Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/10/2024, 07:03
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-09_9f304503e84ccbbeea9a4447a81cd870_mafia.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-10-09_9f304503e84ccbbeea9a4447a81cd870_mafia.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-09_9f304503e84ccbbeea9a4447a81cd870_mafia.exe
-
Size
527KB
-
MD5
9f304503e84ccbbeea9a4447a81cd870
-
SHA1
e8d823241171e30196690b44dc3c47222f3ca221
-
SHA256
a2eb17f7747d7afe992fc44b3dff73c5c7c979e6e26bc9f8402b7b5b4474148d
-
SHA512
3c4f3db24ac8278230de512db64679c47f8ac0221158b504928a50db5706e50368eba14b050f1fffd6eb8fef1fdbf64ca7efb744af51469090b0d5cea27cbe51
-
SSDEEP
12288:fU5rCOTeidUBUGfmabf8f9zbSv/nNyGH4Fr9/t3AvDZu:fUQOJdFy8I0GH4Fr5taDo
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3644 A940.tmp 220 A9CD.tmp 1800 AA2A.tmp 4300 AAB7.tmp 408 AB34.tmp 3868 ABA1.tmp 5096 AC2E.tmp 3252 ACAB.tmp 2412 AD28.tmp 2544 AD76.tmp 3936 ADC4.tmp 872 AE41.tmp 3164 AE9F.tmp 1196 AEED.tmp 2408 AF89.tmp 2720 AFF7.tmp 664 B045.tmp 1376 B0A3.tmp 4576 B120.tmp 2760 B16E.tmp 1680 B1DB.tmp 396 B248.tmp 2032 B2B6.tmp 3580 B323.tmp 2836 B3A0.tmp 3080 B43C.tmp 316 B4B9.tmp 3548 B517.tmp 2300 B594.tmp 1852 B602.tmp 3520 B66F.tmp 4260 B6DC.tmp 4524 B769.tmp 4364 B7C7.tmp 3480 B815.tmp 1836 B863.tmp 100 B8C1.tmp 3488 B90F.tmp 2228 B96D.tmp 3004 B9CA.tmp 3620 BA28.tmp 2552 BA76.tmp 3528 BAC4.tmp 1208 BB12.tmp 3972 BB70.tmp 460 BBBE.tmp 2276 BC0C.tmp 2916 BC6A.tmp 1176 BCB8.tmp 4528 BD16.tmp 3940 BD74.tmp 4356 BDC2.tmp 3364 BE10.tmp 2024 BE5E.tmp 3644 BEAC.tmp 220 BEFA.tmp 3860 BF49.tmp 4984 BFA6.tmp 3116 BFF4.tmp 2660 C052.tmp 1512 C0A0.tmp 408 C0FE.tmp 3592 C14C.tmp 1540 C19A.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F92.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6685.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 849C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D25E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A236.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F567.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D169.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5232.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 316B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F731.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C416.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 819F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFCC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 466A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5724.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6184.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5484.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 311D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B96D.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3852 wrote to memory of 3644 3852 2024-10-09_9f304503e84ccbbeea9a4447a81cd870_mafia.exe 84 PID 3852 wrote to memory of 3644 3852 2024-10-09_9f304503e84ccbbeea9a4447a81cd870_mafia.exe 84 PID 3852 wrote to memory of 3644 3852 2024-10-09_9f304503e84ccbbeea9a4447a81cd870_mafia.exe 84 PID 3644 wrote to memory of 220 3644 A940.tmp 86 PID 3644 wrote to memory of 220 3644 A940.tmp 86 PID 3644 wrote to memory of 220 3644 A940.tmp 86 PID 220 wrote to memory of 1800 220 A9CD.tmp 87 PID 220 wrote to memory of 1800 220 A9CD.tmp 87 PID 220 wrote to memory of 1800 220 A9CD.tmp 87 PID 1800 wrote to memory of 4300 1800 AA2A.tmp 88 PID 1800 wrote to memory of 4300 1800 AA2A.tmp 88 PID 1800 wrote to memory of 4300 1800 AA2A.tmp 88 PID 4300 wrote to memory of 408 4300 AAB7.tmp 89 PID 4300 wrote to memory of 408 4300 AAB7.tmp 89 PID 4300 wrote to memory of 408 4300 AAB7.tmp 89 PID 408 wrote to memory of 3868 408 AB34.tmp 90 PID 408 wrote to memory of 3868 408 AB34.tmp 90 PID 408 wrote to memory of 3868 408 AB34.tmp 90 PID 3868 wrote to memory of 5096 3868 ABA1.tmp 91 PID 3868 wrote to memory of 5096 3868 ABA1.tmp 91 PID 3868 wrote to memory of 5096 3868 ABA1.tmp 91 PID 5096 wrote to memory of 3252 5096 AC2E.tmp 92 PID 5096 wrote to memory of 3252 5096 AC2E.tmp 92 PID 5096 wrote to memory of 3252 5096 AC2E.tmp 92 PID 3252 wrote to memory of 2412 3252 ACAB.tmp 93 PID 3252 wrote to memory of 2412 3252 ACAB.tmp 93 PID 3252 wrote to memory of 2412 3252 ACAB.tmp 93 PID 2412 wrote to memory of 2544 2412 AD28.tmp 94 PID 2412 wrote to memory of 2544 2412 AD28.tmp 94 PID 2412 wrote to memory of 2544 2412 AD28.tmp 94 PID 2544 wrote to memory of 3936 2544 AD76.tmp 95 PID 2544 wrote to memory of 3936 2544 AD76.tmp 95 PID 2544 wrote to memory of 3936 2544 AD76.tmp 95 PID 3936 wrote to memory of 872 3936 ADC4.tmp 96 PID 3936 wrote to memory of 872 3936 ADC4.tmp 96 PID 3936 wrote to memory of 872 3936 ADC4.tmp 96 PID 872 wrote to memory of 3164 872 AE41.tmp 97 PID 872 wrote to memory of 3164 872 AE41.tmp 97 PID 872 wrote to memory of 3164 872 AE41.tmp 97 PID 3164 wrote to memory of 1196 3164 AE9F.tmp 98 PID 3164 wrote to memory of 1196 3164 AE9F.tmp 98 PID 3164 wrote to memory of 1196 3164 AE9F.tmp 98 PID 1196 wrote to memory of 2408 1196 AEED.tmp 99 PID 1196 wrote to memory of 2408 1196 AEED.tmp 99 PID 1196 wrote to memory of 2408 1196 AEED.tmp 99 PID 2408 wrote to memory of 2720 2408 AF89.tmp 100 PID 2408 wrote to memory of 2720 2408 AF89.tmp 100 PID 2408 wrote to memory of 2720 2408 AF89.tmp 100 PID 2720 wrote to memory of 664 2720 AFF7.tmp 101 PID 2720 wrote to memory of 664 2720 AFF7.tmp 101 PID 2720 wrote to memory of 664 2720 AFF7.tmp 101 PID 664 wrote to memory of 1376 664 B045.tmp 102 PID 664 wrote to memory of 1376 664 B045.tmp 102 PID 664 wrote to memory of 1376 664 B045.tmp 102 PID 1376 wrote to memory of 4576 1376 B0A3.tmp 103 PID 1376 wrote to memory of 4576 1376 B0A3.tmp 103 PID 1376 wrote to memory of 4576 1376 B0A3.tmp 103 PID 4576 wrote to memory of 2760 4576 B120.tmp 104 PID 4576 wrote to memory of 2760 4576 B120.tmp 104 PID 4576 wrote to memory of 2760 4576 B120.tmp 104 PID 2760 wrote to memory of 1680 2760 B16E.tmp 105 PID 2760 wrote to memory of 1680 2760 B16E.tmp 105 PID 2760 wrote to memory of 1680 2760 B16E.tmp 105 PID 1680 wrote to memory of 396 1680 B1DB.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-09_9f304503e84ccbbeea9a4447a81cd870_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-09_9f304503e84ccbbeea9a4447a81cd870_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\A940.tmp"C:\Users\Admin\AppData\Local\Temp\A940.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\AB34.tmp"C:\Users\Admin\AppData\Local\Temp\AB34.tmp"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\AD28.tmp"C:\Users\Admin\AppData\Local\Temp\AD28.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\AD76.tmp"C:\Users\Admin\AppData\Local\Temp\AD76.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\ADC4.tmp"C:\Users\Admin\AppData\Local\Temp\ADC4.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\AE41.tmp"C:\Users\Admin\AppData\Local\Temp\AE41.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\AEED.tmp"C:\Users\Admin\AppData\Local\Temp\AEED.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\AF89.tmp"C:\Users\Admin\AppData\Local\Temp\AF89.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\B045.tmp"C:\Users\Admin\AppData\Local\Temp\B045.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\B120.tmp"C:\Users\Admin\AppData\Local\Temp\B120.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\B16E.tmp"C:\Users\Admin\AppData\Local\Temp\B16E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\B248.tmp"C:\Users\Admin\AppData\Local\Temp\B248.tmp"23⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"24⤵
- Executes dropped EXE
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\B323.tmp"C:\Users\Admin\AppData\Local\Temp\B323.tmp"25⤵
- Executes dropped EXE
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"26⤵
- Executes dropped EXE
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\B43C.tmp"C:\Users\Admin\AppData\Local\Temp\B43C.tmp"27⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:316 -
C:\Users\Admin\AppData\Local\Temp\B517.tmp"C:\Users\Admin\AppData\Local\Temp\B517.tmp"29⤵
- Executes dropped EXE
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\B594.tmp"C:\Users\Admin\AppData\Local\Temp\B594.tmp"30⤵
- Executes dropped EXE
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\B602.tmp"C:\Users\Admin\AppData\Local\Temp\B602.tmp"31⤵
- Executes dropped EXE
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\B66F.tmp"C:\Users\Admin\AppData\Local\Temp\B66F.tmp"32⤵
- Executes dropped EXE
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"33⤵
- Executes dropped EXE
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\B769.tmp"C:\Users\Admin\AppData\Local\Temp\B769.tmp"34⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"35⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\B815.tmp"C:\Users\Admin\AppData\Local\Temp\B815.tmp"36⤵
- Executes dropped EXE
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\B863.tmp"C:\Users\Admin\AppData\Local\Temp\B863.tmp"37⤵
- Executes dropped EXE
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"38⤵
- Executes dropped EXE
PID:100 -
C:\Users\Admin\AppData\Local\Temp\B90F.tmp"C:\Users\Admin\AppData\Local\Temp\B90F.tmp"39⤵
- Executes dropped EXE
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\B96D.tmp"C:\Users\Admin\AppData\Local\Temp\B96D.tmp"40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"41⤵
- Executes dropped EXE
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\BA28.tmp"C:\Users\Admin\AppData\Local\Temp\BA28.tmp"42⤵
- Executes dropped EXE
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\BA76.tmp"C:\Users\Admin\AppData\Local\Temp\BA76.tmp"43⤵
- Executes dropped EXE
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"44⤵
- Executes dropped EXE
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\BB12.tmp"C:\Users\Admin\AppData\Local\Temp\BB12.tmp"45⤵
- Executes dropped EXE
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\BB70.tmp"C:\Users\Admin\AppData\Local\Temp\BB70.tmp"46⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"47⤵
- Executes dropped EXE
PID:460 -
C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"48⤵
- Executes dropped EXE
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\BC6A.tmp"C:\Users\Admin\AppData\Local\Temp\BC6A.tmp"49⤵
- Executes dropped EXE
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\BCB8.tmp"C:\Users\Admin\AppData\Local\Temp\BCB8.tmp"50⤵
- Executes dropped EXE
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\BD16.tmp"C:\Users\Admin\AppData\Local\Temp\BD16.tmp"51⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\BD74.tmp"C:\Users\Admin\AppData\Local\Temp\BD74.tmp"52⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\BE10.tmp"C:\Users\Admin\AppData\Local\Temp\BE10.tmp"54⤵
- Executes dropped EXE
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\BE5E.tmp"C:\Users\Admin\AppData\Local\Temp\BE5E.tmp"55⤵
- Executes dropped EXE
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\BEAC.tmp"C:\Users\Admin\AppData\Local\Temp\BEAC.tmp"56⤵
- Executes dropped EXE
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"57⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\BF49.tmp"C:\Users\Admin\AppData\Local\Temp\BF49.tmp"58⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"59⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"60⤵
- Executes dropped EXE
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\C052.tmp"C:\Users\Admin\AppData\Local\Temp\C052.tmp"61⤵
- Executes dropped EXE
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"62⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"63⤵
- Executes dropped EXE
PID:408 -
C:\Users\Admin\AppData\Local\Temp\C14C.tmp"C:\Users\Admin\AppData\Local\Temp\C14C.tmp"64⤵
- Executes dropped EXE
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\C19A.tmp"C:\Users\Admin\AppData\Local\Temp\C19A.tmp"65⤵
- Executes dropped EXE
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\C1F8.tmp"C:\Users\Admin\AppData\Local\Temp\C1F8.tmp"66⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\C246.tmp"C:\Users\Admin\AppData\Local\Temp\C246.tmp"67⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\C2A4.tmp"C:\Users\Admin\AppData\Local\Temp\C2A4.tmp"68⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"69⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\C350.tmp"C:\Users\Admin\AppData\Local\Temp\C350.tmp"70⤵PID:608
-
C:\Users\Admin\AppData\Local\Temp\C39E.tmp"C:\Users\Admin\AppData\Local\Temp\C39E.tmp"71⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"72⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\C44A.tmp"C:\Users\Admin\AppData\Local\Temp\C44A.tmp"73⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\C498.tmp"C:\Users\Admin\AppData\Local\Temp\C498.tmp"74⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"75⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\C544.tmp"C:\Users\Admin\AppData\Local\Temp\C544.tmp"76⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"77⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\C5F0.tmp"C:\Users\Admin\AppData\Local\Temp\C5F0.tmp"78⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\C64D.tmp"C:\Users\Admin\AppData\Local\Temp\C64D.tmp"79⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"80⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\C709.tmp"C:\Users\Admin\AppData\Local\Temp\C709.tmp"81⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\C767.tmp"C:\Users\Admin\AppData\Local\Temp\C767.tmp"82⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\C7B5.tmp"C:\Users\Admin\AppData\Local\Temp\C7B5.tmp"83⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\C803.tmp"C:\Users\Admin\AppData\Local\Temp\C803.tmp"84⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\C851.tmp"C:\Users\Admin\AppData\Local\Temp\C851.tmp"85⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\C8AF.tmp"C:\Users\Admin\AppData\Local\Temp\C8AF.tmp"86⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\C90D.tmp"C:\Users\Admin\AppData\Local\Temp\C90D.tmp"87⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\C96A.tmp"C:\Users\Admin\AppData\Local\Temp\C96A.tmp"88⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\C9B8.tmp"C:\Users\Admin\AppData\Local\Temp\C9B8.tmp"89⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\CA07.tmp"C:\Users\Admin\AppData\Local\Temp\CA07.tmp"90⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\CA64.tmp"C:\Users\Admin\AppData\Local\Temp\CA64.tmp"91⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\CAB2.tmp"C:\Users\Admin\AppData\Local\Temp\CAB2.tmp"92⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\CB10.tmp"C:\Users\Admin\AppData\Local\Temp\CB10.tmp"93⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\CB6E.tmp"C:\Users\Admin\AppData\Local\Temp\CB6E.tmp"94⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\CBCC.tmp"C:\Users\Admin\AppData\Local\Temp\CBCC.tmp"95⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\CC29.tmp"C:\Users\Admin\AppData\Local\Temp\CC29.tmp"96⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\CC87.tmp"C:\Users\Admin\AppData\Local\Temp\CC87.tmp"97⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\CCD5.tmp"C:\Users\Admin\AppData\Local\Temp\CCD5.tmp"98⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\CD23.tmp"C:\Users\Admin\AppData\Local\Temp\CD23.tmp"99⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\CD81.tmp"C:\Users\Admin\AppData\Local\Temp\CD81.tmp"100⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\CDCF.tmp"C:\Users\Admin\AppData\Local\Temp\CDCF.tmp"101⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\CE1D.tmp"C:\Users\Admin\AppData\Local\Temp\CE1D.tmp"102⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\CE6C.tmp"C:\Users\Admin\AppData\Local\Temp\CE6C.tmp"103⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\CEC9.tmp"C:\Users\Admin\AppData\Local\Temp\CEC9.tmp"104⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\CF17.tmp"C:\Users\Admin\AppData\Local\Temp\CF17.tmp"105⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\CF75.tmp"C:\Users\Admin\AppData\Local\Temp\CF75.tmp"106⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\CFC3.tmp"C:\Users\Admin\AppData\Local\Temp\CFC3.tmp"107⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\D021.tmp"C:\Users\Admin\AppData\Local\Temp\D021.tmp"108⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\D06F.tmp"C:\Users\Admin\AppData\Local\Temp\D06F.tmp"109⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\D0CD.tmp"C:\Users\Admin\AppData\Local\Temp\D0CD.tmp"110⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\D11B.tmp"C:\Users\Admin\AppData\Local\Temp\D11B.tmp"111⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\D169.tmp"C:\Users\Admin\AppData\Local\Temp\D169.tmp"112⤵
- System Location Discovery: System Language Discovery
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"113⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\D215.tmp"C:\Users\Admin\AppData\Local\Temp\D215.tmp"114⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\D263.tmp"C:\Users\Admin\AppData\Local\Temp\D263.tmp"115⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\D2D1.tmp"C:\Users\Admin\AppData\Local\Temp\D2D1.tmp"116⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\D32E.tmp"C:\Users\Admin\AppData\Local\Temp\D32E.tmp"117⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\D38C.tmp"C:\Users\Admin\AppData\Local\Temp\D38C.tmp"118⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\D3EA.tmp"C:\Users\Admin\AppData\Local\Temp\D3EA.tmp"119⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\D438.tmp"C:\Users\Admin\AppData\Local\Temp\D438.tmp"120⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\D486.tmp"C:\Users\Admin\AppData\Local\Temp\D486.tmp"121⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\D4D4.tmp"C:\Users\Admin\AppData\Local\Temp\D4D4.tmp"122⤵PID:4392
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-