Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2024, 03:16
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-12_e7f1ac99e870429fe0bb8064ffb6905e_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-12_e7f1ac99e870429fe0bb8064ffb6905e_mafia.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-12_e7f1ac99e870429fe0bb8064ffb6905e_mafia.exe
-
Size
530KB
-
MD5
e7f1ac99e870429fe0bb8064ffb6905e
-
SHA1
552c97753e9128020f45a776eed2f4ba42ae71a8
-
SHA256
52c87e5d5d297b95f848f7dd3535e4b6efb6129e71289bbc47bcd9ea8800361f
-
SHA512
e3a2762d690858b0abb95fda8e68964aeb3b1aa26b3929b6e3d1a428d6f7a3305fdf5024d058963656f78bc65f5e3716d24fde1d915e25d1517187681234134c
-
SSDEEP
12288:AU5rCOTeio6BRrfkgG5aJvFbM3wTETYCzNZulFVg0M1:AUQOJo6zrsgxJvkwZCzNclFV/M1
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1264 FA00.tmp 5088 FAAC.tmp 3084 FB38.tmp 2164 FBB5.tmp 2932 FC52.tmp 1812 FCEE.tmp 3848 FD9A.tmp 3064 FE17.tmp 3676 FEC3.tmp 3568 FF4F.tmp 4988 FFFB.tmp 3648 68.tmp 1128 F5.tmp 1288 182.tmp 3892 1FF.tmp 2604 25C.tmp 3620 2E9.tmp 4756 356.tmp 4416 3D3.tmp 4724 470.tmp 228 4ED.tmp 5104 579.tmp 1864 5E7.tmp 2396 654.tmp 3624 6C1.tmp 1496 72F.tmp 1012 78D.tmp 3780 7FA.tmp 3012 896.tmp 4752 932.tmp 3412 9BF.tmp 2508 A5B.tmp 1680 AF8.tmp 2904 B55.tmp 1860 BB3.tmp 3432 C01.tmp 2972 C4F.tmp 4164 CAD.tmp 2400 D0B.tmp 2540 D59.tmp 4288 DB7.tmp 4244 E14.tmp 1188 E72.tmp 3248 ED0.tmp 2764 F3D.tmp 4200 F8B.tmp 3288 FE9.tmp 3776 1037.tmp 2960 1095.tmp 4372 10F3.tmp 4172 1151.tmp 4600 11AE.tmp 2320 120C.tmp 1468 125A.tmp 2272 12B8.tmp 3616 1306.tmp 1324 1364.tmp 4388 13B2.tmp 3160 1410.tmp 880 147D.tmp 4864 14DB.tmp 3940 1539.tmp 4900 1596.tmp 4460 15E4.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5579.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 232E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 305D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3762.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FCE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C83D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C77.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E77D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E327.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1690.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1855.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2560.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ECB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E615.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 355E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6354.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 477F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 317B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9882.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E21E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2388 wrote to memory of 1264 2388 2024-10-12_e7f1ac99e870429fe0bb8064ffb6905e_mafia.exe 84 PID 2388 wrote to memory of 1264 2388 2024-10-12_e7f1ac99e870429fe0bb8064ffb6905e_mafia.exe 84 PID 2388 wrote to memory of 1264 2388 2024-10-12_e7f1ac99e870429fe0bb8064ffb6905e_mafia.exe 84 PID 1264 wrote to memory of 5088 1264 FA00.tmp 86 PID 1264 wrote to memory of 5088 1264 FA00.tmp 86 PID 1264 wrote to memory of 5088 1264 FA00.tmp 86 PID 5088 wrote to memory of 3084 5088 FAAC.tmp 88 PID 5088 wrote to memory of 3084 5088 FAAC.tmp 88 PID 5088 wrote to memory of 3084 5088 FAAC.tmp 88 PID 3084 wrote to memory of 2164 3084 FB38.tmp 89 PID 3084 wrote to memory of 2164 3084 FB38.tmp 89 PID 3084 wrote to memory of 2164 3084 FB38.tmp 89 PID 2164 wrote to memory of 2932 2164 FBB5.tmp 90 PID 2164 wrote to memory of 2932 2164 FBB5.tmp 90 PID 2164 wrote to memory of 2932 2164 FBB5.tmp 90 PID 2932 wrote to memory of 1812 2932 FC52.tmp 91 PID 2932 wrote to memory of 1812 2932 FC52.tmp 91 PID 2932 wrote to memory of 1812 2932 FC52.tmp 91 PID 1812 wrote to memory of 3848 1812 FCEE.tmp 92 PID 1812 wrote to memory of 3848 1812 FCEE.tmp 92 PID 1812 wrote to memory of 3848 1812 FCEE.tmp 92 PID 3848 wrote to memory of 3064 3848 FD9A.tmp 93 PID 3848 wrote to memory of 3064 3848 FD9A.tmp 93 PID 3848 wrote to memory of 3064 3848 FD9A.tmp 93 PID 3064 wrote to memory of 3676 3064 FE17.tmp 94 PID 3064 wrote to memory of 3676 3064 FE17.tmp 94 PID 3064 wrote to memory of 3676 3064 FE17.tmp 94 PID 3676 wrote to memory of 3568 3676 FEC3.tmp 95 PID 3676 wrote to memory of 3568 3676 FEC3.tmp 95 PID 3676 wrote to memory of 3568 3676 FEC3.tmp 95 PID 3568 wrote to memory of 4988 3568 FF4F.tmp 96 PID 3568 wrote to memory of 4988 3568 FF4F.tmp 96 PID 3568 wrote to memory of 4988 3568 FF4F.tmp 96 PID 4988 wrote to memory of 3648 4988 FFFB.tmp 97 PID 4988 wrote to memory of 3648 4988 FFFB.tmp 97 PID 4988 wrote to memory of 3648 4988 FFFB.tmp 97 PID 3648 wrote to memory of 1128 3648 68.tmp 98 PID 3648 wrote to memory of 1128 3648 68.tmp 98 PID 3648 wrote to memory of 1128 3648 68.tmp 98 PID 1128 wrote to memory of 1288 1128 F5.tmp 99 PID 1128 wrote to memory of 1288 1128 F5.tmp 99 PID 1128 wrote to memory of 1288 1128 F5.tmp 99 PID 1288 wrote to memory of 3892 1288 182.tmp 100 PID 1288 wrote to memory of 3892 1288 182.tmp 100 PID 1288 wrote to memory of 3892 1288 182.tmp 100 PID 3892 wrote to memory of 2604 3892 1FF.tmp 101 PID 3892 wrote to memory of 2604 3892 1FF.tmp 101 PID 3892 wrote to memory of 2604 3892 1FF.tmp 101 PID 2604 wrote to memory of 3620 2604 25C.tmp 102 PID 2604 wrote to memory of 3620 2604 25C.tmp 102 PID 2604 wrote to memory of 3620 2604 25C.tmp 102 PID 3620 wrote to memory of 4756 3620 2E9.tmp 103 PID 3620 wrote to memory of 4756 3620 2E9.tmp 103 PID 3620 wrote to memory of 4756 3620 2E9.tmp 103 PID 4756 wrote to memory of 4416 4756 356.tmp 104 PID 4756 wrote to memory of 4416 4756 356.tmp 104 PID 4756 wrote to memory of 4416 4756 356.tmp 104 PID 4416 wrote to memory of 4724 4416 3D3.tmp 105 PID 4416 wrote to memory of 4724 4416 3D3.tmp 105 PID 4416 wrote to memory of 4724 4416 3D3.tmp 105 PID 4724 wrote to memory of 228 4724 470.tmp 106 PID 4724 wrote to memory of 228 4724 470.tmp 106 PID 4724 wrote to memory of 228 4724 470.tmp 106 PID 228 wrote to memory of 5104 228 4ED.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-12_e7f1ac99e870429fe0bb8064ffb6905e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-12_e7f1ac99e870429fe0bb8064ffb6905e_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\FA00.tmp"C:\Users\Admin\AppData\Local\Temp\FA00.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\FAAC.tmp"C:\Users\Admin\AppData\Local\Temp\FAAC.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\FB38.tmp"C:\Users\Admin\AppData\Local\Temp\FB38.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\FBB5.tmp"C:\Users\Admin\AppData\Local\Temp\FBB5.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\FC52.tmp"C:\Users\Admin\AppData\Local\Temp\FC52.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\FCEE.tmp"C:\Users\Admin\AppData\Local\Temp\FCEE.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\FD9A.tmp"C:\Users\Admin\AppData\Local\Temp\FD9A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\FE17.tmp"C:\Users\Admin\AppData\Local\Temp\FE17.tmp"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\FEC3.tmp"C:\Users\Admin\AppData\Local\Temp\FEC3.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\FF4F.tmp"C:\Users\Admin\AppData\Local\Temp\FF4F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\FFFB.tmp"C:\Users\Admin\AppData\Local\Temp\FFFB.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\68.tmp"C:\Users\Admin\AppData\Local\Temp\68.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\F5.tmp"C:\Users\Admin\AppData\Local\Temp\F5.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\182.tmp"C:\Users\Admin\AppData\Local\Temp\182.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\1FF.tmp"C:\Users\Admin\AppData\Local\Temp\1FF.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\25C.tmp"C:\Users\Admin\AppData\Local\Temp\25C.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\2E9.tmp"C:\Users\Admin\AppData\Local\Temp\2E9.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\356.tmp"C:\Users\Admin\AppData\Local\Temp\356.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\3D3.tmp"C:\Users\Admin\AppData\Local\Temp\3D3.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\470.tmp"C:\Users\Admin\AppData\Local\Temp\470.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\4ED.tmp"C:\Users\Admin\AppData\Local\Temp\4ED.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Users\Admin\AppData\Local\Temp\579.tmp"C:\Users\Admin\AppData\Local\Temp\579.tmp"23⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\5E7.tmp"C:\Users\Admin\AppData\Local\Temp\5E7.tmp"24⤵
- Executes dropped EXE
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\654.tmp"C:\Users\Admin\AppData\Local\Temp\654.tmp"25⤵
- Executes dropped EXE
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\6C1.tmp"C:\Users\Admin\AppData\Local\Temp\6C1.tmp"26⤵
- Executes dropped EXE
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\72F.tmp"C:\Users\Admin\AppData\Local\Temp\72F.tmp"27⤵
- Executes dropped EXE
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\78D.tmp"C:\Users\Admin\AppData\Local\Temp\78D.tmp"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\7FA.tmp"C:\Users\Admin\AppData\Local\Temp\7FA.tmp"29⤵
- Executes dropped EXE
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\896.tmp"C:\Users\Admin\AppData\Local\Temp\896.tmp"30⤵
- Executes dropped EXE
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\932.tmp"C:\Users\Admin\AppData\Local\Temp\932.tmp"31⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\9BF.tmp"C:\Users\Admin\AppData\Local\Temp\9BF.tmp"32⤵
- Executes dropped EXE
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\A5B.tmp"C:\Users\Admin\AppData\Local\Temp\A5B.tmp"33⤵
- Executes dropped EXE
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\AF8.tmp"C:\Users\Admin\AppData\Local\Temp\AF8.tmp"34⤵
- Executes dropped EXE
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\B55.tmp"C:\Users\Admin\AppData\Local\Temp\B55.tmp"35⤵
- Executes dropped EXE
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\BB3.tmp"C:\Users\Admin\AppData\Local\Temp\BB3.tmp"36⤵
- Executes dropped EXE
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\C01.tmp"C:\Users\Admin\AppData\Local\Temp\C01.tmp"37⤵
- Executes dropped EXE
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\C4F.tmp"C:\Users\Admin\AppData\Local\Temp\C4F.tmp"38⤵
- Executes dropped EXE
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\CAD.tmp"C:\Users\Admin\AppData\Local\Temp\CAD.tmp"39⤵
- Executes dropped EXE
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\D0B.tmp"C:\Users\Admin\AppData\Local\Temp\D0B.tmp"40⤵
- Executes dropped EXE
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\D59.tmp"C:\Users\Admin\AppData\Local\Temp\D59.tmp"41⤵
- Executes dropped EXE
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\DB7.tmp"C:\Users\Admin\AppData\Local\Temp\DB7.tmp"42⤵
- Executes dropped EXE
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\E14.tmp"C:\Users\Admin\AppData\Local\Temp\E14.tmp"43⤵
- Executes dropped EXE
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\E72.tmp"C:\Users\Admin\AppData\Local\Temp\E72.tmp"44⤵
- Executes dropped EXE
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\ED0.tmp"C:\Users\Admin\AppData\Local\Temp\ED0.tmp"45⤵
- Executes dropped EXE
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\F3D.tmp"C:\Users\Admin\AppData\Local\Temp\F3D.tmp"46⤵
- Executes dropped EXE
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\F8B.tmp"C:\Users\Admin\AppData\Local\Temp\F8B.tmp"47⤵
- Executes dropped EXE
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\FE9.tmp"C:\Users\Admin\AppData\Local\Temp\FE9.tmp"48⤵
- Executes dropped EXE
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\1037.tmp"C:\Users\Admin\AppData\Local\Temp\1037.tmp"49⤵
- Executes dropped EXE
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\1095.tmp"C:\Users\Admin\AppData\Local\Temp\1095.tmp"50⤵
- Executes dropped EXE
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\10F3.tmp"C:\Users\Admin\AppData\Local\Temp\10F3.tmp"51⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\1151.tmp"C:\Users\Admin\AppData\Local\Temp\1151.tmp"52⤵
- Executes dropped EXE
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\11AE.tmp"C:\Users\Admin\AppData\Local\Temp\11AE.tmp"53⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\120C.tmp"C:\Users\Admin\AppData\Local\Temp\120C.tmp"54⤵
- Executes dropped EXE
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\125A.tmp"C:\Users\Admin\AppData\Local\Temp\125A.tmp"55⤵
- Executes dropped EXE
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\12B8.tmp"C:\Users\Admin\AppData\Local\Temp\12B8.tmp"56⤵
- Executes dropped EXE
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\1306.tmp"C:\Users\Admin\AppData\Local\Temp\1306.tmp"57⤵
- Executes dropped EXE
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\1364.tmp"C:\Users\Admin\AppData\Local\Temp\1364.tmp"58⤵
- Executes dropped EXE
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\13B2.tmp"C:\Users\Admin\AppData\Local\Temp\13B2.tmp"59⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\1410.tmp"C:\Users\Admin\AppData\Local\Temp\1410.tmp"60⤵
- Executes dropped EXE
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\147D.tmp"C:\Users\Admin\AppData\Local\Temp\147D.tmp"61⤵
- Executes dropped EXE
PID:880 -
C:\Users\Admin\AppData\Local\Temp\14DB.tmp"C:\Users\Admin\AppData\Local\Temp\14DB.tmp"62⤵
- Executes dropped EXE
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\1539.tmp"C:\Users\Admin\AppData\Local\Temp\1539.tmp"63⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\1596.tmp"C:\Users\Admin\AppData\Local\Temp\1596.tmp"64⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\15E4.tmp"C:\Users\Admin\AppData\Local\Temp\15E4.tmp"65⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\1633.tmp"C:\Users\Admin\AppData\Local\Temp\1633.tmp"66⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\1690.tmp"C:\Users\Admin\AppData\Local\Temp\1690.tmp"67⤵
- System Location Discovery: System Language Discovery
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\16EE.tmp"C:\Users\Admin\AppData\Local\Temp\16EE.tmp"68⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\174C.tmp"C:\Users\Admin\AppData\Local\Temp\174C.tmp"69⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\17AA.tmp"C:\Users\Admin\AppData\Local\Temp\17AA.tmp"70⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\17F8.tmp"C:\Users\Admin\AppData\Local\Temp\17F8.tmp"71⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\1855.tmp"C:\Users\Admin\AppData\Local\Temp\1855.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\18A4.tmp"C:\Users\Admin\AppData\Local\Temp\18A4.tmp"73⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\1901.tmp"C:\Users\Admin\AppData\Local\Temp\1901.tmp"74⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\196F.tmp"C:\Users\Admin\AppData\Local\Temp\196F.tmp"75⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\19BD.tmp"C:\Users\Admin\AppData\Local\Temp\19BD.tmp"76⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\1A1B.tmp"C:\Users\Admin\AppData\Local\Temp\1A1B.tmp"77⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\1A78.tmp"C:\Users\Admin\AppData\Local\Temp\1A78.tmp"78⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\1AD6.tmp"C:\Users\Admin\AppData\Local\Temp\1AD6.tmp"79⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\1B43.tmp"C:\Users\Admin\AppData\Local\Temp\1B43.tmp"80⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\1BB1.tmp"C:\Users\Admin\AppData\Local\Temp\1BB1.tmp"81⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\1BFF.tmp"C:\Users\Admin\AppData\Local\Temp\1BFF.tmp"82⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\1C5D.tmp"C:\Users\Admin\AppData\Local\Temp\1C5D.tmp"83⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\1CBA.tmp"C:\Users\Admin\AppData\Local\Temp\1CBA.tmp"84⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\1D09.tmp"C:\Users\Admin\AppData\Local\Temp\1D09.tmp"85⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\1D66.tmp"C:\Users\Admin\AppData\Local\Temp\1D66.tmp"86⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\1DC4.tmp"C:\Users\Admin\AppData\Local\Temp\1DC4.tmp"87⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\1E12.tmp"C:\Users\Admin\AppData\Local\Temp\1E12.tmp"88⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\1E60.tmp"C:\Users\Admin\AppData\Local\Temp\1E60.tmp"89⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\1EBE.tmp"C:\Users\Admin\AppData\Local\Temp\1EBE.tmp"90⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\1F4B.tmp"C:\Users\Admin\AppData\Local\Temp\1F4B.tmp"91⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\1F99.tmp"C:\Users\Admin\AppData\Local\Temp\1F99.tmp"92⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\1FF7.tmp"C:\Users\Admin\AppData\Local\Temp\1FF7.tmp"93⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\2045.tmp"C:\Users\Admin\AppData\Local\Temp\2045.tmp"94⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\20A2.tmp"C:\Users\Admin\AppData\Local\Temp\20A2.tmp"95⤵
- System Location Discovery: System Language Discovery
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\2110.tmp"C:\Users\Admin\AppData\Local\Temp\2110.tmp"96⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\216E.tmp"C:\Users\Admin\AppData\Local\Temp\216E.tmp"97⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\21CB.tmp"C:\Users\Admin\AppData\Local\Temp\21CB.tmp"98⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\2219.tmp"C:\Users\Admin\AppData\Local\Temp\2219.tmp"99⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\2277.tmp"C:\Users\Admin\AppData\Local\Temp\2277.tmp"100⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\22E5.tmp"C:\Users\Admin\AppData\Local\Temp\22E5.tmp"101⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\2352.tmp"C:\Users\Admin\AppData\Local\Temp\2352.tmp"102⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\23B0.tmp"C:\Users\Admin\AppData\Local\Temp\23B0.tmp"103⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\23FE.tmp"C:\Users\Admin\AppData\Local\Temp\23FE.tmp"104⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\245C.tmp"C:\Users\Admin\AppData\Local\Temp\245C.tmp"105⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\24AA.tmp"C:\Users\Admin\AppData\Local\Temp\24AA.tmp"106⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\24F8.tmp"C:\Users\Admin\AppData\Local\Temp\24F8.tmp"107⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\2546.tmp"C:\Users\Admin\AppData\Local\Temp\2546.tmp"108⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\25A4.tmp"C:\Users\Admin\AppData\Local\Temp\25A4.tmp"109⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\2611.tmp"C:\Users\Admin\AppData\Local\Temp\2611.tmp"110⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\266F.tmp"C:\Users\Admin\AppData\Local\Temp\266F.tmp"111⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\26CD.tmp"C:\Users\Admin\AppData\Local\Temp\26CD.tmp"112⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\272A.tmp"C:\Users\Admin\AppData\Local\Temp\272A.tmp"113⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\2778.tmp"C:\Users\Admin\AppData\Local\Temp\2778.tmp"114⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\27C7.tmp"C:\Users\Admin\AppData\Local\Temp\27C7.tmp"115⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\2834.tmp"C:\Users\Admin\AppData\Local\Temp\2834.tmp"116⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\2882.tmp"C:\Users\Admin\AppData\Local\Temp\2882.tmp"117⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\28E0.tmp"C:\Users\Admin\AppData\Local\Temp\28E0.tmp"118⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\294D.tmp"C:\Users\Admin\AppData\Local\Temp\294D.tmp"119⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\299B.tmp"C:\Users\Admin\AppData\Local\Temp\299B.tmp"120⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\29E9.tmp"C:\Users\Admin\AppData\Local\Temp\29E9.tmp"121⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\2A38.tmp"C:\Users\Admin\AppData\Local\Temp\2A38.tmp"122⤵PID:4376
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-