Analysis
-
max time kernel
150s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01-09-2024 06:42
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-01_9d8be01e4166f45fb52ec0b7f1ffd5b4_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-09-01_9d8be01e4166f45fb52ec0b7f1ffd5b4_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-01_9d8be01e4166f45fb52ec0b7f1ffd5b4_mafia.exe
-
Size
486KB
-
MD5
9d8be01e4166f45fb52ec0b7f1ffd5b4
-
SHA1
d3d940e5cb08fb276fe185bbbf4ba6b671821462
-
SHA256
87e0bb75b942501867299b74d0c42de8efda7983de36d534b5d72e87cf97bf96
-
SHA512
c8700b5dbbb1ff94312852416a9d4ae0e9140bd1bbc256345efb7b45af9cf072f3ce54855d43f7e8f56296ad1644b09816a145c3653accb2f0d02cc5778564f3
-
SSDEEP
12288:oU5rCOTeiDlaPlKRwdQ87Ftv4iodQLHkfNZ:oUQOJDlGdQw4XQmN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 644 885A.tmp 1472 88D7.tmp 2640 8925.tmp 1460 8993.tmp 2020 89F0.tmp 2320 8A5E.tmp 3544 8ABB.tmp 2208 8B19.tmp 5060 8B77.tmp 4824 8BE4.tmp 3536 8C32.tmp 2188 8C81.tmp 4972 8CDE.tmp 4752 8D2C.tmp 4688 8D8A.tmp 628 8DE8.tmp 4372 8E36.tmp 2732 8E84.tmp 440 8ED2.tmp 2704 8F20.tmp 3732 8F7E.tmp 4236 8FDC.tmp 4532 902A.tmp 216 9078.tmp 5104 90C6.tmp 1896 9124.tmp 2028 9172.tmp 1424 91C0.tmp 1600 920E.tmp 3744 926C.tmp 2932 92DA.tmp 4960 9328.tmp 2392 9385.tmp 4976 93D4.tmp 4272 9422.tmp 696 9470.tmp 4348 94BE.tmp 2304 951C.tmp 4840 95B8.tmp 3304 9616.tmp 3668 9664.tmp 4492 96B2.tmp 1320 9700.tmp 4224 974E.tmp 3472 979C.tmp 4868 97EA.tmp 3544 9839.tmp 2128 9887.tmp 2280 98D5.tmp 1524 9923.tmp 2920 9971.tmp 3536 99BF.tmp 4780 9A0D.tmp 3144 9A5B.tmp 4832 9AAA.tmp 1668 9B07.tmp 4752 9B55.tmp 1552 9BA4.tmp 4852 9BF2.tmp 1100 9C40.tmp 4516 9C8E.tmp 4312 9CDC.tmp 3660 9D49.tmp 440 9DA7.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4188.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A68C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C649.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7143.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CF9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3062.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 484F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 656C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-09-01_9d8be01e4166f45fb52ec0b7f1ffd5b4_mafia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A94B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FF6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A41B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBFB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B07.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C733.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3803.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3F9.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4840 wrote to memory of 644 4840 2024-09-01_9d8be01e4166f45fb52ec0b7f1ffd5b4_mafia.exe 84 PID 4840 wrote to memory of 644 4840 2024-09-01_9d8be01e4166f45fb52ec0b7f1ffd5b4_mafia.exe 84 PID 4840 wrote to memory of 644 4840 2024-09-01_9d8be01e4166f45fb52ec0b7f1ffd5b4_mafia.exe 84 PID 644 wrote to memory of 1472 644 885A.tmp 86 PID 644 wrote to memory of 1472 644 885A.tmp 86 PID 644 wrote to memory of 1472 644 885A.tmp 86 PID 1472 wrote to memory of 2640 1472 88D7.tmp 88 PID 1472 wrote to memory of 2640 1472 88D7.tmp 88 PID 1472 wrote to memory of 2640 1472 88D7.tmp 88 PID 2640 wrote to memory of 1460 2640 8925.tmp 90 PID 2640 wrote to memory of 1460 2640 8925.tmp 90 PID 2640 wrote to memory of 1460 2640 8925.tmp 90 PID 1460 wrote to memory of 2020 1460 8993.tmp 91 PID 1460 wrote to memory of 2020 1460 8993.tmp 91 PID 1460 wrote to memory of 2020 1460 8993.tmp 91 PID 2020 wrote to memory of 2320 2020 89F0.tmp 92 PID 2020 wrote to memory of 2320 2020 89F0.tmp 92 PID 2020 wrote to memory of 2320 2020 89F0.tmp 92 PID 2320 wrote to memory of 3544 2320 8A5E.tmp 138 PID 2320 wrote to memory of 3544 2320 8A5E.tmp 138 PID 2320 wrote to memory of 3544 2320 8A5E.tmp 138 PID 3544 wrote to memory of 2208 3544 8ABB.tmp 94 PID 3544 wrote to memory of 2208 3544 8ABB.tmp 94 PID 3544 wrote to memory of 2208 3544 8ABB.tmp 94 PID 2208 wrote to memory of 5060 2208 8B19.tmp 95 PID 2208 wrote to memory of 5060 2208 8B19.tmp 95 PID 2208 wrote to memory of 5060 2208 8B19.tmp 95 PID 5060 wrote to memory of 4824 5060 8B77.tmp 96 PID 5060 wrote to memory of 4824 5060 8B77.tmp 96 PID 5060 wrote to memory of 4824 5060 8B77.tmp 96 PID 4824 wrote to memory of 3536 4824 8BE4.tmp 143 PID 4824 wrote to memory of 3536 4824 8BE4.tmp 143 PID 4824 wrote to memory of 3536 4824 8BE4.tmp 143 PID 3536 wrote to memory of 2188 3536 8C32.tmp 98 PID 3536 wrote to memory of 2188 3536 8C32.tmp 98 PID 3536 wrote to memory of 2188 3536 8C32.tmp 98 PID 2188 wrote to memory of 4972 2188 8C81.tmp 99 PID 2188 wrote to memory of 4972 2188 8C81.tmp 99 PID 2188 wrote to memory of 4972 2188 8C81.tmp 99 PID 4972 wrote to memory of 4752 4972 8CDE.tmp 148 PID 4972 wrote to memory of 4752 4972 8CDE.tmp 148 PID 4972 wrote to memory of 4752 4972 8CDE.tmp 148 PID 4752 wrote to memory of 4688 4752 8D2C.tmp 101 PID 4752 wrote to memory of 4688 4752 8D2C.tmp 101 PID 4752 wrote to memory of 4688 4752 8D2C.tmp 101 PID 4688 wrote to memory of 628 4688 8D8A.tmp 102 PID 4688 wrote to memory of 628 4688 8D8A.tmp 102 PID 4688 wrote to memory of 628 4688 8D8A.tmp 102 PID 628 wrote to memory of 4372 628 8DE8.tmp 103 PID 628 wrote to memory of 4372 628 8DE8.tmp 103 PID 628 wrote to memory of 4372 628 8DE8.tmp 103 PID 4372 wrote to memory of 2732 4372 8E36.tmp 104 PID 4372 wrote to memory of 2732 4372 8E36.tmp 104 PID 4372 wrote to memory of 2732 4372 8E36.tmp 104 PID 2732 wrote to memory of 440 2732 8E84.tmp 155 PID 2732 wrote to memory of 440 2732 8E84.tmp 155 PID 2732 wrote to memory of 440 2732 8E84.tmp 155 PID 440 wrote to memory of 2704 440 8ED2.tmp 106 PID 440 wrote to memory of 2704 440 8ED2.tmp 106 PID 440 wrote to memory of 2704 440 8ED2.tmp 106 PID 2704 wrote to memory of 3732 2704 8F20.tmp 107 PID 2704 wrote to memory of 3732 2704 8F20.tmp 107 PID 2704 wrote to memory of 3732 2704 8F20.tmp 107 PID 3732 wrote to memory of 4236 3732 8F7E.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-01_9d8be01e4166f45fb52ec0b7f1ffd5b4_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-01_9d8be01e4166f45fb52ec0b7f1ffd5b4_mafia.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\885A.tmp"C:\Users\Admin\AppData\Local\Temp\885A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Users\Admin\AppData\Local\Temp\88D7.tmp"C:\Users\Admin\AppData\Local\Temp\88D7.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\8925.tmp"C:\Users\Admin\AppData\Local\Temp\8925.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\8993.tmp"C:\Users\Admin\AppData\Local\Temp\8993.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\89F0.tmp"C:\Users\Admin\AppData\Local\Temp\89F0.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\8B19.tmp"C:\Users\Admin\AppData\Local\Temp\8B19.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\8B77.tmp"C:\Users\Admin\AppData\Local\Temp\8B77.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\8C32.tmp"C:\Users\Admin\AppData\Local\Temp\8C32.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\8C81.tmp"C:\Users\Admin\AppData\Local\Temp\8C81.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\8DE8.tmp"C:\Users\Admin\AppData\Local\Temp\8DE8.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\8E36.tmp"C:\Users\Admin\AppData\Local\Temp\8E36.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\8E84.tmp"C:\Users\Admin\AppData\Local\Temp\8E84.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Users\Admin\AppData\Local\Temp\8F20.tmp"C:\Users\Admin\AppData\Local\Temp\8F20.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"23⤵
- Executes dropped EXE
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\902A.tmp"C:\Users\Admin\AppData\Local\Temp\902A.tmp"24⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\9078.tmp"C:\Users\Admin\AppData\Local\Temp\9078.tmp"25⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\90C6.tmp"C:\Users\Admin\AppData\Local\Temp\90C6.tmp"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\9124.tmp"C:\Users\Admin\AppData\Local\Temp\9124.tmp"27⤵
- Executes dropped EXE
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\9172.tmp"C:\Users\Admin\AppData\Local\Temp\9172.tmp"28⤵
- Executes dropped EXE
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\91C0.tmp"C:\Users\Admin\AppData\Local\Temp\91C0.tmp"29⤵
- Executes dropped EXE
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\920E.tmp"C:\Users\Admin\AppData\Local\Temp\920E.tmp"30⤵
- Executes dropped EXE
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\926C.tmp"C:\Users\Admin\AppData\Local\Temp\926C.tmp"31⤵
- Executes dropped EXE
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\92DA.tmp"C:\Users\Admin\AppData\Local\Temp\92DA.tmp"32⤵
- Executes dropped EXE
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\9328.tmp"C:\Users\Admin\AppData\Local\Temp\9328.tmp"33⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\9385.tmp"C:\Users\Admin\AppData\Local\Temp\9385.tmp"34⤵
- Executes dropped EXE
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\93D4.tmp"C:\Users\Admin\AppData\Local\Temp\93D4.tmp"35⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\9422.tmp"C:\Users\Admin\AppData\Local\Temp\9422.tmp"36⤵
- Executes dropped EXE
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\9470.tmp"C:\Users\Admin\AppData\Local\Temp\9470.tmp"37⤵
- Executes dropped EXE
PID:696 -
C:\Users\Admin\AppData\Local\Temp\94BE.tmp"C:\Users\Admin\AppData\Local\Temp\94BE.tmp"38⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\951C.tmp"C:\Users\Admin\AppData\Local\Temp\951C.tmp"39⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\956A.tmp"C:\Users\Admin\AppData\Local\Temp\956A.tmp"40⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\95B8.tmp"C:\Users\Admin\AppData\Local\Temp\95B8.tmp"41⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\9616.tmp"C:\Users\Admin\AppData\Local\Temp\9616.tmp"42⤵
- Executes dropped EXE
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\9664.tmp"C:\Users\Admin\AppData\Local\Temp\9664.tmp"43⤵
- Executes dropped EXE
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\96B2.tmp"C:\Users\Admin\AppData\Local\Temp\96B2.tmp"44⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\9700.tmp"C:\Users\Admin\AppData\Local\Temp\9700.tmp"45⤵
- Executes dropped EXE
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\974E.tmp"C:\Users\Admin\AppData\Local\Temp\974E.tmp"46⤵
- Executes dropped EXE
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\979C.tmp"C:\Users\Admin\AppData\Local\Temp\979C.tmp"47⤵
- Executes dropped EXE
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\97EA.tmp"C:\Users\Admin\AppData\Local\Temp\97EA.tmp"48⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\9839.tmp"C:\Users\Admin\AppData\Local\Temp\9839.tmp"49⤵
- Executes dropped EXE
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\9887.tmp"C:\Users\Admin\AppData\Local\Temp\9887.tmp"50⤵
- Executes dropped EXE
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\98D5.tmp"C:\Users\Admin\AppData\Local\Temp\98D5.tmp"51⤵
- Executes dropped EXE
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\9923.tmp"C:\Users\Admin\AppData\Local\Temp\9923.tmp"52⤵
- Executes dropped EXE
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\9971.tmp"C:\Users\Admin\AppData\Local\Temp\9971.tmp"53⤵
- Executes dropped EXE
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\99BF.tmp"C:\Users\Admin\AppData\Local\Temp\99BF.tmp"54⤵
- Executes dropped EXE
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"55⤵
- Executes dropped EXE
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"56⤵
- Executes dropped EXE
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"57⤵
- Executes dropped EXE
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\9B07.tmp"C:\Users\Admin\AppData\Local\Temp\9B07.tmp"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\9B55.tmp"C:\Users\Admin\AppData\Local\Temp\9B55.tmp"59⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"60⤵
- Executes dropped EXE
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"61⤵
- Executes dropped EXE
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\9C40.tmp"C:\Users\Admin\AppData\Local\Temp\9C40.tmp"62⤵
- Executes dropped EXE
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"63⤵
- Executes dropped EXE
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"64⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\9D49.tmp"C:\Users\Admin\AppData\Local\Temp\9D49.tmp"65⤵
- Executes dropped EXE
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"66⤵
- Executes dropped EXE
PID:440 -
C:\Users\Admin\AppData\Local\Temp\9E05.tmp"C:\Users\Admin\AppData\Local\Temp\9E05.tmp"67⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\9EB1.tmp"C:\Users\Admin\AppData\Local\Temp\9EB1.tmp"68⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"69⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"70⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\A047.tmp"C:\Users\Admin\AppData\Local\Temp\A047.tmp"71⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\A170.tmp"C:\Users\Admin\AppData\Local\Temp\A170.tmp"73⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"74⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\A27A.tmp"C:\Users\Admin\AppData\Local\Temp\A27A.tmp"75⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"76⤵
- System Location Discovery: System Language Discovery
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\A364.tmp"C:\Users\Admin\AppData\Local\Temp\A364.tmp"77⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"78⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\A46E.tmp"C:\Users\Admin\AppData\Local\Temp\A46E.tmp"79⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"80⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\A548.tmp"C:\Users\Admin\AppData\Local\Temp\A548.tmp"81⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\A5A6.tmp"C:\Users\Admin\AppData\Local\Temp\A5A6.tmp"82⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"83⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\A662.tmp"C:\Users\Admin\AppData\Local\Temp\A662.tmp"84⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"85⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\A71D.tmp"C:\Users\Admin\AppData\Local\Temp\A71D.tmp"86⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\A77B.tmp"C:\Users\Admin\AppData\Local\Temp\A77B.tmp"87⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"88⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\A836.tmp"C:\Users\Admin\AppData\Local\Temp\A836.tmp"89⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\A884.tmp"C:\Users\Admin\AppData\Local\Temp\A884.tmp"90⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"91⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\A940.tmp"C:\Users\Admin\AppData\Local\Temp\A940.tmp"92⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\A99E.tmp"C:\Users\Admin\AppData\Local\Temp\A99E.tmp"93⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"94⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\AA59.tmp"C:\Users\Admin\AppData\Local\Temp\AA59.tmp"95⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"96⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"97⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\AB53.tmp"C:\Users\Admin\AppData\Local\Temp\AB53.tmp"98⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"99⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"100⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"101⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"102⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\AD18.tmp"C:\Users\Admin\AppData\Local\Temp\AD18.tmp"103⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\AD76.tmp"C:\Users\Admin\AppData\Local\Temp\AD76.tmp"104⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"105⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\AE32.tmp"C:\Users\Admin\AppData\Local\Temp\AE32.tmp"106⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\AE80.tmp"C:\Users\Admin\AppData\Local\Temp\AE80.tmp"107⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"108⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"109⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"110⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"111⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\B016.tmp"C:\Users\Admin\AppData\Local\Temp\B016.tmp"112⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\B064.tmp"C:\Users\Admin\AppData\Local\Temp\B064.tmp"113⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"114⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\B110.tmp"C:\Users\Admin\AppData\Local\Temp\B110.tmp"115⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\B16E.tmp"C:\Users\Admin\AppData\Local\Temp\B16E.tmp"116⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"117⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\B229.tmp"C:\Users\Admin\AppData\Local\Temp\B229.tmp"118⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\B277.tmp"C:\Users\Admin\AppData\Local\Temp\B277.tmp"119⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"120⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\B323.tmp"C:\Users\Admin\AppData\Local\Temp\B323.tmp"121⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\B381.tmp"C:\Users\Admin\AppData\Local\Temp\B381.tmp"122⤵PID:4176
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-