Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07-08-2024 15:22
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-07_4dae39aa88032ba793abd09bbd7231b7_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-08-07_4dae39aa88032ba793abd09bbd7231b7_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-07_4dae39aa88032ba793abd09bbd7231b7_mafia.exe
-
Size
529KB
-
MD5
4dae39aa88032ba793abd09bbd7231b7
-
SHA1
e49c9e312e51087e1ab54aa812807e4c66c59411
-
SHA256
9ba58a50574fb13038aa07e040307405bf85c74562a30d283314d69752403308
-
SHA512
7f075fd8b3f1c4c62ad4dc3c91c03b8815ebc9953d6015fd19ddb7320bd44c40ad300eb34f001b360699bf1a95fe8d5e149030c9e825b7dbd3b5810e67b05907
-
SSDEEP
12288:NU5rCOTeijARl06wSvLvMkGux/frfGaaVTZwlH4Hp:NUQOJjAb0kTvNfreRVTSlH4Hp
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4304 738A.tmp 3296 73F7.tmp 4052 7455.tmp 3976 74D2.tmp 2544 754F.tmp 1756 75CC.tmp 2396 7639.tmp 880 76A7.tmp 2316 7724.tmp 3444 7772.tmp 1532 77EF.tmp 4468 784D.tmp 1916 78BA.tmp 4576 7927.tmp 4276 7A60.tmp 3260 7ACD.tmp 1088 7B2B.tmp 4756 7B98.tmp 1620 7BF6.tmp 536 7C73.tmp 3780 7CC1.tmp 1436 7D1F.tmp 1064 7D8C.tmp 976 7DFA.tmp 1512 7E86.tmp 1432 7EE4.tmp 4340 7F71.tmp 2484 7FEE.tmp 2444 805B.tmp 4852 80A9.tmp 4508 8107.tmp 4732 8155.tmp 624 81B3.tmp 4272 8211.tmp 1824 825F.tmp 2756 82BD.tmp 1720 831A.tmp 552 8368.tmp 4952 83B7.tmp 264 8405.tmp 836 8453.tmp 4864 84B1.tmp 4328 84FF.tmp 3056 854D.tmp 2080 859B.tmp 1448 85E9.tmp 1900 8637.tmp 2648 8685.tmp 4568 86D3.tmp 1028 8722.tmp 3568 8770.tmp 4656 87CD.tmp 1132 881C.tmp 1416 886A.tmp 2912 88B8.tmp 2264 8906.tmp 324 8954.tmp 2952 89A2.tmp 3136 89F0.tmp 5076 8A3E.tmp 4004 8A8D.tmp 4540 8AEA.tmp 3444 8B48.tmp 1660 8BA6.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B67A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B8B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1160.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A613.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5213.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6443.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8368.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 942.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-08-07_4dae39aa88032ba793abd09bbd7231b7_mafia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 319A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A325.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6973.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E35B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A340.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A812.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7724.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E7D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5697.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C525.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAA5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5791.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 877B.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4036 wrote to memory of 4304 4036 2024-08-07_4dae39aa88032ba793abd09bbd7231b7_mafia.exe 85 PID 4036 wrote to memory of 4304 4036 2024-08-07_4dae39aa88032ba793abd09bbd7231b7_mafia.exe 85 PID 4036 wrote to memory of 4304 4036 2024-08-07_4dae39aa88032ba793abd09bbd7231b7_mafia.exe 85 PID 4304 wrote to memory of 3296 4304 738A.tmp 86 PID 4304 wrote to memory of 3296 4304 738A.tmp 86 PID 4304 wrote to memory of 3296 4304 738A.tmp 86 PID 3296 wrote to memory of 4052 3296 73F7.tmp 88 PID 3296 wrote to memory of 4052 3296 73F7.tmp 88 PID 3296 wrote to memory of 4052 3296 73F7.tmp 88 PID 4052 wrote to memory of 3976 4052 7455.tmp 89 PID 4052 wrote to memory of 3976 4052 7455.tmp 89 PID 4052 wrote to memory of 3976 4052 7455.tmp 89 PID 3976 wrote to memory of 2544 3976 74D2.tmp 90 PID 3976 wrote to memory of 2544 3976 74D2.tmp 90 PID 3976 wrote to memory of 2544 3976 74D2.tmp 90 PID 2544 wrote to memory of 1756 2544 754F.tmp 91 PID 2544 wrote to memory of 1756 2544 754F.tmp 91 PID 2544 wrote to memory of 1756 2544 754F.tmp 91 PID 1756 wrote to memory of 2396 1756 75CC.tmp 92 PID 1756 wrote to memory of 2396 1756 75CC.tmp 92 PID 1756 wrote to memory of 2396 1756 75CC.tmp 92 PID 2396 wrote to memory of 880 2396 7639.tmp 93 PID 2396 wrote to memory of 880 2396 7639.tmp 93 PID 2396 wrote to memory of 880 2396 7639.tmp 93 PID 880 wrote to memory of 2316 880 76A7.tmp 94 PID 880 wrote to memory of 2316 880 76A7.tmp 94 PID 880 wrote to memory of 2316 880 76A7.tmp 94 PID 2316 wrote to memory of 3444 2316 7724.tmp 95 PID 2316 wrote to memory of 3444 2316 7724.tmp 95 PID 2316 wrote to memory of 3444 2316 7724.tmp 95 PID 3444 wrote to memory of 1532 3444 7772.tmp 96 PID 3444 wrote to memory of 1532 3444 7772.tmp 96 PID 3444 wrote to memory of 1532 3444 7772.tmp 96 PID 1532 wrote to memory of 4468 1532 77EF.tmp 97 PID 1532 wrote to memory of 4468 1532 77EF.tmp 97 PID 1532 wrote to memory of 4468 1532 77EF.tmp 97 PID 4468 wrote to memory of 1916 4468 784D.tmp 98 PID 4468 wrote to memory of 1916 4468 784D.tmp 98 PID 4468 wrote to memory of 1916 4468 784D.tmp 98 PID 1916 wrote to memory of 4576 1916 78BA.tmp 99 PID 1916 wrote to memory of 4576 1916 78BA.tmp 99 PID 1916 wrote to memory of 4576 1916 78BA.tmp 99 PID 4576 wrote to memory of 4276 4576 7927.tmp 100 PID 4576 wrote to memory of 4276 4576 7927.tmp 100 PID 4576 wrote to memory of 4276 4576 7927.tmp 100 PID 4276 wrote to memory of 3260 4276 7A60.tmp 101 PID 4276 wrote to memory of 3260 4276 7A60.tmp 101 PID 4276 wrote to memory of 3260 4276 7A60.tmp 101 PID 3260 wrote to memory of 1088 3260 7ACD.tmp 102 PID 3260 wrote to memory of 1088 3260 7ACD.tmp 102 PID 3260 wrote to memory of 1088 3260 7ACD.tmp 102 PID 1088 wrote to memory of 4756 1088 7B2B.tmp 103 PID 1088 wrote to memory of 4756 1088 7B2B.tmp 103 PID 1088 wrote to memory of 4756 1088 7B2B.tmp 103 PID 4756 wrote to memory of 1620 4756 7B98.tmp 104 PID 4756 wrote to memory of 1620 4756 7B98.tmp 104 PID 4756 wrote to memory of 1620 4756 7B98.tmp 104 PID 1620 wrote to memory of 536 1620 7BF6.tmp 105 PID 1620 wrote to memory of 536 1620 7BF6.tmp 105 PID 1620 wrote to memory of 536 1620 7BF6.tmp 105 PID 536 wrote to memory of 3780 536 7C73.tmp 106 PID 536 wrote to memory of 3780 536 7C73.tmp 106 PID 536 wrote to memory of 3780 536 7C73.tmp 106 PID 3780 wrote to memory of 1436 3780 7CC1.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-07_4dae39aa88032ba793abd09bbd7231b7_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-07_4dae39aa88032ba793abd09bbd7231b7_mafia.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\738A.tmp"C:\Users\Admin\AppData\Local\Temp\738A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\73F7.tmp"C:\Users\Admin\AppData\Local\Temp\73F7.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\754F.tmp"C:\Users\Admin\AppData\Local\Temp\754F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\75CC.tmp"C:\Users\Admin\AppData\Local\Temp\75CC.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\7639.tmp"C:\Users\Admin\AppData\Local\Temp\7639.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\76A7.tmp"C:\Users\Admin\AppData\Local\Temp\76A7.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Users\Admin\AppData\Local\Temp\7724.tmp"C:\Users\Admin\AppData\Local\Temp\7724.tmp"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\7772.tmp"C:\Users\Admin\AppData\Local\Temp\7772.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\77EF.tmp"C:\Users\Admin\AppData\Local\Temp\77EF.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\784D.tmp"C:\Users\Admin\AppData\Local\Temp\784D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\78BA.tmp"C:\Users\Admin\AppData\Local\Temp\78BA.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\7927.tmp"C:\Users\Admin\AppData\Local\Temp\7927.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\7A60.tmp"C:\Users\Admin\AppData\Local\Temp\7A60.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\7B98.tmp"C:\Users\Admin\AppData\Local\Temp\7B98.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\7BF6.tmp"C:\Users\Admin\AppData\Local\Temp\7BF6.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\7C73.tmp"C:\Users\Admin\AppData\Local\Temp\7C73.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"23⤵
- Executes dropped EXE
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"24⤵
- Executes dropped EXE
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"25⤵
- Executes dropped EXE
PID:976 -
C:\Users\Admin\AppData\Local\Temp\7E86.tmp"C:\Users\Admin\AppData\Local\Temp\7E86.tmp"26⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"27⤵
- Executes dropped EXE
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\7F71.tmp"C:\Users\Admin\AppData\Local\Temp\7F71.tmp"28⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\7FEE.tmp"C:\Users\Admin\AppData\Local\Temp\7FEE.tmp"29⤵
- Executes dropped EXE
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\805B.tmp"C:\Users\Admin\AppData\Local\Temp\805B.tmp"30⤵
- Executes dropped EXE
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\80A9.tmp"C:\Users\Admin\AppData\Local\Temp\80A9.tmp"31⤵
- Executes dropped EXE
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\8107.tmp"C:\Users\Admin\AppData\Local\Temp\8107.tmp"32⤵
- Executes dropped EXE
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\8155.tmp"C:\Users\Admin\AppData\Local\Temp\8155.tmp"33⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\81B3.tmp"C:\Users\Admin\AppData\Local\Temp\81B3.tmp"34⤵
- Executes dropped EXE
PID:624 -
C:\Users\Admin\AppData\Local\Temp\8211.tmp"C:\Users\Admin\AppData\Local\Temp\8211.tmp"35⤵
- Executes dropped EXE
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\825F.tmp"C:\Users\Admin\AppData\Local\Temp\825F.tmp"36⤵
- Executes dropped EXE
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\82BD.tmp"C:\Users\Admin\AppData\Local\Temp\82BD.tmp"37⤵
- Executes dropped EXE
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\831A.tmp"C:\Users\Admin\AppData\Local\Temp\831A.tmp"38⤵
- Executes dropped EXE
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\8368.tmp"C:\Users\Admin\AppData\Local\Temp\8368.tmp"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:552 -
C:\Users\Admin\AppData\Local\Temp\83B7.tmp"C:\Users\Admin\AppData\Local\Temp\83B7.tmp"40⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\8405.tmp"C:\Users\Admin\AppData\Local\Temp\8405.tmp"41⤵
- Executes dropped EXE
PID:264 -
C:\Users\Admin\AppData\Local\Temp\8453.tmp"C:\Users\Admin\AppData\Local\Temp\8453.tmp"42⤵
- Executes dropped EXE
PID:836 -
C:\Users\Admin\AppData\Local\Temp\84B1.tmp"C:\Users\Admin\AppData\Local\Temp\84B1.tmp"43⤵
- Executes dropped EXE
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\84FF.tmp"C:\Users\Admin\AppData\Local\Temp\84FF.tmp"44⤵
- Executes dropped EXE
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\854D.tmp"C:\Users\Admin\AppData\Local\Temp\854D.tmp"45⤵
- Executes dropped EXE
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\859B.tmp"C:\Users\Admin\AppData\Local\Temp\859B.tmp"46⤵
- Executes dropped EXE
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\85E9.tmp"C:\Users\Admin\AppData\Local\Temp\85E9.tmp"47⤵
- Executes dropped EXE
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\8637.tmp"C:\Users\Admin\AppData\Local\Temp\8637.tmp"48⤵
- Executes dropped EXE
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\8685.tmp"C:\Users\Admin\AppData\Local\Temp\8685.tmp"49⤵
- Executes dropped EXE
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\86D3.tmp"C:\Users\Admin\AppData\Local\Temp\86D3.tmp"50⤵
- Executes dropped EXE
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\8722.tmp"C:\Users\Admin\AppData\Local\Temp\8722.tmp"51⤵
- Executes dropped EXE
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\8770.tmp"C:\Users\Admin\AppData\Local\Temp\8770.tmp"52⤵
- Executes dropped EXE
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\87CD.tmp"C:\Users\Admin\AppData\Local\Temp\87CD.tmp"53⤵
- Executes dropped EXE
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\881C.tmp"C:\Users\Admin\AppData\Local\Temp\881C.tmp"54⤵
- Executes dropped EXE
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\886A.tmp"C:\Users\Admin\AppData\Local\Temp\886A.tmp"55⤵
- Executes dropped EXE
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\88B8.tmp"C:\Users\Admin\AppData\Local\Temp\88B8.tmp"56⤵
- Executes dropped EXE
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\8906.tmp"C:\Users\Admin\AppData\Local\Temp\8906.tmp"57⤵
- Executes dropped EXE
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\8954.tmp"C:\Users\Admin\AppData\Local\Temp\8954.tmp"58⤵
- Executes dropped EXE
PID:324 -
C:\Users\Admin\AppData\Local\Temp\89A2.tmp"C:\Users\Admin\AppData\Local\Temp\89A2.tmp"59⤵
- Executes dropped EXE
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\89F0.tmp"C:\Users\Admin\AppData\Local\Temp\89F0.tmp"60⤵
- Executes dropped EXE
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"61⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"62⤵
- Executes dropped EXE
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"63⤵
- Executes dropped EXE
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\8B48.tmp"C:\Users\Admin\AppData\Local\Temp\8B48.tmp"64⤵
- Executes dropped EXE
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"65⤵
- Executes dropped EXE
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"66⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\8C42.tmp"C:\Users\Admin\AppData\Local\Temp\8C42.tmp"67⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\8C90.tmp"C:\Users\Admin\AppData\Local\Temp\8C90.tmp"68⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"69⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"70⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"71⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\8DE8.tmp"C:\Users\Admin\AppData\Local\Temp\8DE8.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\8E46.tmp"C:\Users\Admin\AppData\Local\Temp\8E46.tmp"73⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"74⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\8F01.tmp"C:\Users\Admin\AppData\Local\Temp\8F01.tmp"75⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"76⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\8FBD.tmp"C:\Users\Admin\AppData\Local\Temp\8FBD.tmp"77⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\900B.tmp"C:\Users\Admin\AppData\Local\Temp\900B.tmp"78⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\9059.tmp"C:\Users\Admin\AppData\Local\Temp\9059.tmp"79⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\90A7.tmp"C:\Users\Admin\AppData\Local\Temp\90A7.tmp"80⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\90F5.tmp"C:\Users\Admin\AppData\Local\Temp\90F5.tmp"81⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\9153.tmp"C:\Users\Admin\AppData\Local\Temp\9153.tmp"82⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\91A1.tmp"C:\Users\Admin\AppData\Local\Temp\91A1.tmp"83⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\91FF.tmp"C:\Users\Admin\AppData\Local\Temp\91FF.tmp"84⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\924D.tmp"C:\Users\Admin\AppData\Local\Temp\924D.tmp"85⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\92AB.tmp"C:\Users\Admin\AppData\Local\Temp\92AB.tmp"86⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\92F9.tmp"C:\Users\Admin\AppData\Local\Temp\92F9.tmp"87⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\9347.tmp"C:\Users\Admin\AppData\Local\Temp\9347.tmp"88⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\9395.tmp"C:\Users\Admin\AppData\Local\Temp\9395.tmp"89⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\93F3.tmp"C:\Users\Admin\AppData\Local\Temp\93F3.tmp"90⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\9441.tmp"C:\Users\Admin\AppData\Local\Temp\9441.tmp"91⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\948F.tmp"C:\Users\Admin\AppData\Local\Temp\948F.tmp"92⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\94DD.tmp"C:\Users\Admin\AppData\Local\Temp\94DD.tmp"93⤵
- System Location Discovery: System Language Discovery
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\953B.tmp"C:\Users\Admin\AppData\Local\Temp\953B.tmp"94⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\9599.tmp"C:\Users\Admin\AppData\Local\Temp\9599.tmp"95⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\95E7.tmp"C:\Users\Admin\AppData\Local\Temp\95E7.tmp"96⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\9635.tmp"C:\Users\Admin\AppData\Local\Temp\9635.tmp"97⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\9683.tmp"C:\Users\Admin\AppData\Local\Temp\9683.tmp"98⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\96D1.tmp"C:\Users\Admin\AppData\Local\Temp\96D1.tmp"99⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\971F.tmp"C:\Users\Admin\AppData\Local\Temp\971F.tmp"100⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\977D.tmp"C:\Users\Admin\AppData\Local\Temp\977D.tmp"101⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\97DB.tmp"C:\Users\Admin\AppData\Local\Temp\97DB.tmp"102⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\9829.tmp"C:\Users\Admin\AppData\Local\Temp\9829.tmp"103⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\9877.tmp"C:\Users\Admin\AppData\Local\Temp\9877.tmp"104⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\98C5.tmp"C:\Users\Admin\AppData\Local\Temp\98C5.tmp"105⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\9923.tmp"C:\Users\Admin\AppData\Local\Temp\9923.tmp"106⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\9971.tmp"C:\Users\Admin\AppData\Local\Temp\9971.tmp"107⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\99BF.tmp"C:\Users\Admin\AppData\Local\Temp\99BF.tmp"108⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"109⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"110⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"111⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\9B07.tmp"C:\Users\Admin\AppData\Local\Temp\9B07.tmp"112⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\9B55.tmp"C:\Users\Admin\AppData\Local\Temp\9B55.tmp"113⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"114⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\9C01.tmp"C:\Users\Admin\AppData\Local\Temp\9C01.tmp"115⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"116⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"117⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"118⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\9D78.tmp"C:\Users\Admin\AppData\Local\Temp\9D78.tmp"119⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"120⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\9E15.tmp"C:\Users\Admin\AppData\Local\Temp\9E15.tmp"121⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\9E63.tmp"C:\Users\Admin\AppData\Local\Temp\9E63.tmp"122⤵PID:4016
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-