Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-11-2024 13:03
Static task
static1
Behavioral task
behavioral1
Sample
2024-11-21_c64c64e327a0e20e287e6e7b05bb4a3f_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-11-21_c64c64e327a0e20e287e6e7b05bb4a3f_mafia.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-11-21_c64c64e327a0e20e287e6e7b05bb4a3f_mafia.exe
-
Size
536KB
-
MD5
c64c64e327a0e20e287e6e7b05bb4a3f
-
SHA1
96d7376552fcf4b59fb0a7a223df966e194de1b0
-
SHA256
d07f391929c2d8fef470499038d47be6ec75ad238b5f921f6f931c44f6a90665
-
SHA512
67e7f3c12d29e706712392039afcb4e718f9947c376c7410e221d72ddc92c07aed13da8323c9cc632442691283100e772f9c0b4fed17e22383ff56ba729d3e55
-
SSDEEP
12288:wU5rCOTeiUxCNQNNvrUVQyxIZxVJ0ZT9:wUQOJUaV5xIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
Processes:
8ABB.tmp8B77.tmp8C04.tmp8CDE.tmp8DE8.tmp8E75.tmp8F30.tmp8FFB.tmp9078.tmp90E6.tmp91C0.tmp927C.tmp9366.tmp93D4.tmp9451.tmp94CE.tmp952B.tmp9599.tmp9625.tmp9693.tmp9700.tmp977D.tmp97EA.tmp98C5.tmp9952.tmp99DE.tmp9A8A.tmp9B07.tmp9BA4.tmp9C21.tmp9CBD.tmp9D3A.tmp9E24.tmp9E92.tmp9F3D.tmp9F9B.tmp9FF9.tmpA057.tmpA0C4.tmpA141.tmpA19F.tmpA20C.tmpA27A.tmpA2E7.tmpA345.tmpA3B2.tmpA44E.tmpA49C.tmpA4EB.tmpA548.tmpA596.tmpA5F4.tmpA642.tmpA690.tmpA6DF.tmpA73C.tmpA78A.tmpA7D9.tmpA836.tmpA884.tmpA8E2.tmpA930.tmpA98E.tmpA9DC.tmppid process 5016 8ABB.tmp 4260 8B77.tmp 3808 8C04.tmp 1396 8CDE.tmp 3012 8DE8.tmp 1884 8E75.tmp 5040 8F30.tmp 2444 8FFB.tmp 3988 9078.tmp 4960 90E6.tmp 2620 91C0.tmp 1216 927C.tmp 4296 9366.tmp 1952 93D4.tmp 2676 9451.tmp 2992 94CE.tmp 4984 952B.tmp 3300 9599.tmp 3948 9625.tmp 1644 9693.tmp 316 9700.tmp 3428 977D.tmp 828 97EA.tmp 628 98C5.tmp 944 9952.tmp 2144 99DE.tmp 3392 9A8A.tmp 4748 9B07.tmp 2320 9BA4.tmp 2272 9C21.tmp 832 9CBD.tmp 4412 9D3A.tmp 1476 9E24.tmp 4788 9E92.tmp 2908 9F3D.tmp 464 9F9B.tmp 2692 9FF9.tmp 3824 A057.tmp 2940 A0C4.tmp 4408 A141.tmp 4312 A19F.tmp 4188 A20C.tmp 3820 A27A.tmp 2800 A2E7.tmp 3032 A345.tmp 3388 A3B2.tmp 2168 A44E.tmp 4624 A49C.tmp 4956 A4EB.tmp 1396 A548.tmp 3912 A596.tmp 3496 A5F4.tmp 3908 A642.tmp 5040 A690.tmp 2444 A6DF.tmp 3612 A73C.tmp 2896 A78A.tmp 948 A7D9.tmp 1252 A836.tmp 232 A884.tmp 1216 A8E2.tmp 2596 A930.tmp 2360 A98E.tmp 3560 A9DC.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
ED39.tmpA836.tmp410B.tmpB9A6.tmpB391.tmp1875.tmpEB94.tmp71FF.tmp849C.tmpE704.tmpF983.tmp606.tmp3880.tmpD983.tmpEE33.tmpF29D.tmp2FE5.tmp341B.tmpA7D9.tmpC7FE.tmp6ACB.tmpD35D.tmpEDFA.tmp21CB.tmp4F63.tmp97E6.tmp99F9.tmpA2B3.tmpD712.tmpA5F4.tmpECA2.tmpF3B6.tmpDDC8.tmp923.tmp489D.tmpDE26.tmpE426.tmpEBF6.tmpF6E3.tmpdescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A836.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 410B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B391.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1875.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 849C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E704.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F983.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 606.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3880.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D983.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F29D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 341B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6ACB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D35D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D712.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECA2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDC8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 923.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 489D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E426.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBF6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-11-21_c64c64e327a0e20e287e6e7b05bb4a3f_mafia.exe8ABB.tmp8B77.tmp8C04.tmp8CDE.tmp8DE8.tmp8E75.tmp8F30.tmp8FFB.tmp9078.tmp90E6.tmp91C0.tmp927C.tmp9366.tmp93D4.tmp9451.tmp94CE.tmp952B.tmp9599.tmp9625.tmp9693.tmp9700.tmpdescription pid process target process PID 3140 wrote to memory of 5016 3140 2024-11-21_c64c64e327a0e20e287e6e7b05bb4a3f_mafia.exe 8ABB.tmp PID 3140 wrote to memory of 5016 3140 2024-11-21_c64c64e327a0e20e287e6e7b05bb4a3f_mafia.exe 8ABB.tmp PID 3140 wrote to memory of 5016 3140 2024-11-21_c64c64e327a0e20e287e6e7b05bb4a3f_mafia.exe 8ABB.tmp PID 5016 wrote to memory of 4260 5016 8ABB.tmp 8B77.tmp PID 5016 wrote to memory of 4260 5016 8ABB.tmp 8B77.tmp PID 5016 wrote to memory of 4260 5016 8ABB.tmp 8B77.tmp PID 4260 wrote to memory of 3808 4260 8B77.tmp 8C04.tmp PID 4260 wrote to memory of 3808 4260 8B77.tmp 8C04.tmp PID 4260 wrote to memory of 3808 4260 8B77.tmp 8C04.tmp PID 3808 wrote to memory of 1396 3808 8C04.tmp 8CDE.tmp PID 3808 wrote to memory of 1396 3808 8C04.tmp 8CDE.tmp PID 3808 wrote to memory of 1396 3808 8C04.tmp 8CDE.tmp PID 1396 wrote to memory of 3012 1396 8CDE.tmp 8DE8.tmp PID 1396 wrote to memory of 3012 1396 8CDE.tmp 8DE8.tmp PID 1396 wrote to memory of 3012 1396 8CDE.tmp 8DE8.tmp PID 3012 wrote to memory of 1884 3012 8DE8.tmp 8E75.tmp PID 3012 wrote to memory of 1884 3012 8DE8.tmp 8E75.tmp PID 3012 wrote to memory of 1884 3012 8DE8.tmp 8E75.tmp PID 1884 wrote to memory of 5040 1884 8E75.tmp 8F30.tmp PID 1884 wrote to memory of 5040 1884 8E75.tmp 8F30.tmp PID 1884 wrote to memory of 5040 1884 8E75.tmp 8F30.tmp PID 5040 wrote to memory of 2444 5040 8F30.tmp 8FFB.tmp PID 5040 wrote to memory of 2444 5040 8F30.tmp 8FFB.tmp PID 5040 wrote to memory of 2444 5040 8F30.tmp 8FFB.tmp PID 2444 wrote to memory of 3988 2444 8FFB.tmp 9078.tmp PID 2444 wrote to memory of 3988 2444 8FFB.tmp 9078.tmp PID 2444 wrote to memory of 3988 2444 8FFB.tmp 9078.tmp PID 3988 wrote to memory of 4960 3988 9078.tmp 90E6.tmp PID 3988 wrote to memory of 4960 3988 9078.tmp 90E6.tmp PID 3988 wrote to memory of 4960 3988 9078.tmp 90E6.tmp PID 4960 wrote to memory of 2620 4960 90E6.tmp 91C0.tmp PID 4960 wrote to memory of 2620 4960 90E6.tmp 91C0.tmp PID 4960 wrote to memory of 2620 4960 90E6.tmp 91C0.tmp PID 2620 wrote to memory of 1216 2620 91C0.tmp 927C.tmp PID 2620 wrote to memory of 1216 2620 91C0.tmp 927C.tmp PID 2620 wrote to memory of 1216 2620 91C0.tmp 927C.tmp PID 1216 wrote to memory of 4296 1216 927C.tmp 9366.tmp PID 1216 wrote to memory of 4296 1216 927C.tmp 9366.tmp PID 1216 wrote to memory of 4296 1216 927C.tmp 9366.tmp PID 4296 wrote to memory of 1952 4296 9366.tmp 93D4.tmp PID 4296 wrote to memory of 1952 4296 9366.tmp 93D4.tmp PID 4296 wrote to memory of 1952 4296 9366.tmp 93D4.tmp PID 1952 wrote to memory of 2676 1952 93D4.tmp 9451.tmp PID 1952 wrote to memory of 2676 1952 93D4.tmp 9451.tmp PID 1952 wrote to memory of 2676 1952 93D4.tmp 9451.tmp PID 2676 wrote to memory of 2992 2676 9451.tmp 94CE.tmp PID 2676 wrote to memory of 2992 2676 9451.tmp 94CE.tmp PID 2676 wrote to memory of 2992 2676 9451.tmp 94CE.tmp PID 2992 wrote to memory of 4984 2992 94CE.tmp 952B.tmp PID 2992 wrote to memory of 4984 2992 94CE.tmp 952B.tmp PID 2992 wrote to memory of 4984 2992 94CE.tmp 952B.tmp PID 4984 wrote to memory of 3300 4984 952B.tmp 9599.tmp PID 4984 wrote to memory of 3300 4984 952B.tmp 9599.tmp PID 4984 wrote to memory of 3300 4984 952B.tmp 9599.tmp PID 3300 wrote to memory of 3948 3300 9599.tmp 9625.tmp PID 3300 wrote to memory of 3948 3300 9599.tmp 9625.tmp PID 3300 wrote to memory of 3948 3300 9599.tmp 9625.tmp PID 3948 wrote to memory of 1644 3948 9625.tmp 9693.tmp PID 3948 wrote to memory of 1644 3948 9625.tmp 9693.tmp PID 3948 wrote to memory of 1644 3948 9625.tmp 9693.tmp PID 1644 wrote to memory of 316 1644 9693.tmp 9700.tmp PID 1644 wrote to memory of 316 1644 9693.tmp 9700.tmp PID 1644 wrote to memory of 316 1644 9693.tmp 9700.tmp PID 316 wrote to memory of 3428 316 9700.tmp 977D.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-21_c64c64e327a0e20e287e6e7b05bb4a3f_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-21_c64c64e327a0e20e287e6e7b05bb4a3f_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\8B77.tmp"C:\Users\Admin\AppData\Local\Temp\8B77.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\8C04.tmp"C:\Users\Admin\AppData\Local\Temp\8C04.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\8DE8.tmp"C:\Users\Admin\AppData\Local\Temp\8DE8.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\8E75.tmp"C:\Users\Admin\AppData\Local\Temp\8E75.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\8F30.tmp"C:\Users\Admin\AppData\Local\Temp\8F30.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\9078.tmp"C:\Users\Admin\AppData\Local\Temp\9078.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\90E6.tmp"C:\Users\Admin\AppData\Local\Temp\90E6.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\91C0.tmp"C:\Users\Admin\AppData\Local\Temp\91C0.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\927C.tmp"C:\Users\Admin\AppData\Local\Temp\927C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\9366.tmp"C:\Users\Admin\AppData\Local\Temp\9366.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\93D4.tmp"C:\Users\Admin\AppData\Local\Temp\93D4.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\9451.tmp"C:\Users\Admin\AppData\Local\Temp\9451.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\94CE.tmp"C:\Users\Admin\AppData\Local\Temp\94CE.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\952B.tmp"C:\Users\Admin\AppData\Local\Temp\952B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\9599.tmp"C:\Users\Admin\AppData\Local\Temp\9599.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\9625.tmp"C:\Users\Admin\AppData\Local\Temp\9625.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\9693.tmp"C:\Users\Admin\AppData\Local\Temp\9693.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\9700.tmp"C:\Users\Admin\AppData\Local\Temp\9700.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Users\Admin\AppData\Local\Temp\977D.tmp"C:\Users\Admin\AppData\Local\Temp\977D.tmp"23⤵
- Executes dropped EXE
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\97EA.tmp"C:\Users\Admin\AppData\Local\Temp\97EA.tmp"24⤵
- Executes dropped EXE
PID:828 -
C:\Users\Admin\AppData\Local\Temp\98C5.tmp"C:\Users\Admin\AppData\Local\Temp\98C5.tmp"25⤵
- Executes dropped EXE
PID:628 -
C:\Users\Admin\AppData\Local\Temp\9952.tmp"C:\Users\Admin\AppData\Local\Temp\9952.tmp"26⤵
- Executes dropped EXE
PID:944 -
C:\Users\Admin\AppData\Local\Temp\99DE.tmp"C:\Users\Admin\AppData\Local\Temp\99DE.tmp"27⤵
- Executes dropped EXE
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"28⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\9B07.tmp"C:\Users\Admin\AppData\Local\Temp\9B07.tmp"29⤵
- Executes dropped EXE
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"30⤵
- Executes dropped EXE
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\9C21.tmp"C:\Users\Admin\AppData\Local\Temp\9C21.tmp"31⤵
- Executes dropped EXE
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"32⤵
- Executes dropped EXE
PID:832 -
C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"33⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\9E24.tmp"C:\Users\Admin\AppData\Local\Temp\9E24.tmp"34⤵
- Executes dropped EXE
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\9E92.tmp"C:\Users\Admin\AppData\Local\Temp\9E92.tmp"35⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"36⤵
- Executes dropped EXE
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"37⤵
- Executes dropped EXE
PID:464 -
C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"38⤵
- Executes dropped EXE
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\A057.tmp"C:\Users\Admin\AppData\Local\Temp\A057.tmp"39⤵
- Executes dropped EXE
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"40⤵
- Executes dropped EXE
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\A141.tmp"C:\Users\Admin\AppData\Local\Temp\A141.tmp"41⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\A19F.tmp"C:\Users\Admin\AppData\Local\Temp\A19F.tmp"42⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\A20C.tmp"C:\Users\Admin\AppData\Local\Temp\A20C.tmp"43⤵
- Executes dropped EXE
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\A27A.tmp"C:\Users\Admin\AppData\Local\Temp\A27A.tmp"44⤵
- Executes dropped EXE
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"45⤵
- Executes dropped EXE
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\A345.tmp"C:\Users\Admin\AppData\Local\Temp\A345.tmp"46⤵
- Executes dropped EXE
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"47⤵
- Executes dropped EXE
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\A44E.tmp"C:\Users\Admin\AppData\Local\Temp\A44E.tmp"48⤵
- Executes dropped EXE
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\A49C.tmp"C:\Users\Admin\AppData\Local\Temp\A49C.tmp"49⤵
- Executes dropped EXE
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"50⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\A548.tmp"C:\Users\Admin\AppData\Local\Temp\A548.tmp"51⤵
- Executes dropped EXE
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\A596.tmp"C:\Users\Admin\AppData\Local\Temp\A596.tmp"52⤵
- Executes dropped EXE
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\A642.tmp"C:\Users\Admin\AppData\Local\Temp\A642.tmp"54⤵
- Executes dropped EXE
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\A690.tmp"C:\Users\Admin\AppData\Local\Temp\A690.tmp"55⤵
- Executes dropped EXE
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"56⤵
- Executes dropped EXE
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\A73C.tmp"C:\Users\Admin\AppData\Local\Temp\A73C.tmp"57⤵
- Executes dropped EXE
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\A78A.tmp"C:\Users\Admin\AppData\Local\Temp\A78A.tmp"58⤵
- Executes dropped EXE
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:948 -
C:\Users\Admin\AppData\Local\Temp\A836.tmp"C:\Users\Admin\AppData\Local\Temp\A836.tmp"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\A884.tmp"C:\Users\Admin\AppData\Local\Temp\A884.tmp"61⤵
- Executes dropped EXE
PID:232 -
C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"62⤵
- Executes dropped EXE
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\A930.tmp"C:\Users\Admin\AppData\Local\Temp\A930.tmp"63⤵
- Executes dropped EXE
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\A98E.tmp"C:\Users\Admin\AppData\Local\Temp\A98E.tmp"64⤵
- Executes dropped EXE
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"65⤵
- Executes dropped EXE
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\AA59.tmp"C:\Users\Admin\AppData\Local\Temp\AA59.tmp"66⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"67⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\AB05.tmp"C:\Users\Admin\AppData\Local\Temp\AB05.tmp"68⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\AB63.tmp"C:\Users\Admin\AppData\Local\Temp\AB63.tmp"69⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"70⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"71⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"72⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"73⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\AD09.tmp"C:\Users\Admin\AppData\Local\Temp\AD09.tmp"74⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\AD66.tmp"C:\Users\Admin\AppData\Local\Temp\AD66.tmp"75⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\ADC4.tmp"C:\Users\Admin\AppData\Local\Temp\ADC4.tmp"76⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\AE22.tmp"C:\Users\Admin\AppData\Local\Temp\AE22.tmp"77⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\AE80.tmp"C:\Users\Admin\AppData\Local\Temp\AE80.tmp"78⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\AECE.tmp"C:\Users\Admin\AppData\Local\Temp\AECE.tmp"79⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"80⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"81⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"82⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\B026.tmp"C:\Users\Admin\AppData\Local\Temp\B026.tmp"83⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\B083.tmp"C:\Users\Admin\AppData\Local\Temp\B083.tmp"84⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"85⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\B13F.tmp"C:\Users\Admin\AppData\Local\Temp\B13F.tmp"86⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\B19D.tmp"C:\Users\Admin\AppData\Local\Temp\B19D.tmp"87⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"88⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\B258.tmp"C:\Users\Admin\AppData\Local\Temp\B258.tmp"89⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"90⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\B323.tmp"C:\Users\Admin\AppData\Local\Temp\B323.tmp"91⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\B391.tmp"C:\Users\Admin\AppData\Local\Temp\B391.tmp"92⤵
- System Location Discovery: System Language Discovery
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"93⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\B42D.tmp"C:\Users\Admin\AppData\Local\Temp\B42D.tmp"94⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\B48B.tmp"C:\Users\Admin\AppData\Local\Temp\B48B.tmp"95⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"96⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\B536.tmp"C:\Users\Admin\AppData\Local\Temp\B536.tmp"97⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\B594.tmp"C:\Users\Admin\AppData\Local\Temp\B594.tmp"98⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"99⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\B650.tmp"C:\Users\Admin\AppData\Local\Temp\B650.tmp"100⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\B69E.tmp"C:\Users\Admin\AppData\Local\Temp\B69E.tmp"101⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"102⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\B73A.tmp"C:\Users\Admin\AppData\Local\Temp\B73A.tmp"103⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\B788.tmp"C:\Users\Admin\AppData\Local\Temp\B788.tmp"104⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"105⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\B834.tmp"C:\Users\Admin\AppData\Local\Temp\B834.tmp"106⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\B882.tmp"C:\Users\Admin\AppData\Local\Temp\B882.tmp"107⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\B8E0.tmp"C:\Users\Admin\AppData\Local\Temp\B8E0.tmp"108⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\B92E.tmp"C:\Users\Admin\AppData\Local\Temp\B92E.tmp"109⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\B97C.tmp"C:\Users\Admin\AppData\Local\Temp\B97C.tmp"110⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"111⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\BA28.tmp"C:\Users\Admin\AppData\Local\Temp\BA28.tmp"112⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\BA76.tmp"C:\Users\Admin\AppData\Local\Temp\BA76.tmp"113⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"114⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\BB32.tmp"C:\Users\Admin\AppData\Local\Temp\BB32.tmp"115⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\BB8F.tmp"C:\Users\Admin\AppData\Local\Temp\BB8F.tmp"116⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\BBED.tmp"C:\Users\Admin\AppData\Local\Temp\BBED.tmp"117⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"118⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\BCB8.tmp"C:\Users\Admin\AppData\Local\Temp\BCB8.tmp"119⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\BD06.tmp"C:\Users\Admin\AppData\Local\Temp\BD06.tmp"120⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\BD55.tmp"C:\Users\Admin\AppData\Local\Temp\BD55.tmp"121⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"122⤵PID:1188
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-