Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13/10/2024, 01:07
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-13_a45bb805d89634af61d8743c03b81f0a_mafia.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2024-10-13_a45bb805d89634af61d8743c03b81f0a_mafia.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-13_a45bb805d89634af61d8743c03b81f0a_mafia.exe
-
Size
520KB
-
MD5
a45bb805d89634af61d8743c03b81f0a
-
SHA1
39945373950a2958c84c6edf528adfa055e00b9b
-
SHA256
e6c58b4da14db961ca2137588743c3958b6ff0d92f166c847d49cd3d95c377c9
-
SHA512
f0b7e0fd3e897eb9eb6abd77b7f0ac2683d8539df1aa2aaf8cdf06a8d114ab748a3d4a87b85d2ba1bc8f800596a0bb302c906d12aef49f44ee27f585ab8a541b
-
SSDEEP
12288:gj8fuxR21t5i8fe+gyAcs9DulGwdFGGb+RfZezNZ:gj8fuK1GYe+gvcslhwUGbZN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4084 83D6.tmp 3512 8453.tmp 3096 84DF.tmp 1932 855C.tmp 2792 85BA.tmp 2832 8608.tmp 1748 8666.tmp 3656 86C4.tmp 3612 8722.tmp 4464 877F.tmp 1212 87ED.tmp 4948 886A.tmp 4804 88F6.tmp 3092 8944.tmp 5000 89B2.tmp 1160 8A10.tmp 1788 8A7D.tmp 5008 8AFA.tmp 4812 8B58.tmp 4972 8BD5.tmp 4676 8C32.tmp 1760 8C81.tmp 3284 8D0D.tmp 2568 8D8A.tmp 3596 8DD8.tmp 3944 8E26.tmp 4220 8E94.tmp 4852 8EF2.tmp 376 8F5F.tmp 4272 8FAD.tmp 852 900B.tmp 5012 9069.tmp 224 90F5.tmp 4268 9143.tmp 2156 91A1.tmp 4680 91FF.tmp 2364 925D.tmp 668 92BA.tmp 1512 9308.tmp 3492 9366.tmp 2432 93C4.tmp 2828 9412.tmp 3420 9470.tmp 3556 94BE.tmp 1604 951C.tmp 2436 956A.tmp 2124 95B8.tmp 3096 9606.tmp 1340 9654.tmp 2356 96A2.tmp 4796 9700.tmp 3712 974E.tmp 828 979C.tmp 4976 97EA.tmp 2452 9839.tmp 1532 9887.tmp 1388 98D5.tmp 1132 9923.tmp 4532 9971.tmp 3656 99BF.tmp 3612 9A0D.tmp 1736 9A5B.tmp 2212 9AAA.tmp 5108 9AF8.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D608.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 143F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B46B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2892.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8836.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 214E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C813.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CA4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 242D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 898E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B522.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C515.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 775E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3F1.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 384 wrote to memory of 4084 384 2024-10-13_a45bb805d89634af61d8743c03b81f0a_mafia.exe 84 PID 384 wrote to memory of 4084 384 2024-10-13_a45bb805d89634af61d8743c03b81f0a_mafia.exe 84 PID 384 wrote to memory of 4084 384 2024-10-13_a45bb805d89634af61d8743c03b81f0a_mafia.exe 84 PID 4084 wrote to memory of 3512 4084 83D6.tmp 86 PID 4084 wrote to memory of 3512 4084 83D6.tmp 86 PID 4084 wrote to memory of 3512 4084 83D6.tmp 86 PID 3512 wrote to memory of 3096 3512 8453.tmp 88 PID 3512 wrote to memory of 3096 3512 8453.tmp 88 PID 3512 wrote to memory of 3096 3512 8453.tmp 88 PID 3096 wrote to memory of 1932 3096 84DF.tmp 89 PID 3096 wrote to memory of 1932 3096 84DF.tmp 89 PID 3096 wrote to memory of 1932 3096 84DF.tmp 89 PID 1932 wrote to memory of 2792 1932 855C.tmp 90 PID 1932 wrote to memory of 2792 1932 855C.tmp 90 PID 1932 wrote to memory of 2792 1932 855C.tmp 90 PID 2792 wrote to memory of 2832 2792 85BA.tmp 91 PID 2792 wrote to memory of 2832 2792 85BA.tmp 91 PID 2792 wrote to memory of 2832 2792 85BA.tmp 91 PID 2832 wrote to memory of 1748 2832 8608.tmp 92 PID 2832 wrote to memory of 1748 2832 8608.tmp 92 PID 2832 wrote to memory of 1748 2832 8608.tmp 92 PID 1748 wrote to memory of 3656 1748 8666.tmp 93 PID 1748 wrote to memory of 3656 1748 8666.tmp 93 PID 1748 wrote to memory of 3656 1748 8666.tmp 93 PID 3656 wrote to memory of 3612 3656 86C4.tmp 94 PID 3656 wrote to memory of 3612 3656 86C4.tmp 94 PID 3656 wrote to memory of 3612 3656 86C4.tmp 94 PID 3612 wrote to memory of 4464 3612 8722.tmp 95 PID 3612 wrote to memory of 4464 3612 8722.tmp 95 PID 3612 wrote to memory of 4464 3612 8722.tmp 95 PID 4464 wrote to memory of 1212 4464 877F.tmp 96 PID 4464 wrote to memory of 1212 4464 877F.tmp 96 PID 4464 wrote to memory of 1212 4464 877F.tmp 96 PID 1212 wrote to memory of 4948 1212 87ED.tmp 97 PID 1212 wrote to memory of 4948 1212 87ED.tmp 97 PID 1212 wrote to memory of 4948 1212 87ED.tmp 97 PID 4948 wrote to memory of 4804 4948 886A.tmp 98 PID 4948 wrote to memory of 4804 4948 886A.tmp 98 PID 4948 wrote to memory of 4804 4948 886A.tmp 98 PID 4804 wrote to memory of 3092 4804 88F6.tmp 99 PID 4804 wrote to memory of 3092 4804 88F6.tmp 99 PID 4804 wrote to memory of 3092 4804 88F6.tmp 99 PID 3092 wrote to memory of 5000 3092 8944.tmp 100 PID 3092 wrote to memory of 5000 3092 8944.tmp 100 PID 3092 wrote to memory of 5000 3092 8944.tmp 100 PID 5000 wrote to memory of 1160 5000 89B2.tmp 101 PID 5000 wrote to memory of 1160 5000 89B2.tmp 101 PID 5000 wrote to memory of 1160 5000 89B2.tmp 101 PID 1160 wrote to memory of 1788 1160 8A10.tmp 102 PID 1160 wrote to memory of 1788 1160 8A10.tmp 102 PID 1160 wrote to memory of 1788 1160 8A10.tmp 102 PID 1788 wrote to memory of 5008 1788 8A7D.tmp 103 PID 1788 wrote to memory of 5008 1788 8A7D.tmp 103 PID 1788 wrote to memory of 5008 1788 8A7D.tmp 103 PID 5008 wrote to memory of 4812 5008 8AFA.tmp 104 PID 5008 wrote to memory of 4812 5008 8AFA.tmp 104 PID 5008 wrote to memory of 4812 5008 8AFA.tmp 104 PID 4812 wrote to memory of 4972 4812 8B58.tmp 105 PID 4812 wrote to memory of 4972 4812 8B58.tmp 105 PID 4812 wrote to memory of 4972 4812 8B58.tmp 105 PID 4972 wrote to memory of 4676 4972 8BD5.tmp 106 PID 4972 wrote to memory of 4676 4972 8BD5.tmp 106 PID 4972 wrote to memory of 4676 4972 8BD5.tmp 106 PID 4676 wrote to memory of 1760 4676 8C32.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-13_a45bb805d89634af61d8743c03b81f0a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-13_a45bb805d89634af61d8743c03b81f0a_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Users\Admin\AppData\Local\Temp\83D6.tmp"C:\Users\Admin\AppData\Local\Temp\83D6.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\8453.tmp"C:\Users\Admin\AppData\Local\Temp\8453.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\84DF.tmp"C:\Users\Admin\AppData\Local\Temp\84DF.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\855C.tmp"C:\Users\Admin\AppData\Local\Temp\855C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\85BA.tmp"C:\Users\Admin\AppData\Local\Temp\85BA.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\8608.tmp"C:\Users\Admin\AppData\Local\Temp\8608.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\8666.tmp"C:\Users\Admin\AppData\Local\Temp\8666.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\86C4.tmp"C:\Users\Admin\AppData\Local\Temp\86C4.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\8722.tmp"C:\Users\Admin\AppData\Local\Temp\8722.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\877F.tmp"C:\Users\Admin\AppData\Local\Temp\877F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\87ED.tmp"C:\Users\Admin\AppData\Local\Temp\87ED.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\886A.tmp"C:\Users\Admin\AppData\Local\Temp\886A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\88F6.tmp"C:\Users\Admin\AppData\Local\Temp\88F6.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\8944.tmp"C:\Users\Admin\AppData\Local\Temp\8944.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\89B2.tmp"C:\Users\Admin\AppData\Local\Temp\89B2.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\8A10.tmp"C:\Users\Admin\AppData\Local\Temp\8A10.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\8B58.tmp"C:\Users\Admin\AppData\Local\Temp\8B58.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\8C32.tmp"C:\Users\Admin\AppData\Local\Temp\8C32.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\8C81.tmp"C:\Users\Admin\AppData\Local\Temp\8C81.tmp"23⤵
- Executes dropped EXE
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"24⤵
- Executes dropped EXE
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"25⤵
- Executes dropped EXE
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"26⤵
- Executes dropped EXE
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\8E26.tmp"C:\Users\Admin\AppData\Local\Temp\8E26.tmp"27⤵
- Executes dropped EXE
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\8E94.tmp"C:\Users\Admin\AppData\Local\Temp\8E94.tmp"28⤵
- Executes dropped EXE
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"29⤵
- Executes dropped EXE
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"30⤵
- Executes dropped EXE
PID:376 -
C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"31⤵
- Executes dropped EXE
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\900B.tmp"C:\Users\Admin\AppData\Local\Temp\900B.tmp"32⤵
- Executes dropped EXE
PID:852 -
C:\Users\Admin\AppData\Local\Temp\9069.tmp"C:\Users\Admin\AppData\Local\Temp\9069.tmp"33⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\90F5.tmp"C:\Users\Admin\AppData\Local\Temp\90F5.tmp"34⤵
- Executes dropped EXE
PID:224 -
C:\Users\Admin\AppData\Local\Temp\9143.tmp"C:\Users\Admin\AppData\Local\Temp\9143.tmp"35⤵
- Executes dropped EXE
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\91A1.tmp"C:\Users\Admin\AppData\Local\Temp\91A1.tmp"36⤵
- Executes dropped EXE
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\91FF.tmp"C:\Users\Admin\AppData\Local\Temp\91FF.tmp"37⤵
- Executes dropped EXE
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\925D.tmp"C:\Users\Admin\AppData\Local\Temp\925D.tmp"38⤵
- Executes dropped EXE
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\92BA.tmp"C:\Users\Admin\AppData\Local\Temp\92BA.tmp"39⤵
- Executes dropped EXE
PID:668 -
C:\Users\Admin\AppData\Local\Temp\9308.tmp"C:\Users\Admin\AppData\Local\Temp\9308.tmp"40⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\9366.tmp"C:\Users\Admin\AppData\Local\Temp\9366.tmp"41⤵
- Executes dropped EXE
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\93C4.tmp"C:\Users\Admin\AppData\Local\Temp\93C4.tmp"42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\9412.tmp"C:\Users\Admin\AppData\Local\Temp\9412.tmp"43⤵
- Executes dropped EXE
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\9470.tmp"C:\Users\Admin\AppData\Local\Temp\9470.tmp"44⤵
- Executes dropped EXE
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\94BE.tmp"C:\Users\Admin\AppData\Local\Temp\94BE.tmp"45⤵
- Executes dropped EXE
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\951C.tmp"C:\Users\Admin\AppData\Local\Temp\951C.tmp"46⤵
- Executes dropped EXE
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\956A.tmp"C:\Users\Admin\AppData\Local\Temp\956A.tmp"47⤵
- Executes dropped EXE
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\95B8.tmp"C:\Users\Admin\AppData\Local\Temp\95B8.tmp"48⤵
- Executes dropped EXE
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\9606.tmp"C:\Users\Admin\AppData\Local\Temp\9606.tmp"49⤵
- Executes dropped EXE
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\9654.tmp"C:\Users\Admin\AppData\Local\Temp\9654.tmp"50⤵
- Executes dropped EXE
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\96A2.tmp"C:\Users\Admin\AppData\Local\Temp\96A2.tmp"51⤵
- Executes dropped EXE
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\9700.tmp"C:\Users\Admin\AppData\Local\Temp\9700.tmp"52⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\974E.tmp"C:\Users\Admin\AppData\Local\Temp\974E.tmp"53⤵
- Executes dropped EXE
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\979C.tmp"C:\Users\Admin\AppData\Local\Temp\979C.tmp"54⤵
- Executes dropped EXE
PID:828 -
C:\Users\Admin\AppData\Local\Temp\97EA.tmp"C:\Users\Admin\AppData\Local\Temp\97EA.tmp"55⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\9839.tmp"C:\Users\Admin\AppData\Local\Temp\9839.tmp"56⤵
- Executes dropped EXE
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\9887.tmp"C:\Users\Admin\AppData\Local\Temp\9887.tmp"57⤵
- Executes dropped EXE
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\98D5.tmp"C:\Users\Admin\AppData\Local\Temp\98D5.tmp"58⤵
- Executes dropped EXE
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\9923.tmp"C:\Users\Admin\AppData\Local\Temp\9923.tmp"59⤵
- Executes dropped EXE
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\9971.tmp"C:\Users\Admin\AppData\Local\Temp\9971.tmp"60⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\99BF.tmp"C:\Users\Admin\AppData\Local\Temp\99BF.tmp"61⤵
- Executes dropped EXE
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"62⤵
- Executes dropped EXE
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"63⤵
- Executes dropped EXE
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"64⤵
- Executes dropped EXE
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"65⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"66⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"67⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"68⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\9C40.tmp"C:\Users\Admin\AppData\Local\Temp\9C40.tmp"69⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"70⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"71⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"72⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\9D88.tmp"C:\Users\Admin\AppData\Local\Temp\9D88.tmp"73⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"74⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\9E24.tmp"C:\Users\Admin\AppData\Local\Temp\9E24.tmp"75⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\9E72.tmp"C:\Users\Admin\AppData\Local\Temp\9E72.tmp"76⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"77⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"78⤵
- System Location Discovery: System Language Discovery
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"79⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"80⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"81⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\A047.tmp"C:\Users\Admin\AppData\Local\Temp\A047.tmp"82⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\A095.tmp"C:\Users\Admin\AppData\Local\Temp\A095.tmp"83⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"84⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\A151.tmp"C:\Users\Admin\AppData\Local\Temp\A151.tmp"85⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"86⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\A20C.tmp"C:\Users\Admin\AppData\Local\Temp\A20C.tmp"87⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\A25A.tmp"C:\Users\Admin\AppData\Local\Temp\A25A.tmp"88⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"89⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\A306.tmp"C:\Users\Admin\AppData\Local\Temp\A306.tmp"90⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\A354.tmp"C:\Users\Admin\AppData\Local\Temp\A354.tmp"91⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"92⤵
- System Location Discovery: System Language Discovery
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"93⤵
- System Location Discovery: System Language Discovery
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\A43F.tmp"C:\Users\Admin\AppData\Local\Temp\A43F.tmp"94⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\A48D.tmp"C:\Users\Admin\AppData\Local\Temp\A48D.tmp"95⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"96⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\A529.tmp"C:\Users\Admin\AppData\Local\Temp\A529.tmp"97⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\A587.tmp"C:\Users\Admin\AppData\Local\Temp\A587.tmp"98⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"99⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\A623.tmp"C:\Users\Admin\AppData\Local\Temp\A623.tmp"100⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\A681.tmp"C:\Users\Admin\AppData\Local\Temp\A681.tmp"101⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"102⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\A72D.tmp"C:\Users\Admin\AppData\Local\Temp\A72D.tmp"103⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\A78A.tmp"C:\Users\Admin\AppData\Local\Temp\A78A.tmp"104⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"105⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\A836.tmp"C:\Users\Admin\AppData\Local\Temp\A836.tmp"106⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\A884.tmp"C:\Users\Admin\AppData\Local\Temp\A884.tmp"107⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"108⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\A930.tmp"C:\Users\Admin\AppData\Local\Temp\A930.tmp"109⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\A97E.tmp"C:\Users\Admin\AppData\Local\Temp\A97E.tmp"110⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"111⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"112⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\AA69.tmp"C:\Users\Admin\AppData\Local\Temp\AA69.tmp"113⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"114⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\AB15.tmp"C:\Users\Admin\AppData\Local\Temp\AB15.tmp"115⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\AB63.tmp"C:\Users\Admin\AppData\Local\Temp\AB63.tmp"116⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"117⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"118⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"119⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"120⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"121⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\AD47.tmp"C:\Users\Admin\AppData\Local\Temp\AD47.tmp"122⤵PID:760
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-