Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29-08-2024 08:45
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-29_811c9ce8d6be5cfc39d6d681df7a6a75_mafia.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-08-29_811c9ce8d6be5cfc39d6d681df7a6a75_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-29_811c9ce8d6be5cfc39d6d681df7a6a75_mafia.exe
-
Size
541KB
-
MD5
811c9ce8d6be5cfc39d6d681df7a6a75
-
SHA1
9fc998ee332c47c8f5fa81a59d9abd01a7923bac
-
SHA256
cc23782fc7adfc346cd7045f77a4a5bcb3206b0ac19650d14f7e5eeb82c00100
-
SHA512
c70277d906ec53f5e2e5dd32e6e69a416f058ff8055a1608e0a8414f683f5b8b1b6f36c260965f4bcba34e568623615525986d52fb76dda6357716ce5db99f5b
-
SSDEEP
12288:UU5rCOTeifIO/F5zDuqFiF0SBrZa73ctO:UUQOJfIgJq+OrU73ctO
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1400 7A60.tmp 3248 7ACD.tmp 3124 7B4A.tmp 2024 7BD7.tmp 3132 7C64.tmp 228 7CD1.tmp 4340 7D2F.tmp 3472 7D9C.tmp 412 7E09.tmp 512 7E67.tmp 2540 7EE4.tmp 3680 7F32.tmp 4536 7FAF.tmp 1928 800D.tmp 848 808A.tmp 956 80D8.tmp 4908 8136.tmp 4920 8184.tmp 3640 81E2.tmp 2668 826E.tmp 3168 82BD.tmp 1244 832A.tmp 3504 8397.tmp 3136 8405.tmp 3484 8462.tmp 2376 84D0.tmp 2872 852E.tmp 2988 858B.tmp 1308 8608.tmp 3412 8656.tmp 1868 86C4.tmp 2508 8722.tmp 1440 879F.tmp 4612 87FC.tmp 5032 88A8.tmp 2520 88F6.tmp 4800 8944.tmp 3276 8993.tmp 3220 89E1.tmp 1992 8A3E.tmp 2648 8A8D.tmp 2524 8ADB.tmp 1156 8B29.tmp 4228 8B77.tmp 1988 8BC5.tmp 5108 8C13.tmp 1276 8C61.tmp 5080 8CAF.tmp 2216 8D0D.tmp 708 8D5B.tmp 4960 8DE8.tmp 4304 8E46.tmp 4636 8E94.tmp 1636 8EE2.tmp 4720 8F30.tmp 4864 8F7E.tmp 4060 8FEC.tmp 4752 9049.tmp 2756 9097.tmp 2980 90F5.tmp 3544 9143.tmp 4876 91A1.tmp 4576 920E.tmp 2212 925D.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3803.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F647.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 808A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A76B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D968.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 182.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A65D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B810.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A613.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1345.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6201.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B689.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5752.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C786.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 431F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54C2.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2056 wrote to memory of 1400 2056 2024-08-29_811c9ce8d6be5cfc39d6d681df7a6a75_mafia.exe 85 PID 2056 wrote to memory of 1400 2056 2024-08-29_811c9ce8d6be5cfc39d6d681df7a6a75_mafia.exe 85 PID 2056 wrote to memory of 1400 2056 2024-08-29_811c9ce8d6be5cfc39d6d681df7a6a75_mafia.exe 85 PID 1400 wrote to memory of 3248 1400 7A60.tmp 86 PID 1400 wrote to memory of 3248 1400 7A60.tmp 86 PID 1400 wrote to memory of 3248 1400 7A60.tmp 86 PID 3248 wrote to memory of 3124 3248 7ACD.tmp 88 PID 3248 wrote to memory of 3124 3248 7ACD.tmp 88 PID 3248 wrote to memory of 3124 3248 7ACD.tmp 88 PID 3124 wrote to memory of 2024 3124 7B4A.tmp 90 PID 3124 wrote to memory of 2024 3124 7B4A.tmp 90 PID 3124 wrote to memory of 2024 3124 7B4A.tmp 90 PID 2024 wrote to memory of 3132 2024 7BD7.tmp 92 PID 2024 wrote to memory of 3132 2024 7BD7.tmp 92 PID 2024 wrote to memory of 3132 2024 7BD7.tmp 92 PID 3132 wrote to memory of 228 3132 7C64.tmp 93 PID 3132 wrote to memory of 228 3132 7C64.tmp 93 PID 3132 wrote to memory of 228 3132 7C64.tmp 93 PID 228 wrote to memory of 4340 228 7CD1.tmp 94 PID 228 wrote to memory of 4340 228 7CD1.tmp 94 PID 228 wrote to memory of 4340 228 7CD1.tmp 94 PID 4340 wrote to memory of 3472 4340 7D2F.tmp 95 PID 4340 wrote to memory of 3472 4340 7D2F.tmp 95 PID 4340 wrote to memory of 3472 4340 7D2F.tmp 95 PID 3472 wrote to memory of 412 3472 7D9C.tmp 96 PID 3472 wrote to memory of 412 3472 7D9C.tmp 96 PID 3472 wrote to memory of 412 3472 7D9C.tmp 96 PID 412 wrote to memory of 512 412 7E09.tmp 97 PID 412 wrote to memory of 512 412 7E09.tmp 97 PID 412 wrote to memory of 512 412 7E09.tmp 97 PID 512 wrote to memory of 2540 512 7E67.tmp 98 PID 512 wrote to memory of 2540 512 7E67.tmp 98 PID 512 wrote to memory of 2540 512 7E67.tmp 98 PID 2540 wrote to memory of 3680 2540 7EE4.tmp 99 PID 2540 wrote to memory of 3680 2540 7EE4.tmp 99 PID 2540 wrote to memory of 3680 2540 7EE4.tmp 99 PID 3680 wrote to memory of 4536 3680 7F32.tmp 100 PID 3680 wrote to memory of 4536 3680 7F32.tmp 100 PID 3680 wrote to memory of 4536 3680 7F32.tmp 100 PID 4536 wrote to memory of 1928 4536 7FAF.tmp 101 PID 4536 wrote to memory of 1928 4536 7FAF.tmp 101 PID 4536 wrote to memory of 1928 4536 7FAF.tmp 101 PID 1928 wrote to memory of 848 1928 800D.tmp 102 PID 1928 wrote to memory of 848 1928 800D.tmp 102 PID 1928 wrote to memory of 848 1928 800D.tmp 102 PID 848 wrote to memory of 956 848 808A.tmp 103 PID 848 wrote to memory of 956 848 808A.tmp 103 PID 848 wrote to memory of 956 848 808A.tmp 103 PID 956 wrote to memory of 4908 956 80D8.tmp 104 PID 956 wrote to memory of 4908 956 80D8.tmp 104 PID 956 wrote to memory of 4908 956 80D8.tmp 104 PID 4908 wrote to memory of 4920 4908 8136.tmp 105 PID 4908 wrote to memory of 4920 4908 8136.tmp 105 PID 4908 wrote to memory of 4920 4908 8136.tmp 105 PID 4920 wrote to memory of 3640 4920 8184.tmp 106 PID 4920 wrote to memory of 3640 4920 8184.tmp 106 PID 4920 wrote to memory of 3640 4920 8184.tmp 106 PID 3640 wrote to memory of 2668 3640 81E2.tmp 107 PID 3640 wrote to memory of 2668 3640 81E2.tmp 107 PID 3640 wrote to memory of 2668 3640 81E2.tmp 107 PID 2668 wrote to memory of 3168 2668 826E.tmp 108 PID 2668 wrote to memory of 3168 2668 826E.tmp 108 PID 2668 wrote to memory of 3168 2668 826E.tmp 108 PID 3168 wrote to memory of 1244 3168 82BD.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-29_811c9ce8d6be5cfc39d6d681df7a6a75_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-29_811c9ce8d6be5cfc39d6d681df7a6a75_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\7A60.tmp"C:\Users\Admin\AppData\Local\Temp\7A60.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\7C64.tmp"C:\Users\Admin\AppData\Local\Temp\7C64.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\7D9C.tmp"C:\Users\Admin\AppData\Local\Temp\7D9C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\7E09.tmp"C:\Users\Admin\AppData\Local\Temp\7E09.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Users\Admin\AppData\Local\Temp\7E67.tmp"C:\Users\Admin\AppData\Local\Temp\7E67.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:512 -
C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\7F32.tmp"C:\Users\Admin\AppData\Local\Temp\7F32.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\7FAF.tmp"C:\Users\Admin\AppData\Local\Temp\7FAF.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\800D.tmp"C:\Users\Admin\AppData\Local\Temp\800D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\808A.tmp"C:\Users\Admin\AppData\Local\Temp\808A.tmp"16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Users\Admin\AppData\Local\Temp\80D8.tmp"C:\Users\Admin\AppData\Local\Temp\80D8.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\8136.tmp"C:\Users\Admin\AppData\Local\Temp\8136.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\8184.tmp"C:\Users\Admin\AppData\Local\Temp\8184.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\81E2.tmp"C:\Users\Admin\AppData\Local\Temp\81E2.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\826E.tmp"C:\Users\Admin\AppData\Local\Temp\826E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\82BD.tmp"C:\Users\Admin\AppData\Local\Temp\82BD.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\832A.tmp"C:\Users\Admin\AppData\Local\Temp\832A.tmp"23⤵
- Executes dropped EXE
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\8397.tmp"C:\Users\Admin\AppData\Local\Temp\8397.tmp"24⤵
- Executes dropped EXE
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\8405.tmp"C:\Users\Admin\AppData\Local\Temp\8405.tmp"25⤵
- Executes dropped EXE
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\8462.tmp"C:\Users\Admin\AppData\Local\Temp\8462.tmp"26⤵
- Executes dropped EXE
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\84D0.tmp"C:\Users\Admin\AppData\Local\Temp\84D0.tmp"27⤵
- Executes dropped EXE
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\852E.tmp"C:\Users\Admin\AppData\Local\Temp\852E.tmp"28⤵
- Executes dropped EXE
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\858B.tmp"C:\Users\Admin\AppData\Local\Temp\858B.tmp"29⤵
- Executes dropped EXE
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\8608.tmp"C:\Users\Admin\AppData\Local\Temp\8608.tmp"30⤵
- Executes dropped EXE
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\8656.tmp"C:\Users\Admin\AppData\Local\Temp\8656.tmp"31⤵
- Executes dropped EXE
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\86C4.tmp"C:\Users\Admin\AppData\Local\Temp\86C4.tmp"32⤵
- Executes dropped EXE
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\8722.tmp"C:\Users\Admin\AppData\Local\Temp\8722.tmp"33⤵
- Executes dropped EXE
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\879F.tmp"C:\Users\Admin\AppData\Local\Temp\879F.tmp"34⤵
- Executes dropped EXE
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\87FC.tmp"C:\Users\Admin\AppData\Local\Temp\87FC.tmp"35⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\884A.tmp"C:\Users\Admin\AppData\Local\Temp\884A.tmp"36⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\88A8.tmp"C:\Users\Admin\AppData\Local\Temp\88A8.tmp"37⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\88F6.tmp"C:\Users\Admin\AppData\Local\Temp\88F6.tmp"38⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\8944.tmp"C:\Users\Admin\AppData\Local\Temp\8944.tmp"39⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\8993.tmp"C:\Users\Admin\AppData\Local\Temp\8993.tmp"40⤵
- Executes dropped EXE
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\89E1.tmp"C:\Users\Admin\AppData\Local\Temp\89E1.tmp"41⤵
- Executes dropped EXE
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"43⤵
- Executes dropped EXE
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"44⤵
- Executes dropped EXE
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\8B29.tmp"C:\Users\Admin\AppData\Local\Temp\8B29.tmp"45⤵
- Executes dropped EXE
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\8B77.tmp"C:\Users\Admin\AppData\Local\Temp\8B77.tmp"46⤵
- Executes dropped EXE
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\8BC5.tmp"C:\Users\Admin\AppData\Local\Temp\8BC5.tmp"47⤵
- Executes dropped EXE
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\8C13.tmp"C:\Users\Admin\AppData\Local\Temp\8C13.tmp"48⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\8C61.tmp"C:\Users\Admin\AppData\Local\Temp\8C61.tmp"49⤵
- Executes dropped EXE
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\8CAF.tmp"C:\Users\Admin\AppData\Local\Temp\8CAF.tmp"50⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"51⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\8D5B.tmp"C:\Users\Admin\AppData\Local\Temp\8D5B.tmp"52⤵
- Executes dropped EXE
PID:708 -
C:\Users\Admin\AppData\Local\Temp\8DE8.tmp"C:\Users\Admin\AppData\Local\Temp\8DE8.tmp"53⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\8E46.tmp"C:\Users\Admin\AppData\Local\Temp\8E46.tmp"54⤵
- Executes dropped EXE
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\8E94.tmp"C:\Users\Admin\AppData\Local\Temp\8E94.tmp"55⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\8EE2.tmp"C:\Users\Admin\AppData\Local\Temp\8EE2.tmp"56⤵
- Executes dropped EXE
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\8F30.tmp"C:\Users\Admin\AppData\Local\Temp\8F30.tmp"57⤵
- Executes dropped EXE
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"58⤵
- Executes dropped EXE
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"59⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\9049.tmp"C:\Users\Admin\AppData\Local\Temp\9049.tmp"60⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\9097.tmp"C:\Users\Admin\AppData\Local\Temp\9097.tmp"61⤵
- Executes dropped EXE
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\90F5.tmp"C:\Users\Admin\AppData\Local\Temp\90F5.tmp"62⤵
- Executes dropped EXE
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\9143.tmp"C:\Users\Admin\AppData\Local\Temp\9143.tmp"63⤵
- Executes dropped EXE
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\91A1.tmp"C:\Users\Admin\AppData\Local\Temp\91A1.tmp"64⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\920E.tmp"C:\Users\Admin\AppData\Local\Temp\920E.tmp"65⤵
- Executes dropped EXE
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\925D.tmp"C:\Users\Admin\AppData\Local\Temp\925D.tmp"66⤵
- Executes dropped EXE
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\92AB.tmp"C:\Users\Admin\AppData\Local\Temp\92AB.tmp"67⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\92F9.tmp"C:\Users\Admin\AppData\Local\Temp\92F9.tmp"68⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\9357.tmp"C:\Users\Admin\AppData\Local\Temp\9357.tmp"69⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\93C4.tmp"C:\Users\Admin\AppData\Local\Temp\93C4.tmp"70⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\9412.tmp"C:\Users\Admin\AppData\Local\Temp\9412.tmp"71⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\9470.tmp"C:\Users\Admin\AppData\Local\Temp\9470.tmp"72⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\94CE.tmp"C:\Users\Admin\AppData\Local\Temp\94CE.tmp"73⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\952B.tmp"C:\Users\Admin\AppData\Local\Temp\952B.tmp"74⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\9589.tmp"C:\Users\Admin\AppData\Local\Temp\9589.tmp"75⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\95E7.tmp"C:\Users\Admin\AppData\Local\Temp\95E7.tmp"76⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\9645.tmp"C:\Users\Admin\AppData\Local\Temp\9645.tmp"77⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\96A2.tmp"C:\Users\Admin\AppData\Local\Temp\96A2.tmp"78⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\9700.tmp"C:\Users\Admin\AppData\Local\Temp\9700.tmp"79⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\975E.tmp"C:\Users\Admin\AppData\Local\Temp\975E.tmp"80⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\97AC.tmp"C:\Users\Admin\AppData\Local\Temp\97AC.tmp"81⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\980A.tmp"C:\Users\Admin\AppData\Local\Temp\980A.tmp"82⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\9867.tmp"C:\Users\Admin\AppData\Local\Temp\9867.tmp"83⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\98B6.tmp"C:\Users\Admin\AppData\Local\Temp\98B6.tmp"84⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\9904.tmp"C:\Users\Admin\AppData\Local\Temp\9904.tmp"85⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\9961.tmp"C:\Users\Admin\AppData\Local\Temp\9961.tmp"86⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\99CF.tmp"C:\Users\Admin\AppData\Local\Temp\99CF.tmp"87⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"88⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"89⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"90⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\9B27.tmp"C:\Users\Admin\AppData\Local\Temp\9B27.tmp"91⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"92⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"93⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\9C40.tmp"C:\Users\Admin\AppData\Local\Temp\9C40.tmp"94⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"95⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"96⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"97⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\9D98.tmp"C:\Users\Admin\AppData\Local\Temp\9D98.tmp"98⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"99⤵PID:512
-
C:\Users\Admin\AppData\Local\Temp\9E43.tmp"C:\Users\Admin\AppData\Local\Temp\9E43.tmp"100⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\9E92.tmp"C:\Users\Admin\AppData\Local\Temp\9E92.tmp"101⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"102⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"103⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"104⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"105⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\A047.tmp"C:\Users\Admin\AppData\Local\Temp\A047.tmp"106⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"107⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"108⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\A141.tmp"C:\Users\Admin\AppData\Local\Temp\A141.tmp"109⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\A18F.tmp"C:\Users\Admin\AppData\Local\Temp\A18F.tmp"110⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"111⤵PID:664
-
C:\Users\Admin\AppData\Local\Temp\A22B.tmp"C:\Users\Admin\AppData\Local\Temp\A22B.tmp"112⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\A289.tmp"C:\Users\Admin\AppData\Local\Temp\A289.tmp"113⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"114⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\A335.tmp"C:\Users\Admin\AppData\Local\Temp\A335.tmp"115⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\A383.tmp"C:\Users\Admin\AppData\Local\Temp\A383.tmp"116⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"117⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\A42F.tmp"C:\Users\Admin\AppData\Local\Temp\A42F.tmp"118⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\A47D.tmp"C:\Users\Admin\AppData\Local\Temp\A47D.tmp"119⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"120⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\A529.tmp"C:\Users\Admin\AppData\Local\Temp\A529.tmp"121⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\A577.tmp"C:\Users\Admin\AppData\Local\Temp\A577.tmp"122⤵PID:4648
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-