Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15/10/2024, 05:32
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-15_407c57e3fde31b5d7c14666bd7054609_mafia.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2024-10-15_407c57e3fde31b5d7c14666bd7054609_mafia.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-15_407c57e3fde31b5d7c14666bd7054609_mafia.exe
-
Size
488KB
-
MD5
407c57e3fde31b5d7c14666bd7054609
-
SHA1
e8d8cedd330d77bf3d924ae34e5f734ed0ff29ee
-
SHA256
25b27c5ba70d53405a166c990cba0e5b5538ad0e8912dda1db5fe3ffaae6fe52
-
SHA512
506d3363b631c318487164cb378171ac800aa0d960e2c5678fefae01f5adfb7a45e769c4e5c372e32ff8aec57ada799f1945c3ff535e9275223b445362df6c44
-
SSDEEP
12288:/U5rCOTeiDDHXcts4ZqEc3B0P9npsPNZ:/UQOJDDHXcvZqF8EN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4652 AAD6.tmp 3688 AB63.tmp 4416 ABEF.tmp 3992 AC5D.tmp 3436 ACBB.tmp 2504 AD09.tmp 1208 AD76.tmp 4296 ADD4.tmp 1064 AE41.tmp 4108 AEAF.tmp 1788 AF1C.tmp 4864 AFA9.tmp 2256 B016.tmp 3984 B064.tmp 4048 B0C2.tmp 4348 B120.tmp 3296 B18D.tmp 1652 B1DB.tmp 4196 B229.tmp 2580 B277.tmp 2468 B2D5.tmp 3412 B333.tmp 968 B391.tmp 4364 B3EE.tmp 60 B43C.tmp 4776 B4AA.tmp 1952 B508.tmp 3224 B565.tmp 4248 B5C3.tmp 4924 B650.tmp 1904 B6BD.tmp 2728 B72A.tmp 1848 B788.tmp 2012 B7D6.tmp 1052 B824.tmp 3188 B8A1.tmp 940 B90F.tmp 2980 B95D.tmp 3228 B9CA.tmp 4372 BA18.tmp 4056 BA67.tmp 4416 BAC4.tmp 3768 BB22.tmp 3992 BB70.tmp 5028 BBBE.tmp 4396 BC1C.tmp 3212 BC6A.tmp 4628 BCB8.tmp 1208 BD06.tmp 2128 BD64.tmp 1852 BDB2.tmp 1580 BE10.tmp 1456 BE6E.tmp 2868 BECC.tmp 5052 BF1A.tmp 4040 BF68.tmp 2272 BFB6.tmp 5016 C004.tmp 3984 C071.tmp 512 C0C0.tmp 4568 C11D.tmp 2844 C17B.tmp 2648 C1C9.tmp 4092 C227.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A340.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B987.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C87B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C60A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6099.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 945B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED2A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E733.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1846.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D26E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D282.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6702.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F901.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E366.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F656.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9035.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C822.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 439C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E886.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24F8.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3608 wrote to memory of 4652 3608 2024-10-15_407c57e3fde31b5d7c14666bd7054609_mafia.exe 84 PID 3608 wrote to memory of 4652 3608 2024-10-15_407c57e3fde31b5d7c14666bd7054609_mafia.exe 84 PID 3608 wrote to memory of 4652 3608 2024-10-15_407c57e3fde31b5d7c14666bd7054609_mafia.exe 84 PID 4652 wrote to memory of 3688 4652 AAD6.tmp 85 PID 4652 wrote to memory of 3688 4652 AAD6.tmp 85 PID 4652 wrote to memory of 3688 4652 AAD6.tmp 85 PID 3688 wrote to memory of 4416 3688 AB63.tmp 86 PID 3688 wrote to memory of 4416 3688 AB63.tmp 86 PID 3688 wrote to memory of 4416 3688 AB63.tmp 86 PID 4416 wrote to memory of 3992 4416 ABEF.tmp 88 PID 4416 wrote to memory of 3992 4416 ABEF.tmp 88 PID 4416 wrote to memory of 3992 4416 ABEF.tmp 88 PID 3992 wrote to memory of 3436 3992 AC5D.tmp 90 PID 3992 wrote to memory of 3436 3992 AC5D.tmp 90 PID 3992 wrote to memory of 3436 3992 AC5D.tmp 90 PID 3436 wrote to memory of 2504 3436 ACBB.tmp 91 PID 3436 wrote to memory of 2504 3436 ACBB.tmp 91 PID 3436 wrote to memory of 2504 3436 ACBB.tmp 91 PID 2504 wrote to memory of 1208 2504 AD09.tmp 93 PID 2504 wrote to memory of 1208 2504 AD09.tmp 93 PID 2504 wrote to memory of 1208 2504 AD09.tmp 93 PID 1208 wrote to memory of 4296 1208 AD76.tmp 94 PID 1208 wrote to memory of 4296 1208 AD76.tmp 94 PID 1208 wrote to memory of 4296 1208 AD76.tmp 94 PID 4296 wrote to memory of 1064 4296 ADD4.tmp 95 PID 4296 wrote to memory of 1064 4296 ADD4.tmp 95 PID 4296 wrote to memory of 1064 4296 ADD4.tmp 95 PID 1064 wrote to memory of 4108 1064 AE41.tmp 96 PID 1064 wrote to memory of 4108 1064 AE41.tmp 96 PID 1064 wrote to memory of 4108 1064 AE41.tmp 96 PID 4108 wrote to memory of 1788 4108 AEAF.tmp 97 PID 4108 wrote to memory of 1788 4108 AEAF.tmp 97 PID 4108 wrote to memory of 1788 4108 AEAF.tmp 97 PID 1788 wrote to memory of 4864 1788 AF1C.tmp 98 PID 1788 wrote to memory of 4864 1788 AF1C.tmp 98 PID 1788 wrote to memory of 4864 1788 AF1C.tmp 98 PID 4864 wrote to memory of 2256 4864 AFA9.tmp 99 PID 4864 wrote to memory of 2256 4864 AFA9.tmp 99 PID 4864 wrote to memory of 2256 4864 AFA9.tmp 99 PID 2256 wrote to memory of 3984 2256 B016.tmp 100 PID 2256 wrote to memory of 3984 2256 B016.tmp 100 PID 2256 wrote to memory of 3984 2256 B016.tmp 100 PID 3984 wrote to memory of 4048 3984 B064.tmp 101 PID 3984 wrote to memory of 4048 3984 B064.tmp 101 PID 3984 wrote to memory of 4048 3984 B064.tmp 101 PID 4048 wrote to memory of 4348 4048 B0C2.tmp 102 PID 4048 wrote to memory of 4348 4048 B0C2.tmp 102 PID 4048 wrote to memory of 4348 4048 B0C2.tmp 102 PID 4348 wrote to memory of 3296 4348 B120.tmp 103 PID 4348 wrote to memory of 3296 4348 B120.tmp 103 PID 4348 wrote to memory of 3296 4348 B120.tmp 103 PID 3296 wrote to memory of 1652 3296 B18D.tmp 104 PID 3296 wrote to memory of 1652 3296 B18D.tmp 104 PID 3296 wrote to memory of 1652 3296 B18D.tmp 104 PID 1652 wrote to memory of 4196 1652 B1DB.tmp 105 PID 1652 wrote to memory of 4196 1652 B1DB.tmp 105 PID 1652 wrote to memory of 4196 1652 B1DB.tmp 105 PID 4196 wrote to memory of 2580 4196 B229.tmp 106 PID 4196 wrote to memory of 2580 4196 B229.tmp 106 PID 4196 wrote to memory of 2580 4196 B229.tmp 106 PID 2580 wrote to memory of 2468 2580 B277.tmp 107 PID 2580 wrote to memory of 2468 2580 B277.tmp 107 PID 2580 wrote to memory of 2468 2580 B277.tmp 107 PID 2468 wrote to memory of 3412 2468 B2D5.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-15_407c57e3fde31b5d7c14666bd7054609_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-15_407c57e3fde31b5d7c14666bd7054609_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\AB63.tmp"C:\Users\Admin\AppData\Local\Temp\AB63.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\AD09.tmp"C:\Users\Admin\AppData\Local\Temp\AD09.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\AD76.tmp"C:\Users\Admin\AppData\Local\Temp\AD76.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\AE41.tmp"C:\Users\Admin\AppData\Local\Temp\AE41.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\B016.tmp"C:\Users\Admin\AppData\Local\Temp\B016.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\B064.tmp"C:\Users\Admin\AppData\Local\Temp\B064.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\B120.tmp"C:\Users\Admin\AppData\Local\Temp\B120.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\B18D.tmp"C:\Users\Admin\AppData\Local\Temp\B18D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\B229.tmp"C:\Users\Admin\AppData\Local\Temp\B229.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\B277.tmp"C:\Users\Admin\AppData\Local\Temp\B277.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\B333.tmp"C:\Users\Admin\AppData\Local\Temp\B333.tmp"23⤵
- Executes dropped EXE
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\B391.tmp"C:\Users\Admin\AppData\Local\Temp\B391.tmp"24⤵
- Executes dropped EXE
PID:968 -
C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"25⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\B43C.tmp"C:\Users\Admin\AppData\Local\Temp\B43C.tmp"26⤵
- Executes dropped EXE
PID:60 -
C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"27⤵
- Executes dropped EXE
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\B508.tmp"C:\Users\Admin\AppData\Local\Temp\B508.tmp"28⤵
- Executes dropped EXE
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\B565.tmp"C:\Users\Admin\AppData\Local\Temp\B565.tmp"29⤵
- Executes dropped EXE
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"30⤵
- Executes dropped EXE
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\B650.tmp"C:\Users\Admin\AppData\Local\Temp\B650.tmp"31⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"32⤵
- Executes dropped EXE
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\B72A.tmp"C:\Users\Admin\AppData\Local\Temp\B72A.tmp"33⤵
- Executes dropped EXE
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\B788.tmp"C:\Users\Admin\AppData\Local\Temp\B788.tmp"34⤵
- Executes dropped EXE
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"35⤵
- Executes dropped EXE
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\B824.tmp"C:\Users\Admin\AppData\Local\Temp\B824.tmp"36⤵
- Executes dropped EXE
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"37⤵
- Executes dropped EXE
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\B90F.tmp"C:\Users\Admin\AppData\Local\Temp\B90F.tmp"38⤵
- Executes dropped EXE
PID:940 -
C:\Users\Admin\AppData\Local\Temp\B95D.tmp"C:\Users\Admin\AppData\Local\Temp\B95D.tmp"39⤵
- Executes dropped EXE
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\BA18.tmp"C:\Users\Admin\AppData\Local\Temp\BA18.tmp"41⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\BA67.tmp"C:\Users\Admin\AppData\Local\Temp\BA67.tmp"42⤵
- Executes dropped EXE
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"43⤵
- Executes dropped EXE
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\BB22.tmp"C:\Users\Admin\AppData\Local\Temp\BB22.tmp"44⤵
- Executes dropped EXE
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\BB70.tmp"C:\Users\Admin\AppData\Local\Temp\BB70.tmp"45⤵
- Executes dropped EXE
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"46⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"47⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\BC6A.tmp"C:\Users\Admin\AppData\Local\Temp\BC6A.tmp"48⤵
- Executes dropped EXE
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\BCB8.tmp"C:\Users\Admin\AppData\Local\Temp\BCB8.tmp"49⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\BD06.tmp"C:\Users\Admin\AppData\Local\Temp\BD06.tmp"50⤵
- Executes dropped EXE
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\BD64.tmp"C:\Users\Admin\AppData\Local\Temp\BD64.tmp"51⤵
- Executes dropped EXE
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\BDB2.tmp"C:\Users\Admin\AppData\Local\Temp\BDB2.tmp"52⤵
- Executes dropped EXE
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\BE10.tmp"C:\Users\Admin\AppData\Local\Temp\BE10.tmp"53⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\BE6E.tmp"C:\Users\Admin\AppData\Local\Temp\BE6E.tmp"54⤵
- Executes dropped EXE
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\BECC.tmp"C:\Users\Admin\AppData\Local\Temp\BECC.tmp"55⤵
- Executes dropped EXE
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"56⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\BF68.tmp"C:\Users\Admin\AppData\Local\Temp\BF68.tmp"57⤵
- Executes dropped EXE
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\BFB6.tmp"C:\Users\Admin\AppData\Local\Temp\BFB6.tmp"58⤵
- Executes dropped EXE
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\C004.tmp"C:\Users\Admin\AppData\Local\Temp\C004.tmp"59⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\C071.tmp"C:\Users\Admin\AppData\Local\Temp\C071.tmp"60⤵
- Executes dropped EXE
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"61⤵
- Executes dropped EXE
PID:512 -
C:\Users\Admin\AppData\Local\Temp\C11D.tmp"C:\Users\Admin\AppData\Local\Temp\C11D.tmp"62⤵
- Executes dropped EXE
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\C17B.tmp"C:\Users\Admin\AppData\Local\Temp\C17B.tmp"63⤵
- Executes dropped EXE
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"64⤵
- Executes dropped EXE
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\C227.tmp"C:\Users\Admin\AppData\Local\Temp\C227.tmp"65⤵
- Executes dropped EXE
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\C275.tmp"C:\Users\Admin\AppData\Local\Temp\C275.tmp"66⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"67⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\C331.tmp"C:\Users\Admin\AppData\Local\Temp\C331.tmp"68⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\C39E.tmp"C:\Users\Admin\AppData\Local\Temp\C39E.tmp"69⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"70⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\C459.tmp"C:\Users\Admin\AppData\Local\Temp\C459.tmp"71⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"72⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"73⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\C553.tmp"C:\Users\Admin\AppData\Local\Temp\C553.tmp"74⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\C5B1.tmp"C:\Users\Admin\AppData\Local\Temp\C5B1.tmp"75⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\C60F.tmp"C:\Users\Admin\AppData\Local\Temp\C60F.tmp"76⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\C66D.tmp"C:\Users\Admin\AppData\Local\Temp\C66D.tmp"77⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\C6CA.tmp"C:\Users\Admin\AppData\Local\Temp\C6CA.tmp"78⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\C728.tmp"C:\Users\Admin\AppData\Local\Temp\C728.tmp"79⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\C776.tmp"C:\Users\Admin\AppData\Local\Temp\C776.tmp"80⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"81⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\C822.tmp"C:\Users\Admin\AppData\Local\Temp\C822.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\C880.tmp"C:\Users\Admin\AppData\Local\Temp\C880.tmp"83⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\C8CE.tmp"C:\Users\Admin\AppData\Local\Temp\C8CE.tmp"84⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\C91C.tmp"C:\Users\Admin\AppData\Local\Temp\C91C.tmp"85⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\C97A.tmp"C:\Users\Admin\AppData\Local\Temp\C97A.tmp"86⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\C9D8.tmp"C:\Users\Admin\AppData\Local\Temp\C9D8.tmp"87⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\CA45.tmp"C:\Users\Admin\AppData\Local\Temp\CA45.tmp"88⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\CAA3.tmp"C:\Users\Admin\AppData\Local\Temp\CAA3.tmp"89⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\CB01.tmp"C:\Users\Admin\AppData\Local\Temp\CB01.tmp"90⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\CB5E.tmp"C:\Users\Admin\AppData\Local\Temp\CB5E.tmp"91⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\CBAC.tmp"C:\Users\Admin\AppData\Local\Temp\CBAC.tmp"92⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\CBFB.tmp"C:\Users\Admin\AppData\Local\Temp\CBFB.tmp"93⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\CC58.tmp"C:\Users\Admin\AppData\Local\Temp\CC58.tmp"94⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\CCB6.tmp"C:\Users\Admin\AppData\Local\Temp\CCB6.tmp"95⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\CD14.tmp"C:\Users\Admin\AppData\Local\Temp\CD14.tmp"96⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\CD72.tmp"C:\Users\Admin\AppData\Local\Temp\CD72.tmp"97⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\CDCF.tmp"C:\Users\Admin\AppData\Local\Temp\CDCF.tmp"98⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\CE2D.tmp"C:\Users\Admin\AppData\Local\Temp\CE2D.tmp"99⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\CE8B.tmp"C:\Users\Admin\AppData\Local\Temp\CE8B.tmp"100⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\CED9.tmp"C:\Users\Admin\AppData\Local\Temp\CED9.tmp"101⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\CF27.tmp"C:\Users\Admin\AppData\Local\Temp\CF27.tmp"102⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\CF75.tmp"C:\Users\Admin\AppData\Local\Temp\CF75.tmp"103⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\CFD3.tmp"C:\Users\Admin\AppData\Local\Temp\CFD3.tmp"104⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\D031.tmp"C:\Users\Admin\AppData\Local\Temp\D031.tmp"105⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\D08E.tmp"C:\Users\Admin\AppData\Local\Temp\D08E.tmp"106⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\D0DD.tmp"C:\Users\Admin\AppData\Local\Temp\D0DD.tmp"107⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\D13A.tmp"C:\Users\Admin\AppData\Local\Temp\D13A.tmp"108⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\D188.tmp"C:\Users\Admin\AppData\Local\Temp\D188.tmp"109⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\D1D7.tmp"C:\Users\Admin\AppData\Local\Temp\D1D7.tmp"110⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\D225.tmp"C:\Users\Admin\AppData\Local\Temp\D225.tmp"111⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\D282.tmp"C:\Users\Admin\AppData\Local\Temp\D282.tmp"112⤵
- System Location Discovery: System Language Discovery
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\D2E0.tmp"C:\Users\Admin\AppData\Local\Temp\D2E0.tmp"113⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\D32E.tmp"C:\Users\Admin\AppData\Local\Temp\D32E.tmp"114⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\D38C.tmp"C:\Users\Admin\AppData\Local\Temp\D38C.tmp"115⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\D3EA.tmp"C:\Users\Admin\AppData\Local\Temp\D3EA.tmp"116⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\D438.tmp"C:\Users\Admin\AppData\Local\Temp\D438.tmp"117⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\D496.tmp"C:\Users\Admin\AppData\Local\Temp\D496.tmp"118⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\D4E4.tmp"C:\Users\Admin\AppData\Local\Temp\D4E4.tmp"119⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\D542.tmp"C:\Users\Admin\AppData\Local\Temp\D542.tmp"120⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\D59F.tmp"C:\Users\Admin\AppData\Local\Temp\D59F.tmp"121⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\D5ED.tmp"C:\Users\Admin\AppData\Local\Temp\D5ED.tmp"122⤵PID:2152
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-