Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-11-2024 13:02
Static task
static1
Behavioral task
behavioral1
Sample
2024-11-21_7263d56b53ca4061862bacfe987075d8_mafia.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2024-11-21_7263d56b53ca4061862bacfe987075d8_mafia.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-11-21_7263d56b53ca4061862bacfe987075d8_mafia.exe
-
Size
536KB
-
MD5
7263d56b53ca4061862bacfe987075d8
-
SHA1
8dc3a3cae98316e9992baf31baff01f539c34f02
-
SHA256
ab985b5446601338613643e5a2fbb1121fac1feef875e1c7e5b5543cae1223b5
-
SHA512
ccef60adb3a2ed4051f6e6c02e0fd9046ee7a180735d42dc9bc3a7b3bad77be8da88e2a5611dbd873ba23aefa2f06a0fc4d08fcda0a3f339aa580bd31bf6a60d
-
SSDEEP
12288:wU5rCOTeiUAzguiXynNgteoIZxVJ0ZT9:wUQOJUcNiXyNgJIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4288 7D0F.tmp 1508 7E19.tmp 3620 7F52.tmp 3864 80B9.tmp 1088 8184.tmp 4800 8211.tmp 216 82FB.tmp 4432 83A7.tmp 2408 8453.tmp 3992 851E.tmp 3036 8628.tmp 3180 86C4.tmp 224 8760.tmp 3384 884A.tmp 2884 8944.tmp 4604 8A10.tmp 2980 8ABB.tmp 4120 8B58.tmp 2668 8C42.tmp 2116 8CDE.tmp 4804 8DA9.tmp 368 8E84.tmp 2432 8F9D.tmp 1228 9097.tmp 2880 9114.tmp 1680 91E0.tmp 2228 92CA.tmp 3880 9395.tmp 2540 9470.tmp 4484 952B.tmp 4460 95D7.tmp 2812 96A2.tmp 4796 976D.tmp 3724 97DB.tmp 448 9867.tmp 4436 9904.tmp 4912 9961.tmp 2864 99DE.tmp 3760 9A3C.tmp 4800 9AB9.tmp 1008 9B36.tmp 4116 9BA4.tmp 2408 9C11.tmp 664 9CBD.tmp 2572 9D3A.tmp 2716 9DE6.tmp 1820 9E82.tmp 2944 9F0F.tmp 5036 9F9B.tmp 3628 9FF9.tmp 2564 A057.tmp 4852 A0B4.tmp 4712 A122.tmp 2216 A18F.tmp 68 A1ED.tmp 4264 A25A.tmp 5076 A2A8.tmp 3220 A306.tmp 1072 A374.tmp 4120 A3C2.tmp 4932 A410.tmp 2904 A45E.tmp 4788 A4BC.tmp 2176 A519.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E00A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1085.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 197E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B10B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C743.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E436.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E87B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3350.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5138.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F55C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE24.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C14C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4929.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8920.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B561.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FC3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A803.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF42.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9788.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DD8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B36.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4457.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5004 wrote to memory of 4288 5004 2024-11-21_7263d56b53ca4061862bacfe987075d8_mafia.exe 83 PID 5004 wrote to memory of 4288 5004 2024-11-21_7263d56b53ca4061862bacfe987075d8_mafia.exe 83 PID 5004 wrote to memory of 4288 5004 2024-11-21_7263d56b53ca4061862bacfe987075d8_mafia.exe 83 PID 4288 wrote to memory of 1508 4288 7D0F.tmp 84 PID 4288 wrote to memory of 1508 4288 7D0F.tmp 84 PID 4288 wrote to memory of 1508 4288 7D0F.tmp 84 PID 1508 wrote to memory of 3620 1508 7E19.tmp 85 PID 1508 wrote to memory of 3620 1508 7E19.tmp 85 PID 1508 wrote to memory of 3620 1508 7E19.tmp 85 PID 3620 wrote to memory of 3864 3620 7F52.tmp 86 PID 3620 wrote to memory of 3864 3620 7F52.tmp 86 PID 3620 wrote to memory of 3864 3620 7F52.tmp 86 PID 3864 wrote to memory of 1088 3864 80B9.tmp 87 PID 3864 wrote to memory of 1088 3864 80B9.tmp 87 PID 3864 wrote to memory of 1088 3864 80B9.tmp 87 PID 1088 wrote to memory of 4800 1088 8184.tmp 88 PID 1088 wrote to memory of 4800 1088 8184.tmp 88 PID 1088 wrote to memory of 4800 1088 8184.tmp 88 PID 4800 wrote to memory of 216 4800 8211.tmp 89 PID 4800 wrote to memory of 216 4800 8211.tmp 89 PID 4800 wrote to memory of 216 4800 8211.tmp 89 PID 216 wrote to memory of 4432 216 82FB.tmp 90 PID 216 wrote to memory of 4432 216 82FB.tmp 90 PID 216 wrote to memory of 4432 216 82FB.tmp 90 PID 4432 wrote to memory of 2408 4432 83A7.tmp 91 PID 4432 wrote to memory of 2408 4432 83A7.tmp 91 PID 4432 wrote to memory of 2408 4432 83A7.tmp 91 PID 2408 wrote to memory of 3992 2408 8453.tmp 92 PID 2408 wrote to memory of 3992 2408 8453.tmp 92 PID 2408 wrote to memory of 3992 2408 8453.tmp 92 PID 3992 wrote to memory of 3036 3992 851E.tmp 93 PID 3992 wrote to memory of 3036 3992 851E.tmp 93 PID 3992 wrote to memory of 3036 3992 851E.tmp 93 PID 3036 wrote to memory of 3180 3036 8628.tmp 94 PID 3036 wrote to memory of 3180 3036 8628.tmp 94 PID 3036 wrote to memory of 3180 3036 8628.tmp 94 PID 3180 wrote to memory of 224 3180 86C4.tmp 95 PID 3180 wrote to memory of 224 3180 86C4.tmp 95 PID 3180 wrote to memory of 224 3180 86C4.tmp 95 PID 224 wrote to memory of 3384 224 8760.tmp 96 PID 224 wrote to memory of 3384 224 8760.tmp 96 PID 224 wrote to memory of 3384 224 8760.tmp 96 PID 3384 wrote to memory of 2884 3384 884A.tmp 97 PID 3384 wrote to memory of 2884 3384 884A.tmp 97 PID 3384 wrote to memory of 2884 3384 884A.tmp 97 PID 2884 wrote to memory of 4604 2884 8944.tmp 100 PID 2884 wrote to memory of 4604 2884 8944.tmp 100 PID 2884 wrote to memory of 4604 2884 8944.tmp 100 PID 4604 wrote to memory of 2980 4604 8A10.tmp 101 PID 4604 wrote to memory of 2980 4604 8A10.tmp 101 PID 4604 wrote to memory of 2980 4604 8A10.tmp 101 PID 2980 wrote to memory of 4120 2980 8ABB.tmp 102 PID 2980 wrote to memory of 4120 2980 8ABB.tmp 102 PID 2980 wrote to memory of 4120 2980 8ABB.tmp 102 PID 4120 wrote to memory of 2668 4120 8B58.tmp 103 PID 4120 wrote to memory of 2668 4120 8B58.tmp 103 PID 4120 wrote to memory of 2668 4120 8B58.tmp 103 PID 2668 wrote to memory of 2116 2668 8C42.tmp 104 PID 2668 wrote to memory of 2116 2668 8C42.tmp 104 PID 2668 wrote to memory of 2116 2668 8C42.tmp 104 PID 2116 wrote to memory of 4804 2116 8CDE.tmp 105 PID 2116 wrote to memory of 4804 2116 8CDE.tmp 105 PID 2116 wrote to memory of 4804 2116 8CDE.tmp 105 PID 4804 wrote to memory of 368 4804 8DA9.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-21_7263d56b53ca4061862bacfe987075d8_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-21_7263d56b53ca4061862bacfe987075d8_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\7E19.tmp"C:\Users\Admin\AppData\Local\Temp\7E19.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\7F52.tmp"C:\Users\Admin\AppData\Local\Temp\7F52.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\80B9.tmp"C:\Users\Admin\AppData\Local\Temp\80B9.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\8184.tmp"C:\Users\Admin\AppData\Local\Temp\8184.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\8211.tmp"C:\Users\Admin\AppData\Local\Temp\8211.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\82FB.tmp"C:\Users\Admin\AppData\Local\Temp\82FB.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Users\Admin\AppData\Local\Temp\83A7.tmp"C:\Users\Admin\AppData\Local\Temp\83A7.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\8453.tmp"C:\Users\Admin\AppData\Local\Temp\8453.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\851E.tmp"C:\Users\Admin\AppData\Local\Temp\851E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\8628.tmp"C:\Users\Admin\AppData\Local\Temp\8628.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\86C4.tmp"C:\Users\Admin\AppData\Local\Temp\86C4.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\8760.tmp"C:\Users\Admin\AppData\Local\Temp\8760.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\884A.tmp"C:\Users\Admin\AppData\Local\Temp\884A.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\8944.tmp"C:\Users\Admin\AppData\Local\Temp\8944.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\8A10.tmp"C:\Users\Admin\AppData\Local\Temp\8A10.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\8B58.tmp"C:\Users\Admin\AppData\Local\Temp\8B58.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\8C42.tmp"C:\Users\Admin\AppData\Local\Temp\8C42.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\8E84.tmp"C:\Users\Admin\AppData\Local\Temp\8E84.tmp"23⤵
- Executes dropped EXE
PID:368 -
C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"24⤵
- Executes dropped EXE
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\9097.tmp"C:\Users\Admin\AppData\Local\Temp\9097.tmp"25⤵
- Executes dropped EXE
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\9114.tmp"C:\Users\Admin\AppData\Local\Temp\9114.tmp"26⤵
- Executes dropped EXE
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\91E0.tmp"C:\Users\Admin\AppData\Local\Temp\91E0.tmp"27⤵
- Executes dropped EXE
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\92CA.tmp"C:\Users\Admin\AppData\Local\Temp\92CA.tmp"28⤵
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\9395.tmp"C:\Users\Admin\AppData\Local\Temp\9395.tmp"29⤵
- Executes dropped EXE
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\9470.tmp"C:\Users\Admin\AppData\Local\Temp\9470.tmp"30⤵
- Executes dropped EXE
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\952B.tmp"C:\Users\Admin\AppData\Local\Temp\952B.tmp"31⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\95D7.tmp"C:\Users\Admin\AppData\Local\Temp\95D7.tmp"32⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\96A2.tmp"C:\Users\Admin\AppData\Local\Temp\96A2.tmp"33⤵
- Executes dropped EXE
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\976D.tmp"C:\Users\Admin\AppData\Local\Temp\976D.tmp"34⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\97DB.tmp"C:\Users\Admin\AppData\Local\Temp\97DB.tmp"35⤵
- Executes dropped EXE
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\9867.tmp"C:\Users\Admin\AppData\Local\Temp\9867.tmp"36⤵
- Executes dropped EXE
PID:448 -
C:\Users\Admin\AppData\Local\Temp\9904.tmp"C:\Users\Admin\AppData\Local\Temp\9904.tmp"37⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\9961.tmp"C:\Users\Admin\AppData\Local\Temp\9961.tmp"38⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\99DE.tmp"C:\Users\Admin\AppData\Local\Temp\99DE.tmp"39⤵
- Executes dropped EXE
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"40⤵
- Executes dropped EXE
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"41⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"42⤵
- Executes dropped EXE
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"43⤵
- Executes dropped EXE
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\9C11.tmp"C:\Users\Admin\AppData\Local\Temp\9C11.tmp"44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"45⤵
- Executes dropped EXE
PID:664 -
C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"46⤵
- Executes dropped EXE
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"47⤵
- Executes dropped EXE
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\9E82.tmp"C:\Users\Admin\AppData\Local\Temp\9E82.tmp"48⤵
- Executes dropped EXE
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"50⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"51⤵
- Executes dropped EXE
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\A057.tmp"C:\Users\Admin\AppData\Local\Temp\A057.tmp"52⤵
- Executes dropped EXE
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"53⤵
- Executes dropped EXE
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\A122.tmp"C:\Users\Admin\AppData\Local\Temp\A122.tmp"54⤵
- Executes dropped EXE
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\A18F.tmp"C:\Users\Admin\AppData\Local\Temp\A18F.tmp"55⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"56⤵
- Executes dropped EXE
PID:68 -
C:\Users\Admin\AppData\Local\Temp\A25A.tmp"C:\Users\Admin\AppData\Local\Temp\A25A.tmp"57⤵
- Executes dropped EXE
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"58⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\A306.tmp"C:\Users\Admin\AppData\Local\Temp\A306.tmp"59⤵
- Executes dropped EXE
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\A374.tmp"C:\Users\Admin\AppData\Local\Temp\A374.tmp"60⤵
- Executes dropped EXE
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"61⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\A410.tmp"C:\Users\Admin\AppData\Local\Temp\A410.tmp"62⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\A45E.tmp"C:\Users\Admin\AppData\Local\Temp\A45E.tmp"63⤵
- Executes dropped EXE
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"64⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\A519.tmp"C:\Users\Admin\AppData\Local\Temp\A519.tmp"65⤵
- Executes dropped EXE
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\A577.tmp"C:\Users\Admin\AppData\Local\Temp\A577.tmp"66⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"67⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\A623.tmp"C:\Users\Admin\AppData\Local\Temp\A623.tmp"68⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\A681.tmp"C:\Users\Admin\AppData\Local\Temp\A681.tmp"69⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"70⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\A73C.tmp"C:\Users\Admin\AppData\Local\Temp\A73C.tmp"71⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\A79A.tmp"C:\Users\Admin\AppData\Local\Temp\A79A.tmp"72⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"73⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\A856.tmp"C:\Users\Admin\AppData\Local\Temp\A856.tmp"74⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"75⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\A911.tmp"C:\Users\Admin\AppData\Local\Temp\A911.tmp"76⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\A96F.tmp"C:\Users\Admin\AppData\Local\Temp\A96F.tmp"77⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"78⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"79⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\AA78.tmp"C:\Users\Admin\AppData\Local\Temp\AA78.tmp"80⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"81⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\AB34.tmp"C:\Users\Admin\AppData\Local\Temp\AB34.tmp"82⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\AB82.tmp"C:\Users\Admin\AppData\Local\Temp\AB82.tmp"83⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"84⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"85⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"86⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"87⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\AD57.tmp"C:\Users\Admin\AppData\Local\Temp\AD57.tmp"88⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\ADC4.tmp"C:\Users\Admin\AppData\Local\Temp\ADC4.tmp"89⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\AE22.tmp"C:\Users\Admin\AppData\Local\Temp\AE22.tmp"90⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"91⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"92⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"93⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"94⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\B026.tmp"C:\Users\Admin\AppData\Local\Temp\B026.tmp"95⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\B083.tmp"C:\Users\Admin\AppData\Local\Temp\B083.tmp"96⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"97⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\B12F.tmp"C:\Users\Admin\AppData\Local\Temp\B12F.tmp"98⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\B18D.tmp"C:\Users\Admin\AppData\Local\Temp\B18D.tmp"99⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"100⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\B258.tmp"C:\Users\Admin\AppData\Local\Temp\B258.tmp"101⤵PID:68
-
C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"102⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\B323.tmp"C:\Users\Admin\AppData\Local\Temp\B323.tmp"103⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\B371.tmp"C:\Users\Admin\AppData\Local\Temp\B371.tmp"104⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"105⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\B42D.tmp"C:\Users\Admin\AppData\Local\Temp\B42D.tmp"106⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\B48B.tmp"C:\Users\Admin\AppData\Local\Temp\B48B.tmp"107⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"108⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\B536.tmp"C:\Users\Admin\AppData\Local\Temp\B536.tmp"109⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\B594.tmp"C:\Users\Admin\AppData\Local\Temp\B594.tmp"110⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\B602.tmp"C:\Users\Admin\AppData\Local\Temp\B602.tmp"111⤵PID:588
-
C:\Users\Admin\AppData\Local\Temp\B65F.tmp"C:\Users\Admin\AppData\Local\Temp\B65F.tmp"112⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"113⤵
- System Location Discovery: System Language Discovery
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\B70B.tmp"C:\Users\Admin\AppData\Local\Temp\B70B.tmp"114⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\B779.tmp"C:\Users\Admin\AppData\Local\Temp\B779.tmp"115⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"116⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\B844.tmp"C:\Users\Admin\AppData\Local\Temp\B844.tmp"117⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"118⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\B91E.tmp"C:\Users\Admin\AppData\Local\Temp\B91E.tmp"119⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\B96D.tmp"C:\Users\Admin\AppData\Local\Temp\B96D.tmp"120⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"121⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\BA28.tmp"C:\Users\Admin\AppData\Local\Temp\BA28.tmp"122⤵PID:3196
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-