Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-10-2024 05:43
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-10_54819b2d02208a3227746efbcf778499_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-10-10_54819b2d02208a3227746efbcf778499_mafia.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-10_54819b2d02208a3227746efbcf778499_mafia.exe
-
Size
520KB
-
MD5
54819b2d02208a3227746efbcf778499
-
SHA1
1d307168e23bbb29cefba1d7a2bb7b18ce861bca
-
SHA256
3f7312e5daad5827d917076c969727b7532d4fa30f5436cada0fee2e7fa6e23a
-
SHA512
59361cecb161c75d472028d5330759129a78c4f88ef9cf2e235ce2285d1dd4610c966d0823a40ab82c35ed3a74b60779538784eca7e1202fe590cb6dc188324a
-
SSDEEP
12288:gj8fuxR21t5i8f2TYrVWfzbuDT7fZ20YOBieNZ:gj8fuK1GYtpAS/7fZ2avN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4904 A558.tmp 4312 A5C5.tmp 2352 A633.tmp 2596 A690.tmp 2376 A6EE.tmp 2288 A73C.tmp 5100 A7AA.tmp 2840 A807.tmp 1668 A875.tmp 2296 A8C3.tmp 1172 A930.tmp 1960 A98E.tmp 3128 A9FB.tmp 1552 AA69.tmp 436 AAB7.tmp 2308 AB15.tmp 2016 AB72.tmp 2824 ABE0.tmp 1988 AC4D.tmp 2844 ACCA.tmp 3404 AD38.tmp 4088 AD86.tmp 3376 ADD4.tmp 4724 AE41.tmp 2812 AEBE.tmp 700 AF2C.tmp 1300 AF89.tmp 1580 AFD7.tmp 1468 B054.tmp 2852 B0C2.tmp 2060 B13F.tmp 4728 B1AC.tmp 1952 B229.tmp 3528 B277.tmp 3784 B2C5.tmp 3308 B314.tmp 4404 B362.tmp 1328 B3B0.tmp 3776 B3FE.tmp 2604 B44C.tmp 3384 B49A.tmp 1688 B4E8.tmp 1704 B536.tmp 1728 B585.tmp 4456 B5D3.tmp 1056 B621.tmp 4124 B67F.tmp 1212 B6CD.tmp 3296 B71B.tmp 4500 B769.tmp 452 B7B7.tmp 1296 B815.tmp 2084 B873.tmp 2640 B8D0.tmp 2364 B92E.tmp 620 B97C.tmp 3976 B9CA.tmp 3736 BA18.tmp 1692 BA67.tmp 4204 BAB5.tmp 2180 BB12.tmp 972 BB61.tmp 444 BBAF.tmp 4924 BBFD.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFCE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C649.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D05B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C31C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1901.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B49A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E84D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E37A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D551.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4FFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B91.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C3DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 559D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB88.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E347.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C416.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2AD4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5704.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1972 wrote to memory of 4904 1972 2024-10-10_54819b2d02208a3227746efbcf778499_mafia.exe 85 PID 1972 wrote to memory of 4904 1972 2024-10-10_54819b2d02208a3227746efbcf778499_mafia.exe 85 PID 1972 wrote to memory of 4904 1972 2024-10-10_54819b2d02208a3227746efbcf778499_mafia.exe 85 PID 4904 wrote to memory of 4312 4904 A558.tmp 87 PID 4904 wrote to memory of 4312 4904 A558.tmp 87 PID 4904 wrote to memory of 4312 4904 A558.tmp 87 PID 4312 wrote to memory of 2352 4312 A5C5.tmp 88 PID 4312 wrote to memory of 2352 4312 A5C5.tmp 88 PID 4312 wrote to memory of 2352 4312 A5C5.tmp 88 PID 2352 wrote to memory of 2596 2352 A633.tmp 89 PID 2352 wrote to memory of 2596 2352 A633.tmp 89 PID 2352 wrote to memory of 2596 2352 A633.tmp 89 PID 2596 wrote to memory of 2376 2596 A690.tmp 90 PID 2596 wrote to memory of 2376 2596 A690.tmp 90 PID 2596 wrote to memory of 2376 2596 A690.tmp 90 PID 2376 wrote to memory of 2288 2376 A6EE.tmp 91 PID 2376 wrote to memory of 2288 2376 A6EE.tmp 91 PID 2376 wrote to memory of 2288 2376 A6EE.tmp 91 PID 2288 wrote to memory of 5100 2288 A73C.tmp 92 PID 2288 wrote to memory of 5100 2288 A73C.tmp 92 PID 2288 wrote to memory of 5100 2288 A73C.tmp 92 PID 5100 wrote to memory of 2840 5100 A7AA.tmp 93 PID 5100 wrote to memory of 2840 5100 A7AA.tmp 93 PID 5100 wrote to memory of 2840 5100 A7AA.tmp 93 PID 2840 wrote to memory of 1668 2840 A807.tmp 94 PID 2840 wrote to memory of 1668 2840 A807.tmp 94 PID 2840 wrote to memory of 1668 2840 A807.tmp 94 PID 1668 wrote to memory of 2296 1668 A875.tmp 95 PID 1668 wrote to memory of 2296 1668 A875.tmp 95 PID 1668 wrote to memory of 2296 1668 A875.tmp 95 PID 2296 wrote to memory of 1172 2296 A8C3.tmp 96 PID 2296 wrote to memory of 1172 2296 A8C3.tmp 96 PID 2296 wrote to memory of 1172 2296 A8C3.tmp 96 PID 1172 wrote to memory of 1960 1172 A930.tmp 97 PID 1172 wrote to memory of 1960 1172 A930.tmp 97 PID 1172 wrote to memory of 1960 1172 A930.tmp 97 PID 1960 wrote to memory of 3128 1960 A98E.tmp 98 PID 1960 wrote to memory of 3128 1960 A98E.tmp 98 PID 1960 wrote to memory of 3128 1960 A98E.tmp 98 PID 3128 wrote to memory of 1552 3128 A9FB.tmp 99 PID 3128 wrote to memory of 1552 3128 A9FB.tmp 99 PID 3128 wrote to memory of 1552 3128 A9FB.tmp 99 PID 1552 wrote to memory of 436 1552 AA69.tmp 100 PID 1552 wrote to memory of 436 1552 AA69.tmp 100 PID 1552 wrote to memory of 436 1552 AA69.tmp 100 PID 436 wrote to memory of 2308 436 AAB7.tmp 101 PID 436 wrote to memory of 2308 436 AAB7.tmp 101 PID 436 wrote to memory of 2308 436 AAB7.tmp 101 PID 2308 wrote to memory of 2016 2308 AB15.tmp 102 PID 2308 wrote to memory of 2016 2308 AB15.tmp 102 PID 2308 wrote to memory of 2016 2308 AB15.tmp 102 PID 2016 wrote to memory of 2824 2016 AB72.tmp 103 PID 2016 wrote to memory of 2824 2016 AB72.tmp 103 PID 2016 wrote to memory of 2824 2016 AB72.tmp 103 PID 2824 wrote to memory of 1988 2824 ABE0.tmp 104 PID 2824 wrote to memory of 1988 2824 ABE0.tmp 104 PID 2824 wrote to memory of 1988 2824 ABE0.tmp 104 PID 1988 wrote to memory of 2844 1988 AC4D.tmp 105 PID 1988 wrote to memory of 2844 1988 AC4D.tmp 105 PID 1988 wrote to memory of 2844 1988 AC4D.tmp 105 PID 2844 wrote to memory of 3404 2844 ACCA.tmp 106 PID 2844 wrote to memory of 3404 2844 ACCA.tmp 106 PID 2844 wrote to memory of 3404 2844 ACCA.tmp 106 PID 3404 wrote to memory of 4088 3404 AD38.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-10_54819b2d02208a3227746efbcf778499_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-10_54819b2d02208a3227746efbcf778499_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\A558.tmp"C:\Users\Admin\AppData\Local\Temp\A558.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\A633.tmp"C:\Users\Admin\AppData\Local\Temp\A633.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\A690.tmp"C:\Users\Admin\AppData\Local\Temp\A690.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\A73C.tmp"C:\Users\Admin\AppData\Local\Temp\A73C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\A807.tmp"C:\Users\Admin\AppData\Local\Temp\A807.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\A875.tmp"C:\Users\Admin\AppData\Local\Temp\A875.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\A930.tmp"C:\Users\Admin\AppData\Local\Temp\A930.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\A98E.tmp"C:\Users\Admin\AppData\Local\Temp\A98E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\AA69.tmp"C:\Users\Admin\AppData\Local\Temp\AA69.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Users\Admin\AppData\Local\Temp\AB15.tmp"C:\Users\Admin\AppData\Local\Temp\AB15.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\AB72.tmp"C:\Users\Admin\AppData\Local\Temp\AB72.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\AD38.tmp"C:\Users\Admin\AppData\Local\Temp\AD38.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\AD86.tmp"C:\Users\Admin\AppData\Local\Temp\AD86.tmp"23⤵
- Executes dropped EXE
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"24⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\AE41.tmp"C:\Users\Admin\AppData\Local\Temp\AE41.tmp"25⤵
- Executes dropped EXE
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"26⤵
- Executes dropped EXE
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"27⤵
- Executes dropped EXE
PID:700 -
C:\Users\Admin\AppData\Local\Temp\AF89.tmp"C:\Users\Admin\AppData\Local\Temp\AF89.tmp"28⤵
- Executes dropped EXE
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"29⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\B054.tmp"C:\Users\Admin\AppData\Local\Temp\B054.tmp"30⤵
- Executes dropped EXE
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"31⤵
- Executes dropped EXE
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\B13F.tmp"C:\Users\Admin\AppData\Local\Temp\B13F.tmp"32⤵
- Executes dropped EXE
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"33⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\B229.tmp"C:\Users\Admin\AppData\Local\Temp\B229.tmp"34⤵
- Executes dropped EXE
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\B277.tmp"C:\Users\Admin\AppData\Local\Temp\B277.tmp"35⤵
- Executes dropped EXE
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"36⤵
- Executes dropped EXE
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\B314.tmp"C:\Users\Admin\AppData\Local\Temp\B314.tmp"37⤵
- Executes dropped EXE
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\B362.tmp"C:\Users\Admin\AppData\Local\Temp\B362.tmp"38⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"39⤵
- Executes dropped EXE
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"40⤵
- Executes dropped EXE
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\B44C.tmp"C:\Users\Admin\AppData\Local\Temp\B44C.tmp"41⤵
- Executes dropped EXE
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\B49A.tmp"C:\Users\Admin\AppData\Local\Temp\B49A.tmp"42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"43⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\B536.tmp"C:\Users\Admin\AppData\Local\Temp\B536.tmp"44⤵
- Executes dropped EXE
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\B585.tmp"C:\Users\Admin\AppData\Local\Temp\B585.tmp"45⤵
- Executes dropped EXE
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\B5D3.tmp"C:\Users\Admin\AppData\Local\Temp\B5D3.tmp"46⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\B621.tmp"C:\Users\Admin\AppData\Local\Temp\B621.tmp"47⤵
- Executes dropped EXE
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\B67F.tmp"C:\Users\Admin\AppData\Local\Temp\B67F.tmp"48⤵
- Executes dropped EXE
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"49⤵
- Executes dropped EXE
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\B71B.tmp"C:\Users\Admin\AppData\Local\Temp\B71B.tmp"50⤵
- Executes dropped EXE
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\B769.tmp"C:\Users\Admin\AppData\Local\Temp\B769.tmp"51⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"52⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\B815.tmp"C:\Users\Admin\AppData\Local\Temp\B815.tmp"53⤵
- Executes dropped EXE
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\B873.tmp"C:\Users\Admin\AppData\Local\Temp\B873.tmp"54⤵
- Executes dropped EXE
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\B8D0.tmp"C:\Users\Admin\AppData\Local\Temp\B8D0.tmp"55⤵
- Executes dropped EXE
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\B92E.tmp"C:\Users\Admin\AppData\Local\Temp\B92E.tmp"56⤵
- Executes dropped EXE
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\B97C.tmp"C:\Users\Admin\AppData\Local\Temp\B97C.tmp"57⤵
- Executes dropped EXE
PID:620 -
C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"58⤵
- Executes dropped EXE
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\BA18.tmp"C:\Users\Admin\AppData\Local\Temp\BA18.tmp"59⤵
- Executes dropped EXE
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\BA67.tmp"C:\Users\Admin\AppData\Local\Temp\BA67.tmp"60⤵
- Executes dropped EXE
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"61⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\BB12.tmp"C:\Users\Admin\AppData\Local\Temp\BB12.tmp"62⤵
- Executes dropped EXE
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\BB61.tmp"C:\Users\Admin\AppData\Local\Temp\BB61.tmp"63⤵
- Executes dropped EXE
PID:972 -
C:\Users\Admin\AppData\Local\Temp\BBAF.tmp"C:\Users\Admin\AppData\Local\Temp\BBAF.tmp"64⤵
- Executes dropped EXE
PID:444 -
C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"65⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"66⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\BC99.tmp"C:\Users\Admin\AppData\Local\Temp\BC99.tmp"67⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\BCF7.tmp"C:\Users\Admin\AppData\Local\Temp\BCF7.tmp"68⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\BD45.tmp"C:\Users\Admin\AppData\Local\Temp\BD45.tmp"69⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\BD93.tmp"C:\Users\Admin\AppData\Local\Temp\BD93.tmp"70⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"71⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"72⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"73⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\BEEB.tmp"C:\Users\Admin\AppData\Local\Temp\BEEB.tmp"74⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\BF49.tmp"C:\Users\Admin\AppData\Local\Temp\BF49.tmp"75⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\BF97.tmp"C:\Users\Admin\AppData\Local\Temp\BF97.tmp"76⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"77⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\C033.tmp"C:\Users\Admin\AppData\Local\Temp\C033.tmp"78⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\C091.tmp"C:\Users\Admin\AppData\Local\Temp\C091.tmp"79⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"80⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\C13D.tmp"C:\Users\Admin\AppData\Local\Temp\C13D.tmp"81⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\C19A.tmp"C:\Users\Admin\AppData\Local\Temp\C19A.tmp"82⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"83⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\C237.tmp"C:\Users\Admin\AppData\Local\Temp\C237.tmp"84⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\C285.tmp"C:\Users\Admin\AppData\Local\Temp\C285.tmp"85⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"86⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\C331.tmp"C:\Users\Admin\AppData\Local\Temp\C331.tmp"87⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\C37F.tmp"C:\Users\Admin\AppData\Local\Temp\C37F.tmp"88⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\C3DC.tmp"C:\Users\Admin\AppData\Local\Temp\C3DC.tmp"89⤵
- System Location Discovery: System Language Discovery
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\C42B.tmp"C:\Users\Admin\AppData\Local\Temp\C42B.tmp"90⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\C479.tmp"C:\Users\Admin\AppData\Local\Temp\C479.tmp"91⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\C4C7.tmp"C:\Users\Admin\AppData\Local\Temp\C4C7.tmp"92⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\C525.tmp"C:\Users\Admin\AppData\Local\Temp\C525.tmp"93⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\C573.tmp"C:\Users\Admin\AppData\Local\Temp\C573.tmp"94⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"95⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\C60F.tmp"C:\Users\Admin\AppData\Local\Temp\C60F.tmp"96⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\C65D.tmp"C:\Users\Admin\AppData\Local\Temp\C65D.tmp"97⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"98⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\C709.tmp"C:\Users\Admin\AppData\Local\Temp\C709.tmp"99⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\C757.tmp"C:\Users\Admin\AppData\Local\Temp\C757.tmp"100⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\C7A5.tmp"C:\Users\Admin\AppData\Local\Temp\C7A5.tmp"101⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"102⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\C851.tmp"C:\Users\Admin\AppData\Local\Temp\C851.tmp"103⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\C8AF.tmp"C:\Users\Admin\AppData\Local\Temp\C8AF.tmp"104⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\C8FD.tmp"C:\Users\Admin\AppData\Local\Temp\C8FD.tmp"105⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\C95B.tmp"C:\Users\Admin\AppData\Local\Temp\C95B.tmp"106⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\C9B8.tmp"C:\Users\Admin\AppData\Local\Temp\C9B8.tmp"107⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\CA07.tmp"C:\Users\Admin\AppData\Local\Temp\CA07.tmp"108⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\CA55.tmp"C:\Users\Admin\AppData\Local\Temp\CA55.tmp"109⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\CAA3.tmp"C:\Users\Admin\AppData\Local\Temp\CAA3.tmp"110⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\CAF1.tmp"C:\Users\Admin\AppData\Local\Temp\CAF1.tmp"111⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\CB4F.tmp"C:\Users\Admin\AppData\Local\Temp\CB4F.tmp"112⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\CB9D.tmp"C:\Users\Admin\AppData\Local\Temp\CB9D.tmp"113⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\CBFB.tmp"C:\Users\Admin\AppData\Local\Temp\CBFB.tmp"114⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\CC58.tmp"C:\Users\Admin\AppData\Local\Temp\CC58.tmp"115⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\CCA6.tmp"C:\Users\Admin\AppData\Local\Temp\CCA6.tmp"116⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\CCF5.tmp"C:\Users\Admin\AppData\Local\Temp\CCF5.tmp"117⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\CD52.tmp"C:\Users\Admin\AppData\Local\Temp\CD52.tmp"118⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\CDB0.tmp"C:\Users\Admin\AppData\Local\Temp\CDB0.tmp"119⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\CDFE.tmp"C:\Users\Admin\AppData\Local\Temp\CDFE.tmp"120⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\CE4C.tmp"C:\Users\Admin\AppData\Local\Temp\CE4C.tmp"121⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\CEAA.tmp"C:\Users\Admin\AppData\Local\Temp\CEAA.tmp"122⤵PID:2968
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-