory of 696 972 F9DB.tmp 109 PID 972 wrote to memory of 696 972 F9DB.tmp 109 PID 972 wrote to memory of 696 972 F9DB.tmp 109 PID 696 wrote to memory of 1316 696 FA77.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-04_e692c57e20350a0fee1111effbd920f6_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-04_e692c57e20350a0fee1111effbd920f6_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\EF3C.tmp"C:\Users\Admin\AppData\Local\Temp\EF3C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\EFC9.tmp"C:\Users\Admin\AppData\Local\Temp\EFC9.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\F065.tmp"C:\Users\Admin\AppData\Local\Temp\F065.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\F111.tmp"C:\Users\Admin\AppData\Local\Temp\F111.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\F19E.tmp"C:\Users\Admin\AppData\Local\Temp\F19E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\F22A.tmp"C:\Users\Admin\AppData\Local\Temp\F22A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\F2A7.tmp"C:\Users\Admin\AppData\Local\Temp\F2A7.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\F334.tmp"C:\Users\Admin\AppData\Local\Temp\F334.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\F3B1.tmp"C:\Users\Admin\AppData\Local\Temp\F3B1.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\F41E.tmp"C:\Users\Admin\AppData\Local\Temp\F41E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Users\Admin\AppData\Local\Temp\F48C.tmp"C:\Users\Admin\AppData\Local\Temp\F48C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\F538.tmp"C:\Users\Admin\AppData\Local\Temp\F538.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\F5D4.tmp"C:\Users\Admin\AppData\Local\Temp\F5D4.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\F641.tmp"C:\Users\Admin\AppData\Local\Temp\F641.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\F6CE.tmp"C:\Users\Admin\AppData\Local\Temp\F6CE.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\F76A.tmp"C:\Users\Admin\AppData\Local\Temp\F76A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\F806.tmp"C:\Users\Admin\AppData\Local\Temp\F806.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\F8A3.tmp"C:\Users\Admin\AppData\Local\Temp\F8A3.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\F93F.tmp"C:\Users\Admin\AppData\Local\Temp\F93F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\F9DB.tmp"C:\Users\Admin\AppData\Local\Temp\F9DB.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\FA77.tmp"C:\Users\Admin\AppData\Local\Temp\FA77.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Users\Admin\AppData\Local\Temp\FB23.tmp"C:\Users\Admin\AppData\Local\Temp\FB23.tmp"23⤵
- Executes dropped EXE
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\FBB0.tmp"C:\Users\Admin\AppData\Local\Temp\FBB0.tmp"24⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\FC4C.tmp"C:\Users\Admin\AppData\Local\Temp\FC4C.tmp"25⤵
- Executes dropped EXE
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\FCE8.tmp"C:\Users\Admin\AppData\Local\Temp\FCE8.tmp"26⤵
- Executes dropped EXE
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\FDA4.tmp"C:\Users\Admin\AppData\Local\Temp\FDA4.tmp"27⤵
- Executes dropped EXE
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\FE40.tmp"C:\Users\Admin\AppData\Local\Temp\FE40.tmp"28⤵
- Executes dropped EXE
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\FEDC.tmp"C:\Users\Admin\AppData\Local\Temp\FEDC.tmp"29⤵
- Executes dropped EXE
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\FF79.tmp"C:\Users\Admin\AppData\Local\Temp\FF79.tmp"30⤵
- Executes dropped EXE
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\15.tmp"C:\Users\Admin\AppData\Local\Temp\15.tmp"31⤵
- Executes dropped EXE
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\B1.tmp"C:\Users\Admin\AppData\Local\Temp\B1.tmp"32⤵
- Executes dropped EXE
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\13E.tmp"C:\Users\Admin\AppData\Local\Temp\13E.tmp"33⤵
- Executes dropped EXE
PID:536 -
C:\Users\Admin\AppData\Local\Temp\1DA.tmp"C:\Users\Admin\AppData\Local\Temp\1DA.tmp"34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\247.tmp"C:\Users\Admin\AppData\Local\Temp\247.tmp"35⤵
- Executes dropped EXE
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\296.tmp"C:\Users\Admin\AppData\Local\Temp\296.tmp"36⤵
- Executes dropped EXE
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\303.tmp"C:\Users\Admin\AppData\Local\Temp\303.tmp"37⤵
- Executes dropped EXE
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\370.tmp"C:\Users\Admin\AppData\Local\Temp\370.tmp"38⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\3CE.tmp"C:\Users\Admin\AppData\Local\Temp\3CE.tmp"39⤵
- Executes dropped EXE
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\41C.tmp"C:\Users\Admin\AppData\Local\Temp\41C.tmp"40⤵
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\47A.tmp"C:\Users\Admin\AppData\Local\Temp\47A.tmp"41⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\4E7.tmp"C:\Users\Admin\AppData\Local\Temp\4E7.tmp"42⤵
- Executes dropped EXE
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\545.tmp"C:\Users\Admin\AppData\Local\Temp\545.tmp"43⤵
- Executes dropped EXE
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\5B2.tmp"C:\Users\Admin\AppData\Local\Temp\5B2.tmp"44⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\610.tmp"C:\Users\Admin\AppData\Local\Temp\610.tmp"45⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\65E.tmp"C:\Users\Admin\AppData\Local\Temp\65E.tmp"46⤵
- Executes dropped EXE
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\6BC.tmp"C:\Users\Admin\AppData\Local\Temp\6BC.tmp"47⤵
- Executes dropped EXE
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\729.tmp"C:\Users\Admin\AppData\Local\Temp\729.tmp"48⤵
- Executes dropped EXE
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\797.tmp"C:\Users\Admin\AppData\Local\Temp\797.tmp"49⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\814.tmp"C:\Users\Admin\AppData\Local\Temp\814.tmp"50⤵
- Executes dropped EXE
PID:780 -
C:\Users\Admin\AppData\Local\Temp\872.tmp"C:\Users\Admin\AppData\Local\Temp\872.tmp"51⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\8DF.tmp"C:\Users\Admin\AppData\Local\Temp\8DF.tmp"52⤵
- Executes dropped EXE
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\94C.tmp"C:\Users\Admin\AppData\Local\Temp\94C.tmp"53⤵
- Executes dropped EXE
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\9AA.tmp"C:\Users\Admin\AppData\Local\Temp\9AA.tmp"54⤵
- Executes dropped EXE
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\A08.tmp"C:\Users\Admin\AppData\Local\Temp\A08.tmp"55⤵
- Executes dropped EXE
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\A75.tmp"C:\Users\Admin\AppData\Local\Temp\A75.tmp"56⤵
- Executes dropped EXE
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\AD3.tmp"C:\Users\Admin\AppData\Local\Temp\AD3.tmp"57⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\B21.tmp"C:\Users\Admin\AppData\Local\Temp\B21.tmp"58⤵
- Executes dropped EXE
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\B7F.tmp"C:\Users\Admin\AppData\Local\Temp\B7F.tmp"59⤵
- Executes dropped EXE
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\BCD.tmp"C:\Users\Admin\AppData\Local\Temp\BCD.tmp"60⤵
- Executes dropped EXE
PID:932 -
C:\Users\Admin\AppData\Local\Temp\C1B.tmp"C:\Users\Admin\AppData\Local\Temp\C1B.tmp"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\C88.tmp"C:\Users\Admin\AppData\Local\Temp\C88.tmp"62⤵
- Executes dropped EXE
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\CF6.tmp"C:\Users\Admin\AppData\Local\Temp\CF6.tmp"63⤵
- Executes dropped EXE
PID:972 -
C:\Users\Admin\AppData\Local\Temp\D44.tmp"C:\Users\Admin\AppData\Local\Temp\D44.tmp"64⤵
- Executes dropped EXE
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\DA2.tmp"C:\Users\Admin\AppData\Local\Temp\DA2.tmp"65⤵
- Executes dropped EXE
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\DFF.tmp"C:\Users\Admin\AppData\Local\Temp\DFF.tmp"66⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\E5D.tmp"C:\Users\Admin\AppData\Local\Temp\E5D.tmp"67⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\EBB.tmp"C:\Users\Admin\AppData\Local\Temp\EBB.tmp"68⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\F19.tmp"C:\Users\Admin\AppData\Local\Temp\F19.tmp"69⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\F76.tmp"C:\Users\Admin\AppData\Local\Temp\F76.tmp"70⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\FD4.tmp"C:\Users\Admin\AppData\Local\Temp\FD4.tmp"71⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\1032.tmp"C:\Users\Admin\AppData\Local\Temp\1032.tmp"72⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\1090.tmp"C:\Users\Admin\AppData\Local\Temp\1090.tmp"73⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\10ED.tmp"C:\Users\Admin\AppData\Local\Temp\10ED.tmp"74⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\114B.tmp"C:\Users\Admin\AppData\Local\Temp\114B.tmp"75⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\11B9.tmp"C:\Users\Admin\AppData\Local\Temp\11B9.tmp"76⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\1216.tmp"C:\Users\Admin\AppData\Local\Temp\1216.tmp"77⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\1274.tmp"C:\Users\Admin\AppData\Local\Temp\1274.tmp"78⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\12D2.tmp"C:\Users\Admin\AppData\Local\Temp\12D2.tmp"79⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\133F.tmp"C:\Users\Admin\AppData\Local\Temp\133F.tmp"80⤵
- System Location Discovery: System Language Discovery
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\139D.tmp"C:\Users\Admin\AppData\Local\Temp\139D.tmp"81⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\13FB.tmp"C:\Users\Admin\AppData\Local\Temp\13FB.tmp"82⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\1468.tmp"C:\Users\Admin\AppData\Local\Temp\1468.tmp"83⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\14D5.tmp"C:\Users\Admin\AppData\Local\Temp\14D5.tmp"84⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\1543.tmp"C:\Users\Admin\AppData\Local\Temp\1543.tmp"85⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\15B0.tmp"C:\Users\Admin\AppData\Local\Temp\15B0.tmp"86⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\15FE.tmp"C:\Users\Admin\AppData\Local\Temp\15FE.tmp"87⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\166C.tmp"C:\Users\Admin\AppData\Local\Temp\166C.tmp"88⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\16C9.tmp"C:\Users\Admin\AppData\Local\Temp\16C9.tmp"89⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\1727.tmp"C:\Users\Admin\AppData\Local\Temp\1727.tmp"90⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\1785.tmp"C:\Users\Admin\AppData\Local\Temp\1785.tmp"91⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\17D3.tmp"C:\Users\Admin\AppData\Local\Temp\17D3.tmp"92⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\1840.tmp"C:\Users\Admin\AppData\Local\Temp\1840.tmp"93⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\18AE.tmp"C:\Users\Admin\AppData\Local\Temp\18AE.tmp"94⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\190C.tmp"C:\Users\Admin\AppData\Local\Temp\190C.tmp"95⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\1969.tmp"C:\Users\Admin\AppData\Local\Temp\1969.tmp"96⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\19C7.tmp"C:\Users\Admin\AppData\Local\Temp\19C7.tmp"97⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\1A34.tmp"C:\Users\Admin\AppData\Local\Temp\1A34.tmp"98⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"99⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\1B0F.tmp"C:\Users\Admin\AppData\Local\Temp\1B0F.tmp"100⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"101⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"102⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\1C19.tmp"C:\Users\Admin\AppData\Local\Temp\1C19.tmp"103⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\1C77.tmp"C:\Users\Admin\AppData\Local\Temp\1C77.tmp"104⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\1CE4.tmp"C:\Users\Admin\AppData\Local\Temp\1CE4.tmp"105⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\1D51.tmp"C:\Users\Admin\AppData\Local\Temp\1D51.tmp"106⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\1D9F.tmp"C:\Users\Admin\AppData\Local\Temp\1D9F.tmp"107⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\1E0D.tmp"C:\Users\Admin\AppData\Local\Temp\1E0D.tmp"108⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\1E7A.tmp"C:\Users\Admin\AppData\Local\Temp\1E7A.tmp"109⤵
- System Location Discovery: System Language Discovery
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\1EF7.tmp"C:\Users\Admin\AppData\Local\Temp\1EF7.tmp"110⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\1F65.tmp"C:\Users\Admin\AppData\Local\Temp\1F65.tmp"111⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\1FD2.tmp"C:\Users\Admin\AppData\Local\Temp\1FD2.tmp"112⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\2030.tmp"C:\Users\Admin\AppData\Local\Temp\2030.tmp"113⤵
- System Location Discovery: System Language Discovery
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\208D.tmp"C:\Users\Admin\AppData\Local\Temp\208D.tmp"114⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\20FB.tmp"C:\Users\Admin\AppData\Local\Temp\20FB.tmp"115⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\2159.tmp"C:\Users\Admin\AppData\Local\Temp\2159.tmp"116⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\21B6.tmp"C:\Users\Admin\AppData\Local\Temp\21B6.tmp"117⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\2214.tmp"C:\Users\Admin\AppData\Local\Temp\2214.tmp"118⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\2272.tmp"C:\Users\Admin\AppData\Local\Temp\2272.tmp"119⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\22D0.tmp"C:\Users\Admin\AppData\Local\Temp\22D0.tmp"120⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\231E.tmp"C:\Users\Admin\AppData\Local\Temp\231E.tmp"121⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\236C.tmp"C:\Users\Admin\AppData\Local\Temp\236C.tmp"122⤵
- System Location Discovery: System Language Discovery
PID:2120
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-