Analysis
-
max time kernel
150s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
21/03/2025, 08:01
Static task
static1
Behavioral task
behavioral1
Sample
2025-03-21_a28efdd060f7d3a20efda96ceaf12601_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2025-03-21_a28efdd060f7d3a20efda96ceaf12601_mafia.exe
Resource
win10v2004-20250314-en
General
-
Target
2025-03-21_a28efdd060f7d3a20efda96ceaf12601_mafia.exe
-
Size
520KB
-
MD5
a28efdd060f7d3a20efda96ceaf12601
-
SHA1
ee6ed9e2ace7e27487b60b5c326881ebe090f7d7
-
SHA256
7ceb7acbb3f07bd4f7e5987d69a43c19efd4b89d54b159c9740b3eb4e7950a04
-
SHA512
ef5db4a5defd196e222b6f6feb5ffaad9d3f0e6fb600da224f13358facc8d2225d6a0796e23b063bbc3aee4c882e237a84be32ee09c2f74ca1709f6fe0d83a7e
-
SSDEEP
12288:roRXOQjmOyrk0Ka2FW823TYKCvGkWYc05NZ:rogQ9yZb9TKOkWYcyN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 5800 80D8.tmp 5772 8155.tmp 3816 81B3.tmp 3284 8220.tmp 4404 829D.tmp 3328 82FB.tmp 5636 8378.tmp 3208 83E5.tmp 4120 8434.tmp 2688 84A1.tmp 3564 84FF.tmp 3424 855C.tmp 4540 85D9.tmp 4508 8656.tmp 4624 86D3.tmp 4656 8731.tmp 4756 87AE.tmp 4692 882B.tmp 4388 8889.tmp 3088 88E7.tmp 5944 8964.tmp 4620 89B2.tmp 856 8A10.tmp 3488 8A6D.tmp 4960 8ADB.tmp 4884 8B58.tmp 4892 8BD5.tmp 5020 8C32.tmp 4812 8C90.tmp 4344 8D0D.tmp 5720 8D5B.tmp 2532 8DC9.tmp 5556 8E36.tmp 3724 8E84.tmp 2344 8EF2.tmp 3528 8F4F.tmp 1520 8F9D.tmp 3552 8FEC.tmp 4244 903A.tmp 3024 9088.tmp 2676 90E6.tmp 3628 9134.tmp 3104 9182.tmp 2004 91D0.tmp 876 921E.tmp 2948 926C.tmp 4148 92BA.tmp 2988 9308.tmp 6088 9357.tmp 5852 93B4.tmp 5124 9402.tmp 2140 9451.tmp 5220 949F.tmp 1376 94ED.tmp 380 953B.tmp 1512 9589.tmp 1616 95E7.tmp 5388 9635.tmp 5328 9673.tmp 2580 96C2.tmp 1588 971F.tmp 2368 976D.tmp 3108 97BC.tmp 5620 980A.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC4D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C66D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCBF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2575.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7039.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A236.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F935.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3091.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D90A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F155.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9357.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3350.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA64.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4220 wrote to memory of 5800 4220 2025-03-21_a28efdd060f7d3a20efda96ceaf12601_mafia.exe 86 PID 4220 wrote to memory of 5800 4220 2025-03-21_a28efdd060f7d3a20efda96ceaf12601_mafia.exe 86 PID 4220 wrote to memory of 5800 4220 2025-03-21_a28efdd060f7d3a20efda96ceaf12601_mafia.exe 86 PID 5800 wrote to memory of 5772 5800 80D8.tmp 88 PID 5800 wrote to memory of 5772 5800 80D8.tmp 88 PID 5800 wrote to memory of 5772 5800 80D8.tmp 88 PID 5772 wrote to memory of 3816 5772 8155.tmp 89 PID 5772 wrote to memory of 3816 5772 8155.tmp 89 PID 5772 wrote to memory of 3816 5772 8155.tmp 89 PID 3816 wrote to memory of 3284 3816 81B3.tmp 91 PID 3816 wrote to memory of 3284 3816 81B3.tmp 91 PID 3816 wrote to memory of 3284 3816 81B3.tmp 91 PID 3284 wrote to memory of 4404 3284 8220.tmp 92 PID 3284 wrote to memory of 4404 3284 8220.tmp 92 PID 3284 wrote to memory of 4404 3284 8220.tmp 92 PID 4404 wrote to memory of 3328 4404 829D.tmp 93 PID 4404 wrote to memory of 3328 4404 829D.tmp 93 PID 4404 wrote to memory of 3328 4404 829D.tmp 93 PID 3328 wrote to memory of 5636 3328 82FB.tmp 94 PID 3328 wrote to memory of 5636 3328 82FB.tmp 94 PID 3328 wrote to memory of 5636 3328 82FB.tmp 94 PID 5636 wrote to memory of 3208 5636 8378.tmp 95 PID 5636 wrote to memory of 3208 5636 8378.tmp 95 PID 5636 wrote to memory of 3208 5636 8378.tmp 95 PID 3208 wrote to memory of 4120 3208 83E5.tmp 96 PID 3208 wrote to memory of 4120 3208 83E5.tmp 96 PID 3208 wrote to memory of 4120 3208 83E5.tmp 96 PID 4120 wrote to memory of 2688 4120 8434.tmp 97 PID 4120 wrote to memory of 2688 4120 8434.tmp 97 PID 4120 wrote to memory of 2688 4120 8434.tmp 97 PID 2688 wrote to memory of 3564 2688 84A1.tmp 98 PID 2688 wrote to memory of 3564 2688 84A1.tmp 98 PID 2688 wrote to memory of 3564 2688 84A1.tmp 98 PID 3564 wrote to memory of 3424 3564 84FF.tmp 99 PID 3564 wrote to memory of 3424 3564 84FF.tmp 99 PID 3564 wrote to memory of 3424 3564 84FF.tmp 99 PID 3424 wrote to memory of 4540 3424 855C.tmp 100 PID 3424 wrote to memory of 4540 3424 855C.tmp 100 PID 3424 wrote to memory of 4540 3424 855C.tmp 100 PID 4540 wrote to memory of 4508 4540 85D9.tmp 101 PID 4540 wrote to memory of 4508 4540 85D9.tmp 101 PID 4540 wrote to memory of 4508 4540 85D9.tmp 101 PID 4508 wrote to memory of 4624 4508 8656.tmp 102 PID 4508 wrote to memory of 4624 4508 8656.tmp 102 PID 4508 wrote to memory of 4624 4508 8656.tmp 102 PID 4624 wrote to memory of 4656 4624 86D3.tmp 103 PID 4624 wrote to memory of 4656 4624 86D3.tmp 103 PID 4624 wrote to memory of 4656 4624 86D3.tmp 103 PID 4656 wrote to memory of 4756 4656 8731.tmp 104 PID 4656 wrote to memory of 4756 4656 8731.tmp 104 PID 4656 wrote to memory of 4756 4656 8731.tmp 104 PID 4756 wrote to memory of 4692 4756 87AE.tmp 105 PID 4756 wrote to memory of 4692 4756 87AE.tmp 105 PID 4756 wrote to memory of 4692 4756 87AE.tmp 105 PID 4692 wrote to memory of 4388 4692 882B.tmp 106 PID 4692 wrote to memory of 4388 4692 882B.tmp 106 PID 4692 wrote to memory of 4388 4692 882B.tmp 106 PID 4388 wrote to memory of 3088 4388 8889.tmp 107 PID 4388 wrote to memory of 3088 4388 8889.tmp 107 PID 4388 wrote to memory of 3088 4388 8889.tmp 107 PID 3088 wrote to memory of 5944 3088 88E7.tmp 108 PID 3088 wrote to memory of 5944 3088 88E7.tmp 108 PID 3088 wrote to memory of 5944 3088 88E7.tmp 108 PID 5944 wrote to memory of 4620 5944 8964.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-03-21_a28efdd060f7d3a20efda96ceaf12601_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-21_a28efdd060f7d3a20efda96ceaf12601_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\80D8.tmp"C:\Users\Admin\AppData\Local\Temp\80D8.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\Users\Admin\AppData\Local\Temp\8155.tmp"C:\Users\Admin\AppData\Local\Temp\8155.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5772 -
C:\Users\Admin\AppData\Local\Temp\81B3.tmp"C:\Users\Admin\AppData\Local\Temp\81B3.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\8220.tmp"C:\Users\Admin\AppData\Local\Temp\8220.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\829D.tmp"C:\Users\Admin\AppData\Local\Temp\829D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\82FB.tmp"C:\Users\Admin\AppData\Local\Temp\82FB.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\8378.tmp"C:\Users\Admin\AppData\Local\Temp\8378.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5636 -
C:\Users\Admin\AppData\Local\Temp\83E5.tmp"C:\Users\Admin\AppData\Local\Temp\83E5.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\8434.tmp"C:\Users\Admin\AppData\Local\Temp\8434.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\84A1.tmp"C:\Users\Admin\AppData\Local\Temp\84A1.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\84FF.tmp"C:\Users\Admin\AppData\Local\Temp\84FF.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\855C.tmp"C:\Users\Admin\AppData\Local\Temp\855C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\85D9.tmp"C:\Users\Admin\AppData\Local\Temp\85D9.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\8656.tmp"C:\Users\Admin\AppData\Local\Temp\8656.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\86D3.tmp"C:\Users\Admin\AppData\Local\Temp\86D3.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\8731.tmp"C:\Users\Admin\AppData\Local\Temp\8731.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\87AE.tmp"C:\Users\Admin\AppData\Local\Temp\87AE.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\882B.tmp"C:\Users\Admin\AppData\Local\Temp\882B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\8889.tmp"C:\Users\Admin\AppData\Local\Temp\8889.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\88E7.tmp"C:\Users\Admin\AppData\Local\Temp\88E7.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\8964.tmp"C:\Users\Admin\AppData\Local\Temp\8964.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Users\Admin\AppData\Local\Temp\89B2.tmp"C:\Users\Admin\AppData\Local\Temp\89B2.tmp"23⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\8A10.tmp"C:\Users\Admin\AppData\Local\Temp\8A10.tmp"24⤵
- Executes dropped EXE
PID:856 -
C:\Users\Admin\AppData\Local\Temp\8A6D.tmp"C:\Users\Admin\AppData\Local\Temp\8A6D.tmp"25⤵
- Executes dropped EXE
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"26⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\8B58.tmp"C:\Users\Admin\AppData\Local\Temp\8B58.tmp"27⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"28⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\8C32.tmp"C:\Users\Admin\AppData\Local\Temp\8C32.tmp"29⤵
- Executes dropped EXE
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\8C90.tmp"C:\Users\Admin\AppData\Local\Temp\8C90.tmp"30⤵
- Executes dropped EXE
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"31⤵
- Executes dropped EXE
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\8D5B.tmp"C:\Users\Admin\AppData\Local\Temp\8D5B.tmp"32⤵
- Executes dropped EXE
PID:5720 -
C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"33⤵
- Executes dropped EXE
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\8E36.tmp"C:\Users\Admin\AppData\Local\Temp\8E36.tmp"34⤵
- Executes dropped EXE
PID:5556 -
C:\Users\Admin\AppData\Local\Temp\8E84.tmp"C:\Users\Admin\AppData\Local\Temp\8E84.tmp"35⤵
- Executes dropped EXE
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"36⤵
- Executes dropped EXE
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"37⤵
- Executes dropped EXE
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"38⤵
- Executes dropped EXE
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"39⤵
- Executes dropped EXE
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\903A.tmp"C:\Users\Admin\AppData\Local\Temp\903A.tmp"40⤵
- Executes dropped EXE
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\9088.tmp"C:\Users\Admin\AppData\Local\Temp\9088.tmp"41⤵
- Executes dropped EXE
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\90E6.tmp"C:\Users\Admin\AppData\Local\Temp\90E6.tmp"42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\9134.tmp"C:\Users\Admin\AppData\Local\Temp\9134.tmp"43⤵
- Executes dropped EXE
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\9182.tmp"C:\Users\Admin\AppData\Local\Temp\9182.tmp"44⤵
- Executes dropped EXE
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\91D0.tmp"C:\Users\Admin\AppData\Local\Temp\91D0.tmp"45⤵
- Executes dropped EXE
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\921E.tmp"C:\Users\Admin\AppData\Local\Temp\921E.tmp"46⤵
- Executes dropped EXE
PID:876 -
C:\Users\Admin\AppData\Local\Temp\926C.tmp"C:\Users\Admin\AppData\Local\Temp\926C.tmp"47⤵
- Executes dropped EXE
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\92BA.tmp"C:\Users\Admin\AppData\Local\Temp\92BA.tmp"48⤵
- Executes dropped EXE
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\9308.tmp"C:\Users\Admin\AppData\Local\Temp\9308.tmp"49⤵
- Executes dropped EXE
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\9357.tmp"C:\Users\Admin\AppData\Local\Temp\9357.tmp"50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6088 -
C:\Users\Admin\AppData\Local\Temp\93B4.tmp"C:\Users\Admin\AppData\Local\Temp\93B4.tmp"51⤵
- Executes dropped EXE
PID:5852 -
C:\Users\Admin\AppData\Local\Temp\9402.tmp"C:\Users\Admin\AppData\Local\Temp\9402.tmp"52⤵
- Executes dropped EXE
PID:5124 -
C:\Users\Admin\AppData\Local\Temp\9451.tmp"C:\Users\Admin\AppData\Local\Temp\9451.tmp"53⤵
- Executes dropped EXE
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\949F.tmp"C:\Users\Admin\AppData\Local\Temp\949F.tmp"54⤵
- Executes dropped EXE
PID:5220 -
C:\Users\Admin\AppData\Local\Temp\94ED.tmp"C:\Users\Admin\AppData\Local\Temp\94ED.tmp"55⤵
- Executes dropped EXE
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\953B.tmp"C:\Users\Admin\AppData\Local\Temp\953B.tmp"56⤵
- Executes dropped EXE
PID:380 -
C:\Users\Admin\AppData\Local\Temp\9589.tmp"C:\Users\Admin\AppData\Local\Temp\9589.tmp"57⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\95E7.tmp"C:\Users\Admin\AppData\Local\Temp\95E7.tmp"58⤵
- Executes dropped EXE
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\9635.tmp"C:\Users\Admin\AppData\Local\Temp\9635.tmp"59⤵
- Executes dropped EXE
PID:5388 -
C:\Users\Admin\AppData\Local\Temp\9673.tmp"C:\Users\Admin\AppData\Local\Temp\9673.tmp"60⤵
- Executes dropped EXE
PID:5328 -
C:\Users\Admin\AppData\Local\Temp\96C2.tmp"C:\Users\Admin\AppData\Local\Temp\96C2.tmp"61⤵
- Executes dropped EXE
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\971F.tmp"C:\Users\Admin\AppData\Local\Temp\971F.tmp"62⤵
- Executes dropped EXE
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\976D.tmp"C:\Users\Admin\AppData\Local\Temp\976D.tmp"63⤵
- Executes dropped EXE
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\97BC.tmp"C:\Users\Admin\AppData\Local\Temp\97BC.tmp"64⤵
- Executes dropped EXE
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\980A.tmp"C:\Users\Admin\AppData\Local\Temp\980A.tmp"65⤵
- Executes dropped EXE
PID:5620 -
C:\Users\Admin\AppData\Local\Temp\9858.tmp"C:\Users\Admin\AppData\Local\Temp\9858.tmp"66⤵PID:5860
-
C:\Users\Admin\AppData\Local\Temp\98A6.tmp"C:\Users\Admin\AppData\Local\Temp\98A6.tmp"67⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\98F4.tmp"C:\Users\Admin\AppData\Local\Temp\98F4.tmp"68⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\9942.tmp"C:\Users\Admin\AppData\Local\Temp\9942.tmp"69⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\9990.tmp"C:\Users\Admin\AppData\Local\Temp\9990.tmp"70⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\99EE.tmp"C:\Users\Admin\AppData\Local\Temp\99EE.tmp"71⤵PID:5152
-
C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"72⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"73⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"74⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"75⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\9B94.tmp"C:\Users\Admin\AppData\Local\Temp\9B94.tmp"76⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"77⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\9C30.tmp"C:\Users\Admin\AppData\Local\Temp\9C30.tmp"78⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"79⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"80⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"81⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\9D59.tmp"C:\Users\Admin\AppData\Local\Temp\9D59.tmp"82⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\9DB7.tmp"C:\Users\Admin\AppData\Local\Temp\9DB7.tmp"83⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\9E05.tmp"C:\Users\Admin\AppData\Local\Temp\9E05.tmp"84⤵PID:5868
-
C:\Users\Admin\AppData\Local\Temp\9E53.tmp"C:\Users\Admin\AppData\Local\Temp\9E53.tmp"85⤵PID:6092
-
C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"86⤵PID:5212
-
C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"87⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"88⤵PID:5836
-
C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"89⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"90⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\A057.tmp"C:\Users\Admin\AppData\Local\Temp\A057.tmp"91⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"92⤵PID:6056
-
C:\Users\Admin\AppData\Local\Temp\A103.tmp"C:\Users\Admin\AppData\Local\Temp\A103.tmp"93⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\A151.tmp"C:\Users\Admin\AppData\Local\Temp\A151.tmp"94⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"95⤵PID:5472
-
C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"96⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\A24B.tmp"C:\Users\Admin\AppData\Local\Temp\A24B.tmp"97⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\A299.tmp"C:\Users\Admin\AppData\Local\Temp\A299.tmp"98⤵PID:5380
-
C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"99⤵PID:6080
-
C:\Users\Admin\AppData\Local\Temp\A345.tmp"C:\Users\Admin\AppData\Local\Temp\A345.tmp"100⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"101⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"102⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\A44E.tmp"C:\Users\Admin\AppData\Local\Temp\A44E.tmp"103⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\A49C.tmp"C:\Users\Admin\AppData\Local\Temp\A49C.tmp"104⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"105⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\A548.tmp"C:\Users\Admin\AppData\Local\Temp\A548.tmp"106⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\A5A6.tmp"C:\Users\Admin\AppData\Local\Temp\A5A6.tmp"107⤵PID:5280
-
C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"108⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\A642.tmp"C:\Users\Admin\AppData\Local\Temp\A642.tmp"109⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\A690.tmp"C:\Users\Admin\AppData\Local\Temp\A690.tmp"110⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"111⤵
- System Location Discovery: System Language Discovery
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\A73C.tmp"C:\Users\Admin\AppData\Local\Temp\A73C.tmp"112⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\A79A.tmp"C:\Users\Admin\AppData\Local\Temp\A79A.tmp"113⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"114⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\A846.tmp"C:\Users\Admin\AppData\Local\Temp\A846.tmp"115⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\A894.tmp"C:\Users\Admin\AppData\Local\Temp\A894.tmp"116⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"117⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\A930.tmp"C:\Users\Admin\AppData\Local\Temp\A930.tmp"118⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\A98E.tmp"C:\Users\Admin\AppData\Local\Temp\A98E.tmp"119⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"120⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"121⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\AA78.tmp"C:\Users\Admin\AppData\Local\Temp\AA78.tmp"122⤵PID:4388
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-