Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07/08/2024, 02:28
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-07_c4fdd9ea14835a82d2a3bf59bb24e235_mafia.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2024-08-07_c4fdd9ea14835a82d2a3bf59bb24e235_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-07_c4fdd9ea14835a82d2a3bf59bb24e235_mafia.exe
-
Size
712KB
-
MD5
c4fdd9ea14835a82d2a3bf59bb24e235
-
SHA1
122b6f6d522b726d0c079aed799a11bd6b069906
-
SHA256
b9d912c9b9cabebe9fcd724b04d996fdffe16610c17e551e47779afb0e31fe46
-
SHA512
99dfb71af5453e4d623121d6db4d569f568fe4df7e1dba4baba17bdc6f2516fad5a6f50027ce02ef890e8b276cacf7b51dd88949e236a07da5301d6eb800d693
-
SSDEEP
12288:FU5rCOTeiDvYo/XIaYtoWShNZdCvq5TJLCvY90D8/LVBlVk736Y79GWzNbA:FUQOJDQGXIaYtNeNnCvq5TJLCvY90D8N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4288 8DE8.tmp 1544 8E65.tmp 2660 8F11.tmp 3720 8F9D.tmp 1180 902A.tmp 4712 9097.tmp 4408 9124.tmp 1252 91B1.tmp 5028 923D.tmp 4700 92CA.tmp 3248 9357.tmp 3460 93D4.tmp 3988 9441.tmp 2944 94AE.tmp 4144 951C.tmp 1916 95A8.tmp 1564 9635.tmp 392 96C2.tmp 1888 972F.tmp 4548 979C.tmp 244 9819.tmp 4340 9896.tmp 3928 9913.tmp 3220 99A0.tmp 1948 9A3C.tmp 4088 9AC9.tmp 3520 9B46.tmp 1584 9B94.tmp 812 9C21.tmp 4048 9CCC.tmp 628 9D59.tmp 4040 9DE6.tmp 2288 9E82.tmp 3028 9ED0.tmp 2936 9F2E.tmp 4644 9F7C.tmp 1984 9FDA.tmp 1100 A076.tmp 3544 A0C4.tmp 3208 A131.tmp 3532 A180.tmp 4904 A1CE.tmp 2384 A22B.tmp 836 A27A.tmp 184 A2D7.tmp 540 A325.tmp 3180 A383.tmp 3264 A3E1.tmp 5100 A42F.tmp 4820 A48D.tmp 1484 A4DB.tmp 4360 A539.tmp 3652 A596.tmp 4028 A5E5.tmp 3480 A642.tmp 548 A6A0.tmp 1040 A6FE.tmp 2480 A75C.tmp 4936 A7AA.tmp 4784 A7F8.tmp 4212 A856.tmp 2660 A8A4.tmp 1280 A901.tmp 3076 A95F.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 627E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B18D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E7DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 899D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A246.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5484.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6760.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E6D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E79.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD8A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 848.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6915.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCD1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F194.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F50E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDCD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C36F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D404.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A642.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F56C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 991E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8344.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B074.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB7E.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4028 wrote to memory of 4288 4028 2024-08-07_c4fdd9ea14835a82d2a3bf59bb24e235_mafia.exe 85 PID 4028 wrote to memory of 4288 4028 2024-08-07_c4fdd9ea14835a82d2a3bf59bb24e235_mafia.exe 85 PID 4028 wrote to memory of 4288 4028 2024-08-07_c4fdd9ea14835a82d2a3bf59bb24e235_mafia.exe 85 PID 4288 wrote to memory of 1544 4288 8DE8.tmp 86 PID 4288 wrote to memory of 1544 4288 8DE8.tmp 86 PID 4288 wrote to memory of 1544 4288 8DE8.tmp 86 PID 1544 wrote to memory of 2660 1544 8E65.tmp 88 PID 1544 wrote to memory of 2660 1544 8E65.tmp 88 PID 1544 wrote to memory of 2660 1544 8E65.tmp 88 PID 2660 wrote to memory of 3720 2660 8F11.tmp 89 PID 2660 wrote to memory of 3720 2660 8F11.tmp 89 PID 2660 wrote to memory of 3720 2660 8F11.tmp 89 PID 3720 wrote to memory of 1180 3720 8F9D.tmp 90 PID 3720 wrote to memory of 1180 3720 8F9D.tmp 90 PID 3720 wrote to memory of 1180 3720 8F9D.tmp 90 PID 1180 wrote to memory of 4712 1180 902A.tmp 91 PID 1180 wrote to memory of 4712 1180 902A.tmp 91 PID 1180 wrote to memory of 4712 1180 902A.tmp 91 PID 4712 wrote to memory of 4408 4712 9097.tmp 92 PID 4712 wrote to memory of 4408 4712 9097.tmp 92 PID 4712 wrote to memory of 4408 4712 9097.tmp 92 PID 4408 wrote to memory of 1252 4408 9124.tmp 93 PID 4408 wrote to memory of 1252 4408 9124.tmp 93 PID 4408 wrote to memory of 1252 4408 9124.tmp 93 PID 1252 wrote to memory of 5028 1252 91B1.tmp 94 PID 1252 wrote to memory of 5028 1252 91B1.tmp 94 PID 1252 wrote to memory of 5028 1252 91B1.tmp 94 PID 5028 wrote to memory of 4700 5028 923D.tmp 95 PID 5028 wrote to memory of 4700 5028 923D.tmp 95 PID 5028 wrote to memory of 4700 5028 923D.tmp 95 PID 4700 wrote to memory of 3248 4700 92CA.tmp 96 PID 4700 wrote to memory of 3248 4700 92CA.tmp 96 PID 4700 wrote to memory of 3248 4700 92CA.tmp 96 PID 3248 wrote to memory of 3460 3248 9357.tmp 97 PID 3248 wrote to memory of 3460 3248 9357.tmp 97 PID 3248 wrote to memory of 3460 3248 9357.tmp 97 PID 3460 wrote to memory of 3988 3460 93D4.tmp 98 PID 3460 wrote to memory of 3988 3460 93D4.tmp 98 PID 3460 wrote to memory of 3988 3460 93D4.tmp 98 PID 3988 wrote to memory of 2944 3988 9441.tmp 99 PID 3988 wrote to memory of 2944 3988 9441.tmp 99 PID 3988 wrote to memory of 2944 3988 9441.tmp 99 PID 2944 wrote to memory of 4144 2944 94AE.tmp 100 PID 2944 wrote to memory of 4144 2944 94AE.tmp 100 PID 2944 wrote to memory of 4144 2944 94AE.tmp 100 PID 4144 wrote to memory of 1916 4144 951C.tmp 101 PID 4144 wrote to memory of 1916 4144 951C.tmp 101 PID 4144 wrote to memory of 1916 4144 951C.tmp 101 PID 1916 wrote to memory of 1564 1916 95A8.tmp 102 PID 1916 wrote to memory of 1564 1916 95A8.tmp 102 PID 1916 wrote to memory of 1564 1916 95A8.tmp 102 PID 1564 wrote to memory of 392 1564 9635.tmp 103 PID 1564 wrote to memory of 392 1564 9635.tmp 103 PID 1564 wrote to memory of 392 1564 9635.tmp 103 PID 392 wrote to memory of 1888 392 96C2.tmp 104 PID 392 wrote to memory of 1888 392 96C2.tmp 104 PID 392 wrote to memory of 1888 392 96C2.tmp 104 PID 1888 wrote to memory of 4548 1888 972F.tmp 105 PID 1888 wrote to memory of 4548 1888 972F.tmp 105 PID 1888 wrote to memory of 4548 1888 972F.tmp 105 PID 4548 wrote to memory of 244 4548 979C.tmp 106 PID 4548 wrote to memory of 244 4548 979C.tmp 106 PID 4548 wrote to memory of 244 4548 979C.tmp 106 PID 244 wrote to memory of 4340 244 9819.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-07_c4fdd9ea14835a82d2a3bf59bb24e235_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-07_c4fdd9ea14835a82d2a3bf59bb24e235_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\8DE8.tmp"C:\Users\Admin\AppData\Local\Temp\8DE8.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\8E65.tmp"C:\Users\Admin\AppData\Local\Temp\8E65.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\8F11.tmp"C:\Users\Admin\AppData\Local\Temp\8F11.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\902A.tmp"C:\Users\Admin\AppData\Local\Temp\902A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\9097.tmp"C:\Users\Admin\AppData\Local\Temp\9097.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\9124.tmp"C:\Users\Admin\AppData\Local\Temp\9124.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\91B1.tmp"C:\Users\Admin\AppData\Local\Temp\91B1.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\923D.tmp"C:\Users\Admin\AppData\Local\Temp\923D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\92CA.tmp"C:\Users\Admin\AppData\Local\Temp\92CA.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\9357.tmp"C:\Users\Admin\AppData\Local\Temp\9357.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\93D4.tmp"C:\Users\Admin\AppData\Local\Temp\93D4.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\9441.tmp"C:\Users\Admin\AppData\Local\Temp\9441.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\94AE.tmp"C:\Users\Admin\AppData\Local\Temp\94AE.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\951C.tmp"C:\Users\Admin\AppData\Local\Temp\951C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\95A8.tmp"C:\Users\Admin\AppData\Local\Temp\95A8.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\9635.tmp"C:\Users\Admin\AppData\Local\Temp\9635.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\96C2.tmp"C:\Users\Admin\AppData\Local\Temp\96C2.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Users\Admin\AppData\Local\Temp\972F.tmp"C:\Users\Admin\AppData\Local\Temp\972F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\979C.tmp"C:\Users\Admin\AppData\Local\Temp\979C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\9819.tmp"C:\Users\Admin\AppData\Local\Temp\9819.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Users\Admin\AppData\Local\Temp\9896.tmp"C:\Users\Admin\AppData\Local\Temp\9896.tmp"23⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\9913.tmp"C:\Users\Admin\AppData\Local\Temp\9913.tmp"24⤵
- Executes dropped EXE
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\99A0.tmp"C:\Users\Admin\AppData\Local\Temp\99A0.tmp"25⤵
- Executes dropped EXE
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"26⤵
- Executes dropped EXE
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"27⤵
- Executes dropped EXE
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"28⤵
- Executes dropped EXE
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\9B94.tmp"C:\Users\Admin\AppData\Local\Temp\9B94.tmp"29⤵
- Executes dropped EXE
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\9C21.tmp"C:\Users\Admin\AppData\Local\Temp\9C21.tmp"30⤵
- Executes dropped EXE
PID:812 -
C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"31⤵
- Executes dropped EXE
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\9D59.tmp"C:\Users\Admin\AppData\Local\Temp\9D59.tmp"32⤵
- Executes dropped EXE
PID:628 -
C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"33⤵
- Executes dropped EXE
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\9E82.tmp"C:\Users\Admin\AppData\Local\Temp\9E82.tmp"34⤵
- Executes dropped EXE
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"35⤵
- Executes dropped EXE
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"36⤵
- Executes dropped EXE
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"37⤵
- Executes dropped EXE
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"38⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\A076.tmp"C:\Users\Admin\AppData\Local\Temp\A076.tmp"39⤵
- Executes dropped EXE
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\A131.tmp"C:\Users\Admin\AppData\Local\Temp\A131.tmp"41⤵
- Executes dropped EXE
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\A180.tmp"C:\Users\Admin\AppData\Local\Temp\A180.tmp"42⤵
- Executes dropped EXE
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"43⤵
- Executes dropped EXE
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\A22B.tmp"C:\Users\Admin\AppData\Local\Temp\A22B.tmp"44⤵
- Executes dropped EXE
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\A27A.tmp"C:\Users\Admin\AppData\Local\Temp\A27A.tmp"45⤵
- Executes dropped EXE
PID:836 -
C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"46⤵
- Executes dropped EXE
PID:184 -
C:\Users\Admin\AppData\Local\Temp\A325.tmp"C:\Users\Admin\AppData\Local\Temp\A325.tmp"47⤵
- Executes dropped EXE
PID:540 -
C:\Users\Admin\AppData\Local\Temp\A383.tmp"C:\Users\Admin\AppData\Local\Temp\A383.tmp"48⤵
- Executes dropped EXE
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"49⤵
- Executes dropped EXE
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\A42F.tmp"C:\Users\Admin\AppData\Local\Temp\A42F.tmp"50⤵
- Executes dropped EXE
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\A48D.tmp"C:\Users\Admin\AppData\Local\Temp\A48D.tmp"51⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"52⤵
- Executes dropped EXE
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\A539.tmp"C:\Users\Admin\AppData\Local\Temp\A539.tmp"53⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\A596.tmp"C:\Users\Admin\AppData\Local\Temp\A596.tmp"54⤵
- Executes dropped EXE
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"55⤵
- Executes dropped EXE
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\A642.tmp"C:\Users\Admin\AppData\Local\Temp\A642.tmp"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"57⤵
- Executes dropped EXE
PID:548 -
C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"58⤵
- Executes dropped EXE
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\A75C.tmp"C:\Users\Admin\AppData\Local\Temp\A75C.tmp"59⤵
- Executes dropped EXE
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"60⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"61⤵
- Executes dropped EXE
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\A856.tmp"C:\Users\Admin\AppData\Local\Temp\A856.tmp"62⤵
- Executes dropped EXE
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"63⤵
- Executes dropped EXE
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\A901.tmp"C:\Users\Admin\AppData\Local\Temp\A901.tmp"64⤵
- Executes dropped EXE
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\A95F.tmp"C:\Users\Admin\AppData\Local\Temp\A95F.tmp"65⤵
- Executes dropped EXE
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"66⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"67⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\AA78.tmp"C:\Users\Admin\AppData\Local\Temp\AA78.tmp"68⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"69⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\AB34.tmp"C:\Users\Admin\AppData\Local\Temp\AB34.tmp"70⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\AB82.tmp"C:\Users\Admin\AppData\Local\Temp\AB82.tmp"71⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"72⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"73⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"74⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"75⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\AD18.tmp"C:\Users\Admin\AppData\Local\Temp\AD18.tmp"76⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\AD66.tmp"C:\Users\Admin\AppData\Local\Temp\AD66.tmp"77⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\ADC4.tmp"C:\Users\Admin\AppData\Local\Temp\ADC4.tmp"78⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\AE12.tmp"C:\Users\Admin\AppData\Local\Temp\AE12.tmp"79⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\AE70.tmp"C:\Users\Admin\AppData\Local\Temp\AE70.tmp"80⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"81⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"82⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\AF6A.tmp"C:\Users\Admin\AppData\Local\Temp\AF6A.tmp"83⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"84⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\B016.tmp"C:\Users\Admin\AppData\Local\Temp\B016.tmp"85⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\B074.tmp"C:\Users\Admin\AppData\Local\Temp\B074.tmp"86⤵
- System Location Discovery: System Language Discovery
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"87⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\B120.tmp"C:\Users\Admin\AppData\Local\Temp\B120.tmp"88⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\B18D.tmp"C:\Users\Admin\AppData\Local\Temp\B18D.tmp"89⤵
- System Location Discovery: System Language Discovery
PID:8 -
C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"90⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\B248.tmp"C:\Users\Admin\AppData\Local\Temp\B248.tmp"91⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\B2A6.tmp"C:\Users\Admin\AppData\Local\Temp\B2A6.tmp"92⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"93⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\B352.tmp"C:\Users\Admin\AppData\Local\Temp\B352.tmp"94⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"95⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"96⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\B44C.tmp"C:\Users\Admin\AppData\Local\Temp\B44C.tmp"97⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"98⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\B517.tmp"C:\Users\Admin\AppData\Local\Temp\B517.tmp"99⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\B575.tmp"C:\Users\Admin\AppData\Local\Temp\B575.tmp"100⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\B5D3.tmp"C:\Users\Admin\AppData\Local\Temp\B5D3.tmp"101⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\B630.tmp"C:\Users\Admin\AppData\Local\Temp\B630.tmp"102⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\B68E.tmp"C:\Users\Admin\AppData\Local\Temp\B68E.tmp"103⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"104⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\B74A.tmp"C:\Users\Admin\AppData\Local\Temp\B74A.tmp"105⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"106⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\B815.tmp"C:\Users\Admin\AppData\Local\Temp\B815.tmp"107⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\B882.tmp"C:\Users\Admin\AppData\Local\Temp\B882.tmp"108⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"109⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\B94D.tmp"C:\Users\Admin\AppData\Local\Temp\B94D.tmp"110⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\B99B.tmp"C:\Users\Admin\AppData\Local\Temp\B99B.tmp"111⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\B9F9.tmp"C:\Users\Admin\AppData\Local\Temp\B9F9.tmp"112⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\BA47.tmp"C:\Users\Admin\AppData\Local\Temp\BA47.tmp"113⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\BA95.tmp"C:\Users\Admin\AppData\Local\Temp\BA95.tmp"114⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\BAF3.tmp"C:\Users\Admin\AppData\Local\Temp\BAF3.tmp"115⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\BB41.tmp"C:\Users\Admin\AppData\Local\Temp\BB41.tmp"116⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"117⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"118⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"119⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"120⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\BCF7.tmp"C:\Users\Admin\AppData\Local\Temp\BCF7.tmp"121⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\BD55.tmp"C:\Users\Admin\AppData\Local\Temp\BD55.tmp"122⤵PID:1796
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-