Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03/09/2024, 04:16
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-03_7052d91f75b22dc590edbcab406a42cf_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-09-03_7052d91f75b22dc590edbcab406a42cf_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-03_7052d91f75b22dc590edbcab406a42cf_mafia.exe
-
Size
712KB
-
MD5
7052d91f75b22dc590edbcab406a42cf
-
SHA1
7780066bae08e886c1f4e865f1d514c83ef2803a
-
SHA256
46d76c2f700dc39944a6ac3bad11c5e03d56cb2ba0762d13409d73d4fe99a007
-
SHA512
df675c81b541c5a992b06d33d31c81b580183212f51a3c240d546a1e3eeca37eee72d2d56ab820c8e7bb674807bc8b6b582195fbcea381765b555694d528efe9
-
SSDEEP
12288:FU5rCOTeiDM6JfCSlMcR7O83GCGJ5bNZdCvq5TJLCvY90D8/LVBlVk736Y79GWzC:FUQOJDdRbM83vilNnCvq5TJLCvY90D8N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4212 9A5B.tmp 4812 9AC9.tmp 5028 9B46.tmp 2984 9BC3.tmp 3092 9C21.tmp 3088 9C9E.tmp 4176 9CFB.tmp 4964 9D69.tmp 5016 9DB7.tmp 2144 9E05.tmp 2364 9E82.tmp 4948 9EFF.tmp 4452 9F6C.tmp 5100 9FE9.tmp 404 A037.tmp 3880 A0B4.tmp 2116 A141.tmp 1436 A18F.tmp 1792 A1DD.tmp 1596 A25A.tmp 2956 A2D7.tmp 3768 A335.tmp 1752 A3D1.tmp 3504 A587.tmp 4904 A604.tmp 3688 A681.tmp 3988 A6DF.tmp 3360 A73C.tmp 3460 A7AA.tmp 1032 A827.tmp 2660 A8A4.tmp 1760 A911.tmp 4360 A97E.tmp 880 A9DC.tmp 1680 AA2A.tmp 3316 AA88.tmp 3488 AAE6.tmp 3856 AB34.tmp 3556 AB82.tmp 4160 ABD0.tmp 2964 AC2E.tmp 4708 AC8C.tmp 2872 ACE9.tmp 3700 AD38.tmp 1696 AD95.tmp 3480 ADE3.tmp 2644 AE41.tmp 2252 AE9F.tmp 3172 AEED.tmp 1676 AF4B.tmp 1240 AFA9.tmp 2228 B006.tmp 4916 B064.tmp 3728 B0C2.tmp 3088 B120.tmp 4696 B17D.tmp 1288 B1DB.tmp 4964 B239.tmp 3676 B287.tmp 4132 B2E5.tmp 3760 B342.tmp 1128 B3A0.tmp 3296 B3FE.tmp 560 B45C.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C63E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 771F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB88.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 145E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C3D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9853.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 560A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABCB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F80C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 194F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D760.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E22.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A94B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCC8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8632.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D906.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 752B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C510.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2424 wrote to memory of 4212 2424 2024-09-03_7052d91f75b22dc590edbcab406a42cf_mafia.exe 83 PID 2424 wrote to memory of 4212 2424 2024-09-03_7052d91f75b22dc590edbcab406a42cf_mafia.exe 83 PID 2424 wrote to memory of 4212 2424 2024-09-03_7052d91f75b22dc590edbcab406a42cf_mafia.exe 83 PID 4212 wrote to memory of 4812 4212 9A5B.tmp 85 PID 4212 wrote to memory of 4812 4212 9A5B.tmp 85 PID 4212 wrote to memory of 4812 4212 9A5B.tmp 85 PID 4812 wrote to memory of 5028 4812 9AC9.tmp 87 PID 4812 wrote to memory of 5028 4812 9AC9.tmp 87 PID 4812 wrote to memory of 5028 4812 9AC9.tmp 87 PID 5028 wrote to memory of 2984 5028 9B46.tmp 89 PID 5028 wrote to memory of 2984 5028 9B46.tmp 89 PID 5028 wrote to memory of 2984 5028 9B46.tmp 89 PID 2984 wrote to memory of 3092 2984 9BC3.tmp 90 PID 2984 wrote to memory of 3092 2984 9BC3.tmp 90 PID 2984 wrote to memory of 3092 2984 9BC3.tmp 90 PID 3092 wrote to memory of 3088 3092 9C21.tmp 91 PID 3092 wrote to memory of 3088 3092 9C21.tmp 91 PID 3092 wrote to memory of 3088 3092 9C21.tmp 91 PID 3088 wrote to memory of 4176 3088 9C9E.tmp 92 PID 3088 wrote to memory of 4176 3088 9C9E.tmp 92 PID 3088 wrote to memory of 4176 3088 9C9E.tmp 92 PID 4176 wrote to memory of 4964 4176 9CFB.tmp 93 PID 4176 wrote to memory of 4964 4176 9CFB.tmp 93 PID 4176 wrote to memory of 4964 4176 9CFB.tmp 93 PID 4964 wrote to memory of 5016 4964 9D69.tmp 94 PID 4964 wrote to memory of 5016 4964 9D69.tmp 94 PID 4964 wrote to memory of 5016 4964 9D69.tmp 94 PID 5016 wrote to memory of 2144 5016 9DB7.tmp 95 PID 5016 wrote to memory of 2144 5016 9DB7.tmp 95 PID 5016 wrote to memory of 2144 5016 9DB7.tmp 95 PID 2144 wrote to memory of 2364 2144 9E05.tmp 96 PID 2144 wrote to memory of 2364 2144 9E05.tmp 96 PID 2144 wrote to memory of 2364 2144 9E05.tmp 96 PID 2364 wrote to memory of 4948 2364 9E82.tmp 97 PID 2364 wrote to memory of 4948 2364 9E82.tmp 97 PID 2364 wrote to memory of 4948 2364 9E82.tmp 97 PID 4948 wrote to memory of 4452 4948 9EFF.tmp 98 PID 4948 wrote to memory of 4452 4948 9EFF.tmp 98 PID 4948 wrote to memory of 4452 4948 9EFF.tmp 98 PID 4452 wrote to memory of 5100 4452 9F6C.tmp 99 PID 4452 wrote to memory of 5100 4452 9F6C.tmp 99 PID 4452 wrote to memory of 5100 4452 9F6C.tmp 99 PID 5100 wrote to memory of 404 5100 9FE9.tmp 100 PID 5100 wrote to memory of 404 5100 9FE9.tmp 100 PID 5100 wrote to memory of 404 5100 9FE9.tmp 100 PID 404 wrote to memory of 3880 404 A037.tmp 101 PID 404 wrote to memory of 3880 404 A037.tmp 101 PID 404 wrote to memory of 3880 404 A037.tmp 101 PID 3880 wrote to memory of 2116 3880 A0B4.tmp 102 PID 3880 wrote to memory of 2116 3880 A0B4.tmp 102 PID 3880 wrote to memory of 2116 3880 A0B4.tmp 102 PID 2116 wrote to memory of 1436 2116 A141.tmp 103 PID 2116 wrote to memory of 1436 2116 A141.tmp 103 PID 2116 wrote to memory of 1436 2116 A141.tmp 103 PID 1436 wrote to memory of 1792 1436 A18F.tmp 104 PID 1436 wrote to memory of 1792 1436 A18F.tmp 104 PID 1436 wrote to memory of 1792 1436 A18F.tmp 104 PID 1792 wrote to memory of 1596 1792 A1DD.tmp 105 PID 1792 wrote to memory of 1596 1792 A1DD.tmp 105 PID 1792 wrote to memory of 1596 1792 A1DD.tmp 105 PID 1596 wrote to memory of 2956 1596 A25A.tmp 106 PID 1596 wrote to memory of 2956 1596 A25A.tmp 106 PID 1596 wrote to memory of 2956 1596 A25A.tmp 106 PID 2956 wrote to memory of 3768 2956 A2D7.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-03_7052d91f75b22dc590edbcab406a42cf_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-03_7052d91f75b22dc590edbcab406a42cf_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\9C21.tmp"C:\Users\Admin\AppData\Local\Temp\9C21.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\9D69.tmp"C:\Users\Admin\AppData\Local\Temp\9D69.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\9DB7.tmp"C:\Users\Admin\AppData\Local\Temp\9DB7.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\9E05.tmp"C:\Users\Admin\AppData\Local\Temp\9E05.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\9E82.tmp"C:\Users\Admin\AppData\Local\Temp\9E82.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\A037.tmp"C:\Users\Admin\AppData\Local\Temp\A037.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\A141.tmp"C:\Users\Admin\AppData\Local\Temp\A141.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\A18F.tmp"C:\Users\Admin\AppData\Local\Temp\A18F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\A25A.tmp"C:\Users\Admin\AppData\Local\Temp\A25A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\A335.tmp"C:\Users\Admin\AppData\Local\Temp\A335.tmp"23⤵
- Executes dropped EXE
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"24⤵
- Executes dropped EXE
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\A587.tmp"C:\Users\Admin\AppData\Local\Temp\A587.tmp"25⤵
- Executes dropped EXE
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\A604.tmp"C:\Users\Admin\AppData\Local\Temp\A604.tmp"26⤵
- Executes dropped EXE
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\A681.tmp"C:\Users\Admin\AppData\Local\Temp\A681.tmp"27⤵
- Executes dropped EXE
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"28⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\A73C.tmp"C:\Users\Admin\AppData\Local\Temp\A73C.tmp"29⤵
- Executes dropped EXE
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"30⤵
- Executes dropped EXE
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\A827.tmp"C:\Users\Admin\AppData\Local\Temp\A827.tmp"31⤵
- Executes dropped EXE
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"32⤵
- Executes dropped EXE
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\A911.tmp"C:\Users\Admin\AppData\Local\Temp\A911.tmp"33⤵
- Executes dropped EXE
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\A97E.tmp"C:\Users\Admin\AppData\Local\Temp\A97E.tmp"34⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"35⤵
- Executes dropped EXE
PID:880 -
C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"36⤵
- Executes dropped EXE
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\AA88.tmp"C:\Users\Admin\AppData\Local\Temp\AA88.tmp"37⤵
- Executes dropped EXE
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"38⤵
- Executes dropped EXE
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\AB34.tmp"C:\Users\Admin\AppData\Local\Temp\AB34.tmp"39⤵
- Executes dropped EXE
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\AB82.tmp"C:\Users\Admin\AppData\Local\Temp\AB82.tmp"40⤵
- Executes dropped EXE
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"41⤵
- Executes dropped EXE
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"42⤵
- Executes dropped EXE
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"43⤵
- Executes dropped EXE
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"44⤵
- Executes dropped EXE
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\AD38.tmp"C:\Users\Admin\AppData\Local\Temp\AD38.tmp"45⤵
- Executes dropped EXE
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\AD95.tmp"C:\Users\Admin\AppData\Local\Temp\AD95.tmp"46⤵
- Executes dropped EXE
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"47⤵
- Executes dropped EXE
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\AE41.tmp"C:\Users\Admin\AppData\Local\Temp\AE41.tmp"48⤵
- Executes dropped EXE
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"49⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\AEED.tmp"C:\Users\Admin\AppData\Local\Temp\AEED.tmp"50⤵
- Executes dropped EXE
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"51⤵
- Executes dropped EXE
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"52⤵
- Executes dropped EXE
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\B006.tmp"C:\Users\Admin\AppData\Local\Temp\B006.tmp"53⤵
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\B064.tmp"C:\Users\Admin\AppData\Local\Temp\B064.tmp"54⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"55⤵
- Executes dropped EXE
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\B120.tmp"C:\Users\Admin\AppData\Local\Temp\B120.tmp"56⤵
- Executes dropped EXE
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\B17D.tmp"C:\Users\Admin\AppData\Local\Temp\B17D.tmp"57⤵
- Executes dropped EXE
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"58⤵
- Executes dropped EXE
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\B239.tmp"C:\Users\Admin\AppData\Local\Temp\B239.tmp"59⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\B287.tmp"C:\Users\Admin\AppData\Local\Temp\B287.tmp"60⤵
- Executes dropped EXE
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"61⤵
- Executes dropped EXE
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\B342.tmp"C:\Users\Admin\AppData\Local\Temp\B342.tmp"62⤵
- Executes dropped EXE
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"63⤵
- Executes dropped EXE
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"64⤵
- Executes dropped EXE
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\B45C.tmp"C:\Users\Admin\AppData\Local\Temp\B45C.tmp"65⤵
- Executes dropped EXE
PID:560 -
C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"66⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\B508.tmp"C:\Users\Admin\AppData\Local\Temp\B508.tmp"67⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\B556.tmp"C:\Users\Admin\AppData\Local\Temp\B556.tmp"68⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\B602.tmp"C:\Users\Admin\AppData\Local\Temp\B602.tmp"70⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\B65F.tmp"C:\Users\Admin\AppData\Local\Temp\B65F.tmp"71⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"72⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\B70B.tmp"C:\Users\Admin\AppData\Local\Temp\B70B.tmp"73⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\B759.tmp"C:\Users\Admin\AppData\Local\Temp\B759.tmp"74⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"75⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\B805.tmp"C:\Users\Admin\AppData\Local\Temp\B805.tmp"76⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\B863.tmp"C:\Users\Admin\AppData\Local\Temp\B863.tmp"77⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"78⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"79⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\B94D.tmp"C:\Users\Admin\AppData\Local\Temp\B94D.tmp"80⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"81⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\BA09.tmp"C:\Users\Admin\AppData\Local\Temp\BA09.tmp"82⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\BA67.tmp"C:\Users\Admin\AppData\Local\Temp\BA67.tmp"83⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"84⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\BB12.tmp"C:\Users\Admin\AppData\Local\Temp\BB12.tmp"85⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\BB70.tmp"C:\Users\Admin\AppData\Local\Temp\BB70.tmp"86⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"87⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"88⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"89⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"90⤵
- System Location Discovery: System Language Discovery
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\BD26.tmp"C:\Users\Admin\AppData\Local\Temp\BD26.tmp"91⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\BD83.tmp"C:\Users\Admin\AppData\Local\Temp\BD83.tmp"92⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"93⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"94⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"95⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\BEEB.tmp"C:\Users\Admin\AppData\Local\Temp\BEEB.tmp"96⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\BF49.tmp"C:\Users\Admin\AppData\Local\Temp\BF49.tmp"97⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"98⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\C004.tmp"C:\Users\Admin\AppData\Local\Temp\C004.tmp"99⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\C052.tmp"C:\Users\Admin\AppData\Local\Temp\C052.tmp"100⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"101⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"102⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\C15C.tmp"C:\Users\Admin\AppData\Local\Temp\C15C.tmp"103⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"104⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\C217.tmp"C:\Users\Admin\AppData\Local\Temp\C217.tmp"105⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\C265.tmp"C:\Users\Admin\AppData\Local\Temp\C265.tmp"106⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\C2B4.tmp"C:\Users\Admin\AppData\Local\Temp\C2B4.tmp"107⤵
- System Location Discovery: System Language Discovery
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\C302.tmp"C:\Users\Admin\AppData\Local\Temp\C302.tmp"108⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\C35F.tmp"C:\Users\Admin\AppData\Local\Temp\C35F.tmp"109⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\C3AE.tmp"C:\Users\Admin\AppData\Local\Temp\C3AE.tmp"110⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\C40B.tmp"C:\Users\Admin\AppData\Local\Temp\C40B.tmp"111⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\C469.tmp"C:\Users\Admin\AppData\Local\Temp\C469.tmp"112⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\C4B7.tmp"C:\Users\Admin\AppData\Local\Temp\C4B7.tmp"113⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\C505.tmp"C:\Users\Admin\AppData\Local\Temp\C505.tmp"114⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\C553.tmp"C:\Users\Admin\AppData\Local\Temp\C553.tmp"115⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"116⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\C5F0.tmp"C:\Users\Admin\AppData\Local\Temp\C5F0.tmp"117⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\C63E.tmp"C:\Users\Admin\AppData\Local\Temp\C63E.tmp"118⤵
- System Location Discovery: System Language Discovery
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\C68C.tmp"C:\Users\Admin\AppData\Local\Temp\C68C.tmp"119⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\C6DA.tmp"C:\Users\Admin\AppData\Local\Temp\C6DA.tmp"120⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\C747.tmp"C:\Users\Admin\AppData\Local\Temp\C747.tmp"121⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\C7A5.tmp"C:\Users\Admin\AppData\Local\Temp\C7A5.tmp"122⤵PID:2244
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-