Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2024, 04:10
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-19_d911fd88a865eb2b09345271f27fc7ed_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-19_d911fd88a865eb2b09345271f27fc7ed_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-19_d911fd88a865eb2b09345271f27fc7ed_mafia.exe
-
Size
765KB
-
MD5
d911fd88a865eb2b09345271f27fc7ed
-
SHA1
c56bb1bdacbee89ca67f02e3a2243d539e19214f
-
SHA256
2ee759ac673619a9e79074e7e06c6d148600764b15aef722f3a3c7face27c0a8
-
SHA512
a83260ca6bb782785f82eba7e2eed3ad84422e4a4d2dffb184d001be121a1bab04d21d42eedeb17d6de973772261952ccd53c096c824aaad52ac3463affba276
-
SSDEEP
12288:ZU5rCOTeiDdzIfq9+aQqD5K4Gsog3ZF5rn5rLOa54U5w5A:ZUQOJDdz2qRQA5K4Gsb3vh5Oa+UOS
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1520 54B3.tmp 1508 557E.tmp 3988 5658.tmp 1752 5704.tmp 2812 57A1.tmp 2344 582D.tmp 4832 58AA.tmp 1840 5927.tmp 4636 59B4.tmp 4360 5A60.tmp 2628 5AFC.tmp 3220 5BB7.tmp 2376 5C44.tmp 1756 5CE0.tmp 752 5D8C.tmp 4616 5E28.tmp 2576 5EC5.tmp 1524 5F71.tmp 2292 5FEE.tmp 852 608A.tmp 2528 6136.tmp 1364 61E2.tmp 3724 625F.tmp 4460 62FB.tmp 3964 6387.tmp 644 6414.tmp 3192 64B0.tmp 2552 655C.tmp 3024 6608.tmp 4308 66D3.tmp 4088 678F.tmp 748 6869.tmp 4716 6925.tmp 2792 6983.tmp 1528 69E0.tmp 4724 6A3E.tmp 3008 6AAC.tmp 3948 6B19.tmp 2036 6B86.tmp 668 6BE4.tmp 1808 6C42.tmp 4128 6CAF.tmp 5024 6D0D.tmp 3356 6D5B.tmp 4884 6DC8.tmp 4360 6E36.tmp 3864 6EA3.tmp 1664 6F01.tmp 3084 6F6E.tmp 1772 6FCC.tmp 2768 7039.tmp 2092 7097.tmp 4640 7105.tmp 1064 7162.tmp 4548 71C0.tmp 1652 721E.tmp 3936 729B.tmp 3996 72F9.tmp 3444 7366.tmp 3632 73D3.tmp 2256 7441.tmp 1984 749E.tmp 3724 74FC.tmp 1680 755A.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 920A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9810.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F58.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6608.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1747.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 239B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6160.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9AE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C38A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 640.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 574E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DD6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C01F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C81D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACD0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5927.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7162.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6102.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A60F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7366.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 992E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C33B.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 948 wrote to memory of 1520 948 2024-09-19_d911fd88a865eb2b09345271f27fc7ed_mafia.exe 89 PID 948 wrote to memory of 1520 948 2024-09-19_d911fd88a865eb2b09345271f27fc7ed_mafia.exe 89 PID 948 wrote to memory of 1520 948 2024-09-19_d911fd88a865eb2b09345271f27fc7ed_mafia.exe 89 PID 1520 wrote to memory of 1508 1520 54B3.tmp 90 PID 1520 wrote to memory of 1508 1520 54B3.tmp 90 PID 1520 wrote to memory of 1508 1520 54B3.tmp 90 PID 1508 wrote to memory of 3988 1508 557E.tmp 91 PID 1508 wrote to memory of 3988 1508 557E.tmp 91 PID 1508 wrote to memory of 3988 1508 557E.tmp 91 PID 3988 wrote to memory of 1752 3988 5658.tmp 92 PID 3988 wrote to memory of 1752 3988 5658.tmp 92 PID 3988 wrote to memory of 1752 3988 5658.tmp 92 PID 1752 wrote to memory of 2812 1752 5704.tmp 93 PID 1752 wrote to memory of 2812 1752 5704.tmp 93 PID 1752 wrote to memory of 2812 1752 5704.tmp 93 PID 2812 wrote to memory of 2344 2812 57A1.tmp 94 PID 2812 wrote to memory of 2344 2812 57A1.tmp 94 PID 2812 wrote to memory of 2344 2812 57A1.tmp 94 PID 2344 wrote to memory of 4832 2344 582D.tmp 95 PID 2344 wrote to memory of 4832 2344 582D.tmp 95 PID 2344 wrote to memory of 4832 2344 582D.tmp 95 PID 4832 wrote to memory of 1840 4832 58AA.tmp 96 PID 4832 wrote to memory of 1840 4832 58AA.tmp 96 PID 4832 wrote to memory of 1840 4832 58AA.tmp 96 PID 1840 wrote to memory of 4636 1840 5927.tmp 97 PID 1840 wrote to memory of 4636 1840 5927.tmp 97 PID 1840 wrote to memory of 4636 1840 5927.tmp 97 PID 4636 wrote to memory of 4360 4636 59B4.tmp 98 PID 4636 wrote to memory of 4360 4636 59B4.tmp 98 PID 4636 wrote to memory of 4360 4636 59B4.tmp 98 PID 4360 wrote to memory of 2628 4360 5A60.tmp 99 PID 4360 wrote to memory of 2628 4360 5A60.tmp 99 PID 4360 wrote to memory of 2628 4360 5A60.tmp 99 PID 2628 wrote to memory of 3220 2628 5AFC.tmp 100 PID 2628 wrote to memory of 3220 2628 5AFC.tmp 100 PID 2628 wrote to memory of 3220 2628 5AFC.tmp 100 PID 3220 wrote to memory of 2376 3220 5BB7.tmp 101 PID 3220 wrote to memory of 2376 3220 5BB7.tmp 101 PID 3220 wrote to memory of 2376 3220 5BB7.tmp 101 PID 2376 wrote to memory of 1756 2376 5C44.tmp 102 PID 2376 wrote to memory of 1756 2376 5C44.tmp 102 PID 2376 wrote to memory of 1756 2376 5C44.tmp 102 PID 1756 wrote to memory of 752 1756 5CE0.tmp 105 PID 1756 wrote to memory of 752 1756 5CE0.tmp 105 PID 1756 wrote to memory of 752 1756 5CE0.tmp 105 PID 752 wrote to memory of 4616 752 5D8C.tmp 106 PID 752 wrote to memory of 4616 752 5D8C.tmp 106 PID 752 wrote to memory of 4616 752 5D8C.tmp 106 PID 4616 wrote to memory of 2576 4616 5E28.tmp 107 PID 4616 wrote to memory of 2576 4616 5E28.tmp 107 PID 4616 wrote to memory of 2576 4616 5E28.tmp 107 PID 2576 wrote to memory of 1524 2576 5EC5.tmp 108 PID 2576 wrote to memory of 1524 2576 5EC5.tmp 108 PID 2576 wrote to memory of 1524 2576 5EC5.tmp 108 PID 1524 wrote to memory of 2292 1524 5F71.tmp 109 PID 1524 wrote to memory of 2292 1524 5F71.tmp 109 PID 1524 wrote to memory of 2292 1524 5F71.tmp 109 PID 2292 wrote to memory of 852 2292 5FEE.tmp 110 PID 2292 wrote to memory of 852 2292 5FEE.tmp 110 PID 2292 wrote to memory of 852 2292 5FEE.tmp 110 PID 852 wrote to memory of 2528 852 608A.tmp 111 PID 852 wrote to memory of 2528 852 608A.tmp 111 PID 852 wrote to memory of 2528 852 608A.tmp 111 PID 2528 wrote to memory of 1364 2528 6136.tmp 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_d911fd88a865eb2b09345271f27fc7ed_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_d911fd88a865eb2b09345271f27fc7ed_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Users\Admin\AppData\Local\Temp\54B3.tmp"C:\Users\Admin\AppData\Local\Temp\54B3.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\557E.tmp"C:\Users\Admin\AppData\Local\Temp\557E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\5658.tmp"C:\Users\Admin\AppData\Local\Temp\5658.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\5704.tmp"C:\Users\Admin\AppData\Local\Temp\5704.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\57A1.tmp"C:\Users\Admin\AppData\Local\Temp\57A1.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\582D.tmp"C:\Users\Admin\AppData\Local\Temp\582D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\58AA.tmp"C:\Users\Admin\AppData\Local\Temp\58AA.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\5927.tmp"C:\Users\Admin\AppData\Local\Temp\5927.tmp"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\59B4.tmp"C:\Users\Admin\AppData\Local\Temp\59B4.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\5A60.tmp"C:\Users\Admin\AppData\Local\Temp\5A60.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\5AFC.tmp"C:\Users\Admin\AppData\Local\Temp\5AFC.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\5BB7.tmp"C:\Users\Admin\AppData\Local\Temp\5BB7.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\5C44.tmp"C:\Users\Admin\AppData\Local\Temp\5C44.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\5CE0.tmp"C:\Users\Admin\AppData\Local\Temp\5CE0.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\5D8C.tmp"C:\Users\Admin\AppData\Local\Temp\5D8C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\5E28.tmp"C:\Users\Admin\AppData\Local\Temp\5E28.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\5EC5.tmp"C:\Users\Admin\AppData\Local\Temp\5EC5.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\5F71.tmp"C:\Users\Admin\AppData\Local\Temp\5F71.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\5FEE.tmp"C:\Users\Admin\AppData\Local\Temp\5FEE.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\608A.tmp"C:\Users\Admin\AppData\Local\Temp\608A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Users\Admin\AppData\Local\Temp\6136.tmp"C:\Users\Admin\AppData\Local\Temp\6136.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\61E2.tmp"C:\Users\Admin\AppData\Local\Temp\61E2.tmp"23⤵
- Executes dropped EXE
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\625F.tmp"C:\Users\Admin\AppData\Local\Temp\625F.tmp"24⤵
- Executes dropped EXE
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\62FB.tmp"C:\Users\Admin\AppData\Local\Temp\62FB.tmp"25⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\6387.tmp"C:\Users\Admin\AppData\Local\Temp\6387.tmp"26⤵
- Executes dropped EXE
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\6414.tmp"C:\Users\Admin\AppData\Local\Temp\6414.tmp"27⤵
- Executes dropped EXE
PID:644 -
C:\Users\Admin\AppData\Local\Temp\64B0.tmp"C:\Users\Admin\AppData\Local\Temp\64B0.tmp"28⤵
- Executes dropped EXE
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\655C.tmp"C:\Users\Admin\AppData\Local\Temp\655C.tmp"29⤵
- Executes dropped EXE
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\6608.tmp"C:\Users\Admin\AppData\Local\Temp\6608.tmp"30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\66D3.tmp"C:\Users\Admin\AppData\Local\Temp\66D3.tmp"31⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\678F.tmp"C:\Users\Admin\AppData\Local\Temp\678F.tmp"32⤵
- Executes dropped EXE
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\680C.tmp"C:\Users\Admin\AppData\Local\Temp\680C.tmp"33⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\6869.tmp"C:\Users\Admin\AppData\Local\Temp\6869.tmp"34⤵
- Executes dropped EXE
PID:748 -
C:\Users\Admin\AppData\Local\Temp\6925.tmp"C:\Users\Admin\AppData\Local\Temp\6925.tmp"35⤵
- Executes dropped EXE
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\6983.tmp"C:\Users\Admin\AppData\Local\Temp\6983.tmp"36⤵
- Executes dropped EXE
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\69E0.tmp"C:\Users\Admin\AppData\Local\Temp\69E0.tmp"37⤵
- Executes dropped EXE
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\6A3E.tmp"C:\Users\Admin\AppData\Local\Temp\6A3E.tmp"38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\6AAC.tmp"C:\Users\Admin\AppData\Local\Temp\6AAC.tmp"39⤵
- Executes dropped EXE
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\6B19.tmp"C:\Users\Admin\AppData\Local\Temp\6B19.tmp"40⤵
- Executes dropped EXE
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\6B86.tmp"C:\Users\Admin\AppData\Local\Temp\6B86.tmp"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\6BE4.tmp"C:\Users\Admin\AppData\Local\Temp\6BE4.tmp"42⤵
- Executes dropped EXE
PID:668 -
C:\Users\Admin\AppData\Local\Temp\6C42.tmp"C:\Users\Admin\AppData\Local\Temp\6C42.tmp"43⤵
- Executes dropped EXE
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\6CAF.tmp"C:\Users\Admin\AppData\Local\Temp\6CAF.tmp"44⤵
- Executes dropped EXE
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\6D0D.tmp"C:\Users\Admin\AppData\Local\Temp\6D0D.tmp"45⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\6D5B.tmp"C:\Users\Admin\AppData\Local\Temp\6D5B.tmp"46⤵
- Executes dropped EXE
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\6DC8.tmp"C:\Users\Admin\AppData\Local\Temp\6DC8.tmp"47⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\6E36.tmp"C:\Users\Admin\AppData\Local\Temp\6E36.tmp"48⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\6EA3.tmp"C:\Users\Admin\AppData\Local\Temp\6EA3.tmp"49⤵
- Executes dropped EXE
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\6F01.tmp"C:\Users\Admin\AppData\Local\Temp\6F01.tmp"50⤵
- Executes dropped EXE
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\6F6E.tmp"C:\Users\Admin\AppData\Local\Temp\6F6E.tmp"51⤵
- Executes dropped EXE
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\6FCC.tmp"C:\Users\Admin\AppData\Local\Temp\6FCC.tmp"52⤵
- Executes dropped EXE
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\7039.tmp"C:\Users\Admin\AppData\Local\Temp\7039.tmp"53⤵
- Executes dropped EXE
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\7097.tmp"C:\Users\Admin\AppData\Local\Temp\7097.tmp"54⤵
- Executes dropped EXE
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\7105.tmp"C:\Users\Admin\AppData\Local\Temp\7105.tmp"55⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\7162.tmp"C:\Users\Admin\AppData\Local\Temp\7162.tmp"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\71C0.tmp"C:\Users\Admin\AppData\Local\Temp\71C0.tmp"57⤵
- Executes dropped EXE
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\721E.tmp"C:\Users\Admin\AppData\Local\Temp\721E.tmp"58⤵
- Executes dropped EXE
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\729B.tmp"C:\Users\Admin\AppData\Local\Temp\729B.tmp"59⤵
- Executes dropped EXE
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\72F9.tmp"C:\Users\Admin\AppData\Local\Temp\72F9.tmp"60⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\7366.tmp"C:\Users\Admin\AppData\Local\Temp\7366.tmp"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\73D3.tmp"C:\Users\Admin\AppData\Local\Temp\73D3.tmp"62⤵
- Executes dropped EXE
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\7441.tmp"C:\Users\Admin\AppData\Local\Temp\7441.tmp"63⤵
- Executes dropped EXE
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\749E.tmp"C:\Users\Admin\AppData\Local\Temp\749E.tmp"64⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\74FC.tmp"C:\Users\Admin\AppData\Local\Temp\74FC.tmp"65⤵
- Executes dropped EXE
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\755A.tmp"C:\Users\Admin\AppData\Local\Temp\755A.tmp"66⤵
- Executes dropped EXE
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\75C7.tmp"C:\Users\Admin\AppData\Local\Temp\75C7.tmp"67⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\7625.tmp"C:\Users\Admin\AppData\Local\Temp\7625.tmp"68⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\7692.tmp"C:\Users\Admin\AppData\Local\Temp\7692.tmp"69⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\7700.tmp"C:\Users\Admin\AppData\Local\Temp\7700.tmp"70⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\776D.tmp"C:\Users\Admin\AppData\Local\Temp\776D.tmp"71⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\77DB.tmp"C:\Users\Admin\AppData\Local\Temp\77DB.tmp"72⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\7829.tmp"C:\Users\Admin\AppData\Local\Temp\7829.tmp"73⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\7877.tmp"C:\Users\Admin\AppData\Local\Temp\7877.tmp"74⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\78D5.tmp"C:\Users\Admin\AppData\Local\Temp\78D5.tmp"75⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\7942.tmp"C:\Users\Admin\AppData\Local\Temp\7942.tmp"76⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\79A0.tmp"C:\Users\Admin\AppData\Local\Temp\79A0.tmp"77⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\79FD.tmp"C:\Users\Admin\AppData\Local\Temp\79FD.tmp"78⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\7A5B.tmp"C:\Users\Admin\AppData\Local\Temp\7A5B.tmp"79⤵
- System Location Discovery: System Language Discovery
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\7AA9.tmp"C:\Users\Admin\AppData\Local\Temp\7AA9.tmp"80⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\7B07.tmp"C:\Users\Admin\AppData\Local\Temp\7B07.tmp"81⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\7B65.tmp"C:\Users\Admin\AppData\Local\Temp\7B65.tmp"82⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\7BC3.tmp"C:\Users\Admin\AppData\Local\Temp\7BC3.tmp"83⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\7C20.tmp"C:\Users\Admin\AppData\Local\Temp\7C20.tmp"84⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\7C8E.tmp"C:\Users\Admin\AppData\Local\Temp\7C8E.tmp"85⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\7CEB.tmp"C:\Users\Admin\AppData\Local\Temp\7CEB.tmp"86⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\7D3A.tmp"C:\Users\Admin\AppData\Local\Temp\7D3A.tmp"87⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\7DA7.tmp"C:\Users\Admin\AppData\Local\Temp\7DA7.tmp"88⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\7E14.tmp"C:\Users\Admin\AppData\Local\Temp\7E14.tmp"89⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\7E62.tmp"C:\Users\Admin\AppData\Local\Temp\7E62.tmp"90⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\7EB1.tmp"C:\Users\Admin\AppData\Local\Temp\7EB1.tmp"91⤵
- System Location Discovery: System Language Discovery
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\7F1E.tmp"C:\Users\Admin\AppData\Local\Temp\7F1E.tmp"92⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\7F6C.tmp"C:\Users\Admin\AppData\Local\Temp\7F6C.tmp"93⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\7FBA.tmp"C:\Users\Admin\AppData\Local\Temp\7FBA.tmp"94⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\8008.tmp"C:\Users\Admin\AppData\Local\Temp\8008.tmp"95⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\8076.tmp"C:\Users\Admin\AppData\Local\Temp\8076.tmp"96⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\80E3.tmp"C:\Users\Admin\AppData\Local\Temp\80E3.tmp"97⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\8141.tmp"C:\Users\Admin\AppData\Local\Temp\8141.tmp"98⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\81AE.tmp"C:\Users\Admin\AppData\Local\Temp\81AE.tmp"99⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\81FC.tmp"C:\Users\Admin\AppData\Local\Temp\81FC.tmp"100⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\825A.tmp"C:\Users\Admin\AppData\Local\Temp\825A.tmp"101⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\82C7.tmp"C:\Users\Admin\AppData\Local\Temp\82C7.tmp"102⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\8325.tmp"C:\Users\Admin\AppData\Local\Temp\8325.tmp"103⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\8383.tmp"C:\Users\Admin\AppData\Local\Temp\8383.tmp"104⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\83E1.tmp"C:\Users\Admin\AppData\Local\Temp\83E1.tmp"105⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\843E.tmp"C:\Users\Admin\AppData\Local\Temp\843E.tmp"106⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\84AC.tmp"C:\Users\Admin\AppData\Local\Temp\84AC.tmp"107⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\84FA.tmp"C:\Users\Admin\AppData\Local\Temp\84FA.tmp"108⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\8558.tmp"C:\Users\Admin\AppData\Local\Temp\8558.tmp"109⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\85C5.tmp"C:\Users\Admin\AppData\Local\Temp\85C5.tmp"110⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\8613.tmp"C:\Users\Admin\AppData\Local\Temp\8613.tmp"111⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\8661.tmp"C:\Users\Admin\AppData\Local\Temp\8661.tmp"112⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\86AF.tmp"C:\Users\Admin\AppData\Local\Temp\86AF.tmp"113⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\86FE.tmp"C:\Users\Admin\AppData\Local\Temp\86FE.tmp"114⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\875B.tmp"C:\Users\Admin\AppData\Local\Temp\875B.tmp"115⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\87A9.tmp"C:\Users\Admin\AppData\Local\Temp\87A9.tmp"116⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\87F8.tmp"C:\Users\Admin\AppData\Local\Temp\87F8.tmp"117⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\8855.tmp"C:\Users\Admin\AppData\Local\Temp\8855.tmp"118⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\88A3.tmp"C:\Users\Admin\AppData\Local\Temp\88A3.tmp"119⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\8911.tmp"C:\Users\Admin\AppData\Local\Temp\8911.tmp"120⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\895F.tmp"C:\Users\Admin\AppData\Local\Temp\895F.tmp"121⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\89BD.tmp"C:\Users\Admin\AppData\Local\Temp\89BD.tmp"122⤵PID:4044
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-