Analysis
-
max time kernel
150s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/08/2024, 08:00
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-05_9010a949f27f39055a6cdd99440ca344_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-08-05_9010a949f27f39055a6cdd99440ca344_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-05_9010a949f27f39055a6cdd99440ca344_mafia.exe
-
Size
486KB
-
MD5
9010a949f27f39055a6cdd99440ca344
-
SHA1
1fee8f3ee03586c6e1cf825c6b31c29861cea26c
-
SHA256
8933f1f3a0fd2950c0014cc6a3eee4c97b4fc2096287edcaf2b81804a9634209
-
SHA512
645529762efb671999b6864e6dbd4d1b5f0f86f2eeeacf69cad517a31a87afe88a31700e822837a808d20ee7b7b48251e8ff44cd2f1d398371cbc5fce48134e7
-
SSDEEP
12288:/U5rCOTeiD8CeBwmJimEpilA1hryyOeNZ:/UQOJDXmEpikryyOeN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1916 5B69.tmp 4812 5BE6.tmp 2412 5C44.tmp 1780 5CD1.tmp 964 5D7D.tmp 3588 5DEA.tmp 4680 5E57.tmp 3372 5ED4.tmp 2180 5F61.tmp 4064 5FBF.tmp 1448 606B.tmp 4776 60E8.tmp 2832 6155.tmp 828 61E2.tmp 3688 625F.tmp 3704 62EB.tmp 4796 6378.tmp 4284 63D6.tmp 876 6443.tmp 4420 64A1.tmp 3716 653D.tmp 3616 65AA.tmp 3744 6618.tmp 5000 6685.tmp 452 66E3.tmp 4056 6750.tmp 1864 67CD.tmp 2008 685A.tmp 4268 68C7.tmp 1320 6963.tmp 396 69F0.tmp 1916 6A5D.tmp 2808 6AEA.tmp 3188 6B57.tmp 2032 6BA6.tmp 4564 6BF4.tmp 2952 6C51.tmp 2888 6CA0.tmp 964 6CFD.tmp 676 6D4B.tmp 3588 6DB9.tmp 692 6E07.tmp 4440 6E65.tmp 4504 6EC2.tmp 1528 6F11.tmp 4968 6F5F.tmp 4600 6FCC.tmp 948 702A.tmp 1660 7097.tmp 4276 7105.tmp 3876 7172.tmp 2564 71C0.tmp 2020 721E.tmp 3688 728B.tmp 1728 72D9.tmp 1460 7327.tmp 3984 7376.tmp 3456 73D3.tmp 876 7431.tmp 3092 747F.tmp 2216 74DD.tmp 1704 753B.tmp 544 7598.tmp 1516 75E7.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C58.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7630.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B491.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F325.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C450.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C05D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DF7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A004.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 553A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9381.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3109.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D378.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 207E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C196.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B09E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 229.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5FBF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C0A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C152.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C4BD.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1320 wrote to memory of 1916 1320 2024-08-05_9010a949f27f39055a6cdd99440ca344_mafia.exe 91 PID 1320 wrote to memory of 1916 1320 2024-08-05_9010a949f27f39055a6cdd99440ca344_mafia.exe 91 PID 1320 wrote to memory of 1916 1320 2024-08-05_9010a949f27f39055a6cdd99440ca344_mafia.exe 91 PID 1916 wrote to memory of 4812 1916 5B69.tmp 92 PID 1916 wrote to memory of 4812 1916 5B69.tmp 92 PID 1916 wrote to memory of 4812 1916 5B69.tmp 92 PID 4812 wrote to memory of 2412 4812 5BE6.tmp 94 PID 4812 wrote to memory of 2412 4812 5BE6.tmp 94 PID 4812 wrote to memory of 2412 4812 5BE6.tmp 94 PID 2412 wrote to memory of 1780 2412 5C44.tmp 95 PID 2412 wrote to memory of 1780 2412 5C44.tmp 95 PID 2412 wrote to memory of 1780 2412 5C44.tmp 95 PID 1780 wrote to memory of 964 1780 5CD1.tmp 97 PID 1780 wrote to memory of 964 1780 5CD1.tmp 97 PID 1780 wrote to memory of 964 1780 5CD1.tmp 97 PID 964 wrote to memory of 3588 964 5D7D.tmp 98 PID 964 wrote to memory of 3588 964 5D7D.tmp 98 PID 964 wrote to memory of 3588 964 5D7D.tmp 98 PID 3588 wrote to memory of 4680 3588 5DEA.tmp 99 PID 3588 wrote to memory of 4680 3588 5DEA.tmp 99 PID 3588 wrote to memory of 4680 3588 5DEA.tmp 99 PID 4680 wrote to memory of 3372 4680 5E57.tmp 100 PID 4680 wrote to memory of 3372 4680 5E57.tmp 100 PID 4680 wrote to memory of 3372 4680 5E57.tmp 100 PID 3372 wrote to memory of 2180 3372 5ED4.tmp 101 PID 3372 wrote to memory of 2180 3372 5ED4.tmp 101 PID 3372 wrote to memory of 2180 3372 5ED4.tmp 101 PID 2180 wrote to memory of 4064 2180 5F61.tmp 102 PID 2180 wrote to memory of 4064 2180 5F61.tmp 102 PID 2180 wrote to memory of 4064 2180 5F61.tmp 102 PID 4064 wrote to memory of 1448 4064 5FBF.tmp 103 PID 4064 wrote to memory of 1448 4064 5FBF.tmp 103 PID 4064 wrote to memory of 1448 4064 5FBF.tmp 103 PID 1448 wrote to memory of 4776 1448 606B.tmp 104 PID 1448 wrote to memory of 4776 1448 606B.tmp 104 PID 1448 wrote to memory of 4776 1448 606B.tmp 104 PID 4776 wrote to memory of 2832 4776 60E8.tmp 105 PID 4776 wrote to memory of 2832 4776 60E8.tmp 105 PID 4776 wrote to memory of 2832 4776 60E8.tmp 105 PID 2832 wrote to memory of 828 2832 6155.tmp 106 PID 2832 wrote to memory of 828 2832 6155.tmp 106 PID 2832 wrote to memory of 828 2832 6155.tmp 106 PID 828 wrote to memory of 3688 828 61E2.tmp 107 PID 828 wrote to memory of 3688 828 61E2.tmp 107 PID 828 wrote to memory of 3688 828 61E2.tmp 107 PID 3688 wrote to memory of 3704 3688 625F.tmp 108 PID 3688 wrote to memory of 3704 3688 625F.tmp 108 PID 3688 wrote to memory of 3704 3688 625F.tmp 108 PID 3704 wrote to memory of 4796 3704 62EB.tmp 109 PID 3704 wrote to memory of 4796 3704 62EB.tmp 109 PID 3704 wrote to memory of 4796 3704 62EB.tmp 109 PID 4796 wrote to memory of 4284 4796 6378.tmp 110 PID 4796 wrote to memory of 4284 4796 6378.tmp 110 PID 4796 wrote to memory of 4284 4796 6378.tmp 110 PID 4284 wrote to memory of 876 4284 63D6.tmp 111 PID 4284 wrote to memory of 876 4284 63D6.tmp 111 PID 4284 wrote to memory of 876 4284 63D6.tmp 111 PID 876 wrote to memory of 4420 876 6443.tmp 112 PID 876 wrote to memory of 4420 876 6443.tmp 112 PID 876 wrote to memory of 4420 876 6443.tmp 112 PID 4420 wrote to memory of 3716 4420 64A1.tmp 113 PID 4420 wrote to memory of 3716 4420 64A1.tmp 113 PID 4420 wrote to memory of 3716 4420 64A1.tmp 113 PID 3716 wrote to memory of 3616 3716 653D.tmp 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-05_9010a949f27f39055a6cdd99440ca344_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-05_9010a949f27f39055a6cdd99440ca344_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\5B69.tmp"C:\Users\Admin\AppData\Local\Temp\5B69.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\5BE6.tmp"C:\Users\Admin\AppData\Local\Temp\5BE6.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\5C44.tmp"C:\Users\Admin\AppData\Local\Temp\5C44.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\5CD1.tmp"C:\Users\Admin\AppData\Local\Temp\5CD1.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\5D7D.tmp"C:\Users\Admin\AppData\Local\Temp\5D7D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Users\Admin\AppData\Local\Temp\5DEA.tmp"C:\Users\Admin\AppData\Local\Temp\5DEA.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\5E57.tmp"C:\Users\Admin\AppData\Local\Temp\5E57.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\5ED4.tmp"C:\Users\Admin\AppData\Local\Temp\5ED4.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\5F61.tmp"C:\Users\Admin\AppData\Local\Temp\5F61.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\5FBF.tmp"C:\Users\Admin\AppData\Local\Temp\5FBF.tmp"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\606B.tmp"C:\Users\Admin\AppData\Local\Temp\606B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\60E8.tmp"C:\Users\Admin\AppData\Local\Temp\60E8.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\6155.tmp"C:\Users\Admin\AppData\Local\Temp\6155.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\61E2.tmp"C:\Users\Admin\AppData\Local\Temp\61E2.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\625F.tmp"C:\Users\Admin\AppData\Local\Temp\625F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\62EB.tmp"C:\Users\Admin\AppData\Local\Temp\62EB.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\6378.tmp"C:\Users\Admin\AppData\Local\Temp\6378.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\63D6.tmp"C:\Users\Admin\AppData\Local\Temp\63D6.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\6443.tmp"C:\Users\Admin\AppData\Local\Temp\6443.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Users\Admin\AppData\Local\Temp\64A1.tmp"C:\Users\Admin\AppData\Local\Temp\64A1.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\653D.tmp"C:\Users\Admin\AppData\Local\Temp\653D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\65AA.tmp"C:\Users\Admin\AppData\Local\Temp\65AA.tmp"23⤵
- Executes dropped EXE
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\6618.tmp"C:\Users\Admin\AppData\Local\Temp\6618.tmp"24⤵
- Executes dropped EXE
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\6685.tmp"C:\Users\Admin\AppData\Local\Temp\6685.tmp"25⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\66E3.tmp"C:\Users\Admin\AppData\Local\Temp\66E3.tmp"26⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\6750.tmp"C:\Users\Admin\AppData\Local\Temp\6750.tmp"27⤵
- Executes dropped EXE
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\67CD.tmp"C:\Users\Admin\AppData\Local\Temp\67CD.tmp"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\685A.tmp"C:\Users\Admin\AppData\Local\Temp\685A.tmp"29⤵
- Executes dropped EXE
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\68C7.tmp"C:\Users\Admin\AppData\Local\Temp\68C7.tmp"30⤵
- Executes dropped EXE
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\6963.tmp"C:\Users\Admin\AppData\Local\Temp\6963.tmp"31⤵
- Executes dropped EXE
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\69F0.tmp"C:\Users\Admin\AppData\Local\Temp\69F0.tmp"32⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\6A5D.tmp"C:\Users\Admin\AppData\Local\Temp\6A5D.tmp"33⤵
- Executes dropped EXE
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\6AEA.tmp"C:\Users\Admin\AppData\Local\Temp\6AEA.tmp"34⤵
- Executes dropped EXE
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\6B57.tmp"C:\Users\Admin\AppData\Local\Temp\6B57.tmp"35⤵
- Executes dropped EXE
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\6BA6.tmp"C:\Users\Admin\AppData\Local\Temp\6BA6.tmp"36⤵
- Executes dropped EXE
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\6BF4.tmp"C:\Users\Admin\AppData\Local\Temp\6BF4.tmp"37⤵
- Executes dropped EXE
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\6C51.tmp"C:\Users\Admin\AppData\Local\Temp\6C51.tmp"38⤵
- Executes dropped EXE
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\6CA0.tmp"C:\Users\Admin\AppData\Local\Temp\6CA0.tmp"39⤵
- Executes dropped EXE
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\6CFD.tmp"C:\Users\Admin\AppData\Local\Temp\6CFD.tmp"40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:964 -
C:\Users\Admin\AppData\Local\Temp\6D4B.tmp"C:\Users\Admin\AppData\Local\Temp\6D4B.tmp"41⤵
- Executes dropped EXE
PID:676 -
C:\Users\Admin\AppData\Local\Temp\6DB9.tmp"C:\Users\Admin\AppData\Local\Temp\6DB9.tmp"42⤵
- Executes dropped EXE
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\6E07.tmp"C:\Users\Admin\AppData\Local\Temp\6E07.tmp"43⤵
- Executes dropped EXE
PID:692 -
C:\Users\Admin\AppData\Local\Temp\6E65.tmp"C:\Users\Admin\AppData\Local\Temp\6E65.tmp"44⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\6EC2.tmp"C:\Users\Admin\AppData\Local\Temp\6EC2.tmp"45⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\6F11.tmp"C:\Users\Admin\AppData\Local\Temp\6F11.tmp"46⤵
- Executes dropped EXE
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\6F5F.tmp"C:\Users\Admin\AppData\Local\Temp\6F5F.tmp"47⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\6FCC.tmp"C:\Users\Admin\AppData\Local\Temp\6FCC.tmp"48⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\702A.tmp"C:\Users\Admin\AppData\Local\Temp\702A.tmp"49⤵
- Executes dropped EXE
PID:948 -
C:\Users\Admin\AppData\Local\Temp\7097.tmp"C:\Users\Admin\AppData\Local\Temp\7097.tmp"50⤵
- Executes dropped EXE
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\7105.tmp"C:\Users\Admin\AppData\Local\Temp\7105.tmp"51⤵
- Executes dropped EXE
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\7172.tmp"C:\Users\Admin\AppData\Local\Temp\7172.tmp"52⤵
- Executes dropped EXE
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\71C0.tmp"C:\Users\Admin\AppData\Local\Temp\71C0.tmp"53⤵
- Executes dropped EXE
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\721E.tmp"C:\Users\Admin\AppData\Local\Temp\721E.tmp"54⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\728B.tmp"C:\Users\Admin\AppData\Local\Temp\728B.tmp"55⤵
- Executes dropped EXE
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\72D9.tmp"C:\Users\Admin\AppData\Local\Temp\72D9.tmp"56⤵
- Executes dropped EXE
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\7327.tmp"C:\Users\Admin\AppData\Local\Temp\7327.tmp"57⤵
- Executes dropped EXE
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\7376.tmp"C:\Users\Admin\AppData\Local\Temp\7376.tmp"58⤵
- Executes dropped EXE
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\73D3.tmp"C:\Users\Admin\AppData\Local\Temp\73D3.tmp"59⤵
- Executes dropped EXE
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\7431.tmp"C:\Users\Admin\AppData\Local\Temp\7431.tmp"60⤵
- Executes dropped EXE
PID:876 -
C:\Users\Admin\AppData\Local\Temp\747F.tmp"C:\Users\Admin\AppData\Local\Temp\747F.tmp"61⤵
- Executes dropped EXE
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\74DD.tmp"C:\Users\Admin\AppData\Local\Temp\74DD.tmp"62⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\753B.tmp"C:\Users\Admin\AppData\Local\Temp\753B.tmp"63⤵
- Executes dropped EXE
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\7598.tmp"C:\Users\Admin\AppData\Local\Temp\7598.tmp"64⤵
- Executes dropped EXE
PID:544 -
C:\Users\Admin\AppData\Local\Temp\75E7.tmp"C:\Users\Admin\AppData\Local\Temp\75E7.tmp"65⤵
- Executes dropped EXE
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\7635.tmp"C:\Users\Admin\AppData\Local\Temp\7635.tmp"66⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\7692.tmp"C:\Users\Admin\AppData\Local\Temp\7692.tmp"67⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\76F0.tmp"C:\Users\Admin\AppData\Local\Temp\76F0.tmp"68⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\774E.tmp"C:\Users\Admin\AppData\Local\Temp\774E.tmp"69⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\779C.tmp"C:\Users\Admin\AppData\Local\Temp\779C.tmp"70⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\77FA.tmp"C:\Users\Admin\AppData\Local\Temp\77FA.tmp"71⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\7858.tmp"C:\Users\Admin\AppData\Local\Temp\7858.tmp"72⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\78B5.tmp"C:\Users\Admin\AppData\Local\Temp\78B5.tmp"73⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\7923.tmp"C:\Users\Admin\AppData\Local\Temp\7923.tmp"74⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\7980.tmp"C:\Users\Admin\AppData\Local\Temp\7980.tmp"75⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\79CF.tmp"C:\Users\Admin\AppData\Local\Temp\79CF.tmp"76⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\7A1D.tmp"C:\Users\Admin\AppData\Local\Temp\7A1D.tmp"77⤵
- System Location Discovery: System Language Discovery
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\7A6B.tmp"C:\Users\Admin\AppData\Local\Temp\7A6B.tmp"78⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\7AD8.tmp"C:\Users\Admin\AppData\Local\Temp\7AD8.tmp"79⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\7B36.tmp"C:\Users\Admin\AppData\Local\Temp\7B36.tmp"80⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\7B94.tmp"C:\Users\Admin\AppData\Local\Temp\7B94.tmp"81⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\7BF1.tmp"C:\Users\Admin\AppData\Local\Temp\7BF1.tmp"82⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\7C4F.tmp"C:\Users\Admin\AppData\Local\Temp\7C4F.tmp"83⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\7C9D.tmp"C:\Users\Admin\AppData\Local\Temp\7C9D.tmp"84⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\7D0B.tmp"C:\Users\Admin\AppData\Local\Temp\7D0B.tmp"85⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\7D59.tmp"C:\Users\Admin\AppData\Local\Temp\7D59.tmp"86⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\7DC6.tmp"C:\Users\Admin\AppData\Local\Temp\7DC6.tmp"87⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\7E24.tmp"C:\Users\Admin\AppData\Local\Temp\7E24.tmp"88⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\7E91.tmp"C:\Users\Admin\AppData\Local\Temp\7E91.tmp"89⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\7EDF.tmp"C:\Users\Admin\AppData\Local\Temp\7EDF.tmp"90⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\7F3D.tmp"C:\Users\Admin\AppData\Local\Temp\7F3D.tmp"91⤵PID:184
-
C:\Users\Admin\AppData\Local\Temp\7F9B.tmp"C:\Users\Admin\AppData\Local\Temp\7F9B.tmp"92⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\8008.tmp"C:\Users\Admin\AppData\Local\Temp\8008.tmp"93⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\8066.tmp"C:\Users\Admin\AppData\Local\Temp\8066.tmp"94⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\80C4.tmp"C:\Users\Admin\AppData\Local\Temp\80C4.tmp"95⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\8122.tmp"C:\Users\Admin\AppData\Local\Temp\8122.tmp"96⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\818F.tmp"C:\Users\Admin\AppData\Local\Temp\818F.tmp"97⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\81ED.tmp"C:\Users\Admin\AppData\Local\Temp\81ED.tmp"98⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\824A.tmp"C:\Users\Admin\AppData\Local\Temp\824A.tmp"99⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\82A8.tmp"C:\Users\Admin\AppData\Local\Temp\82A8.tmp"100⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\8316.tmp"C:\Users\Admin\AppData\Local\Temp\8316.tmp"101⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\8373.tmp"C:\Users\Admin\AppData\Local\Temp\8373.tmp"102⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\83E1.tmp"C:\Users\Admin\AppData\Local\Temp\83E1.tmp"103⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\844E.tmp"C:\Users\Admin\AppData\Local\Temp\844E.tmp"104⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\84AC.tmp"C:\Users\Admin\AppData\Local\Temp\84AC.tmp"105⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\84FA.tmp"C:\Users\Admin\AppData\Local\Temp\84FA.tmp"106⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\8558.tmp"C:\Users\Admin\AppData\Local\Temp\8558.tmp"107⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\85C5.tmp"C:\Users\Admin\AppData\Local\Temp\85C5.tmp"108⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\8623.tmp"C:\Users\Admin\AppData\Local\Temp\8623.tmp"109⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\8681.tmp"C:\Users\Admin\AppData\Local\Temp\8681.tmp"110⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\86CF.tmp"C:\Users\Admin\AppData\Local\Temp\86CF.tmp"111⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\871D.tmp"C:\Users\Admin\AppData\Local\Temp\871D.tmp"112⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\877B.tmp"C:\Users\Admin\AppData\Local\Temp\877B.tmp"113⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\87D8.tmp"C:\Users\Admin\AppData\Local\Temp\87D8.tmp"114⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\8836.tmp"C:\Users\Admin\AppData\Local\Temp\8836.tmp"115⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\8894.tmp"C:\Users\Admin\AppData\Local\Temp\8894.tmp"116⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\88F2.tmp"C:\Users\Admin\AppData\Local\Temp\88F2.tmp"117⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\8940.tmp"C:\Users\Admin\AppData\Local\Temp\8940.tmp"118⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\89AD.tmp"C:\Users\Admin\AppData\Local\Temp\89AD.tmp"119⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\8A0B.tmp"C:\Users\Admin\AppData\Local\Temp\8A0B.tmp"120⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\8A69.tmp"C:\Users\Admin\AppData\Local\Temp\8A69.tmp"121⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\8AC6.tmp"C:\Users\Admin\AppData\Local\Temp\8AC6.tmp"122⤵PID:2780
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-