Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2024, 04:07
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-19_d03db29252b6c8336443d3ad35b63917_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-09-19_d03db29252b6c8336443d3ad35b63917_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-19_d03db29252b6c8336443d3ad35b63917_mafia.exe
-
Size
530KB
-
MD5
d03db29252b6c8336443d3ad35b63917
-
SHA1
b3a1667611ec63429a75b443a3d0fa480e1e30b4
-
SHA256
9e663fdab0de82698adbc8d3296a36b7128ecc03b7e8025ca1be3ada6a60cf40
-
SHA512
ac31d790572148df389ec6174544e84e3fd3dbe9e5b4b7393e4a8a9ce3a476bd20eb96381ad7195024abe85c2f59da4d1cb4eead6e14e5effcc5734a1d31d021
-
SSDEEP
12288:AU5rCOTeioMgT1Yv4cwFR2ixkIW6BP3TNZulFVg0M1:AUQOJoMgT1mUH2iPjNclFV/M1
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 640 6FA2.tmp 1420 700F.tmp 2480 709C.tmp 2360 7138.tmp 2088 71A6.tmp 2148 7223.tmp 2292 7290.tmp 2808 730D.tmp 1840 736B.tmp 5092 73C8.tmp 1716 7445.tmp 3812 74B3.tmp 812 7511.tmp 4256 758E.tmp 2496 75FB.tmp 2500 7659.tmp 1060 76D6.tmp 2728 7743.tmp 3112 77C0.tmp 2528 783D.tmp 2764 789B.tmp 1628 78E9.tmp 2484 7976.tmp 3024 79F3.tmp 5080 7A50.tmp 3756 7AAE.tmp 1776 7AFC.tmp 1284 7B4A.tmp 964 7BB8.tmp 1784 7C25.tmp 4380 7C92.tmp 1908 7D0F.tmp 4416 7D6D.tmp 3100 7DBB.tmp 872 7E19.tmp 2400 7E67.tmp 3420 7EC5.tmp 4424 7F23.tmp 5088 7F80.tmp 5020 7FDE.tmp 3996 803C.tmp 3004 808A.tmp 2304 80D8.tmp 5056 8126.tmp 2080 8174.tmp 4792 81C3.tmp 4680 8220.tmp 4288 827E.tmp 4720 82DC.tmp 2440 832A.tmp 640 8388.tmp 1080 83D6.tmp 4580 8434.tmp 4188 8491.tmp 3604 84DF.tmp 3532 852E.tmp 2744 858B.tmp 4700 85E9.tmp 4732 8637.tmp 4076 8695.tmp 2292 86F3.tmp 2808 8741.tmp 1116 878F.tmp 3636 87DD.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFDC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9FE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC68.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCC3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 700.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-09-19_d03db29252b6c8336443d3ad35b63917_mafia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8388.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D830.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 146D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C30.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9337.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B594.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B650.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 124.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 709C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4234.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 789B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 825A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83D6.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1416 wrote to memory of 640 1416 2024-09-19_d03db29252b6c8336443d3ad35b63917_mafia.exe 82 PID 1416 wrote to memory of 640 1416 2024-09-19_d03db29252b6c8336443d3ad35b63917_mafia.exe 82 PID 1416 wrote to memory of 640 1416 2024-09-19_d03db29252b6c8336443d3ad35b63917_mafia.exe 82 PID 640 wrote to memory of 1420 640 6FA2.tmp 83 PID 640 wrote to memory of 1420 640 6FA2.tmp 83 PID 640 wrote to memory of 1420 640 6FA2.tmp 83 PID 1420 wrote to memory of 2480 1420 700F.tmp 84 PID 1420 wrote to memory of 2480 1420 700F.tmp 84 PID 1420 wrote to memory of 2480 1420 700F.tmp 84 PID 2480 wrote to memory of 2360 2480 709C.tmp 85 PID 2480 wrote to memory of 2360 2480 709C.tmp 85 PID 2480 wrote to memory of 2360 2480 709C.tmp 85 PID 2360 wrote to memory of 2088 2360 7138.tmp 86 PID 2360 wrote to memory of 2088 2360 7138.tmp 86 PID 2360 wrote to memory of 2088 2360 7138.tmp 86 PID 2088 wrote to memory of 2148 2088 71A6.tmp 87 PID 2088 wrote to memory of 2148 2088 71A6.tmp 87 PID 2088 wrote to memory of 2148 2088 71A6.tmp 87 PID 2148 wrote to memory of 2292 2148 7223.tmp 88 PID 2148 wrote to memory of 2292 2148 7223.tmp 88 PID 2148 wrote to memory of 2292 2148 7223.tmp 88 PID 2292 wrote to memory of 2808 2292 7290.tmp 89 PID 2292 wrote to memory of 2808 2292 7290.tmp 89 PID 2292 wrote to memory of 2808 2292 7290.tmp 89 PID 2808 wrote to memory of 1840 2808 730D.tmp 90 PID 2808 wrote to memory of 1840 2808 730D.tmp 90 PID 2808 wrote to memory of 1840 2808 730D.tmp 90 PID 1840 wrote to memory of 5092 1840 736B.tmp 91 PID 1840 wrote to memory of 5092 1840 736B.tmp 91 PID 1840 wrote to memory of 5092 1840 736B.tmp 91 PID 5092 wrote to memory of 1716 5092 73C8.tmp 92 PID 5092 wrote to memory of 1716 5092 73C8.tmp 92 PID 5092 wrote to memory of 1716 5092 73C8.tmp 92 PID 1716 wrote to memory of 3812 1716 7445.tmp 93 PID 1716 wrote to memory of 3812 1716 7445.tmp 93 PID 1716 wrote to memory of 3812 1716 7445.tmp 93 PID 3812 wrote to memory of 812 3812 74B3.tmp 94 PID 3812 wrote to memory of 812 3812 74B3.tmp 94 PID 3812 wrote to memory of 812 3812 74B3.tmp 94 PID 812 wrote to memory of 4256 812 7511.tmp 95 PID 812 wrote to memory of 4256 812 7511.tmp 95 PID 812 wrote to memory of 4256 812 7511.tmp 95 PID 4256 wrote to memory of 2496 4256 758E.tmp 96 PID 4256 wrote to memory of 2496 4256 758E.tmp 96 PID 4256 wrote to memory of 2496 4256 758E.tmp 96 PID 2496 wrote to memory of 2500 2496 75FB.tmp 97 PID 2496 wrote to memory of 2500 2496 75FB.tmp 97 PID 2496 wrote to memory of 2500 2496 75FB.tmp 97 PID 2500 wrote to memory of 1060 2500 7659.tmp 98 PID 2500 wrote to memory of 1060 2500 7659.tmp 98 PID 2500 wrote to memory of 1060 2500 7659.tmp 98 PID 1060 wrote to memory of 2728 1060 76D6.tmp 99 PID 1060 wrote to memory of 2728 1060 76D6.tmp 99 PID 1060 wrote to memory of 2728 1060 76D6.tmp 99 PID 2728 wrote to memory of 3112 2728 7743.tmp 100 PID 2728 wrote to memory of 3112 2728 7743.tmp 100 PID 2728 wrote to memory of 3112 2728 7743.tmp 100 PID 3112 wrote to memory of 2528 3112 77C0.tmp 101 PID 3112 wrote to memory of 2528 3112 77C0.tmp 101 PID 3112 wrote to memory of 2528 3112 77C0.tmp 101 PID 2528 wrote to memory of 2764 2528 783D.tmp 104 PID 2528 wrote to memory of 2764 2528 783D.tmp 104 PID 2528 wrote to memory of 2764 2528 783D.tmp 104 PID 2764 wrote to memory of 1628 2764 789B.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_d03db29252b6c8336443d3ad35b63917_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_d03db29252b6c8336443d3ad35b63917_mafia.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Users\Admin\AppData\Local\Temp\700F.tmp"C:\Users\Admin\AppData\Local\Temp\700F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\709C.tmp"C:\Users\Admin\AppData\Local\Temp\709C.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\7138.tmp"C:\Users\Admin\AppData\Local\Temp\7138.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\71A6.tmp"C:\Users\Admin\AppData\Local\Temp\71A6.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\7223.tmp"C:\Users\Admin\AppData\Local\Temp\7223.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\7290.tmp"C:\Users\Admin\AppData\Local\Temp\7290.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\730D.tmp"C:\Users\Admin\AppData\Local\Temp\730D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\736B.tmp"C:\Users\Admin\AppData\Local\Temp\736B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\73C8.tmp"C:\Users\Admin\AppData\Local\Temp\73C8.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\7445.tmp"C:\Users\Admin\AppData\Local\Temp\7445.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Users\Admin\AppData\Local\Temp\758E.tmp"C:\Users\Admin\AppData\Local\Temp\758E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\75FB.tmp"C:\Users\Admin\AppData\Local\Temp\75FB.tmp"16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\7659.tmp"C:\Users\Admin\AppData\Local\Temp\7659.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\76D6.tmp"C:\Users\Admin\AppData\Local\Temp\76D6.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\7743.tmp"C:\Users\Admin\AppData\Local\Temp\7743.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\77C0.tmp"C:\Users\Admin\AppData\Local\Temp\77C0.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\783D.tmp"C:\Users\Admin\AppData\Local\Temp\783D.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\789B.tmp"C:\Users\Admin\AppData\Local\Temp\789B.tmp"22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\78E9.tmp"C:\Users\Admin\AppData\Local\Temp\78E9.tmp"23⤵
- Executes dropped EXE
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\7976.tmp"C:\Users\Admin\AppData\Local\Temp\7976.tmp"24⤵
- Executes dropped EXE
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\79F3.tmp"C:\Users\Admin\AppData\Local\Temp\79F3.tmp"25⤵
- Executes dropped EXE
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\7A50.tmp"C:\Users\Admin\AppData\Local\Temp\7A50.tmp"26⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\7AAE.tmp"C:\Users\Admin\AppData\Local\Temp\7AAE.tmp"27⤵
- Executes dropped EXE
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"28⤵
- Executes dropped EXE
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"30⤵
- Executes dropped EXE
PID:964 -
C:\Users\Admin\AppData\Local\Temp\7C25.tmp"C:\Users\Admin\AppData\Local\Temp\7C25.tmp"31⤵
- Executes dropped EXE
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\7C92.tmp"C:\Users\Admin\AppData\Local\Temp\7C92.tmp"32⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"33⤵
- Executes dropped EXE
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"34⤵
- Executes dropped EXE
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"35⤵
- Executes dropped EXE
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\7E19.tmp"C:\Users\Admin\AppData\Local\Temp\7E19.tmp"36⤵
- Executes dropped EXE
PID:872 -
C:\Users\Admin\AppData\Local\Temp\7E67.tmp"C:\Users\Admin\AppData\Local\Temp\7E67.tmp"37⤵
- Executes dropped EXE
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"38⤵
- Executes dropped EXE
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\7F23.tmp"C:\Users\Admin\AppData\Local\Temp\7F23.tmp"39⤵
- Executes dropped EXE
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\7F80.tmp"C:\Users\Admin\AppData\Local\Temp\7F80.tmp"40⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"41⤵
- Executes dropped EXE
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\803C.tmp"C:\Users\Admin\AppData\Local\Temp\803C.tmp"42⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\808A.tmp"C:\Users\Admin\AppData\Local\Temp\808A.tmp"43⤵
- Executes dropped EXE
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\80D8.tmp"C:\Users\Admin\AppData\Local\Temp\80D8.tmp"44⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\8126.tmp"C:\Users\Admin\AppData\Local\Temp\8126.tmp"45⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\8174.tmp"C:\Users\Admin\AppData\Local\Temp\8174.tmp"46⤵
- Executes dropped EXE
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\81C3.tmp"C:\Users\Admin\AppData\Local\Temp\81C3.tmp"47⤵
- Executes dropped EXE
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\8220.tmp"C:\Users\Admin\AppData\Local\Temp\8220.tmp"48⤵
- Executes dropped EXE
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\827E.tmp"C:\Users\Admin\AppData\Local\Temp\827E.tmp"49⤵
- Executes dropped EXE
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\82DC.tmp"C:\Users\Admin\AppData\Local\Temp\82DC.tmp"50⤵
- Executes dropped EXE
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\832A.tmp"C:\Users\Admin\AppData\Local\Temp\832A.tmp"51⤵
- Executes dropped EXE
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\8388.tmp"C:\Users\Admin\AppData\Local\Temp\8388.tmp"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:640 -
C:\Users\Admin\AppData\Local\Temp\83D6.tmp"C:\Users\Admin\AppData\Local\Temp\83D6.tmp"53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\8434.tmp"C:\Users\Admin\AppData\Local\Temp\8434.tmp"54⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\8491.tmp"C:\Users\Admin\AppData\Local\Temp\8491.tmp"55⤵
- Executes dropped EXE
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\84DF.tmp"C:\Users\Admin\AppData\Local\Temp\84DF.tmp"56⤵
- Executes dropped EXE
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\852E.tmp"C:\Users\Admin\AppData\Local\Temp\852E.tmp"57⤵
- Executes dropped EXE
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\858B.tmp"C:\Users\Admin\AppData\Local\Temp\858B.tmp"58⤵
- Executes dropped EXE
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\85E9.tmp"C:\Users\Admin\AppData\Local\Temp\85E9.tmp"59⤵
- Executes dropped EXE
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\8637.tmp"C:\Users\Admin\AppData\Local\Temp\8637.tmp"60⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\8695.tmp"C:\Users\Admin\AppData\Local\Temp\8695.tmp"61⤵
- Executes dropped EXE
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\86F3.tmp"C:\Users\Admin\AppData\Local\Temp\86F3.tmp"62⤵
- Executes dropped EXE
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\8741.tmp"C:\Users\Admin\AppData\Local\Temp\8741.tmp"63⤵
- Executes dropped EXE
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\878F.tmp"C:\Users\Admin\AppData\Local\Temp\878F.tmp"64⤵
- Executes dropped EXE
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\87DD.tmp"C:\Users\Admin\AppData\Local\Temp\87DD.tmp"65⤵
- Executes dropped EXE
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\882B.tmp"C:\Users\Admin\AppData\Local\Temp\882B.tmp"66⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\8879.tmp"C:\Users\Admin\AppData\Local\Temp\8879.tmp"67⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\88C7.tmp"C:\Users\Admin\AppData\Local\Temp\88C7.tmp"68⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\8925.tmp"C:\Users\Admin\AppData\Local\Temp\8925.tmp"69⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\8983.tmp"C:\Users\Admin\AppData\Local\Temp\8983.tmp"70⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\89D1.tmp"C:\Users\Admin\AppData\Local\Temp\89D1.tmp"71⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"73⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"74⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\8B38.tmp"C:\Users\Admin\AppData\Local\Temp\8B38.tmp"75⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\8B96.tmp"C:\Users\Admin\AppData\Local\Temp\8B96.tmp"76⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"77⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\8C42.tmp"C:\Users\Admin\AppData\Local\Temp\8C42.tmp"78⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\8C90.tmp"C:\Users\Admin\AppData\Local\Temp\8C90.tmp"79⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"80⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"81⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"82⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"83⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\8E17.tmp"C:\Users\Admin\AppData\Local\Temp\8E17.tmp"84⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\8E65.tmp"C:\Users\Admin\AppData\Local\Temp\8E65.tmp"85⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"86⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\8F11.tmp"C:\Users\Admin\AppData\Local\Temp\8F11.tmp"87⤵
- System Location Discovery: System Language Discovery
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"88⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\8FBD.tmp"C:\Users\Admin\AppData\Local\Temp\8FBD.tmp"89⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\901A.tmp"C:\Users\Admin\AppData\Local\Temp\901A.tmp"90⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\9078.tmp"C:\Users\Admin\AppData\Local\Temp\9078.tmp"91⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\90D6.tmp"C:\Users\Admin\AppData\Local\Temp\90D6.tmp"92⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\9134.tmp"C:\Users\Admin\AppData\Local\Temp\9134.tmp"93⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\9182.tmp"C:\Users\Admin\AppData\Local\Temp\9182.tmp"94⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\91D0.tmp"C:\Users\Admin\AppData\Local\Temp\91D0.tmp"95⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\922E.tmp"C:\Users\Admin\AppData\Local\Temp\922E.tmp"96⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\927C.tmp"C:\Users\Admin\AppData\Local\Temp\927C.tmp"97⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\92DA.tmp"C:\Users\Admin\AppData\Local\Temp\92DA.tmp"98⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\9337.tmp"C:\Users\Admin\AppData\Local\Temp\9337.tmp"99⤵
- System Location Discovery: System Language Discovery
PID:508 -
C:\Users\Admin\AppData\Local\Temp\9385.tmp"C:\Users\Admin\AppData\Local\Temp\9385.tmp"100⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\93E3.tmp"C:\Users\Admin\AppData\Local\Temp\93E3.tmp"101⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\9431.tmp"C:\Users\Admin\AppData\Local\Temp\9431.tmp"102⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\947F.tmp"C:\Users\Admin\AppData\Local\Temp\947F.tmp"103⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\94CE.tmp"C:\Users\Admin\AppData\Local\Temp\94CE.tmp"104⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\952B.tmp"C:\Users\Admin\AppData\Local\Temp\952B.tmp"105⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\9589.tmp"C:\Users\Admin\AppData\Local\Temp\9589.tmp"106⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\95E7.tmp"C:\Users\Admin\AppData\Local\Temp\95E7.tmp"107⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\9635.tmp"C:\Users\Admin\AppData\Local\Temp\9635.tmp"108⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\9693.tmp"C:\Users\Admin\AppData\Local\Temp\9693.tmp"109⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\96F0.tmp"C:\Users\Admin\AppData\Local\Temp\96F0.tmp"110⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\973F.tmp"C:\Users\Admin\AppData\Local\Temp\973F.tmp"111⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\978D.tmp"C:\Users\Admin\AppData\Local\Temp\978D.tmp"112⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\97DB.tmp"C:\Users\Admin\AppData\Local\Temp\97DB.tmp"113⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\9829.tmp"C:\Users\Admin\AppData\Local\Temp\9829.tmp"114⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\9877.tmp"C:\Users\Admin\AppData\Local\Temp\9877.tmp"115⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\98C5.tmp"C:\Users\Admin\AppData\Local\Temp\98C5.tmp"116⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\9923.tmp"C:\Users\Admin\AppData\Local\Temp\9923.tmp"117⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\9981.tmp"C:\Users\Admin\AppData\Local\Temp\9981.tmp"118⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\99CF.tmp"C:\Users\Admin\AppData\Local\Temp\99CF.tmp"119⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"120⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"121⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"122⤵PID:4292
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-