Analysis
-
max time kernel
150s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21-08-2024 08:06
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-21_ecb37dc3f246ea3c8f0c76685dd2fbe5_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-08-21_ecb37dc3f246ea3c8f0c76685dd2fbe5_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-21_ecb37dc3f246ea3c8f0c76685dd2fbe5_mafia.exe
-
Size
486KB
-
MD5
ecb37dc3f246ea3c8f0c76685dd2fbe5
-
SHA1
44518e7b66432df640494a2c6459a2027ba1533c
-
SHA256
4739e76e3117c28ebcc7bc7232443ae1ed4cf2ae64445937b1bb9d58ec5d8a6e
-
SHA512
fcdcdba7f3f75ea81e82be161379c2ce1dc119d786e68aa4f3294a1331dda64d19540f1d01e937137ba19ffc964e656b773793a2f2560c384943f00bf24074e4
-
SSDEEP
12288:UU5rCOTeiDUaLbPZi96dfQ7e0ZCLdLT5qNZ:UUQOJDUafxsx7ekChpqN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4136 C340.tmp 1128 C39E.tmp 3528 C3FC.tmp 856 C479.tmp 1052 C4F6.tmp 4980 C553.tmp 344 C5D0.tmp 2752 C67C.tmp 2144 C6EA.tmp 2304 C757.tmp 4060 C7A5.tmp 2224 C822.tmp 4976 C8AF.tmp 4156 C92C.tmp 2580 C98A.tmp 2016 CA07.tmp 3260 CA74.tmp 940 CAC2.tmp 3856 CB20.tmp 4016 CB9D.tmp 2620 CC1A.tmp 4572 CC78.tmp 456 CD14.tmp 2100 CD81.tmp 2896 CDDF.tmp 1272 CE2D.tmp 1572 CE7B.tmp 1960 CEE9.tmp 3292 CF56.tmp 4360 CFC3.tmp 1140 D031.tmp 3240 D0AE.tmp 5012 D11B.tmp 388 D179.tmp 4136 D1D7.tmp 5028 D234.tmp 5040 D292.tmp 3976 D2F0.tmp 908 D33E.tmp 2088 D39C.tmp 4396 D3F9.tmp 4468 D457.tmp 3940 D4B5.tmp 2540 D522.tmp 216 D580.tmp 3796 D5DE.tmp 2124 D64B.tmp 1528 D6A9.tmp 264 D716.tmp 4852 D774.tmp 2304 D7D2.tmp 3612 D830.tmp 3556 D88D.tmp 2224 D8EB.tmp 3972 D949.tmp 4916 D9A7.tmp 540 DA04.tmp 4828 DA62.tmp 3816 DAC0.tmp 5096 DB1E.tmp 2216 DB6C.tmp 5024 DBC9.tmp 3576 DC27.tmp 4636 DC75.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E2CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2287.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBA5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2021.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 360F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F944.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BEB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F491.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9594.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DABB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9843.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B244.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E937.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C89.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D179.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 336F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4236 wrote to memory of 4136 4236 2024-08-21_ecb37dc3f246ea3c8f0c76685dd2fbe5_mafia.exe 84 PID 4236 wrote to memory of 4136 4236 2024-08-21_ecb37dc3f246ea3c8f0c76685dd2fbe5_mafia.exe 84 PID 4236 wrote to memory of 4136 4236 2024-08-21_ecb37dc3f246ea3c8f0c76685dd2fbe5_mafia.exe 84 PID 4136 wrote to memory of 1128 4136 C340.tmp 85 PID 4136 wrote to memory of 1128 4136 C340.tmp 85 PID 4136 wrote to memory of 1128 4136 C340.tmp 85 PID 1128 wrote to memory of 3528 1128 C39E.tmp 86 PID 1128 wrote to memory of 3528 1128 C39E.tmp 86 PID 1128 wrote to memory of 3528 1128 C39E.tmp 86 PID 3528 wrote to memory of 856 3528 C3FC.tmp 88 PID 3528 wrote to memory of 856 3528 C3FC.tmp 88 PID 3528 wrote to memory of 856 3528 C3FC.tmp 88 PID 856 wrote to memory of 1052 856 C479.tmp 90 PID 856 wrote to memory of 1052 856 C479.tmp 90 PID 856 wrote to memory of 1052 856 C479.tmp 90 PID 1052 wrote to memory of 4980 1052 C4F6.tmp 91 PID 1052 wrote to memory of 4980 1052 C4F6.tmp 91 PID 1052 wrote to memory of 4980 1052 C4F6.tmp 91 PID 4980 wrote to memory of 344 4980 C553.tmp 93 PID 4980 wrote to memory of 344 4980 C553.tmp 93 PID 4980 wrote to memory of 344 4980 C553.tmp 93 PID 344 wrote to memory of 2752 344 C5D0.tmp 94 PID 344 wrote to memory of 2752 344 C5D0.tmp 94 PID 344 wrote to memory of 2752 344 C5D0.tmp 94 PID 2752 wrote to memory of 2144 2752 C67C.tmp 95 PID 2752 wrote to memory of 2144 2752 C67C.tmp 95 PID 2752 wrote to memory of 2144 2752 C67C.tmp 95 PID 2144 wrote to memory of 2304 2144 C6EA.tmp 96 PID 2144 wrote to memory of 2304 2144 C6EA.tmp 96 PID 2144 wrote to memory of 2304 2144 C6EA.tmp 96 PID 2304 wrote to memory of 4060 2304 C757.tmp 97 PID 2304 wrote to memory of 4060 2304 C757.tmp 97 PID 2304 wrote to memory of 4060 2304 C757.tmp 97 PID 4060 wrote to memory of 2224 4060 C7A5.tmp 98 PID 4060 wrote to memory of 2224 4060 C7A5.tmp 98 PID 4060 wrote to memory of 2224 4060 C7A5.tmp 98 PID 2224 wrote to memory of 4976 2224 C822.tmp 99 PID 2224 wrote to memory of 4976 2224 C822.tmp 99 PID 2224 wrote to memory of 4976 2224 C822.tmp 99 PID 4976 wrote to memory of 4156 4976 C8AF.tmp 100 PID 4976 wrote to memory of 4156 4976 C8AF.tmp 100 PID 4976 wrote to memory of 4156 4976 C8AF.tmp 100 PID 4156 wrote to memory of 2580 4156 C92C.tmp 101 PID 4156 wrote to memory of 2580 4156 C92C.tmp 101 PID 4156 wrote to memory of 2580 4156 C92C.tmp 101 PID 2580 wrote to memory of 2016 2580 C98A.tmp 102 PID 2580 wrote to memory of 2016 2580 C98A.tmp 102 PID 2580 wrote to memory of 2016 2580 C98A.tmp 102 PID 2016 wrote to memory of 3260 2016 CA07.tmp 103 PID 2016 wrote to memory of 3260 2016 CA07.tmp 103 PID 2016 wrote to memory of 3260 2016 CA07.tmp 103 PID 3260 wrote to memory of 940 3260 CA74.tmp 104 PID 3260 wrote to memory of 940 3260 CA74.tmp 104 PID 3260 wrote to memory of 940 3260 CA74.tmp 104 PID 940 wrote to memory of 3856 940 CAC2.tmp 105 PID 940 wrote to memory of 3856 940 CAC2.tmp 105 PID 940 wrote to memory of 3856 940 CAC2.tmp 105 PID 3856 wrote to memory of 4016 3856 CB20.tmp 106 PID 3856 wrote to memory of 4016 3856 CB20.tmp 106 PID 3856 wrote to memory of 4016 3856 CB20.tmp 106 PID 4016 wrote to memory of 2620 4016 CB9D.tmp 109 PID 4016 wrote to memory of 2620 4016 CB9D.tmp 109 PID 4016 wrote to memory of 2620 4016 CB9D.tmp 109 PID 2620 wrote to memory of 4572 2620 CC1A.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-21_ecb37dc3f246ea3c8f0c76685dd2fbe5_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-21_ecb37dc3f246ea3c8f0c76685dd2fbe5_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\C340.tmp"C:\Users\Admin\AppData\Local\Temp\C340.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\C39E.tmp"C:\Users\Admin\AppData\Local\Temp\C39E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\C479.tmp"C:\Users\Admin\AppData\Local\Temp\C479.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\C553.tmp"C:\Users\Admin\AppData\Local\Temp\C553.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\C5D0.tmp"C:\Users\Admin\AppData\Local\Temp\C5D0.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:344 -
C:\Users\Admin\AppData\Local\Temp\C67C.tmp"C:\Users\Admin\AppData\Local\Temp\C67C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\C6EA.tmp"C:\Users\Admin\AppData\Local\Temp\C6EA.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\C757.tmp"C:\Users\Admin\AppData\Local\Temp\C757.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\C7A5.tmp"C:\Users\Admin\AppData\Local\Temp\C7A5.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\C822.tmp"C:\Users\Admin\AppData\Local\Temp\C822.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\C8AF.tmp"C:\Users\Admin\AppData\Local\Temp\C8AF.tmp"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\C92C.tmp"C:\Users\Admin\AppData\Local\Temp\C92C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\C98A.tmp"C:\Users\Admin\AppData\Local\Temp\C98A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\CA07.tmp"C:\Users\Admin\AppData\Local\Temp\CA07.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\CA74.tmp"C:\Users\Admin\AppData\Local\Temp\CA74.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\CAC2.tmp"C:\Users\Admin\AppData\Local\Temp\CAC2.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\CB20.tmp"C:\Users\Admin\AppData\Local\Temp\CB20.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\CB9D.tmp"C:\Users\Admin\AppData\Local\Temp\CB9D.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\CC1A.tmp"C:\Users\Admin\AppData\Local\Temp\CC1A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\CC78.tmp"C:\Users\Admin\AppData\Local\Temp\CC78.tmp"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\CD14.tmp"C:\Users\Admin\AppData\Local\Temp\CD14.tmp"24⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\AppData\Local\Temp\CD81.tmp"C:\Users\Admin\AppData\Local\Temp\CD81.tmp"25⤵
- Executes dropped EXE
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\CDDF.tmp"C:\Users\Admin\AppData\Local\Temp\CDDF.tmp"26⤵
- Executes dropped EXE
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\CE2D.tmp"C:\Users\Admin\AppData\Local\Temp\CE2D.tmp"27⤵
- Executes dropped EXE
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\CE7B.tmp"C:\Users\Admin\AppData\Local\Temp\CE7B.tmp"28⤵
- Executes dropped EXE
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\CEE9.tmp"C:\Users\Admin\AppData\Local\Temp\CEE9.tmp"29⤵
- Executes dropped EXE
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\CF56.tmp"C:\Users\Admin\AppData\Local\Temp\CF56.tmp"30⤵
- Executes dropped EXE
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\CFC3.tmp"C:\Users\Admin\AppData\Local\Temp\CFC3.tmp"31⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\D031.tmp"C:\Users\Admin\AppData\Local\Temp\D031.tmp"32⤵
- Executes dropped EXE
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"33⤵
- Executes dropped EXE
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\D11B.tmp"C:\Users\Admin\AppData\Local\Temp\D11B.tmp"34⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\D179.tmp"C:\Users\Admin\AppData\Local\Temp\D179.tmp"35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:388 -
C:\Users\Admin\AppData\Local\Temp\D1D7.tmp"C:\Users\Admin\AppData\Local\Temp\D1D7.tmp"36⤵
- Executes dropped EXE
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\D234.tmp"C:\Users\Admin\AppData\Local\Temp\D234.tmp"37⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\D292.tmp"C:\Users\Admin\AppData\Local\Temp\D292.tmp"38⤵
- Executes dropped EXE
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\D2F0.tmp"C:\Users\Admin\AppData\Local\Temp\D2F0.tmp"39⤵
- Executes dropped EXE
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\D33E.tmp"C:\Users\Admin\AppData\Local\Temp\D33E.tmp"40⤵
- Executes dropped EXE
PID:908 -
C:\Users\Admin\AppData\Local\Temp\D39C.tmp"C:\Users\Admin\AppData\Local\Temp\D39C.tmp"41⤵
- Executes dropped EXE
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\D3F9.tmp"C:\Users\Admin\AppData\Local\Temp\D3F9.tmp"42⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\D457.tmp"C:\Users\Admin\AppData\Local\Temp\D457.tmp"43⤵
- Executes dropped EXE
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\D4B5.tmp"C:\Users\Admin\AppData\Local\Temp\D4B5.tmp"44⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\D522.tmp"C:\Users\Admin\AppData\Local\Temp\D522.tmp"45⤵
- Executes dropped EXE
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\D580.tmp"C:\Users\Admin\AppData\Local\Temp\D580.tmp"46⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\D5DE.tmp"C:\Users\Admin\AppData\Local\Temp\D5DE.tmp"47⤵
- Executes dropped EXE
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\D64B.tmp"C:\Users\Admin\AppData\Local\Temp\D64B.tmp"48⤵
- Executes dropped EXE
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\D6A9.tmp"C:\Users\Admin\AppData\Local\Temp\D6A9.tmp"49⤵
- Executes dropped EXE
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\D716.tmp"C:\Users\Admin\AppData\Local\Temp\D716.tmp"50⤵
- Executes dropped EXE
PID:264 -
C:\Users\Admin\AppData\Local\Temp\D774.tmp"C:\Users\Admin\AppData\Local\Temp\D774.tmp"51⤵
- Executes dropped EXE
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\D7D2.tmp"C:\Users\Admin\AppData\Local\Temp\D7D2.tmp"52⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\D830.tmp"C:\Users\Admin\AppData\Local\Temp\D830.tmp"53⤵
- Executes dropped EXE
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\D88D.tmp"C:\Users\Admin\AppData\Local\Temp\D88D.tmp"54⤵
- Executes dropped EXE
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\D8EB.tmp"C:\Users\Admin\AppData\Local\Temp\D8EB.tmp"55⤵
- Executes dropped EXE
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\D949.tmp"C:\Users\Admin\AppData\Local\Temp\D949.tmp"56⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\D9A7.tmp"C:\Users\Admin\AppData\Local\Temp\D9A7.tmp"57⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\DA04.tmp"C:\Users\Admin\AppData\Local\Temp\DA04.tmp"58⤵
- Executes dropped EXE
PID:540 -
C:\Users\Admin\AppData\Local\Temp\DA62.tmp"C:\Users\Admin\AppData\Local\Temp\DA62.tmp"59⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\DAC0.tmp"C:\Users\Admin\AppData\Local\Temp\DAC0.tmp"60⤵
- Executes dropped EXE
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\DB1E.tmp"C:\Users\Admin\AppData\Local\Temp\DB1E.tmp"61⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\DB6C.tmp"C:\Users\Admin\AppData\Local\Temp\DB6C.tmp"62⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\DBC9.tmp"C:\Users\Admin\AppData\Local\Temp\DBC9.tmp"63⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\DC27.tmp"C:\Users\Admin\AppData\Local\Temp\DC27.tmp"64⤵
- Executes dropped EXE
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\DC75.tmp"C:\Users\Admin\AppData\Local\Temp\DC75.tmp"65⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\DCD3.tmp"C:\Users\Admin\AppData\Local\Temp\DCD3.tmp"66⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\DD21.tmp"C:\Users\Admin\AppData\Local\Temp\DD21.tmp"67⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\DD8F.tmp"C:\Users\Admin\AppData\Local\Temp\DD8F.tmp"68⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\DDEC.tmp"C:\Users\Admin\AppData\Local\Temp\DDEC.tmp"69⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\DE4A.tmp"C:\Users\Admin\AppData\Local\Temp\DE4A.tmp"70⤵
- System Location Discovery: System Language Discovery
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"71⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\DF15.tmp"C:\Users\Admin\AppData\Local\Temp\DF15.tmp"72⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\DF73.tmp"C:\Users\Admin\AppData\Local\Temp\DF73.tmp"73⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\DFE0.tmp"C:\Users\Admin\AppData\Local\Temp\DFE0.tmp"74⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\E03E.tmp"C:\Users\Admin\AppData\Local\Temp\E03E.tmp"75⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\E09C.tmp"C:\Users\Admin\AppData\Local\Temp\E09C.tmp"76⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\E0FA.tmp"C:\Users\Admin\AppData\Local\Temp\E0FA.tmp"77⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\E157.tmp"C:\Users\Admin\AppData\Local\Temp\E157.tmp"78⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\E1B5.tmp"C:\Users\Admin\AppData\Local\Temp\E1B5.tmp"79⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\E222.tmp"C:\Users\Admin\AppData\Local\Temp\E222.tmp"80⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\E271.tmp"C:\Users\Admin\AppData\Local\Temp\E271.tmp"81⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\E2CE.tmp"C:\Users\Admin\AppData\Local\Temp\E2CE.tmp"82⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\E32C.tmp"C:\Users\Admin\AppData\Local\Temp\E32C.tmp"83⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\E38A.tmp"C:\Users\Admin\AppData\Local\Temp\E38A.tmp"84⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\E3E8.tmp"C:\Users\Admin\AppData\Local\Temp\E3E8.tmp"85⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\E445.tmp"C:\Users\Admin\AppData\Local\Temp\E445.tmp"86⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\E4A3.tmp"C:\Users\Admin\AppData\Local\Temp\E4A3.tmp"87⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\E501.tmp"C:\Users\Admin\AppData\Local\Temp\E501.tmp"88⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\E55F.tmp"C:\Users\Admin\AppData\Local\Temp\E55F.tmp"89⤵PID:416
-
C:\Users\Admin\AppData\Local\Temp\E5BC.tmp"C:\Users\Admin\AppData\Local\Temp\E5BC.tmp"90⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\E61A.tmp"C:\Users\Admin\AppData\Local\Temp\E61A.tmp"91⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\E668.tmp"C:\Users\Admin\AppData\Local\Temp\E668.tmp"92⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\E6C6.tmp"C:\Users\Admin\AppData\Local\Temp\E6C6.tmp"93⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\E724.tmp"C:\Users\Admin\AppData\Local\Temp\E724.tmp"94⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\E781.tmp"C:\Users\Admin\AppData\Local\Temp\E781.tmp"95⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\E7DF.tmp"C:\Users\Admin\AppData\Local\Temp\E7DF.tmp"96⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\E82D.tmp"C:\Users\Admin\AppData\Local\Temp\E82D.tmp"97⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\E88B.tmp"C:\Users\Admin\AppData\Local\Temp\E88B.tmp"98⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"99⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\E937.tmp"C:\Users\Admin\AppData\Local\Temp\E937.tmp"100⤵
- System Location Discovery: System Language Discovery
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\E995.tmp"C:\Users\Admin\AppData\Local\Temp\E995.tmp"101⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\E9F2.tmp"C:\Users\Admin\AppData\Local\Temp\E9F2.tmp"102⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\EA50.tmp"C:\Users\Admin\AppData\Local\Temp\EA50.tmp"103⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\EAAE.tmp"C:\Users\Admin\AppData\Local\Temp\EAAE.tmp"104⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\EAFC.tmp"C:\Users\Admin\AppData\Local\Temp\EAFC.tmp"105⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\EB4A.tmp"C:\Users\Admin\AppData\Local\Temp\EB4A.tmp"106⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\EBA8.tmp"C:\Users\Admin\AppData\Local\Temp\EBA8.tmp"107⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\EC06.tmp"C:\Users\Admin\AppData\Local\Temp\EC06.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\EC63.tmp"C:\Users\Admin\AppData\Local\Temp\EC63.tmp"109⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\ECC1.tmp"C:\Users\Admin\AppData\Local\Temp\ECC1.tmp"110⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\ED0F.tmp"C:\Users\Admin\AppData\Local\Temp\ED0F.tmp"111⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\ED6D.tmp"C:\Users\Admin\AppData\Local\Temp\ED6D.tmp"112⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\EDCB.tmp"C:\Users\Admin\AppData\Local\Temp\EDCB.tmp"113⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\EE29.tmp"C:\Users\Admin\AppData\Local\Temp\EE29.tmp"114⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\EE86.tmp"C:\Users\Admin\AppData\Local\Temp\EE86.tmp"115⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\EED4.tmp"C:\Users\Admin\AppData\Local\Temp\EED4.tmp"116⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\EF32.tmp"C:\Users\Admin\AppData\Local\Temp\EF32.tmp"117⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\EF80.tmp"C:\Users\Admin\AppData\Local\Temp\EF80.tmp"118⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\EFCE.tmp"C:\Users\Admin\AppData\Local\Temp\EFCE.tmp"119⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\F01D.tmp"C:\Users\Admin\AppData\Local\Temp\F01D.tmp"120⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\F08A.tmp"C:\Users\Admin\AppData\Local\Temp\F08A.tmp"121⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\F0D8.tmp"C:\Users\Admin\AppData\Local\Temp\F0D8.tmp"122⤵PID:4432
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-