Analysis
-
max time kernel
150s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12-10-2024 08:10
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-12_f514fb536eb6dbd23bef3d26b09ec749_mafia.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-10-12_f514fb536eb6dbd23bef3d26b09ec749_mafia.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-12_f514fb536eb6dbd23bef3d26b09ec749_mafia.exe
-
Size
530KB
-
MD5
f514fb536eb6dbd23bef3d26b09ec749
-
SHA1
88cad5c8f2d23031a7b495abbf7d0dcc9d0679a1
-
SHA256
9925cd89225b02cda9ddf8a6de922ea41560cc29bebdf4d763b211c32b3e27f5
-
SHA512
be2414b8340d795e8cbdc2b072d0b2594863a1c3c68fa9efe9f9f08508623462f4a27439447b0e155cdfbdb9afbec4268b6780fca348a109333ea569227aaa30
-
SSDEEP
12288:AU5rCOTeioOtcCPsjR3vNoQ7ML9e5NZulFVg0M1:AUQOJoGcCPsjhvawNclFV/M1
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4436 88D7.tmp 3404 8964.tmp 3172 89D1.tmp 1648 8A7D.tmp 3040 8ACB.tmp 1256 8B29.tmp 3608 8BB5.tmp 4044 8C13.tmp 2424 8C61.tmp 1596 8CBF.tmp 2980 8D1D.tmp 3396 8D6B.tmp 1932 8DC9.tmp 3316 8E46.tmp 4556 8ED2.tmp 3044 8F30.tmp 2596 8FAD.tmp 4032 900B.tmp 4540 9088.tmp 2876 90E6.tmp 2768 9153.tmp 2544 91C0.tmp 1696 923D.tmp 4756 928B.tmp 4824 9308.tmp 4668 9376.tmp 1672 93E3.tmp 3744 9441.tmp 3920 94BE.tmp 3832 952B.tmp 3884 9589.tmp 2520 9606.tmp 1496 9683.tmp 3032 9700.tmp 2312 975E.tmp 368 97BC.tmp 4812 980A.tmp 3352 9858.tmp 4260 98A6.tmp 3948 98F4.tmp 4472 9942.tmp 3960 9990.tmp 4408 99DE.tmp 4068 9A2D.tmp 4300 9A7B.tmp 2812 9AC9.tmp 996 9B17.tmp 3464 9B65.tmp 3996 9BB3.tmp 3780 9C11.tmp 3548 9C5F.tmp 1808 9CAD.tmp 3440 9CFB.tmp 4060 9D49.tmp 3508 9DA7.tmp 3984 9DF5.tmp 1412 9E53.tmp 4564 9EA1.tmp 3040 9EEF.tmp 3280 9F3D.tmp 1528 9F9B.tmp 4828 9FE9.tmp 2220 A047.tmp 2012 A095.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A568.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C10E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F656.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9EBC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B064.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6491.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8661.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E436.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1529.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9006.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D021.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3217.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DD8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 509C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2333.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D0A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D707.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9546.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D433.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4612 wrote to memory of 4436 4612 2024-10-12_f514fb536eb6dbd23bef3d26b09ec749_mafia.exe 84 PID 4612 wrote to memory of 4436 4612 2024-10-12_f514fb536eb6dbd23bef3d26b09ec749_mafia.exe 84 PID 4612 wrote to memory of 4436 4612 2024-10-12_f514fb536eb6dbd23bef3d26b09ec749_mafia.exe 84 PID 4436 wrote to memory of 3404 4436 88D7.tmp 86 PID 4436 wrote to memory of 3404 4436 88D7.tmp 86 PID 4436 wrote to memory of 3404 4436 88D7.tmp 86 PID 3404 wrote to memory of 3172 3404 8964.tmp 88 PID 3404 wrote to memory of 3172 3404 8964.tmp 88 PID 3404 wrote to memory of 3172 3404 8964.tmp 88 PID 3172 wrote to memory of 1648 3172 89D1.tmp 89 PID 3172 wrote to memory of 1648 3172 89D1.tmp 89 PID 3172 wrote to memory of 1648 3172 89D1.tmp 89 PID 1648 wrote to memory of 3040 1648 8A7D.tmp 90 PID 1648 wrote to memory of 3040 1648 8A7D.tmp 90 PID 1648 wrote to memory of 3040 1648 8A7D.tmp 90 PID 3040 wrote to memory of 1256 3040 8ACB.tmp 91 PID 3040 wrote to memory of 1256 3040 8ACB.tmp 91 PID 3040 wrote to memory of 1256 3040 8ACB.tmp 91 PID 1256 wrote to memory of 3608 1256 8B29.tmp 92 PID 1256 wrote to memory of 3608 1256 8B29.tmp 92 PID 1256 wrote to memory of 3608 1256 8B29.tmp 92 PID 3608 wrote to memory of 4044 3608 8BB5.tmp 93 PID 3608 wrote to memory of 4044 3608 8BB5.tmp 93 PID 3608 wrote to memory of 4044 3608 8BB5.tmp 93 PID 4044 wrote to memory of 2424 4044 8C13.tmp 94 PID 4044 wrote to memory of 2424 4044 8C13.tmp 94 PID 4044 wrote to memory of 2424 4044 8C13.tmp 94 PID 2424 wrote to memory of 1596 2424 8C61.tmp 95 PID 2424 wrote to memory of 1596 2424 8C61.tmp 95 PID 2424 wrote to memory of 1596 2424 8C61.tmp 95 PID 1596 wrote to memory of 2980 1596 8CBF.tmp 96 PID 1596 wrote to memory of 2980 1596 8CBF.tmp 96 PID 1596 wrote to memory of 2980 1596 8CBF.tmp 96 PID 2980 wrote to memory of 3396 2980 8D1D.tmp 97 PID 2980 wrote to memory of 3396 2980 8D1D.tmp 97 PID 2980 wrote to memory of 3396 2980 8D1D.tmp 97 PID 3396 wrote to memory of 1932 3396 8D6B.tmp 98 PID 3396 wrote to memory of 1932 3396 8D6B.tmp 98 PID 3396 wrote to memory of 1932 3396 8D6B.tmp 98 PID 1932 wrote to memory of 3316 1932 8DC9.tmp 99 PID 1932 wrote to memory of 3316 1932 8DC9.tmp 99 PID 1932 wrote to memory of 3316 1932 8DC9.tmp 99 PID 3316 wrote to memory of 4556 3316 8E46.tmp 100 PID 3316 wrote to memory of 4556 3316 8E46.tmp 100 PID 3316 wrote to memory of 4556 3316 8E46.tmp 100 PID 4556 wrote to memory of 3044 4556 8ED2.tmp 101 PID 4556 wrote to memory of 3044 4556 8ED2.tmp 101 PID 4556 wrote to memory of 3044 4556 8ED2.tmp 101 PID 3044 wrote to memory of 2596 3044 8F30.tmp 102 PID 3044 wrote to memory of 2596 3044 8F30.tmp 102 PID 3044 wrote to memory of 2596 3044 8F30.tmp 102 PID 2596 wrote to memory of 4032 2596 8FAD.tmp 103 PID 2596 wrote to memory of 4032 2596 8FAD.tmp 103 PID 2596 wrote to memory of 4032 2596 8FAD.tmp 103 PID 4032 wrote to memory of 4540 4032 900B.tmp 104 PID 4032 wrote to memory of 4540 4032 900B.tmp 104 PID 4032 wrote to memory of 4540 4032 900B.tmp 104 PID 4540 wrote to memory of 2876 4540 9088.tmp 105 PID 4540 wrote to memory of 2876 4540 9088.tmp 105 PID 4540 wrote to memory of 2876 4540 9088.tmp 105 PID 2876 wrote to memory of 2768 2876 90E6.tmp 106 PID 2876 wrote to memory of 2768 2876 90E6.tmp 106 PID 2876 wrote to memory of 2768 2876 90E6.tmp 106 PID 2768 wrote to memory of 2544 2768 9153.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-12_f514fb536eb6dbd23bef3d26b09ec749_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-12_f514fb536eb6dbd23bef3d26b09ec749_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\88D7.tmp"C:\Users\Admin\AppData\Local\Temp\88D7.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\8964.tmp"C:\Users\Admin\AppData\Local\Temp\8964.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\89D1.tmp"C:\Users\Admin\AppData\Local\Temp\89D1.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\8B29.tmp"C:\Users\Admin\AppData\Local\Temp\8B29.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\8C13.tmp"C:\Users\Admin\AppData\Local\Temp\8C13.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\8C61.tmp"C:\Users\Admin\AppData\Local\Temp\8C61.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\8CBF.tmp"C:\Users\Admin\AppData\Local\Temp\8CBF.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\8E46.tmp"C:\Users\Admin\AppData\Local\Temp\8E46.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\8F30.tmp"C:\Users\Admin\AppData\Local\Temp\8F30.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\900B.tmp"C:\Users\Admin\AppData\Local\Temp\900B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\9088.tmp"C:\Users\Admin\AppData\Local\Temp\9088.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\90E6.tmp"C:\Users\Admin\AppData\Local\Temp\90E6.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\9153.tmp"C:\Users\Admin\AppData\Local\Temp\9153.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\91C0.tmp"C:\Users\Admin\AppData\Local\Temp\91C0.tmp"23⤵
- Executes dropped EXE
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\923D.tmp"C:\Users\Admin\AppData\Local\Temp\923D.tmp"24⤵
- Executes dropped EXE
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\928B.tmp"C:\Users\Admin\AppData\Local\Temp\928B.tmp"25⤵
- Executes dropped EXE
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\9308.tmp"C:\Users\Admin\AppData\Local\Temp\9308.tmp"26⤵
- Executes dropped EXE
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\9376.tmp"C:\Users\Admin\AppData\Local\Temp\9376.tmp"27⤵
- Executes dropped EXE
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\93E3.tmp"C:\Users\Admin\AppData\Local\Temp\93E3.tmp"28⤵
- Executes dropped EXE
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\9441.tmp"C:\Users\Admin\AppData\Local\Temp\9441.tmp"29⤵
- Executes dropped EXE
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\94BE.tmp"C:\Users\Admin\AppData\Local\Temp\94BE.tmp"30⤵
- Executes dropped EXE
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\952B.tmp"C:\Users\Admin\AppData\Local\Temp\952B.tmp"31⤵
- Executes dropped EXE
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\9589.tmp"C:\Users\Admin\AppData\Local\Temp\9589.tmp"32⤵
- Executes dropped EXE
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\9606.tmp"C:\Users\Admin\AppData\Local\Temp\9606.tmp"33⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\9683.tmp"C:\Users\Admin\AppData\Local\Temp\9683.tmp"34⤵
- Executes dropped EXE
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\9700.tmp"C:\Users\Admin\AppData\Local\Temp\9700.tmp"35⤵
- Executes dropped EXE
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\975E.tmp"C:\Users\Admin\AppData\Local\Temp\975E.tmp"36⤵
- Executes dropped EXE
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\97BC.tmp"C:\Users\Admin\AppData\Local\Temp\97BC.tmp"37⤵
- Executes dropped EXE
PID:368 -
C:\Users\Admin\AppData\Local\Temp\980A.tmp"C:\Users\Admin\AppData\Local\Temp\980A.tmp"38⤵
- Executes dropped EXE
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\9858.tmp"C:\Users\Admin\AppData\Local\Temp\9858.tmp"39⤵
- Executes dropped EXE
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\98A6.tmp"C:\Users\Admin\AppData\Local\Temp\98A6.tmp"40⤵
- Executes dropped EXE
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\98F4.tmp"C:\Users\Admin\AppData\Local\Temp\98F4.tmp"41⤵
- Executes dropped EXE
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\9942.tmp"C:\Users\Admin\AppData\Local\Temp\9942.tmp"42⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\9990.tmp"C:\Users\Admin\AppData\Local\Temp\9990.tmp"43⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\99DE.tmp"C:\Users\Admin\AppData\Local\Temp\99DE.tmp"44⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"45⤵
- Executes dropped EXE
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"46⤵
- Executes dropped EXE
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"47⤵
- Executes dropped EXE
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\9B17.tmp"C:\Users\Admin\AppData\Local\Temp\9B17.tmp"48⤵
- Executes dropped EXE
PID:996 -
C:\Users\Admin\AppData\Local\Temp\9B65.tmp"C:\Users\Admin\AppData\Local\Temp\9B65.tmp"49⤵
- Executes dropped EXE
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"50⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\9C11.tmp"C:\Users\Admin\AppData\Local\Temp\9C11.tmp"51⤵
- Executes dropped EXE
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"52⤵
- Executes dropped EXE
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"53⤵
- Executes dropped EXE
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"54⤵
- Executes dropped EXE
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\9D49.tmp"C:\Users\Admin\AppData\Local\Temp\9D49.tmp"55⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"56⤵
- Executes dropped EXE
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"57⤵
- Executes dropped EXE
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\9E53.tmp"C:\Users\Admin\AppData\Local\Temp\9E53.tmp"58⤵
- Executes dropped EXE
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"59⤵
- Executes dropped EXE
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"60⤵
- Executes dropped EXE
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"61⤵
- Executes dropped EXE
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"62⤵
- Executes dropped EXE
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"63⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\A047.tmp"C:\Users\Admin\AppData\Local\Temp\A047.tmp"64⤵
- Executes dropped EXE
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\A095.tmp"C:\Users\Admin\AppData\Local\Temp\A095.tmp"65⤵
- Executes dropped EXE
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"66⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\A141.tmp"C:\Users\Admin\AppData\Local\Temp\A141.tmp"67⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\A18F.tmp"C:\Users\Admin\AppData\Local\Temp\A18F.tmp"68⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"69⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\A22B.tmp"C:\Users\Admin\AppData\Local\Temp\A22B.tmp"70⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\A289.tmp"C:\Users\Admin\AppData\Local\Temp\A289.tmp"71⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"72⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\A325.tmp"C:\Users\Admin\AppData\Local\Temp\A325.tmp"73⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\A374.tmp"C:\Users\Admin\AppData\Local\Temp\A374.tmp"74⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"75⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\A41F.tmp"C:\Users\Admin\AppData\Local\Temp\A41F.tmp"76⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\A46E.tmp"C:\Users\Admin\AppData\Local\Temp\A46E.tmp"77⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"78⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\A519.tmp"C:\Users\Admin\AppData\Local\Temp\A519.tmp"79⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\A568.tmp"C:\Users\Admin\AppData\Local\Temp\A568.tmp"80⤵
- System Location Discovery: System Language Discovery
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"81⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\A613.tmp"C:\Users\Admin\AppData\Local\Temp\A613.tmp"82⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\A671.tmp"C:\Users\Admin\AppData\Local\Temp\A671.tmp"83⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"84⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\A70D.tmp"C:\Users\Admin\AppData\Local\Temp\A70D.tmp"85⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\A76B.tmp"C:\Users\Admin\AppData\Local\Temp\A76B.tmp"86⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"87⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\A807.tmp"C:\Users\Admin\AppData\Local\Temp\A807.tmp"88⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\A856.tmp"C:\Users\Admin\AppData\Local\Temp\A856.tmp"89⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"90⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"91⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\A940.tmp"C:\Users\Admin\AppData\Local\Temp\A940.tmp"92⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\A98E.tmp"C:\Users\Admin\AppData\Local\Temp\A98E.tmp"93⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"94⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"95⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\AA78.tmp"C:\Users\Admin\AppData\Local\Temp\AA78.tmp"96⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"97⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\AB34.tmp"C:\Users\Admin\AppData\Local\Temp\AB34.tmp"98⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\AB92.tmp"C:\Users\Admin\AppData\Local\Temp\AB92.tmp"99⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"100⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"101⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"102⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"103⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\AD28.tmp"C:\Users\Admin\AppData\Local\Temp\AD28.tmp"104⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\AD76.tmp"C:\Users\Admin\AppData\Local\Temp\AD76.tmp"105⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"106⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\AE32.tmp"C:\Users\Admin\AppData\Local\Temp\AE32.tmp"107⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"108⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\AEED.tmp"C:\Users\Admin\AppData\Local\Temp\AEED.tmp"109⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"110⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"111⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\B006.tmp"C:\Users\Admin\AppData\Local\Temp\B006.tmp"112⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\B064.tmp"C:\Users\Admin\AppData\Local\Temp\B064.tmp"113⤵
- System Location Discovery: System Language Discovery
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"114⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\B110.tmp"C:\Users\Admin\AppData\Local\Temp\B110.tmp"115⤵PID:512
-
C:\Users\Admin\AppData\Local\Temp\B16E.tmp"C:\Users\Admin\AppData\Local\Temp\B16E.tmp"116⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\B1BC.tmp"C:\Users\Admin\AppData\Local\Temp\B1BC.tmp"117⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\B20A.tmp"C:\Users\Admin\AppData\Local\Temp\B20A.tmp"118⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\B258.tmp"C:\Users\Admin\AppData\Local\Temp\B258.tmp"119⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\B2A6.tmp"C:\Users\Admin\AppData\Local\Temp\B2A6.tmp"120⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"121⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\B352.tmp"C:\Users\Admin\AppData\Local\Temp\B352.tmp"122⤵PID:2408
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-