Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2024, 04:03
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-19_155ac49f3d5af9da52fa972f9d542976_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-19_155ac49f3d5af9da52fa972f9d542976_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-19_155ac49f3d5af9da52fa972f9d542976_mafia.exe
-
Size
765KB
-
MD5
155ac49f3d5af9da52fa972f9d542976
-
SHA1
19bcbb8b94e8ffd9bd6e84befad97bb6c24ffa40
-
SHA256
ef3f33e3e434f6fe1dde3ee7a2544733a59cda201ceeecd648f5d69176453320
-
SHA512
4f80fa3233bb0dc9116d2dec1b6d62c23796441279dc2c39220ec5603bc9d741488ff4f4e4b57be0266594d5f443cadaf79d54422b9fdf83d1af8aab9974fcbd
-
SSDEEP
12288:ZU5rCOTeiDNpzR+6uSFHTnjL7udd33ZF5rn5rLOa54U5w5A:ZUQOJDN6iHT63vh5Oa+UOS
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4048 80B9.tmp 2616 8146.tmp 452 81D2.tmp 2996 826E.tmp 2008 82CC.tmp 944 832A.tmp 616 8397.tmp 4888 8405.tmp 456 8482.tmp 872 84FF.tmp 4592 855C.tmp 1160 85CA.tmp 2828 8637.tmp 1884 86A5.tmp 4040 8712.tmp 5060 877F.tmp 5056 87FC.tmp 4924 886A.tmp 1620 88E7.tmp 2724 8964.tmp 4632 89B2.tmp 1360 8A2F.tmp 5012 8A7D.tmp 4964 8AEA.tmp 1788 8B67.tmp 2184 8BF4.tmp 4464 8C52.tmp 4124 8CCF.tmp 2024 8D2C.tmp 4600 8D8A.tmp 4612 8E07.tmp 3388 8E65.tmp 4400 8EE2.tmp 3580 8F30.tmp 3400 8F7E.tmp 3232 8FDC.tmp 3196 903A.tmp 3724 9088.tmp 4904 90D6.tmp 3952 9124.tmp 1588 9182.tmp 1572 91D0.tmp 1752 921E.tmp 4436 927C.tmp 1700 92CA.tmp 1056 9318.tmp 4204 9376.tmp 4692 93D4.tmp 2340 9431.tmp 2508 948F.tmp 732 94DD.tmp 2352 953B.tmp 2856 9589.tmp 2424 95E7.tmp 1140 9645.tmp 3352 96A2.tmp 1180 9700.tmp 2396 974E.tmp 2964 979C.tmp 2780 97EA.tmp 3456 9848.tmp 3700 98A6.tmp 392 98F4.tmp 3556 9952.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9287.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4457.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A901.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C147.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 142F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6099.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCB8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC4D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A65D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C791.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C776.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2892.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F89.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B45C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5FFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F0A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECA2.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1624 wrote to memory of 4048 1624 2024-09-19_155ac49f3d5af9da52fa972f9d542976_mafia.exe 82 PID 1624 wrote to memory of 4048 1624 2024-09-19_155ac49f3d5af9da52fa972f9d542976_mafia.exe 82 PID 1624 wrote to memory of 4048 1624 2024-09-19_155ac49f3d5af9da52fa972f9d542976_mafia.exe 82 PID 4048 wrote to memory of 2616 4048 80B9.tmp 83 PID 4048 wrote to memory of 2616 4048 80B9.tmp 83 PID 4048 wrote to memory of 2616 4048 80B9.tmp 83 PID 2616 wrote to memory of 452 2616 8146.tmp 84 PID 2616 wrote to memory of 452 2616 8146.tmp 84 PID 2616 wrote to memory of 452 2616 8146.tmp 84 PID 452 wrote to memory of 2996 452 81D2.tmp 85 PID 452 wrote to memory of 2996 452 81D2.tmp 85 PID 452 wrote to memory of 2996 452 81D2.tmp 85 PID 2996 wrote to memory of 2008 2996 826E.tmp 86 PID 2996 wrote to memory of 2008 2996 826E.tmp 86 PID 2996 wrote to memory of 2008 2996 826E.tmp 86 PID 2008 wrote to memory of 944 2008 82CC.tmp 87 PID 2008 wrote to memory of 944 2008 82CC.tmp 87 PID 2008 wrote to memory of 944 2008 82CC.tmp 87 PID 944 wrote to memory of 616 944 832A.tmp 88 PID 944 wrote to memory of 616 944 832A.tmp 88 PID 944 wrote to memory of 616 944 832A.tmp 88 PID 616 wrote to memory of 4888 616 8397.tmp 89 PID 616 wrote to memory of 4888 616 8397.tmp 89 PID 616 wrote to memory of 4888 616 8397.tmp 89 PID 4888 wrote to memory of 456 4888 8405.tmp 90 PID 4888 wrote to memory of 456 4888 8405.tmp 90 PID 4888 wrote to memory of 456 4888 8405.tmp 90 PID 456 wrote to memory of 872 456 8482.tmp 91 PID 456 wrote to memory of 872 456 8482.tmp 91 PID 456 wrote to memory of 872 456 8482.tmp 91 PID 872 wrote to memory of 4592 872 84FF.tmp 92 PID 872 wrote to memory of 4592 872 84FF.tmp 92 PID 872 wrote to memory of 4592 872 84FF.tmp 92 PID 4592 wrote to memory of 1160 4592 855C.tmp 93 PID 4592 wrote to memory of 1160 4592 855C.tmp 93 PID 4592 wrote to memory of 1160 4592 855C.tmp 93 PID 1160 wrote to memory of 2828 1160 85CA.tmp 94 PID 1160 wrote to memory of 2828 1160 85CA.tmp 94 PID 1160 wrote to memory of 2828 1160 85CA.tmp 94 PID 2828 wrote to memory of 1884 2828 8637.tmp 95 PID 2828 wrote to memory of 1884 2828 8637.tmp 95 PID 2828 wrote to memory of 1884 2828 8637.tmp 95 PID 1884 wrote to memory of 4040 1884 86A5.tmp 96 PID 1884 wrote to memory of 4040 1884 86A5.tmp 96 PID 1884 wrote to memory of 4040 1884 86A5.tmp 96 PID 4040 wrote to memory of 5060 4040 8712.tmp 97 PID 4040 wrote to memory of 5060 4040 8712.tmp 97 PID 4040 wrote to memory of 5060 4040 8712.tmp 97 PID 5060 wrote to memory of 5056 5060 877F.tmp 98 PID 5060 wrote to memory of 5056 5060 877F.tmp 98 PID 5060 wrote to memory of 5056 5060 877F.tmp 98 PID 5056 wrote to memory of 4924 5056 87FC.tmp 99 PID 5056 wrote to memory of 4924 5056 87FC.tmp 99 PID 5056 wrote to memory of 4924 5056 87FC.tmp 99 PID 4924 wrote to memory of 1620 4924 886A.tmp 100 PID 4924 wrote to memory of 1620 4924 886A.tmp 100 PID 4924 wrote to memory of 1620 4924 886A.tmp 100 PID 1620 wrote to memory of 2724 1620 88E7.tmp 101 PID 1620 wrote to memory of 2724 1620 88E7.tmp 101 PID 1620 wrote to memory of 2724 1620 88E7.tmp 101 PID 2724 wrote to memory of 4632 2724 8964.tmp 102 PID 2724 wrote to memory of 4632 2724 8964.tmp 102 PID 2724 wrote to memory of 4632 2724 8964.tmp 102 PID 4632 wrote to memory of 1360 4632 89B2.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_155ac49f3d5af9da52fa972f9d542976_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_155ac49f3d5af9da52fa972f9d542976_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\80B9.tmp"C:\Users\Admin\AppData\Local\Temp\80B9.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\8146.tmp"C:\Users\Admin\AppData\Local\Temp\8146.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\81D2.tmp"C:\Users\Admin\AppData\Local\Temp\81D2.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Users\Admin\AppData\Local\Temp\826E.tmp"C:\Users\Admin\AppData\Local\Temp\826E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\82CC.tmp"C:\Users\Admin\AppData\Local\Temp\82CC.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\832A.tmp"C:\Users\Admin\AppData\Local\Temp\832A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\8397.tmp"C:\Users\Admin\AppData\Local\Temp\8397.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Users\Admin\AppData\Local\Temp\8405.tmp"C:\Users\Admin\AppData\Local\Temp\8405.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\8482.tmp"C:\Users\Admin\AppData\Local\Temp\8482.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Users\Admin\AppData\Local\Temp\84FF.tmp"C:\Users\Admin\AppData\Local\Temp\84FF.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\AppData\Local\Temp\855C.tmp"C:\Users\Admin\AppData\Local\Temp\855C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\85CA.tmp"C:\Users\Admin\AppData\Local\Temp\85CA.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\8637.tmp"C:\Users\Admin\AppData\Local\Temp\8637.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\86A5.tmp"C:\Users\Admin\AppData\Local\Temp\86A5.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\8712.tmp"C:\Users\Admin\AppData\Local\Temp\8712.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\877F.tmp"C:\Users\Admin\AppData\Local\Temp\877F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\87FC.tmp"C:\Users\Admin\AppData\Local\Temp\87FC.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\886A.tmp"C:\Users\Admin\AppData\Local\Temp\886A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\88E7.tmp"C:\Users\Admin\AppData\Local\Temp\88E7.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\8964.tmp"C:\Users\Admin\AppData\Local\Temp\8964.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\89B2.tmp"C:\Users\Admin\AppData\Local\Temp\89B2.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"23⤵
- Executes dropped EXE
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"24⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"25⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\8B67.tmp"C:\Users\Admin\AppData\Local\Temp\8B67.tmp"26⤵
- Executes dropped EXE
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"27⤵
- Executes dropped EXE
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\8C52.tmp"C:\Users\Admin\AppData\Local\Temp\8C52.tmp"28⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"29⤵
- Executes dropped EXE
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"31⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\8E07.tmp"C:\Users\Admin\AppData\Local\Temp\8E07.tmp"32⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\8E65.tmp"C:\Users\Admin\AppData\Local\Temp\8E65.tmp"33⤵
- Executes dropped EXE
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\8EE2.tmp"C:\Users\Admin\AppData\Local\Temp\8EE2.tmp"34⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\8F30.tmp"C:\Users\Admin\AppData\Local\Temp\8F30.tmp"35⤵
- Executes dropped EXE
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"37⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\903A.tmp"C:\Users\Admin\AppData\Local\Temp\903A.tmp"38⤵
- Executes dropped EXE
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\9088.tmp"C:\Users\Admin\AppData\Local\Temp\9088.tmp"39⤵
- Executes dropped EXE
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\90D6.tmp"C:\Users\Admin\AppData\Local\Temp\90D6.tmp"40⤵
- Executes dropped EXE
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\9124.tmp"C:\Users\Admin\AppData\Local\Temp\9124.tmp"41⤵
- Executes dropped EXE
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\9182.tmp"C:\Users\Admin\AppData\Local\Temp\9182.tmp"42⤵
- Executes dropped EXE
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\91D0.tmp"C:\Users\Admin\AppData\Local\Temp\91D0.tmp"43⤵
- Executes dropped EXE
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\921E.tmp"C:\Users\Admin\AppData\Local\Temp\921E.tmp"44⤵
- Executes dropped EXE
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\927C.tmp"C:\Users\Admin\AppData\Local\Temp\927C.tmp"45⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\92CA.tmp"C:\Users\Admin\AppData\Local\Temp\92CA.tmp"46⤵
- Executes dropped EXE
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\9318.tmp"C:\Users\Admin\AppData\Local\Temp\9318.tmp"47⤵
- Executes dropped EXE
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\9376.tmp"C:\Users\Admin\AppData\Local\Temp\9376.tmp"48⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\93D4.tmp"C:\Users\Admin\AppData\Local\Temp\93D4.tmp"49⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\9431.tmp"C:\Users\Admin\AppData\Local\Temp\9431.tmp"50⤵
- Executes dropped EXE
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\948F.tmp"C:\Users\Admin\AppData\Local\Temp\948F.tmp"51⤵
- Executes dropped EXE
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\94DD.tmp"C:\Users\Admin\AppData\Local\Temp\94DD.tmp"52⤵
- Executes dropped EXE
PID:732 -
C:\Users\Admin\AppData\Local\Temp\953B.tmp"C:\Users\Admin\AppData\Local\Temp\953B.tmp"53⤵
- Executes dropped EXE
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\9589.tmp"C:\Users\Admin\AppData\Local\Temp\9589.tmp"54⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\95E7.tmp"C:\Users\Admin\AppData\Local\Temp\95E7.tmp"55⤵
- Executes dropped EXE
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\9645.tmp"C:\Users\Admin\AppData\Local\Temp\9645.tmp"56⤵
- Executes dropped EXE
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\96A2.tmp"C:\Users\Admin\AppData\Local\Temp\96A2.tmp"57⤵
- Executes dropped EXE
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\9700.tmp"C:\Users\Admin\AppData\Local\Temp\9700.tmp"58⤵
- Executes dropped EXE
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\974E.tmp"C:\Users\Admin\AppData\Local\Temp\974E.tmp"59⤵
- Executes dropped EXE
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\979C.tmp"C:\Users\Admin\AppData\Local\Temp\979C.tmp"60⤵
- Executes dropped EXE
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\97EA.tmp"C:\Users\Admin\AppData\Local\Temp\97EA.tmp"61⤵
- Executes dropped EXE
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\9848.tmp"C:\Users\Admin\AppData\Local\Temp\9848.tmp"62⤵
- Executes dropped EXE
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\98A6.tmp"C:\Users\Admin\AppData\Local\Temp\98A6.tmp"63⤵
- Executes dropped EXE
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\98F4.tmp"C:\Users\Admin\AppData\Local\Temp\98F4.tmp"64⤵
- Executes dropped EXE
PID:392 -
C:\Users\Admin\AppData\Local\Temp\9952.tmp"C:\Users\Admin\AppData\Local\Temp\9952.tmp"65⤵
- Executes dropped EXE
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\99A0.tmp"C:\Users\Admin\AppData\Local\Temp\99A0.tmp"66⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\99FE.tmp"C:\Users\Admin\AppData\Local\Temp\99FE.tmp"67⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"68⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"69⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\9B07.tmp"C:\Users\Admin\AppData\Local\Temp\9B07.tmp"70⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\9B55.tmp"C:\Users\Admin\AppData\Local\Temp\9B55.tmp"71⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"72⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"73⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\9C40.tmp"C:\Users\Admin\AppData\Local\Temp\9C40.tmp"74⤵
- System Location Discovery: System Language Discovery
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"75⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"76⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"77⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\9D78.tmp"C:\Users\Admin\AppData\Local\Temp\9D78.tmp"78⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"79⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\9E34.tmp"C:\Users\Admin\AppData\Local\Temp\9E34.tmp"80⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\9E82.tmp"C:\Users\Admin\AppData\Local\Temp\9E82.tmp"81⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"82⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"83⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"84⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"85⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\A037.tmp"C:\Users\Admin\AppData\Local\Temp\A037.tmp"86⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\A086.tmp"C:\Users\Admin\AppData\Local\Temp\A086.tmp"87⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"88⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\A141.tmp"C:\Users\Admin\AppData\Local\Temp\A141.tmp"89⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\A19F.tmp"C:\Users\Admin\AppData\Local\Temp\A19F.tmp"90⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"91⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\A25A.tmp"C:\Users\Admin\AppData\Local\Temp\A25A.tmp"92⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"93⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\A306.tmp"C:\Users\Admin\AppData\Local\Temp\A306.tmp"94⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\A354.tmp"C:\Users\Admin\AppData\Local\Temp\A354.tmp"95⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"96⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\A410.tmp"C:\Users\Admin\AppData\Local\Temp\A410.tmp"97⤵PID:32
-
C:\Users\Admin\AppData\Local\Temp\A46E.tmp"C:\Users\Admin\AppData\Local\Temp\A46E.tmp"98⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"99⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\A519.tmp"C:\Users\Admin\AppData\Local\Temp\A519.tmp"100⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\A568.tmp"C:\Users\Admin\AppData\Local\Temp\A568.tmp"101⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"102⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\A613.tmp"C:\Users\Admin\AppData\Local\Temp\A613.tmp"103⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\A662.tmp"C:\Users\Admin\AppData\Local\Temp\A662.tmp"104⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"105⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\A70D.tmp"C:\Users\Admin\AppData\Local\Temp\A70D.tmp"106⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\A75C.tmp"C:\Users\Admin\AppData\Local\Temp\A75C.tmp"107⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"108⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\A807.tmp"C:\Users\Admin\AppData\Local\Temp\A807.tmp"109⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\A856.tmp"C:\Users\Admin\AppData\Local\Temp\A856.tmp"110⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"111⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\A901.tmp"C:\Users\Admin\AppData\Local\Temp\A901.tmp"112⤵
- System Location Discovery: System Language Discovery
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\A950.tmp"C:\Users\Admin\AppData\Local\Temp\A950.tmp"113⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\A99E.tmp"C:\Users\Admin\AppData\Local\Temp\A99E.tmp"114⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"115⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"116⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\AA98.tmp"C:\Users\Admin\AppData\Local\Temp\AA98.tmp"117⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"118⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\AB34.tmp"C:\Users\Admin\AppData\Local\Temp\AB34.tmp"119⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\AB92.tmp"C:\Users\Admin\AppData\Local\Temp\AB92.tmp"120⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"121⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"122⤵
- System Location Discovery: System Language Discovery
PID:2008
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-