Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2024, 01:02
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-12_893f60ddc84a33e0eea0cde5239dcb7f_mafia.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2024-10-12_893f60ddc84a33e0eea0cde5239dcb7f_mafia.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-12_893f60ddc84a33e0eea0cde5239dcb7f_mafia.exe
-
Size
487KB
-
MD5
893f60ddc84a33e0eea0cde5239dcb7f
-
SHA1
2af38920cd0ae7608349d2e23557452a699a1a9f
-
SHA256
78ce13d1497412cab28fc4c36a15c62e0aba5bce49431026cefbe538c69cf4d5
-
SHA512
f62e3f278f4bd3f87305a23706c0e0a6e7854b961c2214e74678e4dfaaaceb9154f6cd3076328ae1985e54deee2c250bf6afc3709f26592d4bed0446a2e48e89
-
SSDEEP
12288:HU5rCOTeiJGgWBVdSXcFc+gAGpLwrfNZ:HUQOJJGLUcSYGpLwbN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4548 7B4A.tmp 1640 7BB8.tmp 4292 7C35.tmp 3016 7CC1.tmp 1984 7D4E.tmp 3020 7DAC.tmp 2312 7E09.tmp 3340 7E77.tmp 4964 7ED5.tmp 4900 7F42.tmp 1200 7FBF.tmp 1596 801D.tmp 424 809A.tmp 4844 8117.tmp 3012 8165.tmp 3912 81D2.tmp 1944 8230.tmp 760 827E.tmp 3596 82DC.tmp 4116 8349.tmp 2340 83A7.tmp 1760 8414.tmp 4732 8462.tmp 2996 84B1.tmp 3356 852E.tmp 1576 85AB.tmp 2380 8628.tmp 364 8676.tmp 4944 86E3.tmp 3492 8750.tmp 1980 879F.tmp 3752 87FC.tmp 4836 885A.tmp 1216 88A8.tmp 1540 88F6.tmp 2184 8944.tmp 4600 8993.tmp 4444 89F0.tmp 1100 8A3E.tmp 2240 8A9C.tmp 2492 8AEA.tmp 2304 8B38.tmp 4308 8B87.tmp 3920 8BE4.tmp 1896 8C42.tmp 3152 8CA0.tmp 5060 8CFE.tmp 1372 8D4C.tmp 2960 8D9A.tmp 1640 8DF8.tmp 2636 8E55.tmp 3536 8EA3.tmp 5056 8F01.tmp 4336 8F4F.tmp 3348 8F9D.tmp 832 8FFB.tmp 3020 9049.tmp 4736 90A7.tmp 2312 90F5.tmp 3068 9143.tmp 2248 91A1.tmp 3660 91EF.tmp 1948 923D.tmp 1200 928B.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 412B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A301.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C237.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8901.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1596.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8681.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A776.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A832.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E29F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E2D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 684A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CCC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8165.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D64B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 948F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDBB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 953B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C544.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4179.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 653D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E697.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B34D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FE7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4812 wrote to memory of 4548 4812 2024-10-12_893f60ddc84a33e0eea0cde5239dcb7f_mafia.exe 85 PID 4812 wrote to memory of 4548 4812 2024-10-12_893f60ddc84a33e0eea0cde5239dcb7f_mafia.exe 85 PID 4812 wrote to memory of 4548 4812 2024-10-12_893f60ddc84a33e0eea0cde5239dcb7f_mafia.exe 85 PID 4548 wrote to memory of 1640 4548 7B4A.tmp 87 PID 4548 wrote to memory of 1640 4548 7B4A.tmp 87 PID 4548 wrote to memory of 1640 4548 7B4A.tmp 87 PID 1640 wrote to memory of 4292 1640 7BB8.tmp 88 PID 1640 wrote to memory of 4292 1640 7BB8.tmp 88 PID 1640 wrote to memory of 4292 1640 7BB8.tmp 88 PID 4292 wrote to memory of 3016 4292 7C35.tmp 89 PID 4292 wrote to memory of 3016 4292 7C35.tmp 89 PID 4292 wrote to memory of 3016 4292 7C35.tmp 89 PID 3016 wrote to memory of 1984 3016 7CC1.tmp 90 PID 3016 wrote to memory of 1984 3016 7CC1.tmp 90 PID 3016 wrote to memory of 1984 3016 7CC1.tmp 90 PID 1984 wrote to memory of 3020 1984 7D4E.tmp 91 PID 1984 wrote to memory of 3020 1984 7D4E.tmp 91 PID 1984 wrote to memory of 3020 1984 7D4E.tmp 91 PID 3020 wrote to memory of 2312 3020 7DAC.tmp 92 PID 3020 wrote to memory of 2312 3020 7DAC.tmp 92 PID 3020 wrote to memory of 2312 3020 7DAC.tmp 92 PID 2312 wrote to memory of 3340 2312 7E09.tmp 93 PID 2312 wrote to memory of 3340 2312 7E09.tmp 93 PID 2312 wrote to memory of 3340 2312 7E09.tmp 93 PID 3340 wrote to memory of 4964 3340 7E77.tmp 94 PID 3340 wrote to memory of 4964 3340 7E77.tmp 94 PID 3340 wrote to memory of 4964 3340 7E77.tmp 94 PID 4964 wrote to memory of 4900 4964 7ED5.tmp 95 PID 4964 wrote to memory of 4900 4964 7ED5.tmp 95 PID 4964 wrote to memory of 4900 4964 7ED5.tmp 95 PID 4900 wrote to memory of 1200 4900 7F42.tmp 96 PID 4900 wrote to memory of 1200 4900 7F42.tmp 96 PID 4900 wrote to memory of 1200 4900 7F42.tmp 96 PID 1200 wrote to memory of 1596 1200 7FBF.tmp 97 PID 1200 wrote to memory of 1596 1200 7FBF.tmp 97 PID 1200 wrote to memory of 1596 1200 7FBF.tmp 97 PID 1596 wrote to memory of 424 1596 801D.tmp 98 PID 1596 wrote to memory of 424 1596 801D.tmp 98 PID 1596 wrote to memory of 424 1596 801D.tmp 98 PID 424 wrote to memory of 4844 424 809A.tmp 99 PID 424 wrote to memory of 4844 424 809A.tmp 99 PID 424 wrote to memory of 4844 424 809A.tmp 99 PID 4844 wrote to memory of 3012 4844 8117.tmp 100 PID 4844 wrote to memory of 3012 4844 8117.tmp 100 PID 4844 wrote to memory of 3012 4844 8117.tmp 100 PID 3012 wrote to memory of 3912 3012 8165.tmp 101 PID 3012 wrote to memory of 3912 3012 8165.tmp 101 PID 3012 wrote to memory of 3912 3012 8165.tmp 101 PID 3912 wrote to memory of 1944 3912 81D2.tmp 102 PID 3912 wrote to memory of 1944 3912 81D2.tmp 102 PID 3912 wrote to memory of 1944 3912 81D2.tmp 102 PID 1944 wrote to memory of 760 1944 8230.tmp 103 PID 1944 wrote to memory of 760 1944 8230.tmp 103 PID 1944 wrote to memory of 760 1944 8230.tmp 103 PID 760 wrote to memory of 3596 760 827E.tmp 104 PID 760 wrote to memory of 3596 760 827E.tmp 104 PID 760 wrote to memory of 3596 760 827E.tmp 104 PID 3596 wrote to memory of 4116 3596 82DC.tmp 105 PID 3596 wrote to memory of 4116 3596 82DC.tmp 105 PID 3596 wrote to memory of 4116 3596 82DC.tmp 105 PID 4116 wrote to memory of 2340 4116 8349.tmp 106 PID 4116 wrote to memory of 2340 4116 8349.tmp 106 PID 4116 wrote to memory of 2340 4116 8349.tmp 106 PID 2340 wrote to memory of 1760 2340 83A7.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-12_893f60ddc84a33e0eea0cde5239dcb7f_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-12_893f60ddc84a33e0eea0cde5239dcb7f_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\7C35.tmp"C:\Users\Admin\AppData\Local\Temp\7C35.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\7E09.tmp"C:\Users\Admin\AppData\Local\Temp\7E09.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\7E77.tmp"C:\Users\Admin\AppData\Local\Temp\7E77.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\7F42.tmp"C:\Users\Admin\AppData\Local\Temp\7F42.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\801D.tmp"C:\Users\Admin\AppData\Local\Temp\801D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\809A.tmp"C:\Users\Admin\AppData\Local\Temp\809A.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:424 -
C:\Users\Admin\AppData\Local\Temp\8117.tmp"C:\Users\Admin\AppData\Local\Temp\8117.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\8165.tmp"C:\Users\Admin\AppData\Local\Temp\8165.tmp"16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\81D2.tmp"C:\Users\Admin\AppData\Local\Temp\81D2.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\8230.tmp"C:\Users\Admin\AppData\Local\Temp\8230.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\827E.tmp"C:\Users\Admin\AppData\Local\Temp\827E.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\82DC.tmp"C:\Users\Admin\AppData\Local\Temp\82DC.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\8349.tmp"C:\Users\Admin\AppData\Local\Temp\8349.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\83A7.tmp"C:\Users\Admin\AppData\Local\Temp\83A7.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\8414.tmp"C:\Users\Admin\AppData\Local\Temp\8414.tmp"23⤵
- Executes dropped EXE
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\8462.tmp"C:\Users\Admin\AppData\Local\Temp\8462.tmp"24⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\84B1.tmp"C:\Users\Admin\AppData\Local\Temp\84B1.tmp"25⤵
- Executes dropped EXE
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\852E.tmp"C:\Users\Admin\AppData\Local\Temp\852E.tmp"26⤵
- Executes dropped EXE
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\85AB.tmp"C:\Users\Admin\AppData\Local\Temp\85AB.tmp"27⤵
- Executes dropped EXE
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\8628.tmp"C:\Users\Admin\AppData\Local\Temp\8628.tmp"28⤵
- Executes dropped EXE
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\8676.tmp"C:\Users\Admin\AppData\Local\Temp\8676.tmp"29⤵
- Executes dropped EXE
PID:364 -
C:\Users\Admin\AppData\Local\Temp\86E3.tmp"C:\Users\Admin\AppData\Local\Temp\86E3.tmp"30⤵
- Executes dropped EXE
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\8750.tmp"C:\Users\Admin\AppData\Local\Temp\8750.tmp"31⤵
- Executes dropped EXE
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\879F.tmp"C:\Users\Admin\AppData\Local\Temp\879F.tmp"32⤵
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\87FC.tmp"C:\Users\Admin\AppData\Local\Temp\87FC.tmp"33⤵
- Executes dropped EXE
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\885A.tmp"C:\Users\Admin\AppData\Local\Temp\885A.tmp"34⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\88A8.tmp"C:\Users\Admin\AppData\Local\Temp\88A8.tmp"35⤵
- Executes dropped EXE
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\88F6.tmp"C:\Users\Admin\AppData\Local\Temp\88F6.tmp"36⤵
- Executes dropped EXE
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\8944.tmp"C:\Users\Admin\AppData\Local\Temp\8944.tmp"37⤵
- Executes dropped EXE
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\8993.tmp"C:\Users\Admin\AppData\Local\Temp\8993.tmp"38⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\89F0.tmp"C:\Users\Admin\AppData\Local\Temp\89F0.tmp"39⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"40⤵
- Executes dropped EXE
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"41⤵
- Executes dropped EXE
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"42⤵
- Executes dropped EXE
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\8B38.tmp"C:\Users\Admin\AppData\Local\Temp\8B38.tmp"43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\8B87.tmp"C:\Users\Admin\AppData\Local\Temp\8B87.tmp"44⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"45⤵
- Executes dropped EXE
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\8C42.tmp"C:\Users\Admin\AppData\Local\Temp\8C42.tmp"46⤵
- Executes dropped EXE
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"47⤵
- Executes dropped EXE
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"48⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"49⤵
- Executes dropped EXE
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"50⤵
- Executes dropped EXE
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\8DF8.tmp"C:\Users\Admin\AppData\Local\Temp\8DF8.tmp"51⤵
- Executes dropped EXE
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\8E55.tmp"C:\Users\Admin\AppData\Local\Temp\8E55.tmp"52⤵
- Executes dropped EXE
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"53⤵
- Executes dropped EXE
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\8F01.tmp"C:\Users\Admin\AppData\Local\Temp\8F01.tmp"54⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"55⤵
- Executes dropped EXE
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"56⤵
- Executes dropped EXE
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"57⤵
- Executes dropped EXE
PID:832 -
C:\Users\Admin\AppData\Local\Temp\9049.tmp"C:\Users\Admin\AppData\Local\Temp\9049.tmp"58⤵
- Executes dropped EXE
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\90A7.tmp"C:\Users\Admin\AppData\Local\Temp\90A7.tmp"59⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\90F5.tmp"C:\Users\Admin\AppData\Local\Temp\90F5.tmp"60⤵
- Executes dropped EXE
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\9143.tmp"C:\Users\Admin\AppData\Local\Temp\9143.tmp"61⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\91A1.tmp"C:\Users\Admin\AppData\Local\Temp\91A1.tmp"62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\91EF.tmp"C:\Users\Admin\AppData\Local\Temp\91EF.tmp"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\923D.tmp"C:\Users\Admin\AppData\Local\Temp\923D.tmp"64⤵
- Executes dropped EXE
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\928B.tmp"C:\Users\Admin\AppData\Local\Temp\928B.tmp"65⤵
- Executes dropped EXE
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\92DA.tmp"C:\Users\Admin\AppData\Local\Temp\92DA.tmp"66⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\9328.tmp"C:\Users\Admin\AppData\Local\Temp\9328.tmp"67⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\9385.tmp"C:\Users\Admin\AppData\Local\Temp\9385.tmp"68⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\93D4.tmp"C:\Users\Admin\AppData\Local\Temp\93D4.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\9431.tmp"C:\Users\Admin\AppData\Local\Temp\9431.tmp"70⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\948F.tmp"C:\Users\Admin\AppData\Local\Temp\948F.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\94DD.tmp"C:\Users\Admin\AppData\Local\Temp\94DD.tmp"72⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\953B.tmp"C:\Users\Admin\AppData\Local\Temp\953B.tmp"73⤵
- System Location Discovery: System Language Discovery
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\9599.tmp"C:\Users\Admin\AppData\Local\Temp\9599.tmp"74⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\95E7.tmp"C:\Users\Admin\AppData\Local\Temp\95E7.tmp"75⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\9635.tmp"C:\Users\Admin\AppData\Local\Temp\9635.tmp"76⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\9693.tmp"C:\Users\Admin\AppData\Local\Temp\9693.tmp"77⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\96E1.tmp"C:\Users\Admin\AppData\Local\Temp\96E1.tmp"78⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\973F.tmp"C:\Users\Admin\AppData\Local\Temp\973F.tmp"79⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\978D.tmp"C:\Users\Admin\AppData\Local\Temp\978D.tmp"80⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\97EA.tmp"C:\Users\Admin\AppData\Local\Temp\97EA.tmp"81⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\9848.tmp"C:\Users\Admin\AppData\Local\Temp\9848.tmp"82⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\98A6.tmp"C:\Users\Admin\AppData\Local\Temp\98A6.tmp"83⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\98F4.tmp"C:\Users\Admin\AppData\Local\Temp\98F4.tmp"84⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\9942.tmp"C:\Users\Admin\AppData\Local\Temp\9942.tmp"85⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\9990.tmp"C:\Users\Admin\AppData\Local\Temp\9990.tmp"86⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\99DE.tmp"C:\Users\Admin\AppData\Local\Temp\99DE.tmp"87⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"88⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"89⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"90⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\9B27.tmp"C:\Users\Admin\AppData\Local\Temp\9B27.tmp"91⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"92⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"93⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\9C30.tmp"C:\Users\Admin\AppData\Local\Temp\9C30.tmp"94⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"95⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"96⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"97⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\9D98.tmp"C:\Users\Admin\AppData\Local\Temp\9D98.tmp"98⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"99⤵
- System Location Discovery: System Language Discovery
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\9E34.tmp"C:\Users\Admin\AppData\Local\Temp\9E34.tmp"100⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\9E92.tmp"C:\Users\Admin\AppData\Local\Temp\9E92.tmp"101⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"102⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"103⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"104⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"105⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\A028.tmp"C:\Users\Admin\AppData\Local\Temp\A028.tmp"106⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\A076.tmp"C:\Users\Admin\AppData\Local\Temp\A076.tmp"107⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"108⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\A122.tmp"C:\Users\Admin\AppData\Local\Temp\A122.tmp"109⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\A180.tmp"C:\Users\Admin\AppData\Local\Temp\A180.tmp"110⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"111⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\A23B.tmp"C:\Users\Admin\AppData\Local\Temp\A23B.tmp"112⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\A289.tmp"C:\Users\Admin\AppData\Local\Temp\A289.tmp"113⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"114⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\A345.tmp"C:\Users\Admin\AppData\Local\Temp\A345.tmp"115⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\A393.tmp"C:\Users\Admin\AppData\Local\Temp\A393.tmp"116⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"117⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\A42F.tmp"C:\Users\Admin\AppData\Local\Temp\A42F.tmp"118⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\A48D.tmp"C:\Users\Admin\AppData\Local\Temp\A48D.tmp"119⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"120⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\A539.tmp"C:\Users\Admin\AppData\Local\Temp\A539.tmp"121⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\A587.tmp"C:\Users\Admin\AppData\Local\Temp\A587.tmp"122⤵PID:4548
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-