Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13/10/2024, 01:16
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-13_c560319aa708f1a3fb92f8459fb8634c_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-13_c560319aa708f1a3fb92f8459fb8634c_mafia.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-13_c560319aa708f1a3fb92f8459fb8634c_mafia.exe
-
Size
536KB
-
MD5
c560319aa708f1a3fb92f8459fb8634c
-
SHA1
3fb3035949a126ffe6d3386da3d8b3baebabd740
-
SHA256
c52eb9b8b8e5d98d723123449ed65400e6eccb5afe2fe267c44a149a08689176
-
SHA512
e8fedaa4cd43427bf3b22faec02bee75cb5cd9fd639d7a7d0a99c658982214e8c7b93b2cb6bf34c7e68881cc9748439b9616d8c55b91a4e736f83cbe4f9bad7a
-
SSDEEP
12288:wU5rCOTeiUIA+Vzvn9ajzQeRHvJA/8NYNIZxVJ0ZT9:wUQOJUIJOcebA/8WNIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1392 C5FF.tmp 2044 C68C.tmp 2632 C728.tmp 1728 C7C4.tmp 4760 C832.tmp 332 C89F.tmp 4504 C92C.tmp 4688 C999.tmp 4020 CA45.tmp 3668 CAD2.tmp 4448 CB4F.tmp 2368 CBCC.tmp 4904 CC49.tmp 1536 CCD5.tmp 4544 CD81.tmp 3328 CDFE.tmp 4196 CE7B.tmp 2672 CED9.tmp 2088 CF37.tmp 4644 CFA4.tmp 3580 D031.tmp 3908 D0BD.tmp 5116 D13A.tmp 788 D1C7.tmp 5004 D254.tmp 1572 D2E0.tmp 3704 D37C.tmp 1132 D409.tmp 3300 D467.tmp 884 D4E4.tmp 736 D561.tmp 3620 D5CE.tmp 1904 D62C.tmp 220 D6A9.tmp 2364 D6F7.tmp 2392 D745.tmp 4248 D7B3.tmp 840 D820.tmp 224 D86E.tmp 2972 D8CC.tmp 1984 D987.tmp 448 D9F5.tmp 820 DA62.tmp 4380 DACF.tmp 5024 DB4C.tmp 956 DBBA.tmp 2092 DC08.tmp 3528 DC56.tmp 1556 DCA4.tmp 456 DD02.tmp 332 DD50.tmp 4220 DD9E.tmp 748 DE0C.tmp 3640 DE5A.tmp 1112 DEA8.tmp 4708 DEF6.tmp 4472 DF54.tmp 388 DFA2.tmp 3400 DFF0.tmp 3812 E03E.tmp 4604 E08C.tmp 3328 E0DA.tmp 3052 E128.tmp 712 E177.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9AA5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7039.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F76B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 319A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9882.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8577.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F81B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF30.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9824.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B65B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F906.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9361.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 546.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CBD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C0A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 313C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E6A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1279.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA91.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 673.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7124.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3116 wrote to memory of 1392 3116 2024-10-13_c560319aa708f1a3fb92f8459fb8634c_mafia.exe 87 PID 3116 wrote to memory of 1392 3116 2024-10-13_c560319aa708f1a3fb92f8459fb8634c_mafia.exe 87 PID 3116 wrote to memory of 1392 3116 2024-10-13_c560319aa708f1a3fb92f8459fb8634c_mafia.exe 87 PID 1392 wrote to memory of 2044 1392 C5FF.tmp 88 PID 1392 wrote to memory of 2044 1392 C5FF.tmp 88 PID 1392 wrote to memory of 2044 1392 C5FF.tmp 88 PID 2044 wrote to memory of 2632 2044 C68C.tmp 90 PID 2044 wrote to memory of 2632 2044 C68C.tmp 90 PID 2044 wrote to memory of 2632 2044 C68C.tmp 90 PID 2632 wrote to memory of 1728 2632 C728.tmp 91 PID 2632 wrote to memory of 1728 2632 C728.tmp 91 PID 2632 wrote to memory of 1728 2632 C728.tmp 91 PID 1728 wrote to memory of 4760 1728 C7C4.tmp 92 PID 1728 wrote to memory of 4760 1728 C7C4.tmp 92 PID 1728 wrote to memory of 4760 1728 C7C4.tmp 92 PID 4760 wrote to memory of 332 4760 C832.tmp 93 PID 4760 wrote to memory of 332 4760 C832.tmp 93 PID 4760 wrote to memory of 332 4760 C832.tmp 93 PID 332 wrote to memory of 4504 332 C89F.tmp 94 PID 332 wrote to memory of 4504 332 C89F.tmp 94 PID 332 wrote to memory of 4504 332 C89F.tmp 94 PID 4504 wrote to memory of 4688 4504 C92C.tmp 95 PID 4504 wrote to memory of 4688 4504 C92C.tmp 95 PID 4504 wrote to memory of 4688 4504 C92C.tmp 95 PID 4688 wrote to memory of 4020 4688 C999.tmp 96 PID 4688 wrote to memory of 4020 4688 C999.tmp 96 PID 4688 wrote to memory of 4020 4688 C999.tmp 96 PID 4020 wrote to memory of 3668 4020 CA45.tmp 97 PID 4020 wrote to memory of 3668 4020 CA45.tmp 97 PID 4020 wrote to memory of 3668 4020 CA45.tmp 97 PID 3668 wrote to memory of 4448 3668 CAD2.tmp 98 PID 3668 wrote to memory of 4448 3668 CAD2.tmp 98 PID 3668 wrote to memory of 4448 3668 CAD2.tmp 98 PID 4448 wrote to memory of 2368 4448 CB4F.tmp 99 PID 4448 wrote to memory of 2368 4448 CB4F.tmp 99 PID 4448 wrote to memory of 2368 4448 CB4F.tmp 99 PID 2368 wrote to memory of 4904 2368 CBCC.tmp 100 PID 2368 wrote to memory of 4904 2368 CBCC.tmp 100 PID 2368 wrote to memory of 4904 2368 CBCC.tmp 100 PID 4904 wrote to memory of 1536 4904 CC49.tmp 101 PID 4904 wrote to memory of 1536 4904 CC49.tmp 101 PID 4904 wrote to memory of 1536 4904 CC49.tmp 101 PID 1536 wrote to memory of 4544 1536 CCD5.tmp 102 PID 1536 wrote to memory of 4544 1536 CCD5.tmp 102 PID 1536 wrote to memory of 4544 1536 CCD5.tmp 102 PID 4544 wrote to memory of 3328 4544 CD81.tmp 103 PID 4544 wrote to memory of 3328 4544 CD81.tmp 103 PID 4544 wrote to memory of 3328 4544 CD81.tmp 103 PID 3328 wrote to memory of 4196 3328 CDFE.tmp 104 PID 3328 wrote to memory of 4196 3328 CDFE.tmp 104 PID 3328 wrote to memory of 4196 3328 CDFE.tmp 104 PID 4196 wrote to memory of 2672 4196 CE7B.tmp 105 PID 4196 wrote to memory of 2672 4196 CE7B.tmp 105 PID 4196 wrote to memory of 2672 4196 CE7B.tmp 105 PID 2672 wrote to memory of 2088 2672 CED9.tmp 106 PID 2672 wrote to memory of 2088 2672 CED9.tmp 106 PID 2672 wrote to memory of 2088 2672 CED9.tmp 106 PID 2088 wrote to memory of 4644 2088 CF37.tmp 107 PID 2088 wrote to memory of 4644 2088 CF37.tmp 107 PID 2088 wrote to memory of 4644 2088 CF37.tmp 107 PID 4644 wrote to memory of 3580 4644 CFA4.tmp 108 PID 4644 wrote to memory of 3580 4644 CFA4.tmp 108 PID 4644 wrote to memory of 3580 4644 CFA4.tmp 108 PID 3580 wrote to memory of 3908 3580 D031.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-13_c560319aa708f1a3fb92f8459fb8634c_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-13_c560319aa708f1a3fb92f8459fb8634c_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\C5FF.tmp"C:\Users\Admin\AppData\Local\Temp\C5FF.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\C68C.tmp"C:\Users\Admin\AppData\Local\Temp\C68C.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\C728.tmp"C:\Users\Admin\AppData\Local\Temp\C728.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\C832.tmp"C:\Users\Admin\AppData\Local\Temp\C832.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\C89F.tmp"C:\Users\Admin\AppData\Local\Temp\C89F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:332 -
C:\Users\Admin\AppData\Local\Temp\C92C.tmp"C:\Users\Admin\AppData\Local\Temp\C92C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\C999.tmp"C:\Users\Admin\AppData\Local\Temp\C999.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\CA45.tmp"C:\Users\Admin\AppData\Local\Temp\CA45.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\CAD2.tmp"C:\Users\Admin\AppData\Local\Temp\CAD2.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\CB4F.tmp"C:\Users\Admin\AppData\Local\Temp\CB4F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\CBCC.tmp"C:\Users\Admin\AppData\Local\Temp\CBCC.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\CC49.tmp"C:\Users\Admin\AppData\Local\Temp\CC49.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\CCD5.tmp"C:\Users\Admin\AppData\Local\Temp\CCD5.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\CD81.tmp"C:\Users\Admin\AppData\Local\Temp\CD81.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\CDFE.tmp"C:\Users\Admin\AppData\Local\Temp\CDFE.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\CE7B.tmp"C:\Users\Admin\AppData\Local\Temp\CE7B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\CED9.tmp"C:\Users\Admin\AppData\Local\Temp\CED9.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\CF37.tmp"C:\Users\Admin\AppData\Local\Temp\CF37.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\CFA4.tmp"C:\Users\Admin\AppData\Local\Temp\CFA4.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\D031.tmp"C:\Users\Admin\AppData\Local\Temp\D031.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\D0BD.tmp"C:\Users\Admin\AppData\Local\Temp\D0BD.tmp"23⤵
- Executes dropped EXE
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\D13A.tmp"C:\Users\Admin\AppData\Local\Temp\D13A.tmp"24⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"25⤵
- Executes dropped EXE
PID:788 -
C:\Users\Admin\AppData\Local\Temp\D254.tmp"C:\Users\Admin\AppData\Local\Temp\D254.tmp"26⤵
- Executes dropped EXE
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\D2E0.tmp"C:\Users\Admin\AppData\Local\Temp\D2E0.tmp"27⤵
- Executes dropped EXE
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\D37C.tmp"C:\Users\Admin\AppData\Local\Temp\D37C.tmp"28⤵
- Executes dropped EXE
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\D409.tmp"C:\Users\Admin\AppData\Local\Temp\D409.tmp"29⤵
- Executes dropped EXE
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\D467.tmp"C:\Users\Admin\AppData\Local\Temp\D467.tmp"30⤵
- Executes dropped EXE
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\D4E4.tmp"C:\Users\Admin\AppData\Local\Temp\D4E4.tmp"31⤵
- Executes dropped EXE
PID:884 -
C:\Users\Admin\AppData\Local\Temp\D561.tmp"C:\Users\Admin\AppData\Local\Temp\D561.tmp"32⤵
- Executes dropped EXE
PID:736 -
C:\Users\Admin\AppData\Local\Temp\D5CE.tmp"C:\Users\Admin\AppData\Local\Temp\D5CE.tmp"33⤵
- Executes dropped EXE
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\D62C.tmp"C:\Users\Admin\AppData\Local\Temp\D62C.tmp"34⤵
- Executes dropped EXE
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\D6A9.tmp"C:\Users\Admin\AppData\Local\Temp\D6A9.tmp"35⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\D6F7.tmp"C:\Users\Admin\AppData\Local\Temp\D6F7.tmp"36⤵
- Executes dropped EXE
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\D745.tmp"C:\Users\Admin\AppData\Local\Temp\D745.tmp"37⤵
- Executes dropped EXE
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\D7B3.tmp"C:\Users\Admin\AppData\Local\Temp\D7B3.tmp"38⤵
- Executes dropped EXE
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\D820.tmp"C:\Users\Admin\AppData\Local\Temp\D820.tmp"39⤵
- Executes dropped EXE
PID:840 -
C:\Users\Admin\AppData\Local\Temp\D86E.tmp"C:\Users\Admin\AppData\Local\Temp\D86E.tmp"40⤵
- Executes dropped EXE
PID:224 -
C:\Users\Admin\AppData\Local\Temp\D8CC.tmp"C:\Users\Admin\AppData\Local\Temp\D8CC.tmp"41⤵
- Executes dropped EXE
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\D91A.tmp"C:\Users\Admin\AppData\Local\Temp\D91A.tmp"42⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\D987.tmp"C:\Users\Admin\AppData\Local\Temp\D987.tmp"43⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\D9F5.tmp"C:\Users\Admin\AppData\Local\Temp\D9F5.tmp"44⤵
- Executes dropped EXE
PID:448 -
C:\Users\Admin\AppData\Local\Temp\DA62.tmp"C:\Users\Admin\AppData\Local\Temp\DA62.tmp"45⤵
- Executes dropped EXE
PID:820 -
C:\Users\Admin\AppData\Local\Temp\DACF.tmp"C:\Users\Admin\AppData\Local\Temp\DACF.tmp"46⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\DB4C.tmp"C:\Users\Admin\AppData\Local\Temp\DB4C.tmp"47⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\DBBA.tmp"C:\Users\Admin\AppData\Local\Temp\DBBA.tmp"48⤵
- Executes dropped EXE
PID:956 -
C:\Users\Admin\AppData\Local\Temp\DC08.tmp"C:\Users\Admin\AppData\Local\Temp\DC08.tmp"49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\DC56.tmp"C:\Users\Admin\AppData\Local\Temp\DC56.tmp"50⤵
- Executes dropped EXE
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\DCA4.tmp"C:\Users\Admin\AppData\Local\Temp\DCA4.tmp"51⤵
- Executes dropped EXE
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\DD02.tmp"C:\Users\Admin\AppData\Local\Temp\DD02.tmp"52⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\AppData\Local\Temp\DD50.tmp"C:\Users\Admin\AppData\Local\Temp\DD50.tmp"53⤵
- Executes dropped EXE
PID:332 -
C:\Users\Admin\AppData\Local\Temp\DD9E.tmp"C:\Users\Admin\AppData\Local\Temp\DD9E.tmp"54⤵
- Executes dropped EXE
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\DE0C.tmp"C:\Users\Admin\AppData\Local\Temp\DE0C.tmp"55⤵
- Executes dropped EXE
PID:748 -
C:\Users\Admin\AppData\Local\Temp\DE5A.tmp"C:\Users\Admin\AppData\Local\Temp\DE5A.tmp"56⤵
- Executes dropped EXE
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"57⤵
- Executes dropped EXE
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\DEF6.tmp"C:\Users\Admin\AppData\Local\Temp\DEF6.tmp"58⤵
- Executes dropped EXE
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\DF54.tmp"C:\Users\Admin\AppData\Local\Temp\DF54.tmp"59⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\DFA2.tmp"C:\Users\Admin\AppData\Local\Temp\DFA2.tmp"60⤵
- Executes dropped EXE
PID:388 -
C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"61⤵
- Executes dropped EXE
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\E03E.tmp"C:\Users\Admin\AppData\Local\Temp\E03E.tmp"62⤵
- Executes dropped EXE
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\E08C.tmp"C:\Users\Admin\AppData\Local\Temp\E08C.tmp"63⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\E0DA.tmp"C:\Users\Admin\AppData\Local\Temp\E0DA.tmp"64⤵
- Executes dropped EXE
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\E128.tmp"C:\Users\Admin\AppData\Local\Temp\E128.tmp"65⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\E177.tmp"C:\Users\Admin\AppData\Local\Temp\E177.tmp"66⤵
- Executes dropped EXE
PID:712 -
C:\Users\Admin\AppData\Local\Temp\E1D4.tmp"C:\Users\Admin\AppData\Local\Temp\E1D4.tmp"67⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\E222.tmp"C:\Users\Admin\AppData\Local\Temp\E222.tmp"68⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\E271.tmp"C:\Users\Admin\AppData\Local\Temp\E271.tmp"69⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\E2BF.tmp"C:\Users\Admin\AppData\Local\Temp\E2BF.tmp"70⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\E31C.tmp"C:\Users\Admin\AppData\Local\Temp\E31C.tmp"71⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\E36B.tmp"C:\Users\Admin\AppData\Local\Temp\E36B.tmp"72⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\E3B9.tmp"C:\Users\Admin\AppData\Local\Temp\E3B9.tmp"73⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\E407.tmp"C:\Users\Admin\AppData\Local\Temp\E407.tmp"74⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\E455.tmp"C:\Users\Admin\AppData\Local\Temp\E455.tmp"75⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\E4A3.tmp"C:\Users\Admin\AppData\Local\Temp\E4A3.tmp"76⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\E501.tmp"C:\Users\Admin\AppData\Local\Temp\E501.tmp"77⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\E54F.tmp"C:\Users\Admin\AppData\Local\Temp\E54F.tmp"78⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\E59D.tmp"C:\Users\Admin\AppData\Local\Temp\E59D.tmp"79⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\E5EB.tmp"C:\Users\Admin\AppData\Local\Temp\E5EB.tmp"80⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\E649.tmp"C:\Users\Admin\AppData\Local\Temp\E649.tmp"81⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\E704.tmp"C:\Users\Admin\AppData\Local\Temp\E704.tmp"83⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\E762.tmp"C:\Users\Admin\AppData\Local\Temp\E762.tmp"84⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"85⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\E80E.tmp"C:\Users\Admin\AppData\Local\Temp\E80E.tmp"86⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\E85C.tmp"C:\Users\Admin\AppData\Local\Temp\E85C.tmp"87⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"88⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\E918.tmp"C:\Users\Admin\AppData\Local\Temp\E918.tmp"89⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\E966.tmp"C:\Users\Admin\AppData\Local\Temp\E966.tmp"90⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\E9B4.tmp"C:\Users\Admin\AppData\Local\Temp\E9B4.tmp"91⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\EA02.tmp"C:\Users\Admin\AppData\Local\Temp\EA02.tmp"92⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\EA50.tmp"C:\Users\Admin\AppData\Local\Temp\EA50.tmp"93⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\EA9E.tmp"C:\Users\Admin\AppData\Local\Temp\EA9E.tmp"94⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\EAFC.tmp"C:\Users\Admin\AppData\Local\Temp\EAFC.tmp"95⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\EB4A.tmp"C:\Users\Admin\AppData\Local\Temp\EB4A.tmp"96⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\EB98.tmp"C:\Users\Admin\AppData\Local\Temp\EB98.tmp"97⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\EBF6.tmp"C:\Users\Admin\AppData\Local\Temp\EBF6.tmp"98⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\EC54.tmp"C:\Users\Admin\AppData\Local\Temp\EC54.tmp"99⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\ECA2.tmp"C:\Users\Admin\AppData\Local\Temp\ECA2.tmp"100⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\ECF0.tmp"C:\Users\Admin\AppData\Local\Temp\ECF0.tmp"101⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\ED4E.tmp"C:\Users\Admin\AppData\Local\Temp\ED4E.tmp"102⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\EDAC.tmp"C:\Users\Admin\AppData\Local\Temp\EDAC.tmp"103⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\EDFA.tmp"C:\Users\Admin\AppData\Local\Temp\EDFA.tmp"104⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\EE48.tmp"C:\Users\Admin\AppData\Local\Temp\EE48.tmp"105⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\EE96.tmp"C:\Users\Admin\AppData\Local\Temp\EE96.tmp"106⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\EEF4.tmp"C:\Users\Admin\AppData\Local\Temp\EEF4.tmp"107⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\EF42.tmp"C:\Users\Admin\AppData\Local\Temp\EF42.tmp"108⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\EF90.tmp"C:\Users\Admin\AppData\Local\Temp\EF90.tmp"109⤵PID:728
-
C:\Users\Admin\AppData\Local\Temp\EFDE.tmp"C:\Users\Admin\AppData\Local\Temp\EFDE.tmp"110⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\F02C.tmp"C:\Users\Admin\AppData\Local\Temp\F02C.tmp"111⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\F07A.tmp"C:\Users\Admin\AppData\Local\Temp\F07A.tmp"112⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\F0D8.tmp"C:\Users\Admin\AppData\Local\Temp\F0D8.tmp"113⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\F126.tmp"C:\Users\Admin\AppData\Local\Temp\F126.tmp"114⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\F184.tmp"C:\Users\Admin\AppData\Local\Temp\F184.tmp"115⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\F1D2.tmp"C:\Users\Admin\AppData\Local\Temp\F1D2.tmp"116⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\F230.tmp"C:\Users\Admin\AppData\Local\Temp\F230.tmp"117⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\F27E.tmp"C:\Users\Admin\AppData\Local\Temp\F27E.tmp"118⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\F2DC.tmp"C:\Users\Admin\AppData\Local\Temp\F2DC.tmp"119⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\F32A.tmp"C:\Users\Admin\AppData\Local\Temp\F32A.tmp"120⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\F378.tmp"C:\Users\Admin\AppData\Local\Temp\F378.tmp"121⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\F3D6.tmp"C:\Users\Admin\AppData\Local\Temp\F3D6.tmp"122⤵PID:2420
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-