Analysis
-
max time kernel
150s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12-08-2024 00:31
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-12_10c8bb5df011ebcdd1fabf48a7882e96_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-08-12_10c8bb5df011ebcdd1fabf48a7882e96_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-12_10c8bb5df011ebcdd1fabf48a7882e96_mafia.exe
-
Size
536KB
-
MD5
10c8bb5df011ebcdd1fabf48a7882e96
-
SHA1
6ffd666f3e19afa0dfd0b33bbd9f6539c19189e1
-
SHA256
7fc95d4bacd8c1a37cc7d825affad194b1e11d730cfd1927394761a6e956ba37
-
SHA512
e44f7482928630e677ccbe5bbd1fa6eff5b60580caa68bbe26ab3e151547f9ae453abed791d5dccd4cc9575af78fe6684338e5b410127d2c3720b78647f636eb
-
SSDEEP
12288:wU5rCOTeiUoBVWNcGFXv+cVutnGCYpRuIZxVJ0ZT9:wUQOJUoBwNcGF/+AWs6IRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1960 BE8D.tmp 1196 BF49.tmp 5116 BFD5.tmp 2168 C052.tmp 4888 C0CF.tmp 1132 C13D.tmp 3004 C1AA.tmp 1784 C217.tmp 4824 C2A4.tmp 1444 C321.tmp 3256 C39E.tmp 2124 C41B.tmp 1048 C4A8.tmp 3744 C515.tmp 4788 C582.tmp 5020 C60F.tmp 3112 C69C.tmp 5060 C709.tmp 4392 C776.tmp 388 C803.tmp 1648 C890.tmp 4032 C8FD.tmp 4772 C98A.tmp 2236 CA07.tmp 4940 CA93.tmp 4136 CB10.tmp 3216 CB8D.tmp 4608 CC1A.tmp 2464 CC97.tmp 4476 CD14.tmp 3488 CDB0.tmp 5028 CE4C.tmp 4564 CF08.tmp 1404 CF75.tmp 112 CFF2.tmp 216 D060.tmp 1448 D0CD.tmp 4612 D11B.tmp 4960 D198.tmp 1684 D1F6.tmp 1956 D254.tmp 2860 D2D1.tmp 1524 D33E.tmp 3928 D39C.tmp 2988 D409.tmp 4780 D476.tmp 3184 D4C5.tmp 4644 D522.tmp 2124 D590.tmp 4396 D5ED.tmp 3748 D63C.tmp 3228 D68A.tmp 2720 D6D8.tmp 2420 D736.tmp 2704 D784.tmp 5060 D7E1.tmp 548 D830.tmp 3172 D87E.tmp 1076 D8CC.tmp 5080 D91A.tmp 2120 D968.tmp 1876 D9B6.tmp 372 DA14.tmp 4940 DA62.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FE7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C109.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3534.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E55A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F879.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC73.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 414A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6184.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C966.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F642.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E271.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 105.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E30D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFAD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9296.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 775E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CDC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A023.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9892.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E668.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 961.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3948 wrote to memory of 1960 3948 2024-08-12_10c8bb5df011ebcdd1fabf48a7882e96_mafia.exe 86 PID 3948 wrote to memory of 1960 3948 2024-08-12_10c8bb5df011ebcdd1fabf48a7882e96_mafia.exe 86 PID 3948 wrote to memory of 1960 3948 2024-08-12_10c8bb5df011ebcdd1fabf48a7882e96_mafia.exe 86 PID 1960 wrote to memory of 1196 1960 BE8D.tmp 88 PID 1960 wrote to memory of 1196 1960 BE8D.tmp 88 PID 1960 wrote to memory of 1196 1960 BE8D.tmp 88 PID 1196 wrote to memory of 5116 1196 BF49.tmp 90 PID 1196 wrote to memory of 5116 1196 BF49.tmp 90 PID 1196 wrote to memory of 5116 1196 BF49.tmp 90 PID 5116 wrote to memory of 2168 5116 BFD5.tmp 92 PID 5116 wrote to memory of 2168 5116 BFD5.tmp 92 PID 5116 wrote to memory of 2168 5116 BFD5.tmp 92 PID 2168 wrote to memory of 4888 2168 C052.tmp 93 PID 2168 wrote to memory of 4888 2168 C052.tmp 93 PID 2168 wrote to memory of 4888 2168 C052.tmp 93 PID 4888 wrote to memory of 1132 4888 C0CF.tmp 94 PID 4888 wrote to memory of 1132 4888 C0CF.tmp 94 PID 4888 wrote to memory of 1132 4888 C0CF.tmp 94 PID 1132 wrote to memory of 3004 1132 C13D.tmp 95 PID 1132 wrote to memory of 3004 1132 C13D.tmp 95 PID 1132 wrote to memory of 3004 1132 C13D.tmp 95 PID 3004 wrote to memory of 1784 3004 C1AA.tmp 96 PID 3004 wrote to memory of 1784 3004 C1AA.tmp 96 PID 3004 wrote to memory of 1784 3004 C1AA.tmp 96 PID 1784 wrote to memory of 4824 1784 C217.tmp 97 PID 1784 wrote to memory of 4824 1784 C217.tmp 97 PID 1784 wrote to memory of 4824 1784 C217.tmp 97 PID 4824 wrote to memory of 1444 4824 C2A4.tmp 98 PID 4824 wrote to memory of 1444 4824 C2A4.tmp 98 PID 4824 wrote to memory of 1444 4824 C2A4.tmp 98 PID 1444 wrote to memory of 3256 1444 C321.tmp 99 PID 1444 wrote to memory of 3256 1444 C321.tmp 99 PID 1444 wrote to memory of 3256 1444 C321.tmp 99 PID 3256 wrote to memory of 2124 3256 C39E.tmp 100 PID 3256 wrote to memory of 2124 3256 C39E.tmp 100 PID 3256 wrote to memory of 2124 3256 C39E.tmp 100 PID 2124 wrote to memory of 1048 2124 C41B.tmp 101 PID 2124 wrote to memory of 1048 2124 C41B.tmp 101 PID 2124 wrote to memory of 1048 2124 C41B.tmp 101 PID 1048 wrote to memory of 3744 1048 C4A8.tmp 102 PID 1048 wrote to memory of 3744 1048 C4A8.tmp 102 PID 1048 wrote to memory of 3744 1048 C4A8.tmp 102 PID 3744 wrote to memory of 4788 3744 C515.tmp 103 PID 3744 wrote to memory of 4788 3744 C515.tmp 103 PID 3744 wrote to memory of 4788 3744 C515.tmp 103 PID 4788 wrote to memory of 5020 4788 C582.tmp 104 PID 4788 wrote to memory of 5020 4788 C582.tmp 104 PID 4788 wrote to memory of 5020 4788 C582.tmp 104 PID 5020 wrote to memory of 3112 5020 C60F.tmp 105 PID 5020 wrote to memory of 3112 5020 C60F.tmp 105 PID 5020 wrote to memory of 3112 5020 C60F.tmp 105 PID 3112 wrote to memory of 5060 3112 C69C.tmp 106 PID 3112 wrote to memory of 5060 3112 C69C.tmp 106 PID 3112 wrote to memory of 5060 3112 C69C.tmp 106 PID 5060 wrote to memory of 4392 5060 C709.tmp 107 PID 5060 wrote to memory of 4392 5060 C709.tmp 107 PID 5060 wrote to memory of 4392 5060 C709.tmp 107 PID 4392 wrote to memory of 388 4392 C776.tmp 108 PID 4392 wrote to memory of 388 4392 C776.tmp 108 PID 4392 wrote to memory of 388 4392 C776.tmp 108 PID 388 wrote to memory of 1648 388 C803.tmp 109 PID 388 wrote to memory of 1648 388 C803.tmp 109 PID 388 wrote to memory of 1648 388 C803.tmp 109 PID 1648 wrote to memory of 4032 1648 C890.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-12_10c8bb5df011ebcdd1fabf48a7882e96_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-12_10c8bb5df011ebcdd1fabf48a7882e96_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\BF49.tmp"C:\Users\Admin\AppData\Local\Temp\BF49.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\BFD5.tmp"C:\Users\Admin\AppData\Local\Temp\BFD5.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\C052.tmp"C:\Users\Admin\AppData\Local\Temp\C052.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\C13D.tmp"C:\Users\Admin\AppData\Local\Temp\C13D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\C217.tmp"C:\Users\Admin\AppData\Local\Temp\C217.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\C2A4.tmp"C:\Users\Admin\AppData\Local\Temp\C2A4.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\C321.tmp"C:\Users\Admin\AppData\Local\Temp\C321.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\C39E.tmp"C:\Users\Admin\AppData\Local\Temp\C39E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\C41B.tmp"C:\Users\Admin\AppData\Local\Temp\C41B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\C515.tmp"C:\Users\Admin\AppData\Local\Temp\C515.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\C582.tmp"C:\Users\Admin\AppData\Local\Temp\C582.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\C60F.tmp"C:\Users\Admin\AppData\Local\Temp\C60F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\C69C.tmp"C:\Users\Admin\AppData\Local\Temp\C69C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\C709.tmp"C:\Users\Admin\AppData\Local\Temp\C709.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\C776.tmp"C:\Users\Admin\AppData\Local\Temp\C776.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\C803.tmp"C:\Users\Admin\AppData\Local\Temp\C803.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Users\Admin\AppData\Local\Temp\C890.tmp"C:\Users\Admin\AppData\Local\Temp\C890.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\C8FD.tmp"C:\Users\Admin\AppData\Local\Temp\C8FD.tmp"23⤵
- Executes dropped EXE
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\C98A.tmp"C:\Users\Admin\AppData\Local\Temp\C98A.tmp"24⤵
- Executes dropped EXE
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\CA07.tmp"C:\Users\Admin\AppData\Local\Temp\CA07.tmp"25⤵
- Executes dropped EXE
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\CA93.tmp"C:\Users\Admin\AppData\Local\Temp\CA93.tmp"26⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\CB10.tmp"C:\Users\Admin\AppData\Local\Temp\CB10.tmp"27⤵
- Executes dropped EXE
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\CB8D.tmp"C:\Users\Admin\AppData\Local\Temp\CB8D.tmp"28⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\CC1A.tmp"C:\Users\Admin\AppData\Local\Temp\CC1A.tmp"29⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\CC97.tmp"C:\Users\Admin\AppData\Local\Temp\CC97.tmp"30⤵
- Executes dropped EXE
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\CD14.tmp"C:\Users\Admin\AppData\Local\Temp\CD14.tmp"31⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\CDB0.tmp"C:\Users\Admin\AppData\Local\Temp\CDB0.tmp"32⤵
- Executes dropped EXE
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\CE4C.tmp"C:\Users\Admin\AppData\Local\Temp\CE4C.tmp"33⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\CE9A.tmp"C:\Users\Admin\AppData\Local\Temp\CE9A.tmp"34⤵
- System Location Discovery: System Language Discovery
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\CF08.tmp"C:\Users\Admin\AppData\Local\Temp\CF08.tmp"35⤵
- Executes dropped EXE
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\CF75.tmp"C:\Users\Admin\AppData\Local\Temp\CF75.tmp"36⤵
- Executes dropped EXE
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\CFF2.tmp"C:\Users\Admin\AppData\Local\Temp\CFF2.tmp"37⤵
- Executes dropped EXE
PID:112 -
C:\Users\Admin\AppData\Local\Temp\D060.tmp"C:\Users\Admin\AppData\Local\Temp\D060.tmp"38⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\D0CD.tmp"C:\Users\Admin\AppData\Local\Temp\D0CD.tmp"39⤵
- Executes dropped EXE
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\D11B.tmp"C:\Users\Admin\AppData\Local\Temp\D11B.tmp"40⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\D198.tmp"C:\Users\Admin\AppData\Local\Temp\D198.tmp"41⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\D1F6.tmp"C:\Users\Admin\AppData\Local\Temp\D1F6.tmp"42⤵
- Executes dropped EXE
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\D254.tmp"C:\Users\Admin\AppData\Local\Temp\D254.tmp"43⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\D2D1.tmp"C:\Users\Admin\AppData\Local\Temp\D2D1.tmp"44⤵
- Executes dropped EXE
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\D33E.tmp"C:\Users\Admin\AppData\Local\Temp\D33E.tmp"45⤵
- Executes dropped EXE
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\D39C.tmp"C:\Users\Admin\AppData\Local\Temp\D39C.tmp"46⤵
- Executes dropped EXE
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\D409.tmp"C:\Users\Admin\AppData\Local\Temp\D409.tmp"47⤵
- Executes dropped EXE
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\D476.tmp"C:\Users\Admin\AppData\Local\Temp\D476.tmp"48⤵
- Executes dropped EXE
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\D4C5.tmp"C:\Users\Admin\AppData\Local\Temp\D4C5.tmp"49⤵
- Executes dropped EXE
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\D522.tmp"C:\Users\Admin\AppData\Local\Temp\D522.tmp"50⤵
- Executes dropped EXE
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\D590.tmp"C:\Users\Admin\AppData\Local\Temp\D590.tmp"51⤵
- Executes dropped EXE
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\D5ED.tmp"C:\Users\Admin\AppData\Local\Temp\D5ED.tmp"52⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\D63C.tmp"C:\Users\Admin\AppData\Local\Temp\D63C.tmp"53⤵
- Executes dropped EXE
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\D68A.tmp"C:\Users\Admin\AppData\Local\Temp\D68A.tmp"54⤵
- Executes dropped EXE
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\D6D8.tmp"C:\Users\Admin\AppData\Local\Temp\D6D8.tmp"55⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\D736.tmp"C:\Users\Admin\AppData\Local\Temp\D736.tmp"56⤵
- Executes dropped EXE
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\D784.tmp"C:\Users\Admin\AppData\Local\Temp\D784.tmp"57⤵
- Executes dropped EXE
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\D7E1.tmp"C:\Users\Admin\AppData\Local\Temp\D7E1.tmp"58⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\D830.tmp"C:\Users\Admin\AppData\Local\Temp\D830.tmp"59⤵
- Executes dropped EXE
PID:548 -
C:\Users\Admin\AppData\Local\Temp\D87E.tmp"C:\Users\Admin\AppData\Local\Temp\D87E.tmp"60⤵
- Executes dropped EXE
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\D8CC.tmp"C:\Users\Admin\AppData\Local\Temp\D8CC.tmp"61⤵
- Executes dropped EXE
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\D91A.tmp"C:\Users\Admin\AppData\Local\Temp\D91A.tmp"62⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\D968.tmp"C:\Users\Admin\AppData\Local\Temp\D968.tmp"63⤵
- Executes dropped EXE
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\D9B6.tmp"C:\Users\Admin\AppData\Local\Temp\D9B6.tmp"64⤵
- Executes dropped EXE
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\DA14.tmp"C:\Users\Admin\AppData\Local\Temp\DA14.tmp"65⤵
- Executes dropped EXE
PID:372 -
C:\Users\Admin\AppData\Local\Temp\DA62.tmp"C:\Users\Admin\AppData\Local\Temp\DA62.tmp"66⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\DAB0.tmp"C:\Users\Admin\AppData\Local\Temp\DAB0.tmp"67⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\DAFE.tmp"C:\Users\Admin\AppData\Local\Temp\DAFE.tmp"68⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\DB5C.tmp"C:\Users\Admin\AppData\Local\Temp\DB5C.tmp"69⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\DBBA.tmp"C:\Users\Admin\AppData\Local\Temp\DBBA.tmp"70⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\DC18.tmp"C:\Users\Admin\AppData\Local\Temp\DC18.tmp"71⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\DC66.tmp"C:\Users\Admin\AppData\Local\Temp\DC66.tmp"72⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\DCC3.tmp"C:\Users\Admin\AppData\Local\Temp\DCC3.tmp"73⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\DD12.tmp"C:\Users\Admin\AppData\Local\Temp\DD12.tmp"74⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\DD60.tmp"C:\Users\Admin\AppData\Local\Temp\DD60.tmp"75⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\DDAE.tmp"C:\Users\Admin\AppData\Local\Temp\DDAE.tmp"76⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\DE0C.tmp"C:\Users\Admin\AppData\Local\Temp\DE0C.tmp"77⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\DE5A.tmp"C:\Users\Admin\AppData\Local\Temp\DE5A.tmp"78⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\DEB7.tmp"C:\Users\Admin\AppData\Local\Temp\DEB7.tmp"79⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\DF06.tmp"C:\Users\Admin\AppData\Local\Temp\DF06.tmp"80⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\DF54.tmp"C:\Users\Admin\AppData\Local\Temp\DF54.tmp"81⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\DFA2.tmp"C:\Users\Admin\AppData\Local\Temp\DFA2.tmp"82⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"83⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\E04E.tmp"C:\Users\Admin\AppData\Local\Temp\E04E.tmp"84⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\E09C.tmp"C:\Users\Admin\AppData\Local\Temp\E09C.tmp"85⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\E0EA.tmp"C:\Users\Admin\AppData\Local\Temp\E0EA.tmp"86⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\E138.tmp"C:\Users\Admin\AppData\Local\Temp\E138.tmp"87⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\E177.tmp"C:\Users\Admin\AppData\Local\Temp\E177.tmp"88⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\E1D4.tmp"C:\Users\Admin\AppData\Local\Temp\E1D4.tmp"89⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\E222.tmp"C:\Users\Admin\AppData\Local\Temp\E222.tmp"90⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\E271.tmp"C:\Users\Admin\AppData\Local\Temp\E271.tmp"91⤵
- System Location Discovery: System Language Discovery
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\E2BF.tmp"C:\Users\Admin\AppData\Local\Temp\E2BF.tmp"92⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\E30D.tmp"C:\Users\Admin\AppData\Local\Temp\E30D.tmp"93⤵
- System Location Discovery: System Language Discovery
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\E35B.tmp"C:\Users\Admin\AppData\Local\Temp\E35B.tmp"94⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\E3B9.tmp"C:\Users\Admin\AppData\Local\Temp\E3B9.tmp"95⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\E416.tmp"C:\Users\Admin\AppData\Local\Temp\E416.tmp"96⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\E474.tmp"C:\Users\Admin\AppData\Local\Temp\E474.tmp"97⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\E4C2.tmp"C:\Users\Admin\AppData\Local\Temp\E4C2.tmp"98⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\E510.tmp"C:\Users\Admin\AppData\Local\Temp\E510.tmp"99⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\E56E.tmp"C:\Users\Admin\AppData\Local\Temp\E56E.tmp"100⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\E5BC.tmp"C:\Users\Admin\AppData\Local\Temp\E5BC.tmp"101⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\E61A.tmp"C:\Users\Admin\AppData\Local\Temp\E61A.tmp"102⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\E668.tmp"C:\Users\Admin\AppData\Local\Temp\E668.tmp"103⤵
- System Location Discovery: System Language Discovery
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\E6B6.tmp"C:\Users\Admin\AppData\Local\Temp\E6B6.tmp"104⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\E704.tmp"C:\Users\Admin\AppData\Local\Temp\E704.tmp"105⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\E753.tmp"C:\Users\Admin\AppData\Local\Temp\E753.tmp"106⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"107⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"108⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\E83D.tmp"C:\Users\Admin\AppData\Local\Temp\E83D.tmp"109⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\E88B.tmp"C:\Users\Admin\AppData\Local\Temp\E88B.tmp"110⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"111⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\E927.tmp"C:\Users\Admin\AppData\Local\Temp\E927.tmp"112⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\E975.tmp"C:\Users\Admin\AppData\Local\Temp\E975.tmp"113⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\E9C4.tmp"C:\Users\Admin\AppData\Local\Temp\E9C4.tmp"114⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\EA12.tmp"C:\Users\Admin\AppData\Local\Temp\EA12.tmp"115⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\EA60.tmp"C:\Users\Admin\AppData\Local\Temp\EA60.tmp"116⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\EAAE.tmp"C:\Users\Admin\AppData\Local\Temp\EAAE.tmp"117⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\EB0C.tmp"C:\Users\Admin\AppData\Local\Temp\EB0C.tmp"118⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\EB5A.tmp"C:\Users\Admin\AppData\Local\Temp\EB5A.tmp"119⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\EBB8.tmp"C:\Users\Admin\AppData\Local\Temp\EBB8.tmp"120⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\EC06.tmp"C:\Users\Admin\AppData\Local\Temp\EC06.tmp"121⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\EC54.tmp"C:\Users\Admin\AppData\Local\Temp\EC54.tmp"122⤵PID:3464
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-