Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
02/08/2024, 06:53
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-02_88eb397e0c418aa2866a5cecb5aad6b7_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-08-02_88eb397e0c418aa2866a5cecb5aad6b7_mafia.exe
Resource
win10v2004-20240730-en
General
-
Target
2024-08-02_88eb397e0c418aa2866a5cecb5aad6b7_mafia.exe
-
Size
486KB
-
MD5
88eb397e0c418aa2866a5cecb5aad6b7
-
SHA1
52a38db1b479f75d8cf237f529784ac72d3ef670
-
SHA256
a93c59b0875328d6aaf3363048c757de7afbb33434e292143d950cecbb0d816d
-
SHA512
01ce3509f22c39bf251e7a8a7772cabacd65aa2935b8dd8c2ad7c495555aa3c406e874dccc638bf486f1a54fcbda26f0a5ff995f6562dcdada01960df272419e
-
SSDEEP
12288:/U5rCOTeiDrnQ/tZOMvMw/GB6zvU6cNZ:/UQOJDM/jHGBIvUXN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4868 B834.tmp 4196 B8A1.tmp 4124 B90F.tmp 1912 B99B.tmp 2968 B9F9.tmp 2380 BA47.tmp 5044 BAA5.tmp 4816 BB03.tmp 1208 BB61.tmp 2384 BBDE.tmp 3928 BC4B.tmp 2880 BCB8.tmp 1072 BD26.tmp 1600 BD74.tmp 4048 BDE1.tmp 900 BE4F.tmp 2188 BEAC.tmp 2720 BEFA.tmp 2536 BF68.tmp 860 BFD5.tmp 3716 C023.tmp 4624 C091.tmp 2652 C0EE.tmp 4548 C15C.tmp 4952 C1C9.tmp 4620 C237.tmp 3712 C2B4.tmp 1840 C331.tmp 1492 C3AE.tmp 2760 C41B.tmp 3636 C4A8.tmp 1768 C515.tmp 3040 C573.tmp 3244 C60F.tmp 3088 C66D.tmp 4940 C6CA.tmp 3116 C728.tmp 2640 C796.tmp 2440 C803.tmp 4296 C870.tmp 3472 C8BE.tmp 696 C91C.tmp 3528 C97A.tmp 1808 C9D8.tmp 4124 CA45.tmp 1684 CAA3.tmp 4408 CB01.tmp 3420 CB5E.tmp 1280 CBCC.tmp 3148 CC39.tmp 2520 CC97.tmp 4392 CD04.tmp 2960 CD52.tmp 4188 CDA0.tmp 4140 CDEF.tmp 3300 CE4C.tmp 1524 CE9A.tmp 2384 CEF8.tmp 1752 CF56.tmp 4752 CFB4.tmp 1924 D011.tmp 1780 D060.tmp 1072 D0BD.tmp 4876 D10B.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3747.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 555.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4968.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B205.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1911.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 729B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFD9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 904.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 600D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBCC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D60D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 171D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7450.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8623.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7105.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B409.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C697.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE48.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B040.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C75.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F0A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D193.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4428 wrote to memory of 4868 4428 2024-08-02_88eb397e0c418aa2866a5cecb5aad6b7_mafia.exe 85 PID 4428 wrote to memory of 4868 4428 2024-08-02_88eb397e0c418aa2866a5cecb5aad6b7_mafia.exe 85 PID 4428 wrote to memory of 4868 4428 2024-08-02_88eb397e0c418aa2866a5cecb5aad6b7_mafia.exe 85 PID 4868 wrote to memory of 4196 4868 B834.tmp 86 PID 4868 wrote to memory of 4196 4868 B834.tmp 86 PID 4868 wrote to memory of 4196 4868 B834.tmp 86 PID 4196 wrote to memory of 4124 4196 B8A1.tmp 87 PID 4196 wrote to memory of 4124 4196 B8A1.tmp 87 PID 4196 wrote to memory of 4124 4196 B8A1.tmp 87 PID 4124 wrote to memory of 1912 4124 B90F.tmp 90 PID 4124 wrote to memory of 1912 4124 B90F.tmp 90 PID 4124 wrote to memory of 1912 4124 B90F.tmp 90 PID 1912 wrote to memory of 2968 1912 B99B.tmp 92 PID 1912 wrote to memory of 2968 1912 B99B.tmp 92 PID 1912 wrote to memory of 2968 1912 B99B.tmp 92 PID 2968 wrote to memory of 2380 2968 B9F9.tmp 93 PID 2968 wrote to memory of 2380 2968 B9F9.tmp 93 PID 2968 wrote to memory of 2380 2968 B9F9.tmp 93 PID 2380 wrote to memory of 5044 2380 BA47.tmp 94 PID 2380 wrote to memory of 5044 2380 BA47.tmp 94 PID 2380 wrote to memory of 5044 2380 BA47.tmp 94 PID 5044 wrote to memory of 4816 5044 BAA5.tmp 95 PID 5044 wrote to memory of 4816 5044 BAA5.tmp 95 PID 5044 wrote to memory of 4816 5044 BAA5.tmp 95 PID 4816 wrote to memory of 1208 4816 BB03.tmp 96 PID 4816 wrote to memory of 1208 4816 BB03.tmp 96 PID 4816 wrote to memory of 1208 4816 BB03.tmp 96 PID 1208 wrote to memory of 2384 1208 BB61.tmp 97 PID 1208 wrote to memory of 2384 1208 BB61.tmp 97 PID 1208 wrote to memory of 2384 1208 BB61.tmp 97 PID 2384 wrote to memory of 3928 2384 BBDE.tmp 98 PID 2384 wrote to memory of 3928 2384 BBDE.tmp 98 PID 2384 wrote to memory of 3928 2384 BBDE.tmp 98 PID 3928 wrote to memory of 2880 3928 BC4B.tmp 99 PID 3928 wrote to memory of 2880 3928 BC4B.tmp 99 PID 3928 wrote to memory of 2880 3928 BC4B.tmp 99 PID 2880 wrote to memory of 1072 2880 BCB8.tmp 100 PID 2880 wrote to memory of 1072 2880 BCB8.tmp 100 PID 2880 wrote to memory of 1072 2880 BCB8.tmp 100 PID 1072 wrote to memory of 1600 1072 BD26.tmp 101 PID 1072 wrote to memory of 1600 1072 BD26.tmp 101 PID 1072 wrote to memory of 1600 1072 BD26.tmp 101 PID 1600 wrote to memory of 4048 1600 BD74.tmp 102 PID 1600 wrote to memory of 4048 1600 BD74.tmp 102 PID 1600 wrote to memory of 4048 1600 BD74.tmp 102 PID 4048 wrote to memory of 900 4048 BDE1.tmp 103 PID 4048 wrote to memory of 900 4048 BDE1.tmp 103 PID 4048 wrote to memory of 900 4048 BDE1.tmp 103 PID 900 wrote to memory of 2188 900 BE4F.tmp 104 PID 900 wrote to memory of 2188 900 BE4F.tmp 104 PID 900 wrote to memory of 2188 900 BE4F.tmp 104 PID 2188 wrote to memory of 2720 2188 BEAC.tmp 105 PID 2188 wrote to memory of 2720 2188 BEAC.tmp 105 PID 2188 wrote to memory of 2720 2188 BEAC.tmp 105 PID 2720 wrote to memory of 2536 2720 BEFA.tmp 106 PID 2720 wrote to memory of 2536 2720 BEFA.tmp 106 PID 2720 wrote to memory of 2536 2720 BEFA.tmp 106 PID 2536 wrote to memory of 860 2536 BF68.tmp 107 PID 2536 wrote to memory of 860 2536 BF68.tmp 107 PID 2536 wrote to memory of 860 2536 BF68.tmp 107 PID 860 wrote to memory of 3716 860 BFD5.tmp 108 PID 860 wrote to memory of 3716 860 BFD5.tmp 108 PID 860 wrote to memory of 3716 860 BFD5.tmp 108 PID 3716 wrote to memory of 4624 3716 C023.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-02_88eb397e0c418aa2866a5cecb5aad6b7_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-02_88eb397e0c418aa2866a5cecb5aad6b7_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\B834.tmp"C:\Users\Admin\AppData\Local\Temp\B834.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\B90F.tmp"C:\Users\Admin\AppData\Local\Temp\B90F.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\B99B.tmp"C:\Users\Admin\AppData\Local\Temp\B99B.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\B9F9.tmp"C:\Users\Admin\AppData\Local\Temp\B9F9.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\BA47.tmp"C:\Users\Admin\AppData\Local\Temp\BA47.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\BAA5.tmp"C:\Users\Admin\AppData\Local\Temp\BAA5.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\BB03.tmp"C:\Users\Admin\AppData\Local\Temp\BB03.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\BB61.tmp"C:\Users\Admin\AppData\Local\Temp\BB61.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\BCB8.tmp"C:\Users\Admin\AppData\Local\Temp\BCB8.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\BD26.tmp"C:\Users\Admin\AppData\Local\Temp\BD26.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\BD74.tmp"C:\Users\Admin\AppData\Local\Temp\BD74.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Users\Admin\AppData\Local\Temp\BEAC.tmp"C:\Users\Admin\AppData\Local\Temp\BEAC.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\BF68.tmp"C:\Users\Admin\AppData\Local\Temp\BF68.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\BFD5.tmp"C:\Users\Admin\AppData\Local\Temp\BFD5.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Users\Admin\AppData\Local\Temp\C023.tmp"C:\Users\Admin\AppData\Local\Temp\C023.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\C091.tmp"C:\Users\Admin\AppData\Local\Temp\C091.tmp"23⤵
- Executes dropped EXE
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"24⤵
- Executes dropped EXE
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\C15C.tmp"C:\Users\Admin\AppData\Local\Temp\C15C.tmp"25⤵
- Executes dropped EXE
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"26⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\C237.tmp"C:\Users\Admin\AppData\Local\Temp\C237.tmp"27⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\C2B4.tmp"C:\Users\Admin\AppData\Local\Temp\C2B4.tmp"28⤵
- Executes dropped EXE
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\C331.tmp"C:\Users\Admin\AppData\Local\Temp\C331.tmp"29⤵
- Executes dropped EXE
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\C3AE.tmp"C:\Users\Admin\AppData\Local\Temp\C3AE.tmp"30⤵
- Executes dropped EXE
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\C41B.tmp"C:\Users\Admin\AppData\Local\Temp\C41B.tmp"31⤵
- Executes dropped EXE
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"32⤵
- Executes dropped EXE
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\C515.tmp"C:\Users\Admin\AppData\Local\Temp\C515.tmp"33⤵
- Executes dropped EXE
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\C573.tmp"C:\Users\Admin\AppData\Local\Temp\C573.tmp"34⤵
- Executes dropped EXE
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\C60F.tmp"C:\Users\Admin\AppData\Local\Temp\C60F.tmp"35⤵
- Executes dropped EXE
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\C66D.tmp"C:\Users\Admin\AppData\Local\Temp\C66D.tmp"36⤵
- Executes dropped EXE
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\C6CA.tmp"C:\Users\Admin\AppData\Local\Temp\C6CA.tmp"37⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\C728.tmp"C:\Users\Admin\AppData\Local\Temp\C728.tmp"38⤵
- Executes dropped EXE
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\C796.tmp"C:\Users\Admin\AppData\Local\Temp\C796.tmp"39⤵
- Executes dropped EXE
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\C803.tmp"C:\Users\Admin\AppData\Local\Temp\C803.tmp"40⤵
- Executes dropped EXE
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\C870.tmp"C:\Users\Admin\AppData\Local\Temp\C870.tmp"41⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"42⤵
- Executes dropped EXE
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\C91C.tmp"C:\Users\Admin\AppData\Local\Temp\C91C.tmp"43⤵
- Executes dropped EXE
PID:696 -
C:\Users\Admin\AppData\Local\Temp\C97A.tmp"C:\Users\Admin\AppData\Local\Temp\C97A.tmp"44⤵
- Executes dropped EXE
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\C9D8.tmp"C:\Users\Admin\AppData\Local\Temp\C9D8.tmp"45⤵
- Executes dropped EXE
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\CA45.tmp"C:\Users\Admin\AppData\Local\Temp\CA45.tmp"46⤵
- Executes dropped EXE
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\CAA3.tmp"C:\Users\Admin\AppData\Local\Temp\CAA3.tmp"47⤵
- Executes dropped EXE
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\CB01.tmp"C:\Users\Admin\AppData\Local\Temp\CB01.tmp"48⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\CB5E.tmp"C:\Users\Admin\AppData\Local\Temp\CB5E.tmp"49⤵
- Executes dropped EXE
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\CBCC.tmp"C:\Users\Admin\AppData\Local\Temp\CBCC.tmp"50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\CC39.tmp"C:\Users\Admin\AppData\Local\Temp\CC39.tmp"51⤵
- Executes dropped EXE
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\CC97.tmp"C:\Users\Admin\AppData\Local\Temp\CC97.tmp"52⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\CD04.tmp"C:\Users\Admin\AppData\Local\Temp\CD04.tmp"53⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\CD52.tmp"C:\Users\Admin\AppData\Local\Temp\CD52.tmp"54⤵
- Executes dropped EXE
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\CDA0.tmp"C:\Users\Admin\AppData\Local\Temp\CDA0.tmp"55⤵
- Executes dropped EXE
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\CDEF.tmp"C:\Users\Admin\AppData\Local\Temp\CDEF.tmp"56⤵
- Executes dropped EXE
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\CE4C.tmp"C:\Users\Admin\AppData\Local\Temp\CE4C.tmp"57⤵
- Executes dropped EXE
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\CE9A.tmp"C:\Users\Admin\AppData\Local\Temp\CE9A.tmp"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\CEF8.tmp"C:\Users\Admin\AppData\Local\Temp\CEF8.tmp"59⤵
- Executes dropped EXE
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\CF56.tmp"C:\Users\Admin\AppData\Local\Temp\CF56.tmp"60⤵
- Executes dropped EXE
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\CFB4.tmp"C:\Users\Admin\AppData\Local\Temp\CFB4.tmp"61⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\D011.tmp"C:\Users\Admin\AppData\Local\Temp\D011.tmp"62⤵
- Executes dropped EXE
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\D060.tmp"C:\Users\Admin\AppData\Local\Temp\D060.tmp"63⤵
- Executes dropped EXE
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\D0BD.tmp"C:\Users\Admin\AppData\Local\Temp\D0BD.tmp"64⤵
- Executes dropped EXE
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\D10B.tmp"C:\Users\Admin\AppData\Local\Temp\D10B.tmp"65⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\D169.tmp"C:\Users\Admin\AppData\Local\Temp\D169.tmp"66⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\D1B7.tmp"C:\Users\Admin\AppData\Local\Temp\D1B7.tmp"67⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\D215.tmp"C:\Users\Admin\AppData\Local\Temp\D215.tmp"68⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\D263.tmp"C:\Users\Admin\AppData\Local\Temp\D263.tmp"69⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\D2C1.tmp"C:\Users\Admin\AppData\Local\Temp\D2C1.tmp"70⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\D31F.tmp"C:\Users\Admin\AppData\Local\Temp\D31F.tmp"71⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\D37C.tmp"C:\Users\Admin\AppData\Local\Temp\D37C.tmp"72⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\D3CB.tmp"C:\Users\Admin\AppData\Local\Temp\D3CB.tmp"73⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\D419.tmp"C:\Users\Admin\AppData\Local\Temp\D419.tmp"74⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\D467.tmp"C:\Users\Admin\AppData\Local\Temp\D467.tmp"75⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\D4B5.tmp"C:\Users\Admin\AppData\Local\Temp\D4B5.tmp"76⤵
- System Location Discovery: System Language Discovery
PID:388 -
C:\Users\Admin\AppData\Local\Temp\D503.tmp"C:\Users\Admin\AppData\Local\Temp\D503.tmp"77⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\D561.tmp"C:\Users\Admin\AppData\Local\Temp\D561.tmp"78⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"79⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\D60D.tmp"C:\Users\Admin\AppData\Local\Temp\D60D.tmp"80⤵
- System Location Discovery: System Language Discovery
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\D66A.tmp"C:\Users\Admin\AppData\Local\Temp\D66A.tmp"81⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\D6B9.tmp"C:\Users\Admin\AppData\Local\Temp\D6B9.tmp"82⤵PID:512
-
C:\Users\Admin\AppData\Local\Temp\D707.tmp"C:\Users\Admin\AppData\Local\Temp\D707.tmp"83⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\D764.tmp"C:\Users\Admin\AppData\Local\Temp\D764.tmp"84⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\D7B3.tmp"C:\Users\Admin\AppData\Local\Temp\D7B3.tmp"85⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\D810.tmp"C:\Users\Admin\AppData\Local\Temp\D810.tmp"86⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\D85E.tmp"C:\Users\Admin\AppData\Local\Temp\D85E.tmp"87⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\D8AD.tmp"C:\Users\Admin\AppData\Local\Temp\D8AD.tmp"88⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\D90A.tmp"C:\Users\Admin\AppData\Local\Temp\D90A.tmp"89⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\D958.tmp"C:\Users\Admin\AppData\Local\Temp\D958.tmp"90⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\D9A7.tmp"C:\Users\Admin\AppData\Local\Temp\D9A7.tmp"91⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\D9F5.tmp"C:\Users\Admin\AppData\Local\Temp\D9F5.tmp"92⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\DA52.tmp"C:\Users\Admin\AppData\Local\Temp\DA52.tmp"93⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\DAB0.tmp"C:\Users\Admin\AppData\Local\Temp\DAB0.tmp"94⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\DB0E.tmp"C:\Users\Admin\AppData\Local\Temp\DB0E.tmp"95⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\DB6C.tmp"C:\Users\Admin\AppData\Local\Temp\DB6C.tmp"96⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\DBBA.tmp"C:\Users\Admin\AppData\Local\Temp\DBBA.tmp"97⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\DC08.tmp"C:\Users\Admin\AppData\Local\Temp\DC08.tmp"98⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\DC66.tmp"C:\Users\Admin\AppData\Local\Temp\DC66.tmp"99⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\DCC3.tmp"C:\Users\Admin\AppData\Local\Temp\DCC3.tmp"100⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\DD12.tmp"C:\Users\Admin\AppData\Local\Temp\DD12.tmp"101⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\DD60.tmp"C:\Users\Admin\AppData\Local\Temp\DD60.tmp"102⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\DDAE.tmp"C:\Users\Admin\AppData\Local\Temp\DDAE.tmp"103⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\DE0C.tmp"C:\Users\Admin\AppData\Local\Temp\DE0C.tmp"104⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\DE5A.tmp"C:\Users\Admin\AppData\Local\Temp\DE5A.tmp"105⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\DEB7.tmp"C:\Users\Admin\AppData\Local\Temp\DEB7.tmp"106⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\DF15.tmp"C:\Users\Admin\AppData\Local\Temp\DF15.tmp"107⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\DF63.tmp"C:\Users\Admin\AppData\Local\Temp\DF63.tmp"108⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\DFB1.tmp"C:\Users\Admin\AppData\Local\Temp\DFB1.tmp"109⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\E000.tmp"C:\Users\Admin\AppData\Local\Temp\E000.tmp"110⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\E04E.tmp"C:\Users\Admin\AppData\Local\Temp\E04E.tmp"111⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\E09C.tmp"C:\Users\Admin\AppData\Local\Temp\E09C.tmp"112⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\E0EA.tmp"C:\Users\Admin\AppData\Local\Temp\E0EA.tmp"113⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\E148.tmp"C:\Users\Admin\AppData\Local\Temp\E148.tmp"114⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\E196.tmp"C:\Users\Admin\AppData\Local\Temp\E196.tmp"115⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\E1E4.tmp"C:\Users\Admin\AppData\Local\Temp\E1E4.tmp"116⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\E232.tmp"C:\Users\Admin\AppData\Local\Temp\E232.tmp"117⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\E290.tmp"C:\Users\Admin\AppData\Local\Temp\E290.tmp"118⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\E2EE.tmp"C:\Users\Admin\AppData\Local\Temp\E2EE.tmp"119⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\E33C.tmp"C:\Users\Admin\AppData\Local\Temp\E33C.tmp"120⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\E3A9.tmp"C:\Users\Admin\AppData\Local\Temp\E3A9.tmp"121⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\E407.tmp"C:\Users\Admin\AppData\Local\Temp\E407.tmp"122⤵PID:4392
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-