Analysis
-
max time kernel
150s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29/08/2024, 01:04
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-29_5a6f7fa704000e66556ef2e5e67ae9f1_mafia.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2024-08-29_5a6f7fa704000e66556ef2e5e67ae9f1_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-29_5a6f7fa704000e66556ef2e5e67ae9f1_mafia.exe
-
Size
712KB
-
MD5
5a6f7fa704000e66556ef2e5e67ae9f1
-
SHA1
431763d60c9cf52fc5aa88e7351c0b2636b6aadb
-
SHA256
c3340ca9a34307395ae3ea61214e4b86320a14e7bb31814a59b51600cdfe4911
-
SHA512
437cf2a6b715eab43f8fdb5bde2f259d9a34a9ec1ca318d5d221eacc61b824633ca77ac88f1f11f3551f128d6c715a50fba6af0228398cb1007b60eed8452730
-
SSDEEP
12288:FU5rCOTeiDJ1/h2PfKsHTBZ9fI3mETbTN4nNZdCvq5TJLCvY90D8/LVBlVk736YI:FUQOJDJ1p2KsH79I3mE/ANnCvq5TJLC0
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2112 AEDD.tmp 4944 AF4B.tmp 4140 AFB8.tmp 1500 B054.tmp 1964 B0D1.tmp 2068 B12F.tmp 3124 B1CB.tmp 5076 B229.tmp 1268 B2A6.tmp 4996 B304.tmp 4560 B381.tmp 2932 B3EE.tmp 3356 B45C.tmp 2164 B4C9.tmp 2864 B536.tmp 4872 B5C3.tmp 2504 B630.tmp 2552 B68E.tmp 1504 B6FC.tmp 4500 B759.tmp 628 B7E6.tmp 864 B853.tmp 3216 B8B1.tmp 1100 B90F.tmp 1564 B95D.tmp 3452 B9DA.tmp 944 BA76.tmp 652 BAD4.tmp 4040 BB51.tmp 4480 BBDE.tmp 4988 BC3B.tmp 1372 BCB8.tmp 4332 BD45.tmp 4352 BD93.tmp 3076 BDF1.tmp 920 BE3F.tmp 3204 BE9D.tmp 4944 BEEB.tmp 4708 BF39.tmp 1980 BF87.tmp 1536 BFD5.tmp 1512 C033.tmp 2036 C081.tmp 1932 C0DF.tmp 4312 C12D.tmp 2160 C19A.tmp 4560 C1F8.tmp 3920 C256.tmp 1496 C2A4.tmp 4272 C302.tmp 4628 C350.tmp 4868 C3AE.tmp 3648 C40B.tmp 3140 C459.tmp 2024 C4B7.tmp 3908 C525.tmp 3500 C573.tmp 4912 C5D0.tmp 1928 C62E.tmp 4500 C67C.tmp 2228 C6CA.tmp 3496 C728.tmp 3960 C786.tmp 4120 C7E4.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 846D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 588B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F056.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A870.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C31C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B512.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B968.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E6E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7308.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B381.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E186.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FA4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E104.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 623F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C09C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D481.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 172D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 579.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 436D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4541.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7838.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEB3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFD0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2488 wrote to memory of 2112 2488 2024-08-29_5a6f7fa704000e66556ef2e5e67ae9f1_mafia.exe 84 PID 2488 wrote to memory of 2112 2488 2024-08-29_5a6f7fa704000e66556ef2e5e67ae9f1_mafia.exe 84 PID 2488 wrote to memory of 2112 2488 2024-08-29_5a6f7fa704000e66556ef2e5e67ae9f1_mafia.exe 84 PID 2112 wrote to memory of 4944 2112 AEDD.tmp 86 PID 2112 wrote to memory of 4944 2112 AEDD.tmp 86 PID 2112 wrote to memory of 4944 2112 AEDD.tmp 86 PID 4944 wrote to memory of 4140 4944 AF4B.tmp 87 PID 4944 wrote to memory of 4140 4944 AF4B.tmp 87 PID 4944 wrote to memory of 4140 4944 AF4B.tmp 87 PID 4140 wrote to memory of 1500 4140 AFB8.tmp 89 PID 4140 wrote to memory of 1500 4140 AFB8.tmp 89 PID 4140 wrote to memory of 1500 4140 AFB8.tmp 89 PID 1500 wrote to memory of 1964 1500 B054.tmp 91 PID 1500 wrote to memory of 1964 1500 B054.tmp 91 PID 1500 wrote to memory of 1964 1500 B054.tmp 91 PID 1964 wrote to memory of 2068 1964 B0D1.tmp 92 PID 1964 wrote to memory of 2068 1964 B0D1.tmp 92 PID 1964 wrote to memory of 2068 1964 B0D1.tmp 92 PID 2068 wrote to memory of 3124 2068 B12F.tmp 93 PID 2068 wrote to memory of 3124 2068 B12F.tmp 93 PID 2068 wrote to memory of 3124 2068 B12F.tmp 93 PID 3124 wrote to memory of 5076 3124 B1CB.tmp 94 PID 3124 wrote to memory of 5076 3124 B1CB.tmp 94 PID 3124 wrote to memory of 5076 3124 B1CB.tmp 94 PID 5076 wrote to memory of 1268 5076 B229.tmp 95 PID 5076 wrote to memory of 1268 5076 B229.tmp 95 PID 5076 wrote to memory of 1268 5076 B229.tmp 95 PID 1268 wrote to memory of 4996 1268 B2A6.tmp 96 PID 1268 wrote to memory of 4996 1268 B2A6.tmp 96 PID 1268 wrote to memory of 4996 1268 B2A6.tmp 96 PID 4996 wrote to memory of 4560 4996 B304.tmp 97 PID 4996 wrote to memory of 4560 4996 B304.tmp 97 PID 4996 wrote to memory of 4560 4996 B304.tmp 97 PID 4560 wrote to memory of 2932 4560 B381.tmp 98 PID 4560 wrote to memory of 2932 4560 B381.tmp 98 PID 4560 wrote to memory of 2932 4560 B381.tmp 98 PID 2932 wrote to memory of 3356 2932 B3EE.tmp 99 PID 2932 wrote to memory of 3356 2932 B3EE.tmp 99 PID 2932 wrote to memory of 3356 2932 B3EE.tmp 99 PID 3356 wrote to memory of 2164 3356 B45C.tmp 100 PID 3356 wrote to memory of 2164 3356 B45C.tmp 100 PID 3356 wrote to memory of 2164 3356 B45C.tmp 100 PID 2164 wrote to memory of 2864 2164 B4C9.tmp 101 PID 2164 wrote to memory of 2864 2164 B4C9.tmp 101 PID 2164 wrote to memory of 2864 2164 B4C9.tmp 101 PID 2864 wrote to memory of 4872 2864 B536.tmp 102 PID 2864 wrote to memory of 4872 2864 B536.tmp 102 PID 2864 wrote to memory of 4872 2864 B536.tmp 102 PID 4872 wrote to memory of 2504 4872 B5C3.tmp 103 PID 4872 wrote to memory of 2504 4872 B5C3.tmp 103 PID 4872 wrote to memory of 2504 4872 B5C3.tmp 103 PID 2504 wrote to memory of 2552 2504 B630.tmp 104 PID 2504 wrote to memory of 2552 2504 B630.tmp 104 PID 2504 wrote to memory of 2552 2504 B630.tmp 104 PID 2552 wrote to memory of 1504 2552 B68E.tmp 105 PID 2552 wrote to memory of 1504 2552 B68E.tmp 105 PID 2552 wrote to memory of 1504 2552 B68E.tmp 105 PID 1504 wrote to memory of 4500 1504 B6FC.tmp 106 PID 1504 wrote to memory of 4500 1504 B6FC.tmp 106 PID 1504 wrote to memory of 4500 1504 B6FC.tmp 106 PID 4500 wrote to memory of 628 4500 B759.tmp 107 PID 4500 wrote to memory of 628 4500 B759.tmp 107 PID 4500 wrote to memory of 628 4500 B759.tmp 107 PID 628 wrote to memory of 864 628 B7E6.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-29_5a6f7fa704000e66556ef2e5e67ae9f1_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-29_5a6f7fa704000e66556ef2e5e67ae9f1_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\B054.tmp"C:\Users\Admin\AppData\Local\Temp\B054.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\B12F.tmp"C:\Users\Admin\AppData\Local\Temp\B12F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\B229.tmp"C:\Users\Admin\AppData\Local\Temp\B229.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\B2A6.tmp"C:\Users\Admin\AppData\Local\Temp\B2A6.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\B304.tmp"C:\Users\Admin\AppData\Local\Temp\B304.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\B381.tmp"C:\Users\Admin\AppData\Local\Temp\B381.tmp"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\B45C.tmp"C:\Users\Admin\AppData\Local\Temp\B45C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\B4C9.tmp"C:\Users\Admin\AppData\Local\Temp\B4C9.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\B536.tmp"C:\Users\Admin\AppData\Local\Temp\B536.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\B630.tmp"C:\Users\Admin\AppData\Local\Temp\B630.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\B68E.tmp"C:\Users\Admin\AppData\Local\Temp\B68E.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\B6FC.tmp"C:\Users\Admin\AppData\Local\Temp\B6FC.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\B759.tmp"C:\Users\Admin\AppData\Local\Temp\B759.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\B853.tmp"C:\Users\Admin\AppData\Local\Temp\B853.tmp"23⤵
- Executes dropped EXE
PID:864 -
C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"24⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\B90F.tmp"C:\Users\Admin\AppData\Local\Temp\B90F.tmp"25⤵
- Executes dropped EXE
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\B95D.tmp"C:\Users\Admin\AppData\Local\Temp\B95D.tmp"26⤵
- Executes dropped EXE
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"27⤵
- Executes dropped EXE
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\BA76.tmp"C:\Users\Admin\AppData\Local\Temp\BA76.tmp"28⤵
- Executes dropped EXE
PID:944 -
C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"29⤵
- Executes dropped EXE
PID:652 -
C:\Users\Admin\AppData\Local\Temp\BB51.tmp"C:\Users\Admin\AppData\Local\Temp\BB51.tmp"30⤵
- Executes dropped EXE
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"31⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"32⤵
- Executes dropped EXE
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\BCB8.tmp"C:\Users\Admin\AppData\Local\Temp\BCB8.tmp"33⤵
- Executes dropped EXE
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\BD45.tmp"C:\Users\Admin\AppData\Local\Temp\BD45.tmp"34⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\BD93.tmp"C:\Users\Admin\AppData\Local\Temp\BD93.tmp"35⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\BDF1.tmp"C:\Users\Admin\AppData\Local\Temp\BDF1.tmp"36⤵
- Executes dropped EXE
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"37⤵
- Executes dropped EXE
PID:920 -
C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"38⤵
- Executes dropped EXE
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\BEEB.tmp"C:\Users\Admin\AppData\Local\Temp\BEEB.tmp"39⤵
- Executes dropped EXE
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\BF39.tmp"C:\Users\Admin\AppData\Local\Temp\BF39.tmp"40⤵
- Executes dropped EXE
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\BF87.tmp"C:\Users\Admin\AppData\Local\Temp\BF87.tmp"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\BFD5.tmp"C:\Users\Admin\AppData\Local\Temp\BFD5.tmp"42⤵
- Executes dropped EXE
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\C033.tmp"C:\Users\Admin\AppData\Local\Temp\C033.tmp"43⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\C081.tmp"C:\Users\Admin\AppData\Local\Temp\C081.tmp"44⤵
- Executes dropped EXE
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"45⤵
- Executes dropped EXE
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\C12D.tmp"C:\Users\Admin\AppData\Local\Temp\C12D.tmp"46⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\C19A.tmp"C:\Users\Admin\AppData\Local\Temp\C19A.tmp"47⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\C1F8.tmp"C:\Users\Admin\AppData\Local\Temp\C1F8.tmp"48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\C256.tmp"C:\Users\Admin\AppData\Local\Temp\C256.tmp"49⤵
- Executes dropped EXE
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\C2A4.tmp"C:\Users\Admin\AppData\Local\Temp\C2A4.tmp"50⤵
- Executes dropped EXE
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\C302.tmp"C:\Users\Admin\AppData\Local\Temp\C302.tmp"51⤵
- Executes dropped EXE
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\C350.tmp"C:\Users\Admin\AppData\Local\Temp\C350.tmp"52⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\C3AE.tmp"C:\Users\Admin\AppData\Local\Temp\C3AE.tmp"53⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\C40B.tmp"C:\Users\Admin\AppData\Local\Temp\C40B.tmp"54⤵
- Executes dropped EXE
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\C459.tmp"C:\Users\Admin\AppData\Local\Temp\C459.tmp"55⤵
- Executes dropped EXE
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\C4B7.tmp"C:\Users\Admin\AppData\Local\Temp\C4B7.tmp"56⤵
- Executes dropped EXE
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\C525.tmp"C:\Users\Admin\AppData\Local\Temp\C525.tmp"57⤵
- Executes dropped EXE
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\C573.tmp"C:\Users\Admin\AppData\Local\Temp\C573.tmp"58⤵
- Executes dropped EXE
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\C5D0.tmp"C:\Users\Admin\AppData\Local\Temp\C5D0.tmp"59⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\C62E.tmp"C:\Users\Admin\AppData\Local\Temp\C62E.tmp"60⤵
- Executes dropped EXE
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\C67C.tmp"C:\Users\Admin\AppData\Local\Temp\C67C.tmp"61⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\C6CA.tmp"C:\Users\Admin\AppData\Local\Temp\C6CA.tmp"62⤵
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\C728.tmp"C:\Users\Admin\AppData\Local\Temp\C728.tmp"63⤵
- Executes dropped EXE
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\C786.tmp"C:\Users\Admin\AppData\Local\Temp\C786.tmp"64⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\C7E4.tmp"C:\Users\Admin\AppData\Local\Temp\C7E4.tmp"65⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\C832.tmp"C:\Users\Admin\AppData\Local\Temp\C832.tmp"66⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\C890.tmp"C:\Users\Admin\AppData\Local\Temp\C890.tmp"67⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\C8DE.tmp"C:\Users\Admin\AppData\Local\Temp\C8DE.tmp"68⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\C93B.tmp"C:\Users\Admin\AppData\Local\Temp\C93B.tmp"69⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\C999.tmp"C:\Users\Admin\AppData\Local\Temp\C999.tmp"70⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\C9F7.tmp"C:\Users\Admin\AppData\Local\Temp\C9F7.tmp"71⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\CA55.tmp"C:\Users\Admin\AppData\Local\Temp\CA55.tmp"72⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\CAB2.tmp"C:\Users\Admin\AppData\Local\Temp\CAB2.tmp"73⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\CB10.tmp"C:\Users\Admin\AppData\Local\Temp\CB10.tmp"74⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\CB5E.tmp"C:\Users\Admin\AppData\Local\Temp\CB5E.tmp"75⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\CBCC.tmp"C:\Users\Admin\AppData\Local\Temp\CBCC.tmp"76⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\CC1A.tmp"C:\Users\Admin\AppData\Local\Temp\CC1A.tmp"77⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\CC87.tmp"C:\Users\Admin\AppData\Local\Temp\CC87.tmp"78⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\CCC6.tmp"C:\Users\Admin\AppData\Local\Temp\CCC6.tmp"79⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\CD33.tmp"C:\Users\Admin\AppData\Local\Temp\CD33.tmp"80⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\CD81.tmp"C:\Users\Admin\AppData\Local\Temp\CD81.tmp"81⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\CDEF.tmp"C:\Users\Admin\AppData\Local\Temp\CDEF.tmp"82⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\CE3D.tmp"C:\Users\Admin\AppData\Local\Temp\CE3D.tmp"83⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\CE9A.tmp"C:\Users\Admin\AppData\Local\Temp\CE9A.tmp"84⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\CEF8.tmp"C:\Users\Admin\AppData\Local\Temp\CEF8.tmp"85⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\CF56.tmp"C:\Users\Admin\AppData\Local\Temp\CF56.tmp"86⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\CFB4.tmp"C:\Users\Admin\AppData\Local\Temp\CFB4.tmp"87⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\D011.tmp"C:\Users\Admin\AppData\Local\Temp\D011.tmp"88⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\D06F.tmp"C:\Users\Admin\AppData\Local\Temp\D06F.tmp"89⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\D0CD.tmp"C:\Users\Admin\AppData\Local\Temp\D0CD.tmp"90⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\D11B.tmp"C:\Users\Admin\AppData\Local\Temp\D11B.tmp"91⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\D179.tmp"C:\Users\Admin\AppData\Local\Temp\D179.tmp"92⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"93⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\D225.tmp"C:\Users\Admin\AppData\Local\Temp\D225.tmp"94⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\D292.tmp"C:\Users\Admin\AppData\Local\Temp\D292.tmp"95⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\D2F0.tmp"C:\Users\Admin\AppData\Local\Temp\D2F0.tmp"96⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\D32E.tmp"C:\Users\Admin\AppData\Local\Temp\D32E.tmp"97⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\D38C.tmp"C:\Users\Admin\AppData\Local\Temp\D38C.tmp"98⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\D3EA.tmp"C:\Users\Admin\AppData\Local\Temp\D3EA.tmp"99⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\D448.tmp"C:\Users\Admin\AppData\Local\Temp\D448.tmp"100⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\D4A5.tmp"C:\Users\Admin\AppData\Local\Temp\D4A5.tmp"101⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\D4F3.tmp"C:\Users\Admin\AppData\Local\Temp\D4F3.tmp"102⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\D551.tmp"C:\Users\Admin\AppData\Local\Temp\D551.tmp"103⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\D59F.tmp"C:\Users\Admin\AppData\Local\Temp\D59F.tmp"104⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\D5ED.tmp"C:\Users\Admin\AppData\Local\Temp\D5ED.tmp"105⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\D64B.tmp"C:\Users\Admin\AppData\Local\Temp\D64B.tmp"106⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\D699.tmp"C:\Users\Admin\AppData\Local\Temp\D699.tmp"107⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\D6F7.tmp"C:\Users\Admin\AppData\Local\Temp\D6F7.tmp"108⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\D755.tmp"C:\Users\Admin\AppData\Local\Temp\D755.tmp"109⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\D7A3.tmp"C:\Users\Admin\AppData\Local\Temp\D7A3.tmp"110⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\D801.tmp"C:\Users\Admin\AppData\Local\Temp\D801.tmp"111⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\D84F.tmp"C:\Users\Admin\AppData\Local\Temp\D84F.tmp"112⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\D89D.tmp"C:\Users\Admin\AppData\Local\Temp\D89D.tmp"113⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\D8EB.tmp"C:\Users\Admin\AppData\Local\Temp\D8EB.tmp"114⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\D958.tmp"C:\Users\Admin\AppData\Local\Temp\D958.tmp"115⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\D9A7.tmp"C:\Users\Admin\AppData\Local\Temp\D9A7.tmp"116⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\DA04.tmp"C:\Users\Admin\AppData\Local\Temp\DA04.tmp"117⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\DA52.tmp"C:\Users\Admin\AppData\Local\Temp\DA52.tmp"118⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\DAA1.tmp"C:\Users\Admin\AppData\Local\Temp\DAA1.tmp"119⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\DAEF.tmp"C:\Users\Admin\AppData\Local\Temp\DAEF.tmp"120⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\DB3D.tmp"C:\Users\Admin\AppData\Local\Temp\DB3D.tmp"121⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\DB8B.tmp"C:\Users\Admin\AppData\Local\Temp\DB8B.tmp"122⤵PID:448
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-