Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06-08-2024 13:43
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-06_f4ae88f6f900f6949fd78211a881da72_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-08-06_f4ae88f6f900f6949fd78211a881da72_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-06_f4ae88f6f900f6949fd78211a881da72_mafia.exe
-
Size
765KB
-
MD5
f4ae88f6f900f6949fd78211a881da72
-
SHA1
f13e824657e2e2d61556f88d9c5d03f9e8ef58c8
-
SHA256
40cfb38090fe90a3e582a4ed0a1b7641b63815653b0d44ac2a3a68e7f014df8f
-
SHA512
531422cb51c33b2c2525557af7334ae47cd08e8937dd94b503847e78a9256dc36fa280c4d70fe3689d6cd3b66e7573cdfeceab3c1c1a047660b2569961995b24
-
SSDEEP
12288:ZU5rCOTeiDEg6q565U8hLduWPlWHc3ZF5rn5rLOa54U5w5A:ZUQOJDEgT565U8hLdu2lKc3vh5Oa+UOS
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3616 B8B1.tmp 3640 B93E.tmp 1416 B9CA.tmp 5072 BA18.tmp 2408 BA95.tmp 220 BAE4.tmp 232 BB51.tmp 2992 BBBE.tmp 4508 BC4B.tmp 4428 BCA9.tmp 4456 BD26.tmp 2552 BDA3.tmp 5108 BE00.tmp 4552 BE5E.tmp 3540 BECC.tmp 4816 BF39.tmp 1596 BF97.tmp 1736 BFF4.tmp 4040 C052.tmp 1940 C0A0.tmp 4548 C0FE.tmp 1112 C14C.tmp 2800 C1BA.tmp 4472 C208.tmp 2276 C265.tmp 3696 C2D3.tmp 3732 C321.tmp 3096 C3BD.tmp 3980 C41B.tmp 4272 C469.tmp 2316 C4C7.tmp 2956 C515.tmp 4728 C592.tmp 1140 C5E0.tmp 2208 C62E.tmp 5052 C67C.tmp 4772 C6DA.tmp 4884 C728.tmp 1220 C786.tmp 4892 C803.tmp 636 C890.tmp 2424 C8FD.tmp 3544 C95B.tmp 4720 C9A9.tmp 5076 C9F7.tmp 460 CAE1.tmp 2216 CB5E.tmp 3144 CBBC.tmp 3332 CC0A.tmp 1868 CC68.tmp 4532 CCB6.tmp 4256 CD14.tmp 4012 CD72.tmp 3216 CDCF.tmp 3812 CE1D.tmp 4824 CE7B.tmp 2352 CED9.tmp 1604 CF37.tmp 232 CF94.tmp 4828 CFF2.tmp 2988 D050.tmp 2404 D09E.tmp 3184 D0FC.tmp 4428 D14A.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C67C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 546.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B91A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 196F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4292.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 755A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 369B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9824.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E162.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F48C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C3C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D050.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D0F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C8B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E078.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9352.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4810.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2216 wrote to memory of 3616 2216 2024-08-06_f4ae88f6f900f6949fd78211a881da72_mafia.exe 85 PID 2216 wrote to memory of 3616 2216 2024-08-06_f4ae88f6f900f6949fd78211a881da72_mafia.exe 85 PID 2216 wrote to memory of 3616 2216 2024-08-06_f4ae88f6f900f6949fd78211a881da72_mafia.exe 85 PID 3616 wrote to memory of 3640 3616 B8B1.tmp 87 PID 3616 wrote to memory of 3640 3616 B8B1.tmp 87 PID 3616 wrote to memory of 3640 3616 B8B1.tmp 87 PID 3640 wrote to memory of 1416 3640 B93E.tmp 88 PID 3640 wrote to memory of 1416 3640 B93E.tmp 88 PID 3640 wrote to memory of 1416 3640 B93E.tmp 88 PID 1416 wrote to memory of 5072 1416 B9CA.tmp 89 PID 1416 wrote to memory of 5072 1416 B9CA.tmp 89 PID 1416 wrote to memory of 5072 1416 B9CA.tmp 89 PID 5072 wrote to memory of 2408 5072 BA18.tmp 90 PID 5072 wrote to memory of 2408 5072 BA18.tmp 90 PID 5072 wrote to memory of 2408 5072 BA18.tmp 90 PID 2408 wrote to memory of 220 2408 BA95.tmp 91 PID 2408 wrote to memory of 220 2408 BA95.tmp 91 PID 2408 wrote to memory of 220 2408 BA95.tmp 91 PID 220 wrote to memory of 232 220 BAE4.tmp 92 PID 220 wrote to memory of 232 220 BAE4.tmp 92 PID 220 wrote to memory of 232 220 BAE4.tmp 92 PID 232 wrote to memory of 2992 232 BB51.tmp 93 PID 232 wrote to memory of 2992 232 BB51.tmp 93 PID 232 wrote to memory of 2992 232 BB51.tmp 93 PID 2992 wrote to memory of 4508 2992 BBBE.tmp 94 PID 2992 wrote to memory of 4508 2992 BBBE.tmp 94 PID 2992 wrote to memory of 4508 2992 BBBE.tmp 94 PID 4508 wrote to memory of 4428 4508 BC4B.tmp 95 PID 4508 wrote to memory of 4428 4508 BC4B.tmp 95 PID 4508 wrote to memory of 4428 4508 BC4B.tmp 95 PID 4428 wrote to memory of 4456 4428 BCA9.tmp 96 PID 4428 wrote to memory of 4456 4428 BCA9.tmp 96 PID 4428 wrote to memory of 4456 4428 BCA9.tmp 96 PID 4456 wrote to memory of 2552 4456 BD26.tmp 97 PID 4456 wrote to memory of 2552 4456 BD26.tmp 97 PID 4456 wrote to memory of 2552 4456 BD26.tmp 97 PID 2552 wrote to memory of 5108 2552 BDA3.tmp 98 PID 2552 wrote to memory of 5108 2552 BDA3.tmp 98 PID 2552 wrote to memory of 5108 2552 BDA3.tmp 98 PID 5108 wrote to memory of 4552 5108 BE00.tmp 99 PID 5108 wrote to memory of 4552 5108 BE00.tmp 99 PID 5108 wrote to memory of 4552 5108 BE00.tmp 99 PID 4552 wrote to memory of 3540 4552 BE5E.tmp 100 PID 4552 wrote to memory of 3540 4552 BE5E.tmp 100 PID 4552 wrote to memory of 3540 4552 BE5E.tmp 100 PID 3540 wrote to memory of 4816 3540 BECC.tmp 101 PID 3540 wrote to memory of 4816 3540 BECC.tmp 101 PID 3540 wrote to memory of 4816 3540 BECC.tmp 101 PID 4816 wrote to memory of 1596 4816 BF39.tmp 102 PID 4816 wrote to memory of 1596 4816 BF39.tmp 102 PID 4816 wrote to memory of 1596 4816 BF39.tmp 102 PID 1596 wrote to memory of 1736 1596 BF97.tmp 103 PID 1596 wrote to memory of 1736 1596 BF97.tmp 103 PID 1596 wrote to memory of 1736 1596 BF97.tmp 103 PID 1736 wrote to memory of 4040 1736 BFF4.tmp 104 PID 1736 wrote to memory of 4040 1736 BFF4.tmp 104 PID 1736 wrote to memory of 4040 1736 BFF4.tmp 104 PID 4040 wrote to memory of 1940 4040 C052.tmp 105 PID 4040 wrote to memory of 1940 4040 C052.tmp 105 PID 4040 wrote to memory of 1940 4040 C052.tmp 105 PID 1940 wrote to memory of 4548 1940 C0A0.tmp 106 PID 1940 wrote to memory of 4548 1940 C0A0.tmp 106 PID 1940 wrote to memory of 4548 1940 C0A0.tmp 106 PID 4548 wrote to memory of 1112 4548 C0FE.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-06_f4ae88f6f900f6949fd78211a881da72_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-06_f4ae88f6f900f6949fd78211a881da72_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\B93E.tmp"C:\Users\Admin\AppData\Local\Temp\B93E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\BA18.tmp"C:\Users\Admin\AppData\Local\Temp\BA18.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\BA95.tmp"C:\Users\Admin\AppData\Local\Temp\BA95.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\BB51.tmp"C:\Users\Admin\AppData\Local\Temp\BB51.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\BD26.tmp"C:\Users\Admin\AppData\Local\Temp\BD26.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\BE00.tmp"C:\Users\Admin\AppData\Local\Temp\BE00.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\BE5E.tmp"C:\Users\Admin\AppData\Local\Temp\BE5E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\BECC.tmp"C:\Users\Admin\AppData\Local\Temp\BECC.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\BF39.tmp"C:\Users\Admin\AppData\Local\Temp\BF39.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\BF97.tmp"C:\Users\Admin\AppData\Local\Temp\BF97.tmp"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\C052.tmp"C:\Users\Admin\AppData\Local\Temp\C052.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\C14C.tmp"C:\Users\Admin\AppData\Local\Temp\C14C.tmp"23⤵
- Executes dropped EXE
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"24⤵
- Executes dropped EXE
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\C208.tmp"C:\Users\Admin\AppData\Local\Temp\C208.tmp"25⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\C265.tmp"C:\Users\Admin\AppData\Local\Temp\C265.tmp"26⤵
- Executes dropped EXE
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"27⤵
- Executes dropped EXE
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\C321.tmp"C:\Users\Admin\AppData\Local\Temp\C321.tmp"28⤵
- Executes dropped EXE
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\C3BD.tmp"C:\Users\Admin\AppData\Local\Temp\C3BD.tmp"29⤵
- Executes dropped EXE
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\C41B.tmp"C:\Users\Admin\AppData\Local\Temp\C41B.tmp"30⤵
- Executes dropped EXE
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\C469.tmp"C:\Users\Admin\AppData\Local\Temp\C469.tmp"31⤵
- Executes dropped EXE
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\C4C7.tmp"C:\Users\Admin\AppData\Local\Temp\C4C7.tmp"32⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\C515.tmp"C:\Users\Admin\AppData\Local\Temp\C515.tmp"33⤵
- Executes dropped EXE
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\C592.tmp"C:\Users\Admin\AppData\Local\Temp\C592.tmp"34⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\C5E0.tmp"C:\Users\Admin\AppData\Local\Temp\C5E0.tmp"35⤵
- Executes dropped EXE
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\C62E.tmp"C:\Users\Admin\AppData\Local\Temp\C62E.tmp"36⤵
- Executes dropped EXE
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\C67C.tmp"C:\Users\Admin\AppData\Local\Temp\C67C.tmp"37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\C6DA.tmp"C:\Users\Admin\AppData\Local\Temp\C6DA.tmp"38⤵
- Executes dropped EXE
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\C728.tmp"C:\Users\Admin\AppData\Local\Temp\C728.tmp"39⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\C786.tmp"C:\Users\Admin\AppData\Local\Temp\C786.tmp"40⤵
- Executes dropped EXE
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\C803.tmp"C:\Users\Admin\AppData\Local\Temp\C803.tmp"41⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\C890.tmp"C:\Users\Admin\AppData\Local\Temp\C890.tmp"42⤵
- Executes dropped EXE
PID:636 -
C:\Users\Admin\AppData\Local\Temp\C8FD.tmp"C:\Users\Admin\AppData\Local\Temp\C8FD.tmp"43⤵
- Executes dropped EXE
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\C95B.tmp"C:\Users\Admin\AppData\Local\Temp\C95B.tmp"44⤵
- Executes dropped EXE
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\C9A9.tmp"C:\Users\Admin\AppData\Local\Temp\C9A9.tmp"45⤵
- Executes dropped EXE
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\C9F7.tmp"C:\Users\Admin\AppData\Local\Temp\C9F7.tmp"46⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\CA84.tmp"C:\Users\Admin\AppData\Local\Temp\CA84.tmp"47⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\CAE1.tmp"C:\Users\Admin\AppData\Local\Temp\CAE1.tmp"48⤵
- Executes dropped EXE
PID:460 -
C:\Users\Admin\AppData\Local\Temp\CB5E.tmp"C:\Users\Admin\AppData\Local\Temp\CB5E.tmp"49⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\CBBC.tmp"C:\Users\Admin\AppData\Local\Temp\CBBC.tmp"50⤵
- Executes dropped EXE
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\CC0A.tmp"C:\Users\Admin\AppData\Local\Temp\CC0A.tmp"51⤵
- Executes dropped EXE
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\CC68.tmp"C:\Users\Admin\AppData\Local\Temp\CC68.tmp"52⤵
- Executes dropped EXE
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\CCB6.tmp"C:\Users\Admin\AppData\Local\Temp\CCB6.tmp"53⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\CD14.tmp"C:\Users\Admin\AppData\Local\Temp\CD14.tmp"54⤵
- Executes dropped EXE
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\CD72.tmp"C:\Users\Admin\AppData\Local\Temp\CD72.tmp"55⤵
- Executes dropped EXE
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\CDCF.tmp"C:\Users\Admin\AppData\Local\Temp\CDCF.tmp"56⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\CE1D.tmp"C:\Users\Admin\AppData\Local\Temp\CE1D.tmp"57⤵
- Executes dropped EXE
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\CE7B.tmp"C:\Users\Admin\AppData\Local\Temp\CE7B.tmp"58⤵
- Executes dropped EXE
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\CED9.tmp"C:\Users\Admin\AppData\Local\Temp\CED9.tmp"59⤵
- Executes dropped EXE
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\CF37.tmp"C:\Users\Admin\AppData\Local\Temp\CF37.tmp"60⤵
- Executes dropped EXE
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\CF94.tmp"C:\Users\Admin\AppData\Local\Temp\CF94.tmp"61⤵
- Executes dropped EXE
PID:232 -
C:\Users\Admin\AppData\Local\Temp\CFF2.tmp"C:\Users\Admin\AppData\Local\Temp\CFF2.tmp"62⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\D050.tmp"C:\Users\Admin\AppData\Local\Temp\D050.tmp"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\D09E.tmp"C:\Users\Admin\AppData\Local\Temp\D09E.tmp"64⤵
- Executes dropped EXE
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\D0FC.tmp"C:\Users\Admin\AppData\Local\Temp\D0FC.tmp"65⤵
- Executes dropped EXE
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\D14A.tmp"C:\Users\Admin\AppData\Local\Temp\D14A.tmp"66⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\D198.tmp"C:\Users\Admin\AppData\Local\Temp\D198.tmp"67⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\D1E6.tmp"C:\Users\Admin\AppData\Local\Temp\D1E6.tmp"68⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\D234.tmp"C:\Users\Admin\AppData\Local\Temp\D234.tmp"69⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\D282.tmp"C:\Users\Admin\AppData\Local\Temp\D282.tmp"70⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\D2D1.tmp"C:\Users\Admin\AppData\Local\Temp\D2D1.tmp"71⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\D31F.tmp"C:\Users\Admin\AppData\Local\Temp\D31F.tmp"72⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\D36D.tmp"C:\Users\Admin\AppData\Local\Temp\D36D.tmp"73⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\D3BB.tmp"C:\Users\Admin\AppData\Local\Temp\D3BB.tmp"74⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\D409.tmp"C:\Users\Admin\AppData\Local\Temp\D409.tmp"75⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\D457.tmp"C:\Users\Admin\AppData\Local\Temp\D457.tmp"76⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\D4A5.tmp"C:\Users\Admin\AppData\Local\Temp\D4A5.tmp"77⤵
- System Location Discovery: System Language Discovery
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\D4F3.tmp"C:\Users\Admin\AppData\Local\Temp\D4F3.tmp"78⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\D542.tmp"C:\Users\Admin\AppData\Local\Temp\D542.tmp"79⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\D590.tmp"C:\Users\Admin\AppData\Local\Temp\D590.tmp"80⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\D5DE.tmp"C:\Users\Admin\AppData\Local\Temp\D5DE.tmp"81⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\D62C.tmp"C:\Users\Admin\AppData\Local\Temp\D62C.tmp"82⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\D67A.tmp"C:\Users\Admin\AppData\Local\Temp\D67A.tmp"83⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\D6D8.tmp"C:\Users\Admin\AppData\Local\Temp\D6D8.tmp"84⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\D736.tmp"C:\Users\Admin\AppData\Local\Temp\D736.tmp"85⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\D784.tmp"C:\Users\Admin\AppData\Local\Temp\D784.tmp"86⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\D7E1.tmp"C:\Users\Admin\AppData\Local\Temp\D7E1.tmp"87⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\D83F.tmp"C:\Users\Admin\AppData\Local\Temp\D83F.tmp"88⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\D88D.tmp"C:\Users\Admin\AppData\Local\Temp\D88D.tmp"89⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\D90A.tmp"C:\Users\Admin\AppData\Local\Temp\D90A.tmp"90⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\D958.tmp"C:\Users\Admin\AppData\Local\Temp\D958.tmp"91⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\D9A7.tmp"C:\Users\Admin\AppData\Local\Temp\D9A7.tmp"92⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\D9F5.tmp"C:\Users\Admin\AppData\Local\Temp\D9F5.tmp"93⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\DA52.tmp"C:\Users\Admin\AppData\Local\Temp\DA52.tmp"94⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\DAA1.tmp"C:\Users\Admin\AppData\Local\Temp\DAA1.tmp"95⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\DAEF.tmp"C:\Users\Admin\AppData\Local\Temp\DAEF.tmp"96⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\DB4C.tmp"C:\Users\Admin\AppData\Local\Temp\DB4C.tmp"97⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\DB9B.tmp"C:\Users\Admin\AppData\Local\Temp\DB9B.tmp"98⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\DBF8.tmp"C:\Users\Admin\AppData\Local\Temp\DBF8.tmp"99⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\DC46.tmp"C:\Users\Admin\AppData\Local\Temp\DC46.tmp"100⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\DC95.tmp"C:\Users\Admin\AppData\Local\Temp\DC95.tmp"101⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\DCF2.tmp"C:\Users\Admin\AppData\Local\Temp\DCF2.tmp"102⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\DD50.tmp"C:\Users\Admin\AppData\Local\Temp\DD50.tmp"103⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\DDAE.tmp"C:\Users\Admin\AppData\Local\Temp\DDAE.tmp"104⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\DDFC.tmp"C:\Users\Admin\AppData\Local\Temp\DDFC.tmp"105⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\DE5A.tmp"C:\Users\Admin\AppData\Local\Temp\DE5A.tmp"106⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"107⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\DEF6.tmp"C:\Users\Admin\AppData\Local\Temp\DEF6.tmp"108⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\DF54.tmp"C:\Users\Admin\AppData\Local\Temp\DF54.tmp"109⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\DFB1.tmp"C:\Users\Admin\AppData\Local\Temp\DFB1.tmp"110⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\E00F.tmp"C:\Users\Admin\AppData\Local\Temp\E00F.tmp"111⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\E06D.tmp"C:\Users\Admin\AppData\Local\Temp\E06D.tmp"112⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\E0BB.tmp"C:\Users\Admin\AppData\Local\Temp\E0BB.tmp"113⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\E119.tmp"C:\Users\Admin\AppData\Local\Temp\E119.tmp"114⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\E167.tmp"C:\Users\Admin\AppData\Local\Temp\E167.tmp"115⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\E1C5.tmp"C:\Users\Admin\AppData\Local\Temp\E1C5.tmp"116⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\E213.tmp"C:\Users\Admin\AppData\Local\Temp\E213.tmp"117⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\E271.tmp"C:\Users\Admin\AppData\Local\Temp\E271.tmp"118⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\E2BF.tmp"C:\Users\Admin\AppData\Local\Temp\E2BF.tmp"119⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\E30D.tmp"C:\Users\Admin\AppData\Local\Temp\E30D.tmp"120⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\E36B.tmp"C:\Users\Admin\AppData\Local\Temp\E36B.tmp"121⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\E3C8.tmp"C:\Users\Admin\AppData\Local\Temp\E3C8.tmp"122⤵PID:1060
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-