Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04-10-2024 13:42
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-04_2aa3406c7afd9046bf292b4b50893b8f_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-04_2aa3406c7afd9046bf292b4b50893b8f_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-10-04_2aa3406c7afd9046bf292b4b50893b8f_mafia.exe
-
Size
541KB
-
MD5
2aa3406c7afd9046bf292b4b50893b8f
-
SHA1
e00643b9f9130519cbdd9a9e2736367b9563b3b1
-
SHA256
0d3f3927f1b55d2e0c3979e0296f39917d41014fca80c46fc22fd6b01134e179
-
SHA512
2c9f812b922a0261b0e3254e5af6d249a8b12a11b0996e852bc15febd3a6ba33d9b115ddf0397ec5f54b18b5105e03ee904e063d52dbda1629e47d3f47e8054d
-
SSDEEP
6144:Forf3lPvovsgZnqG2C7mOTeiLjD71sjbMFWzXeUoD98pAP9+gsAmH8TQscsH37ZO:UU5rCOTeif6M8r1mdxu88slrZa73ctO
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 116 A940.tmp 4708 A99E.tmp 1288 A9FB.tmp 4324 AA88.tmp 5000 AAF5.tmp 5064 AB63.tmp 632 ABE0.tmp 4712 AC3E.tmp 3600 AC9B.tmp 1644 ACF9.tmp 868 AD76.tmp 4788 ADE3.tmp 4164 AE41.tmp 4216 AEAF.tmp 1556 AF0C.tmp 4168 AF5A.tmp 1568 AFD7.tmp 4480 B045.tmp 2004 B0A3.tmp 4948 B100.tmp 2120 B16E.tmp 5024 B1EB.tmp 372 B248.tmp 4928 B2D5.tmp 1184 B352.tmp 2300 B3CF.tmp 1252 B42D.tmp 692 B49A.tmp 64 B4E8.tmp 1436 B546.tmp 1872 B5A4.tmp 1032 B602.tmp 1092 B67F.tmp 3972 B6DC.tmp 3980 B72A.tmp 2408 B779.tmp 3036 B7C7.tmp 3992 B815.tmp 4432 B863.tmp 3684 B8B1.tmp 2868 B8FF.tmp 2152 B94D.tmp 1532 B99B.tmp 4044 B9EA.tmp 3004 BA38.tmp 2472 BA95.tmp 3240 BAE4.tmp 3580 BB32.tmp 976 BB8F.tmp 2240 BBED.tmp 4472 BC3B.tmp 3656 BC99.tmp 3480 BCE7.tmp 1472 BD35.tmp 4968 BD83.tmp 3220 BDD2.tmp 916 BE2F.tmp 4896 BE7D.tmp 1308 BECC.tmp 3248 BF1A.tmp 920 BF77.tmp 1768 BFC6.tmp 4352 C014.tmp 4380 C062.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D27E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5484.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFAD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 967E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A478.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A61E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F642.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B72A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7606.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D145.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 630A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC56.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A940.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CD1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5724.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C03E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E28B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6443.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D85A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E896.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E635.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E838.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4404 wrote to memory of 116 4404 2024-10-04_2aa3406c7afd9046bf292b4b50893b8f_mafia.exe 81 PID 4404 wrote to memory of 116 4404 2024-10-04_2aa3406c7afd9046bf292b4b50893b8f_mafia.exe 81 PID 4404 wrote to memory of 116 4404 2024-10-04_2aa3406c7afd9046bf292b4b50893b8f_mafia.exe 81 PID 116 wrote to memory of 4708 116 A940.tmp 82 PID 116 wrote to memory of 4708 116 A940.tmp 82 PID 116 wrote to memory of 4708 116 A940.tmp 82 PID 4708 wrote to memory of 1288 4708 A99E.tmp 83 PID 4708 wrote to memory of 1288 4708 A99E.tmp 83 PID 4708 wrote to memory of 1288 4708 A99E.tmp 83 PID 1288 wrote to memory of 4324 1288 A9FB.tmp 84 PID 1288 wrote to memory of 4324 1288 A9FB.tmp 84 PID 1288 wrote to memory of 4324 1288 A9FB.tmp 84 PID 4324 wrote to memory of 5000 4324 AA88.tmp 85 PID 4324 wrote to memory of 5000 4324 AA88.tmp 85 PID 4324 wrote to memory of 5000 4324 AA88.tmp 85 PID 5000 wrote to memory of 5064 5000 AAF5.tmp 86 PID 5000 wrote to memory of 5064 5000 AAF5.tmp 86 PID 5000 wrote to memory of 5064 5000 AAF5.tmp 86 PID 5064 wrote to memory of 632 5064 AB63.tmp 87 PID 5064 wrote to memory of 632 5064 AB63.tmp 87 PID 5064 wrote to memory of 632 5064 AB63.tmp 87 PID 632 wrote to memory of 4712 632 ABE0.tmp 88 PID 632 wrote to memory of 4712 632 ABE0.tmp 88 PID 632 wrote to memory of 4712 632 ABE0.tmp 88 PID 4712 wrote to memory of 3600 4712 AC3E.tmp 89 PID 4712 wrote to memory of 3600 4712 AC3E.tmp 89 PID 4712 wrote to memory of 3600 4712 AC3E.tmp 89 PID 3600 wrote to memory of 1644 3600 AC9B.tmp 90 PID 3600 wrote to memory of 1644 3600 AC9B.tmp 90 PID 3600 wrote to memory of 1644 3600 AC9B.tmp 90 PID 1644 wrote to memory of 868 1644 ACF9.tmp 91 PID 1644 wrote to memory of 868 1644 ACF9.tmp 91 PID 1644 wrote to memory of 868 1644 ACF9.tmp 91 PID 868 wrote to memory of 4788 868 AD76.tmp 92 PID 868 wrote to memory of 4788 868 AD76.tmp 92 PID 868 wrote to memory of 4788 868 AD76.tmp 92 PID 4788 wrote to memory of 4164 4788 ADE3.tmp 93 PID 4788 wrote to memory of 4164 4788 ADE3.tmp 93 PID 4788 wrote to memory of 4164 4788 ADE3.tmp 93 PID 4164 wrote to memory of 4216 4164 AE41.tmp 94 PID 4164 wrote to memory of 4216 4164 AE41.tmp 94 PID 4164 wrote to memory of 4216 4164 AE41.tmp 94 PID 4216 wrote to memory of 1556 4216 AEAF.tmp 95 PID 4216 wrote to memory of 1556 4216 AEAF.tmp 95 PID 4216 wrote to memory of 1556 4216 AEAF.tmp 95 PID 1556 wrote to memory of 4168 1556 AF0C.tmp 96 PID 1556 wrote to memory of 4168 1556 AF0C.tmp 96 PID 1556 wrote to memory of 4168 1556 AF0C.tmp 96 PID 4168 wrote to memory of 1568 4168 AF5A.tmp 97 PID 4168 wrote to memory of 1568 4168 AF5A.tmp 97 PID 4168 wrote to memory of 1568 4168 AF5A.tmp 97 PID 1568 wrote to memory of 4480 1568 AFD7.tmp 98 PID 1568 wrote to memory of 4480 1568 AFD7.tmp 98 PID 1568 wrote to memory of 4480 1568 AFD7.tmp 98 PID 4480 wrote to memory of 2004 4480 B045.tmp 99 PID 4480 wrote to memory of 2004 4480 B045.tmp 99 PID 4480 wrote to memory of 2004 4480 B045.tmp 99 PID 2004 wrote to memory of 4948 2004 B0A3.tmp 100 PID 2004 wrote to memory of 4948 2004 B0A3.tmp 100 PID 2004 wrote to memory of 4948 2004 B0A3.tmp 100 PID 4948 wrote to memory of 2120 4948 B100.tmp 102 PID 4948 wrote to memory of 2120 4948 B100.tmp 102 PID 4948 wrote to memory of 2120 4948 B100.tmp 102 PID 2120 wrote to memory of 5024 2120 B16E.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-04_2aa3406c7afd9046bf292b4b50893b8f_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-04_2aa3406c7afd9046bf292b4b50893b8f_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\A940.tmp"C:\Users\Admin\AppData\Local\Temp\A940.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Users\Admin\AppData\Local\Temp\A99E.tmp"C:\Users\Admin\AppData\Local\Temp\A99E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\AA88.tmp"C:\Users\Admin\AppData\Local\Temp\AA88.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\AB63.tmp"C:\Users\Admin\AppData\Local\Temp\AB63.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\AD76.tmp"C:\Users\Admin\AppData\Local\Temp\AD76.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\AE41.tmp"C:\Users\Admin\AppData\Local\Temp\AE41.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\AF0C.tmp"C:\Users\Admin\AppData\Local\Temp\AF0C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\B045.tmp"C:\Users\Admin\AppData\Local\Temp\B045.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\B100.tmp"C:\Users\Admin\AppData\Local\Temp\B100.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\B16E.tmp"C:\Users\Admin\AppData\Local\Temp\B16E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"23⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\B248.tmp"C:\Users\Admin\AppData\Local\Temp\B248.tmp"24⤵
- Executes dropped EXE
PID:372 -
C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"25⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\B352.tmp"C:\Users\Admin\AppData\Local\Temp\B352.tmp"26⤵
- Executes dropped EXE
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"27⤵
- Executes dropped EXE
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\B42D.tmp"C:\Users\Admin\AppData\Local\Temp\B42D.tmp"28⤵
- Executes dropped EXE
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\B49A.tmp"C:\Users\Admin\AppData\Local\Temp\B49A.tmp"29⤵
- Executes dropped EXE
PID:692 -
C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"30⤵
- Executes dropped EXE
PID:64 -
C:\Users\Admin\AppData\Local\Temp\B546.tmp"C:\Users\Admin\AppData\Local\Temp\B546.tmp"31⤵
- Executes dropped EXE
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"32⤵
- Executes dropped EXE
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\B602.tmp"C:\Users\Admin\AppData\Local\Temp\B602.tmp"33⤵
- Executes dropped EXE
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\B67F.tmp"C:\Users\Admin\AppData\Local\Temp\B67F.tmp"34⤵
- Executes dropped EXE
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"35⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\B72A.tmp"C:\Users\Admin\AppData\Local\Temp\B72A.tmp"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\B779.tmp"C:\Users\Admin\AppData\Local\Temp\B779.tmp"37⤵
- Executes dropped EXE
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"38⤵
- Executes dropped EXE
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\B815.tmp"C:\Users\Admin\AppData\Local\Temp\B815.tmp"39⤵
- Executes dropped EXE
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\B863.tmp"C:\Users\Admin\AppData\Local\Temp\B863.tmp"40⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"41⤵
- Executes dropped EXE
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"42⤵
- Executes dropped EXE
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\B94D.tmp"C:\Users\Admin\AppData\Local\Temp\B94D.tmp"43⤵
- Executes dropped EXE
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\B99B.tmp"C:\Users\Admin\AppData\Local\Temp\B99B.tmp"44⤵
- Executes dropped EXE
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"45⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\BA38.tmp"C:\Users\Admin\AppData\Local\Temp\BA38.tmp"46⤵
- Executes dropped EXE
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\BA95.tmp"C:\Users\Admin\AppData\Local\Temp\BA95.tmp"47⤵
- Executes dropped EXE
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"48⤵
- Executes dropped EXE
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\BB32.tmp"C:\Users\Admin\AppData\Local\Temp\BB32.tmp"49⤵
- Executes dropped EXE
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\BB8F.tmp"C:\Users\Admin\AppData\Local\Temp\BB8F.tmp"50⤵
- Executes dropped EXE
PID:976 -
C:\Users\Admin\AppData\Local\Temp\BBED.tmp"C:\Users\Admin\AppData\Local\Temp\BBED.tmp"51⤵
- Executes dropped EXE
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"52⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\BC99.tmp"C:\Users\Admin\AppData\Local\Temp\BC99.tmp"53⤵
- Executes dropped EXE
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"54⤵
- Executes dropped EXE
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\BD35.tmp"C:\Users\Admin\AppData\Local\Temp\BD35.tmp"55⤵
- Executes dropped EXE
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\BD83.tmp"C:\Users\Admin\AppData\Local\Temp\BD83.tmp"56⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"57⤵
- Executes dropped EXE
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"58⤵
- Executes dropped EXE
PID:916 -
C:\Users\Admin\AppData\Local\Temp\BE7D.tmp"C:\Users\Admin\AppData\Local\Temp\BE7D.tmp"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\BECC.tmp"C:\Users\Admin\AppData\Local\Temp\BECC.tmp"60⤵
- Executes dropped EXE
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"61⤵
- Executes dropped EXE
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\BF77.tmp"C:\Users\Admin\AppData\Local\Temp\BF77.tmp"62⤵
- Executes dropped EXE
PID:920 -
C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"63⤵
- Executes dropped EXE
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\C014.tmp"C:\Users\Admin\AppData\Local\Temp\C014.tmp"64⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\C062.tmp"C:\Users\Admin\AppData\Local\Temp\C062.tmp"65⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"66⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"67⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\C14C.tmp"C:\Users\Admin\AppData\Local\Temp\C14C.tmp"68⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"69⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\C1F8.tmp"C:\Users\Admin\AppData\Local\Temp\C1F8.tmp"70⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\C246.tmp"C:\Users\Admin\AppData\Local\Temp\C246.tmp"71⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\C294.tmp"C:\Users\Admin\AppData\Local\Temp\C294.tmp"72⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"73⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\C331.tmp"C:\Users\Admin\AppData\Local\Temp\C331.tmp"74⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\C37F.tmp"C:\Users\Admin\AppData\Local\Temp\C37F.tmp"75⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\C3DC.tmp"C:\Users\Admin\AppData\Local\Temp\C3DC.tmp"76⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\C42B.tmp"C:\Users\Admin\AppData\Local\Temp\C42B.tmp"77⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\C488.tmp"C:\Users\Admin\AppData\Local\Temp\C488.tmp"78⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\C4D6.tmp"C:\Users\Admin\AppData\Local\Temp\C4D6.tmp"79⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\C525.tmp"C:\Users\Admin\AppData\Local\Temp\C525.tmp"80⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\C573.tmp"C:\Users\Admin\AppData\Local\Temp\C573.tmp"81⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"82⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\C60F.tmp"C:\Users\Admin\AppData\Local\Temp\C60F.tmp"83⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\C66D.tmp"C:\Users\Admin\AppData\Local\Temp\C66D.tmp"84⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"85⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\C719.tmp"C:\Users\Admin\AppData\Local\Temp\C719.tmp"86⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\C767.tmp"C:\Users\Admin\AppData\Local\Temp\C767.tmp"87⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\C7B5.tmp"C:\Users\Admin\AppData\Local\Temp\C7B5.tmp"88⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\C813.tmp"C:\Users\Admin\AppData\Local\Temp\C813.tmp"89⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\C870.tmp"C:\Users\Admin\AppData\Local\Temp\C870.tmp"90⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"91⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\C90D.tmp"C:\Users\Admin\AppData\Local\Temp\C90D.tmp"92⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\C95B.tmp"C:\Users\Admin\AppData\Local\Temp\C95B.tmp"93⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\C9A9.tmp"C:\Users\Admin\AppData\Local\Temp\C9A9.tmp"94⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\C9F7.tmp"C:\Users\Admin\AppData\Local\Temp\C9F7.tmp"95⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\CA45.tmp"C:\Users\Admin\AppData\Local\Temp\CA45.tmp"96⤵
- System Location Discovery: System Language Discovery
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\CAA3.tmp"C:\Users\Admin\AppData\Local\Temp\CAA3.tmp"97⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\CB01.tmp"C:\Users\Admin\AppData\Local\Temp\CB01.tmp"98⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\CB5E.tmp"C:\Users\Admin\AppData\Local\Temp\CB5E.tmp"99⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\CBBC.tmp"C:\Users\Admin\AppData\Local\Temp\CBBC.tmp"100⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\CC0A.tmp"C:\Users\Admin\AppData\Local\Temp\CC0A.tmp"101⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\CC58.tmp"C:\Users\Admin\AppData\Local\Temp\CC58.tmp"102⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\CCB6.tmp"C:\Users\Admin\AppData\Local\Temp\CCB6.tmp"103⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\CD14.tmp"C:\Users\Admin\AppData\Local\Temp\CD14.tmp"104⤵PID:512
-
C:\Users\Admin\AppData\Local\Temp\CD72.tmp"C:\Users\Admin\AppData\Local\Temp\CD72.tmp"105⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\CDC0.tmp"C:\Users\Admin\AppData\Local\Temp\CDC0.tmp"106⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\CE1D.tmp"C:\Users\Admin\AppData\Local\Temp\CE1D.tmp"107⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\CE6C.tmp"C:\Users\Admin\AppData\Local\Temp\CE6C.tmp"108⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\CEC9.tmp"C:\Users\Admin\AppData\Local\Temp\CEC9.tmp"109⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\CF27.tmp"C:\Users\Admin\AppData\Local\Temp\CF27.tmp"110⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\CF85.tmp"C:\Users\Admin\AppData\Local\Temp\CF85.tmp"111⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\CFE3.tmp"C:\Users\Admin\AppData\Local\Temp\CFE3.tmp"112⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\D031.tmp"C:\Users\Admin\AppData\Local\Temp\D031.tmp"113⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\D07F.tmp"C:\Users\Admin\AppData\Local\Temp\D07F.tmp"114⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\D0CD.tmp"C:\Users\Admin\AppData\Local\Temp\D0CD.tmp"115⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\D11B.tmp"C:\Users\Admin\AppData\Local\Temp\D11B.tmp"116⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\D169.tmp"C:\Users\Admin\AppData\Local\Temp\D169.tmp"117⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\D1B7.tmp"C:\Users\Admin\AppData\Local\Temp\D1B7.tmp"118⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\D205.tmp"C:\Users\Admin\AppData\Local\Temp\D205.tmp"119⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\D254.tmp"C:\Users\Admin\AppData\Local\Temp\D254.tmp"120⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\D2B1.tmp"C:\Users\Admin\AppData\Local\Temp\D2B1.tmp"121⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\D30F.tmp"C:\Users\Admin\AppData\Local\Temp\D30F.tmp"122⤵PID:4464
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-