Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15/10/2024, 05:57
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-15_d96d6e372f03b095eeec97430226066b_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-15_d96d6e372f03b095eeec97430226066b_mafia.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-15_d96d6e372f03b095eeec97430226066b_mafia.exe
-
Size
520KB
-
MD5
d96d6e372f03b095eeec97430226066b
-
SHA1
3d4eb67c2ba7b6abcee07c101201578c9677095f
-
SHA256
944bd4f6304973a21fa870694988b15299f34eda730c00fd2c20ac0648cc70ed
-
SHA512
4a6d54802f752ed137139d13cc926bdc5c89916ce16e99c27ac775b25b6a66b767de5d841fafae515b10b65e8c3a91b2fc7ee9150b3450728aef8b08cf95c1f9
-
SSDEEP
12288:XbB1mLVrShiKWhXs2baejlWp595QPmLy/3xcNZ:XbGLshiLVs2HRS595CZcN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1340 8FCC.tmp 2996 9049.tmp 1212 90C6.tmp 400 9143.tmp 2192 91C0.tmp 1056 922E.tmp 4740 92AB.tmp 5024 9318.tmp 3964 9395.tmp 2736 9412.tmp 4076 949F.tmp 3120 94FC.tmp 2844 955A.tmp 3024 95A8.tmp 2584 9606.tmp 3116 9673.tmp 1356 96C2.tmp 2136 971F.tmp 1696 979C.tmp 2088 97FA.tmp 4576 9858.tmp 4652 98D5.tmp 4572 9952.tmp 4452 99DE.tmp 4500 9A4C.tmp 5020 9AC9.tmp 1180 9B36.tmp 1988 9BA4.tmp 1624 9BF2.tmp 1840 9C5F.tmp 1900 9CAD.tmp 3408 9D2A.tmp 1148 9D88.tmp 440 9DE6.tmp 4348 9E34.tmp 1116 9E92.tmp 3168 9EE0.tmp 5044 9F3D.tmp 4400 9F8C.tmp 3484 9FE9.tmp 4372 A037.tmp 3172 A0A5.tmp 4568 A103.tmp 1124 A170.tmp 400 A1ED.tmp 4188 A24B.tmp 2788 A2B8.tmp 1608 A316.tmp 396 A364.tmp 4288 A3B2.tmp 2644 A400.tmp 1576 A44E.tmp 2956 A4AC.tmp 5024 A50A.tmp 4688 A558.tmp 2060 A5C5.tmp 4908 A623.tmp 4076 A681.tmp 1080 A6EE.tmp 4060 A74C.tmp 2352 A79A.tmp 2368 A807.tmp 4956 A865.tmp 1620 A8C3.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 991E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5270.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F4F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 273A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C00F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E271.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8CCA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B36.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B815.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 720E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C68C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 489D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C4F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D774.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C33B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D9D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F424.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2128 wrote to memory of 1340 2128 2024-10-15_d96d6e372f03b095eeec97430226066b_mafia.exe 85 PID 2128 wrote to memory of 1340 2128 2024-10-15_d96d6e372f03b095eeec97430226066b_mafia.exe 85 PID 2128 wrote to memory of 1340 2128 2024-10-15_d96d6e372f03b095eeec97430226066b_mafia.exe 85 PID 1340 wrote to memory of 2996 1340 8FCC.tmp 86 PID 1340 wrote to memory of 2996 1340 8FCC.tmp 86 PID 1340 wrote to memory of 2996 1340 8FCC.tmp 86 PID 2996 wrote to memory of 1212 2996 9049.tmp 88 PID 2996 wrote to memory of 1212 2996 9049.tmp 88 PID 2996 wrote to memory of 1212 2996 9049.tmp 88 PID 1212 wrote to memory of 400 1212 90C6.tmp 89 PID 1212 wrote to memory of 400 1212 90C6.tmp 89 PID 1212 wrote to memory of 400 1212 90C6.tmp 89 PID 400 wrote to memory of 2192 400 9143.tmp 90 PID 400 wrote to memory of 2192 400 9143.tmp 90 PID 400 wrote to memory of 2192 400 9143.tmp 90 PID 2192 wrote to memory of 1056 2192 91C0.tmp 91 PID 2192 wrote to memory of 1056 2192 91C0.tmp 91 PID 2192 wrote to memory of 1056 2192 91C0.tmp 91 PID 1056 wrote to memory of 4740 1056 922E.tmp 93 PID 1056 wrote to memory of 4740 1056 922E.tmp 93 PID 1056 wrote to memory of 4740 1056 922E.tmp 93 PID 4740 wrote to memory of 5024 4740 92AB.tmp 94 PID 4740 wrote to memory of 5024 4740 92AB.tmp 94 PID 4740 wrote to memory of 5024 4740 92AB.tmp 94 PID 5024 wrote to memory of 3964 5024 9318.tmp 95 PID 5024 wrote to memory of 3964 5024 9318.tmp 95 PID 5024 wrote to memory of 3964 5024 9318.tmp 95 PID 3964 wrote to memory of 2736 3964 9395.tmp 96 PID 3964 wrote to memory of 2736 3964 9395.tmp 96 PID 3964 wrote to memory of 2736 3964 9395.tmp 96 PID 2736 wrote to memory of 4076 2736 9412.tmp 97 PID 2736 wrote to memory of 4076 2736 9412.tmp 97 PID 2736 wrote to memory of 4076 2736 9412.tmp 97 PID 4076 wrote to memory of 3120 4076 949F.tmp 98 PID 4076 wrote to memory of 3120 4076 949F.tmp 98 PID 4076 wrote to memory of 3120 4076 949F.tmp 98 PID 3120 wrote to memory of 2844 3120 94FC.tmp 99 PID 3120 wrote to memory of 2844 3120 94FC.tmp 99 PID 3120 wrote to memory of 2844 3120 94FC.tmp 99 PID 2844 wrote to memory of 3024 2844 955A.tmp 100 PID 2844 wrote to memory of 3024 2844 955A.tmp 100 PID 2844 wrote to memory of 3024 2844 955A.tmp 100 PID 3024 wrote to memory of 2584 3024 95A8.tmp 101 PID 3024 wrote to memory of 2584 3024 95A8.tmp 101 PID 3024 wrote to memory of 2584 3024 95A8.tmp 101 PID 2584 wrote to memory of 3116 2584 9606.tmp 102 PID 2584 wrote to memory of 3116 2584 9606.tmp 102 PID 2584 wrote to memory of 3116 2584 9606.tmp 102 PID 3116 wrote to memory of 1356 3116 9673.tmp 103 PID 3116 wrote to memory of 1356 3116 9673.tmp 103 PID 3116 wrote to memory of 1356 3116 9673.tmp 103 PID 1356 wrote to memory of 2136 1356 96C2.tmp 104 PID 1356 wrote to memory of 2136 1356 96C2.tmp 104 PID 1356 wrote to memory of 2136 1356 96C2.tmp 104 PID 2136 wrote to memory of 1696 2136 971F.tmp 105 PID 2136 wrote to memory of 1696 2136 971F.tmp 105 PID 2136 wrote to memory of 1696 2136 971F.tmp 105 PID 1696 wrote to memory of 2088 1696 979C.tmp 106 PID 1696 wrote to memory of 2088 1696 979C.tmp 106 PID 1696 wrote to memory of 2088 1696 979C.tmp 106 PID 2088 wrote to memory of 4576 2088 97FA.tmp 107 PID 2088 wrote to memory of 4576 2088 97FA.tmp 107 PID 2088 wrote to memory of 4576 2088 97FA.tmp 107 PID 4576 wrote to memory of 4652 4576 9858.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-15_d96d6e372f03b095eeec97430226066b_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-15_d96d6e372f03b095eeec97430226066b_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\9049.tmp"C:\Users\Admin\AppData\Local\Temp\9049.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\90C6.tmp"C:\Users\Admin\AppData\Local\Temp\90C6.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\9143.tmp"C:\Users\Admin\AppData\Local\Temp\9143.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Users\Admin\AppData\Local\Temp\91C0.tmp"C:\Users\Admin\AppData\Local\Temp\91C0.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\922E.tmp"C:\Users\Admin\AppData\Local\Temp\922E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\92AB.tmp"C:\Users\Admin\AppData\Local\Temp\92AB.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\9318.tmp"C:\Users\Admin\AppData\Local\Temp\9318.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\9395.tmp"C:\Users\Admin\AppData\Local\Temp\9395.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\9412.tmp"C:\Users\Admin\AppData\Local\Temp\9412.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\949F.tmp"C:\Users\Admin\AppData\Local\Temp\949F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\94FC.tmp"C:\Users\Admin\AppData\Local\Temp\94FC.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\955A.tmp"C:\Users\Admin\AppData\Local\Temp\955A.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\95A8.tmp"C:\Users\Admin\AppData\Local\Temp\95A8.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\9606.tmp"C:\Users\Admin\AppData\Local\Temp\9606.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\9673.tmp"C:\Users\Admin\AppData\Local\Temp\9673.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\96C2.tmp"C:\Users\Admin\AppData\Local\Temp\96C2.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\971F.tmp"C:\Users\Admin\AppData\Local\Temp\971F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\979C.tmp"C:\Users\Admin\AppData\Local\Temp\979C.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\97FA.tmp"C:\Users\Admin\AppData\Local\Temp\97FA.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\9858.tmp"C:\Users\Admin\AppData\Local\Temp\9858.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\98D5.tmp"C:\Users\Admin\AppData\Local\Temp\98D5.tmp"23⤵
- Executes dropped EXE
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\9952.tmp"C:\Users\Admin\AppData\Local\Temp\9952.tmp"24⤵
- Executes dropped EXE
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\99DE.tmp"C:\Users\Admin\AppData\Local\Temp\99DE.tmp"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"26⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"27⤵
- Executes dropped EXE
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"29⤵
- Executes dropped EXE
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"30⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"31⤵
- Executes dropped EXE
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"32⤵
- Executes dropped EXE
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"33⤵
- Executes dropped EXE
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\9D88.tmp"C:\Users\Admin\AppData\Local\Temp\9D88.tmp"34⤵
- Executes dropped EXE
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"35⤵
- Executes dropped EXE
PID:440 -
C:\Users\Admin\AppData\Local\Temp\9E34.tmp"C:\Users\Admin\AppData\Local\Temp\9E34.tmp"36⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\9E92.tmp"C:\Users\Admin\AppData\Local\Temp\9E92.tmp"37⤵
- Executes dropped EXE
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"38⤵
- Executes dropped EXE
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"39⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"40⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"41⤵
- Executes dropped EXE
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\A037.tmp"C:\Users\Admin\AppData\Local\Temp\A037.tmp"42⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"43⤵
- Executes dropped EXE
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\A103.tmp"C:\Users\Admin\AppData\Local\Temp\A103.tmp"44⤵
- Executes dropped EXE
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\A170.tmp"C:\Users\Admin\AppData\Local\Temp\A170.tmp"45⤵
- Executes dropped EXE
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"46⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\A24B.tmp"C:\Users\Admin\AppData\Local\Temp\A24B.tmp"47⤵
- Executes dropped EXE
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"48⤵
- Executes dropped EXE
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\A316.tmp"C:\Users\Admin\AppData\Local\Temp\A316.tmp"49⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\A364.tmp"C:\Users\Admin\AppData\Local\Temp\A364.tmp"50⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"51⤵
- Executes dropped EXE
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\A400.tmp"C:\Users\Admin\AppData\Local\Temp\A400.tmp"52⤵
- Executes dropped EXE
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\A44E.tmp"C:\Users\Admin\AppData\Local\Temp\A44E.tmp"53⤵
- Executes dropped EXE
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"54⤵
- Executes dropped EXE
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\A50A.tmp"C:\Users\Admin\AppData\Local\Temp\A50A.tmp"55⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\A558.tmp"C:\Users\Admin\AppData\Local\Temp\A558.tmp"56⤵
- Executes dropped EXE
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"57⤵
- Executes dropped EXE
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\A623.tmp"C:\Users\Admin\AppData\Local\Temp\A623.tmp"58⤵
- Executes dropped EXE
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\A681.tmp"C:\Users\Admin\AppData\Local\Temp\A681.tmp"59⤵
- Executes dropped EXE
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"60⤵
- Executes dropped EXE
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\A74C.tmp"C:\Users\Admin\AppData\Local\Temp\A74C.tmp"61⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\A79A.tmp"C:\Users\Admin\AppData\Local\Temp\A79A.tmp"62⤵
- Executes dropped EXE
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\A807.tmp"C:\Users\Admin\AppData\Local\Temp\A807.tmp"63⤵
- Executes dropped EXE
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\A865.tmp"C:\Users\Admin\AppData\Local\Temp\A865.tmp"64⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"65⤵
- Executes dropped EXE
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\A911.tmp"C:\Users\Admin\AppData\Local\Temp\A911.tmp"66⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\A95F.tmp"C:\Users\Admin\AppData\Local\Temp\A95F.tmp"67⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"68⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"69⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\AA78.tmp"C:\Users\Admin\AppData\Local\Temp\AA78.tmp"70⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"71⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\AB24.tmp"C:\Users\Admin\AppData\Local\Temp\AB24.tmp"72⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\AB72.tmp"C:\Users\Admin\AppData\Local\Temp\AB72.tmp"73⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"74⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"75⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"76⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"77⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\AD28.tmp"C:\Users\Admin\AppData\Local\Temp\AD28.tmp"78⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\AD86.tmp"C:\Users\Admin\AppData\Local\Temp\AD86.tmp"79⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"80⤵
- System Location Discovery: System Language Discovery
PID:756 -
C:\Users\Admin\AppData\Local\Temp\AE41.tmp"C:\Users\Admin\AppData\Local\Temp\AE41.tmp"81⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"82⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"83⤵
- System Location Discovery: System Language Discovery
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"84⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"85⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\B016.tmp"C:\Users\Admin\AppData\Local\Temp\B016.tmp"86⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\B074.tmp"C:\Users\Admin\AppData\Local\Temp\B074.tmp"87⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"88⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\B13F.tmp"C:\Users\Admin\AppData\Local\Temp\B13F.tmp"89⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\B19D.tmp"C:\Users\Admin\AppData\Local\Temp\B19D.tmp"90⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"91⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\B258.tmp"C:\Users\Admin\AppData\Local\Temp\B258.tmp"92⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"93⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\B333.tmp"C:\Users\Admin\AppData\Local\Temp\B333.tmp"94⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\B391.tmp"C:\Users\Admin\AppData\Local\Temp\B391.tmp"95⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"96⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\B43C.tmp"C:\Users\Admin\AppData\Local\Temp\B43C.tmp"97⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\B49A.tmp"C:\Users\Admin\AppData\Local\Temp\B49A.tmp"98⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"99⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\B556.tmp"C:\Users\Admin\AppData\Local\Temp\B556.tmp"100⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"101⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"102⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\B650.tmp"C:\Users\Admin\AppData\Local\Temp\B650.tmp"103⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"104⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\B70B.tmp"C:\Users\Admin\AppData\Local\Temp\B70B.tmp"105⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\B759.tmp"C:\Users\Admin\AppData\Local\Temp\B759.tmp"106⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"107⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\B815.tmp"C:\Users\Admin\AppData\Local\Temp\B815.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\B873.tmp"C:\Users\Admin\AppData\Local\Temp\B873.tmp"109⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\B8D0.tmp"C:\Users\Admin\AppData\Local\Temp\B8D0.tmp"110⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\B92E.tmp"C:\Users\Admin\AppData\Local\Temp\B92E.tmp"111⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\B98C.tmp"C:\Users\Admin\AppData\Local\Temp\B98C.tmp"112⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"113⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\BA47.tmp"C:\Users\Admin\AppData\Local\Temp\BA47.tmp"114⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\BA95.tmp"C:\Users\Admin\AppData\Local\Temp\BA95.tmp"115⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"116⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\BB41.tmp"C:\Users\Admin\AppData\Local\Temp\BB41.tmp"117⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"118⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"119⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"120⤵PID:428
-
C:\Users\Admin\AppData\Local\Temp\BC99.tmp"C:\Users\Admin\AppData\Local\Temp\BC99.tmp"121⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\BCF7.tmp"C:\Users\Admin\AppData\Local\Temp\BCF7.tmp"122⤵PID:1780
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-