Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/10/2024, 06:32
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-09_2d6ed0cfc2ddb5d91ffdc37c3401a43f_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-10-09_2d6ed0cfc2ddb5d91ffdc37c3401a43f_mafia.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-09_2d6ed0cfc2ddb5d91ffdc37c3401a43f_mafia.exe
-
Size
520KB
-
MD5
2d6ed0cfc2ddb5d91ffdc37c3401a43f
-
SHA1
9f64e85a0b068586639ecb1587b64afc7cc31c6a
-
SHA256
43d69cc9decb1f7a6951536ad1b4a6820a70feebe34b5bf0bc2bb554d3063e52
-
SHA512
091fe383b00c10619fbbbc6d104492e8e246c3302ee07fb5f32d03c10c30f94f5101829a506907ef9bfc80580cd1498fefc4c22ed8c34ef8c30e99e6d3e93638
-
SSDEEP
12288:gj8fuxR21t5i8fS6eV9JhCiZWeo7pPilqdeyaVBnBCdgjG98NZ:gj8fuK1GYS6QhCCAFf4yuBCd6N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 180 9E92.tmp 5108 9F2E.tmp 348 9F8C.tmp 3684 9FF9.tmp 4324 A18F.tmp 2156 A20C.tmp 4120 A289.tmp 5012 A306.tmp 2616 A374.tmp 3564 A3F1.tmp 2216 A45E.tmp 2008 A4BC.tmp 2964 A539.tmp 3508 A596.tmp 3244 A5E5.tmp 3160 A652.tmp 4092 A6CF.tmp 2392 A74C.tmp 1388 A79A.tmp 2684 A7F8.tmp 2784 A865.tmp 3976 A8B3.tmp 1084 A930.tmp 2040 A9BD.tmp 2448 AA2A.tmp 3688 AAA7.tmp 5020 AB15.tmp 2916 AB82.tmp 1476 ABFF.tmp 1720 AC6C.tmp 3172 ACE9.tmp 1988 AD66.tmp 3920 ADB5.tmp 1728 AE22.tmp 4292 AE70.tmp 4016 AECE.tmp 4276 AF1C.tmp 1108 AF6A.tmp 3948 AFC8.tmp 1756 B026.tmp 4200 B083.tmp 3476 B0D1.tmp 920 B120.tmp 1468 B16E.tmp 816 B1BC.tmp 1328 B20A.tmp 4368 B268.tmp 4340 B2C5.tmp 1292 B314.tmp 2200 B362.tmp 4700 B3B0.tmp 4780 B3FE.tmp 3060 B44C.tmp 1408 B49A.tmp 2552 B4E8.tmp 348 B546.tmp 468 B594.tmp 932 B5E2.tmp 2080 B640.tmp 1524 B68E.tmp 2864 B6DC.tmp 2780 B73A.tmp 212 B798.tmp 5012 B805.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E70.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8596.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D164.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB3D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E05D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3553.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3812.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ED9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F482.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B67A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 172.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D760.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1519.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2AB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E2EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CFD.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4944 wrote to memory of 180 4944 2024-10-09_2d6ed0cfc2ddb5d91ffdc37c3401a43f_mafia.exe 85 PID 4944 wrote to memory of 180 4944 2024-10-09_2d6ed0cfc2ddb5d91ffdc37c3401a43f_mafia.exe 85 PID 4944 wrote to memory of 180 4944 2024-10-09_2d6ed0cfc2ddb5d91ffdc37c3401a43f_mafia.exe 85 PID 180 wrote to memory of 5108 180 9E92.tmp 87 PID 180 wrote to memory of 5108 180 9E92.tmp 87 PID 180 wrote to memory of 5108 180 9E92.tmp 87 PID 5108 wrote to memory of 348 5108 9F2E.tmp 88 PID 5108 wrote to memory of 348 5108 9F2E.tmp 88 PID 5108 wrote to memory of 348 5108 9F2E.tmp 88 PID 348 wrote to memory of 3684 348 9F8C.tmp 89 PID 348 wrote to memory of 3684 348 9F8C.tmp 89 PID 348 wrote to memory of 3684 348 9F8C.tmp 89 PID 3684 wrote to memory of 4324 3684 9FF9.tmp 90 PID 3684 wrote to memory of 4324 3684 9FF9.tmp 90 PID 3684 wrote to memory of 4324 3684 9FF9.tmp 90 PID 4324 wrote to memory of 2156 4324 A18F.tmp 91 PID 4324 wrote to memory of 2156 4324 A18F.tmp 91 PID 4324 wrote to memory of 2156 4324 A18F.tmp 91 PID 2156 wrote to memory of 4120 2156 A20C.tmp 92 PID 2156 wrote to memory of 4120 2156 A20C.tmp 92 PID 2156 wrote to memory of 4120 2156 A20C.tmp 92 PID 4120 wrote to memory of 5012 4120 A289.tmp 93 PID 4120 wrote to memory of 5012 4120 A289.tmp 93 PID 4120 wrote to memory of 5012 4120 A289.tmp 93 PID 5012 wrote to memory of 2616 5012 A306.tmp 94 PID 5012 wrote to memory of 2616 5012 A306.tmp 94 PID 5012 wrote to memory of 2616 5012 A306.tmp 94 PID 2616 wrote to memory of 3564 2616 A374.tmp 95 PID 2616 wrote to memory of 3564 2616 A374.tmp 95 PID 2616 wrote to memory of 3564 2616 A374.tmp 95 PID 3564 wrote to memory of 2216 3564 A3F1.tmp 96 PID 3564 wrote to memory of 2216 3564 A3F1.tmp 96 PID 3564 wrote to memory of 2216 3564 A3F1.tmp 96 PID 2216 wrote to memory of 2008 2216 A45E.tmp 97 PID 2216 wrote to memory of 2008 2216 A45E.tmp 97 PID 2216 wrote to memory of 2008 2216 A45E.tmp 97 PID 2008 wrote to memory of 2964 2008 A4BC.tmp 98 PID 2008 wrote to memory of 2964 2008 A4BC.tmp 98 PID 2008 wrote to memory of 2964 2008 A4BC.tmp 98 PID 2964 wrote to memory of 3508 2964 A539.tmp 99 PID 2964 wrote to memory of 3508 2964 A539.tmp 99 PID 2964 wrote to memory of 3508 2964 A539.tmp 99 PID 3508 wrote to memory of 3244 3508 A596.tmp 100 PID 3508 wrote to memory of 3244 3508 A596.tmp 100 PID 3508 wrote to memory of 3244 3508 A596.tmp 100 PID 3244 wrote to memory of 3160 3244 A5E5.tmp 101 PID 3244 wrote to memory of 3160 3244 A5E5.tmp 101 PID 3244 wrote to memory of 3160 3244 A5E5.tmp 101 PID 3160 wrote to memory of 4092 3160 A652.tmp 102 PID 3160 wrote to memory of 4092 3160 A652.tmp 102 PID 3160 wrote to memory of 4092 3160 A652.tmp 102 PID 4092 wrote to memory of 2392 4092 A6CF.tmp 103 PID 4092 wrote to memory of 2392 4092 A6CF.tmp 103 PID 4092 wrote to memory of 2392 4092 A6CF.tmp 103 PID 2392 wrote to memory of 1388 2392 A74C.tmp 104 PID 2392 wrote to memory of 1388 2392 A74C.tmp 104 PID 2392 wrote to memory of 1388 2392 A74C.tmp 104 PID 1388 wrote to memory of 2684 1388 A79A.tmp 105 PID 1388 wrote to memory of 2684 1388 A79A.tmp 105 PID 1388 wrote to memory of 2684 1388 A79A.tmp 105 PID 2684 wrote to memory of 2784 2684 A7F8.tmp 106 PID 2684 wrote to memory of 2784 2684 A7F8.tmp 106 PID 2684 wrote to memory of 2784 2684 A7F8.tmp 106 PID 2784 wrote to memory of 3976 2784 A865.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-09_2d6ed0cfc2ddb5d91ffdc37c3401a43f_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-09_2d6ed0cfc2ddb5d91ffdc37c3401a43f_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\9E92.tmp"C:\Users\Admin\AppData\Local\Temp\9E92.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:180 -
C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:348 -
C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\A18F.tmp"C:\Users\Admin\AppData\Local\Temp\A18F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\A20C.tmp"C:\Users\Admin\AppData\Local\Temp\A20C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\A289.tmp"C:\Users\Admin\AppData\Local\Temp\A289.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\A306.tmp"C:\Users\Admin\AppData\Local\Temp\A306.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\A374.tmp"C:\Users\Admin\AppData\Local\Temp\A374.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\A45E.tmp"C:\Users\Admin\AppData\Local\Temp\A45E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\A539.tmp"C:\Users\Admin\AppData\Local\Temp\A539.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\A596.tmp"C:\Users\Admin\AppData\Local\Temp\A596.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\A652.tmp"C:\Users\Admin\AppData\Local\Temp\A652.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\A6CF.tmp"C:\Users\Admin\AppData\Local\Temp\A6CF.tmp"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\A74C.tmp"C:\Users\Admin\AppData\Local\Temp\A74C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\A79A.tmp"C:\Users\Admin\AppData\Local\Temp\A79A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\A865.tmp"C:\Users\Admin\AppData\Local\Temp\A865.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"23⤵
- Executes dropped EXE
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\A930.tmp"C:\Users\Admin\AppData\Local\Temp\A930.tmp"24⤵
- Executes dropped EXE
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"25⤵
- Executes dropped EXE
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"26⤵
- Executes dropped EXE
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"27⤵
- Executes dropped EXE
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\AB15.tmp"C:\Users\Admin\AppData\Local\Temp\AB15.tmp"28⤵
- Executes dropped EXE
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\AB82.tmp"C:\Users\Admin\AppData\Local\Temp\AB82.tmp"29⤵
- Executes dropped EXE
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"30⤵
- Executes dropped EXE
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"31⤵
- Executes dropped EXE
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\AD66.tmp"C:\Users\Admin\AppData\Local\Temp\AD66.tmp"33⤵
- Executes dropped EXE
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"34⤵
- Executes dropped EXE
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\AE22.tmp"C:\Users\Admin\AppData\Local\Temp\AE22.tmp"35⤵
- Executes dropped EXE
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\AE70.tmp"C:\Users\Admin\AppData\Local\Temp\AE70.tmp"36⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\AECE.tmp"C:\Users\Admin\AppData\Local\Temp\AECE.tmp"37⤵
- Executes dropped EXE
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"38⤵
- Executes dropped EXE
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\AF6A.tmp"C:\Users\Admin\AppData\Local\Temp\AF6A.tmp"39⤵
- Executes dropped EXE
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"40⤵
- Executes dropped EXE
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\B026.tmp"C:\Users\Admin\AppData\Local\Temp\B026.tmp"41⤵
- Executes dropped EXE
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\B083.tmp"C:\Users\Admin\AppData\Local\Temp\B083.tmp"42⤵
- Executes dropped EXE
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"43⤵
- Executes dropped EXE
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\B120.tmp"C:\Users\Admin\AppData\Local\Temp\B120.tmp"44⤵
- Executes dropped EXE
PID:920 -
C:\Users\Admin\AppData\Local\Temp\B16E.tmp"C:\Users\Admin\AppData\Local\Temp\B16E.tmp"45⤵
- Executes dropped EXE
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\B1BC.tmp"C:\Users\Admin\AppData\Local\Temp\B1BC.tmp"46⤵
- Executes dropped EXE
PID:816 -
C:\Users\Admin\AppData\Local\Temp\B20A.tmp"C:\Users\Admin\AppData\Local\Temp\B20A.tmp"47⤵
- Executes dropped EXE
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\B268.tmp"C:\Users\Admin\AppData\Local\Temp\B268.tmp"48⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"49⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\B314.tmp"C:\Users\Admin\AppData\Local\Temp\B314.tmp"50⤵
- Executes dropped EXE
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\B362.tmp"C:\Users\Admin\AppData\Local\Temp\B362.tmp"51⤵
- Executes dropped EXE
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"52⤵
- Executes dropped EXE
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"53⤵
- Executes dropped EXE
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\B44C.tmp"C:\Users\Admin\AppData\Local\Temp\B44C.tmp"54⤵
- Executes dropped EXE
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\B49A.tmp"C:\Users\Admin\AppData\Local\Temp\B49A.tmp"55⤵
- Executes dropped EXE
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"56⤵
- Executes dropped EXE
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\B546.tmp"C:\Users\Admin\AppData\Local\Temp\B546.tmp"57⤵
- Executes dropped EXE
PID:348 -
C:\Users\Admin\AppData\Local\Temp\B594.tmp"C:\Users\Admin\AppData\Local\Temp\B594.tmp"58⤵
- Executes dropped EXE
PID:468 -
C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"59⤵
- Executes dropped EXE
PID:932 -
C:\Users\Admin\AppData\Local\Temp\B640.tmp"C:\Users\Admin\AppData\Local\Temp\B640.tmp"60⤵
- Executes dropped EXE
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\B68E.tmp"C:\Users\Admin\AppData\Local\Temp\B68E.tmp"61⤵
- Executes dropped EXE
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"62⤵
- Executes dropped EXE
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\B73A.tmp"C:\Users\Admin\AppData\Local\Temp\B73A.tmp"63⤵
- Executes dropped EXE
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\B798.tmp"C:\Users\Admin\AppData\Local\Temp\B798.tmp"64⤵
- Executes dropped EXE
PID:212 -
C:\Users\Admin\AppData\Local\Temp\B805.tmp"C:\Users\Admin\AppData\Local\Temp\B805.tmp"65⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\B863.tmp"C:\Users\Admin\AppData\Local\Temp\B863.tmp"66⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"67⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"68⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\B94D.tmp"C:\Users\Admin\AppData\Local\Temp\B94D.tmp"69⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\B99B.tmp"C:\Users\Admin\AppData\Local\Temp\B99B.tmp"70⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\B9F9.tmp"C:\Users\Admin\AppData\Local\Temp\B9F9.tmp"71⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\BA47.tmp"C:\Users\Admin\AppData\Local\Temp\BA47.tmp"72⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\BA95.tmp"C:\Users\Admin\AppData\Local\Temp\BA95.tmp"73⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"74⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\BB32.tmp"C:\Users\Admin\AppData\Local\Temp\BB32.tmp"75⤵
- System Location Discovery: System Language Discovery
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\BB8F.tmp"C:\Users\Admin\AppData\Local\Temp\BB8F.tmp"76⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"77⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\BC2C.tmp"C:\Users\Admin\AppData\Local\Temp\BC2C.tmp"78⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\BC89.tmp"C:\Users\Admin\AppData\Local\Temp\BC89.tmp"79⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\BCD8.tmp"C:\Users\Admin\AppData\Local\Temp\BCD8.tmp"80⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\BD35.tmp"C:\Users\Admin\AppData\Local\Temp\BD35.tmp"81⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\BD83.tmp"C:\Users\Admin\AppData\Local\Temp\BD83.tmp"82⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"83⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"84⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\BE7D.tmp"C:\Users\Admin\AppData\Local\Temp\BE7D.tmp"85⤵PID:428
-
C:\Users\Admin\AppData\Local\Temp\BECC.tmp"C:\Users\Admin\AppData\Local\Temp\BECC.tmp"86⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"87⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\BF68.tmp"C:\Users\Admin\AppData\Local\Temp\BF68.tmp"88⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\BFB6.tmp"C:\Users\Admin\AppData\Local\Temp\BFB6.tmp"89⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\C014.tmp"C:\Users\Admin\AppData\Local\Temp\C014.tmp"90⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\C062.tmp"C:\Users\Admin\AppData\Local\Temp\C062.tmp"91⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"92⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\C11D.tmp"C:\Users\Admin\AppData\Local\Temp\C11D.tmp"93⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\C17B.tmp"C:\Users\Admin\AppData\Local\Temp\C17B.tmp"94⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"95⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\C217.tmp"C:\Users\Admin\AppData\Local\Temp\C217.tmp"96⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\C275.tmp"C:\Users\Admin\AppData\Local\Temp\C275.tmp"97⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"98⤵PID:660
-
C:\Users\Admin\AppData\Local\Temp\C311.tmp"C:\Users\Admin\AppData\Local\Temp\C311.tmp"99⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\C35F.tmp"C:\Users\Admin\AppData\Local\Temp\C35F.tmp"100⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\C3AE.tmp"C:\Users\Admin\AppData\Local\Temp\C3AE.tmp"101⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"102⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\C459.tmp"C:\Users\Admin\AppData\Local\Temp\C459.tmp"103⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"104⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"105⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\C553.tmp"C:\Users\Admin\AppData\Local\Temp\C553.tmp"106⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\C5B1.tmp"C:\Users\Admin\AppData\Local\Temp\C5B1.tmp"107⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\C60F.tmp"C:\Users\Admin\AppData\Local\Temp\C60F.tmp"108⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\C65D.tmp"C:\Users\Admin\AppData\Local\Temp\C65D.tmp"109⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"110⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\C709.tmp"C:\Users\Admin\AppData\Local\Temp\C709.tmp"111⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\C757.tmp"C:\Users\Admin\AppData\Local\Temp\C757.tmp"112⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\C7B5.tmp"C:\Users\Admin\AppData\Local\Temp\C7B5.tmp"113⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\C813.tmp"C:\Users\Admin\AppData\Local\Temp\C813.tmp"114⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\C861.tmp"C:\Users\Admin\AppData\Local\Temp\C861.tmp"115⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"116⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\C90D.tmp"C:\Users\Admin\AppData\Local\Temp\C90D.tmp"117⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\C95B.tmp"C:\Users\Admin\AppData\Local\Temp\C95B.tmp"118⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\C9B8.tmp"C:\Users\Admin\AppData\Local\Temp\C9B8.tmp"119⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\CA16.tmp"C:\Users\Admin\AppData\Local\Temp\CA16.tmp"120⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\CA55.tmp"C:\Users\Admin\AppData\Local\Temp\CA55.tmp"121⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\CAA3.tmp"C:\Users\Admin\AppData\Local\Temp\CAA3.tmp"122⤵
- System Location Discovery: System Language Discovery
PID:180
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-