Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29/08/2024, 03:47
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-29_0f83b0254bb8c005cc6c2ace8386d1d3_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-08-29_0f83b0254bb8c005cc6c2ace8386d1d3_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-29_0f83b0254bb8c005cc6c2ace8386d1d3_mafia.exe
-
Size
527KB
-
MD5
0f83b0254bb8c005cc6c2ace8386d1d3
-
SHA1
a2019a2876e3bde6d5e2ee5c939a1f0d2f5fbfb6
-
SHA256
0c1c3b0a4db41ab81ab1e9c89a04981ff63b77335cc18971fcc7b774fa4c64f5
-
SHA512
1040539f18c97e01da795efbebc7376aac55b44a30391e9a6099c3d7aeda0e1ea805ddf2e94d97a6f0839d23da2b76e1cac35a944a37346882d68418e34d87e1
-
SSDEEP
6144:yorf3lPvovsgZnqG2C7mOTeiLRDYm7MiKQpQdiCxY1HLAhJy7TxPxCfImnBZWTbi:fU5rCOTeid4QpQ3y50wlPxkBETbFDZu
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3896 BBDE.tmp 2776 BC4B.tmp 2236 BCE7.tmp 4212 BD64.tmp 5064 BDE1.tmp 1416 BE2F.tmp 2912 BE8D.tmp 4460 BEDB.tmp 3852 BF39.tmp 3708 BFB6.tmp 4256 C033.tmp 2968 C091.tmp 4972 C0DF.tmp 3668 C14C.tmp 4692 C1AA.tmp 2404 C1F8.tmp 3956 C265.tmp 3868 C2E2.tmp 4596 C331.tmp 2288 C39E.tmp 3856 C3FC.tmp 388 C459.tmp 1728 C4E6.tmp 4244 C553.tmp 3972 C5B1.tmp 1740 C5FF.tmp 4544 C67C.tmp 4956 C6F9.tmp 4756 C757.tmp 3420 C7B5.tmp 3460 C813.tmp 1488 C870.tmp 1008 C8BE.tmp 3788 C90D.tmp 2312 C9A9.tmp 3456 CA16.tmp 3984 CA74.tmp 5108 CAC2.tmp 3996 CB20.tmp 2540 CB6E.tmp 2196 CBBC.tmp 4820 CC1A.tmp 3344 CC68.tmp 872 CCB6.tmp 112 CD14.tmp 4928 CD72.tmp 1784 CDC0.tmp 800 CE1D.tmp 4280 CE7B.tmp 3128 CED9.tmp 2492 CF27.tmp 3396 CF85.tmp 864 CFD3.tmp 5080 D021.tmp 4084 D06F.tmp 4816 D0CD.tmp 452 D11B.tmp 4248 D169.tmp 4936 D1C7.tmp 740 D225.tmp 3304 D282.tmp 3664 D2E0.tmp 3868 D32E.tmp 4432 D37C.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCB6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4532.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B90A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC58.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9575.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 364D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B253.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5455.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 559D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F68.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C59D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3EAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4716.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C5B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4050.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F155.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E71F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1AF5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6414.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D944.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3796 wrote to memory of 3896 3796 2024-08-29_0f83b0254bb8c005cc6c2ace8386d1d3_mafia.exe 84 PID 3796 wrote to memory of 3896 3796 2024-08-29_0f83b0254bb8c005cc6c2ace8386d1d3_mafia.exe 84 PID 3796 wrote to memory of 3896 3796 2024-08-29_0f83b0254bb8c005cc6c2ace8386d1d3_mafia.exe 84 PID 3896 wrote to memory of 2776 3896 BBDE.tmp 86 PID 3896 wrote to memory of 2776 3896 BBDE.tmp 86 PID 3896 wrote to memory of 2776 3896 BBDE.tmp 86 PID 2776 wrote to memory of 2236 2776 BC4B.tmp 88 PID 2776 wrote to memory of 2236 2776 BC4B.tmp 88 PID 2776 wrote to memory of 2236 2776 BC4B.tmp 88 PID 2236 wrote to memory of 4212 2236 BCE7.tmp 89 PID 2236 wrote to memory of 4212 2236 BCE7.tmp 89 PID 2236 wrote to memory of 4212 2236 BCE7.tmp 89 PID 4212 wrote to memory of 5064 4212 BD64.tmp 91 PID 4212 wrote to memory of 5064 4212 BD64.tmp 91 PID 4212 wrote to memory of 5064 4212 BD64.tmp 91 PID 5064 wrote to memory of 1416 5064 BDE1.tmp 92 PID 5064 wrote to memory of 1416 5064 BDE1.tmp 92 PID 5064 wrote to memory of 1416 5064 BDE1.tmp 92 PID 1416 wrote to memory of 2912 1416 BE2F.tmp 93 PID 1416 wrote to memory of 2912 1416 BE2F.tmp 93 PID 1416 wrote to memory of 2912 1416 BE2F.tmp 93 PID 2912 wrote to memory of 4460 2912 BE8D.tmp 94 PID 2912 wrote to memory of 4460 2912 BE8D.tmp 94 PID 2912 wrote to memory of 4460 2912 BE8D.tmp 94 PID 4460 wrote to memory of 3852 4460 BEDB.tmp 95 PID 4460 wrote to memory of 3852 4460 BEDB.tmp 95 PID 4460 wrote to memory of 3852 4460 BEDB.tmp 95 PID 3852 wrote to memory of 3708 3852 BF39.tmp 96 PID 3852 wrote to memory of 3708 3852 BF39.tmp 96 PID 3852 wrote to memory of 3708 3852 BF39.tmp 96 PID 3708 wrote to memory of 4256 3708 BFB6.tmp 97 PID 3708 wrote to memory of 4256 3708 BFB6.tmp 97 PID 3708 wrote to memory of 4256 3708 BFB6.tmp 97 PID 4256 wrote to memory of 2968 4256 C033.tmp 98 PID 4256 wrote to memory of 2968 4256 C033.tmp 98 PID 4256 wrote to memory of 2968 4256 C033.tmp 98 PID 2968 wrote to memory of 4972 2968 C091.tmp 99 PID 2968 wrote to memory of 4972 2968 C091.tmp 99 PID 2968 wrote to memory of 4972 2968 C091.tmp 99 PID 4972 wrote to memory of 3668 4972 C0DF.tmp 100 PID 4972 wrote to memory of 3668 4972 C0DF.tmp 100 PID 4972 wrote to memory of 3668 4972 C0DF.tmp 100 PID 3668 wrote to memory of 4692 3668 C14C.tmp 101 PID 3668 wrote to memory of 4692 3668 C14C.tmp 101 PID 3668 wrote to memory of 4692 3668 C14C.tmp 101 PID 4692 wrote to memory of 2404 4692 C1AA.tmp 102 PID 4692 wrote to memory of 2404 4692 C1AA.tmp 102 PID 4692 wrote to memory of 2404 4692 C1AA.tmp 102 PID 2404 wrote to memory of 3956 2404 C1F8.tmp 103 PID 2404 wrote to memory of 3956 2404 C1F8.tmp 103 PID 2404 wrote to memory of 3956 2404 C1F8.tmp 103 PID 3956 wrote to memory of 3868 3956 C265.tmp 104 PID 3956 wrote to memory of 3868 3956 C265.tmp 104 PID 3956 wrote to memory of 3868 3956 C265.tmp 104 PID 3868 wrote to memory of 4596 3868 C2E2.tmp 105 PID 3868 wrote to memory of 4596 3868 C2E2.tmp 105 PID 3868 wrote to memory of 4596 3868 C2E2.tmp 105 PID 4596 wrote to memory of 2288 4596 C331.tmp 106 PID 4596 wrote to memory of 2288 4596 C331.tmp 106 PID 4596 wrote to memory of 2288 4596 C331.tmp 106 PID 2288 wrote to memory of 3856 2288 C39E.tmp 107 PID 2288 wrote to memory of 3856 2288 C39E.tmp 107 PID 2288 wrote to memory of 3856 2288 C39E.tmp 107 PID 3856 wrote to memory of 388 3856 C3FC.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-29_0f83b0254bb8c005cc6c2ace8386d1d3_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-29_0f83b0254bb8c005cc6c2ace8386d1d3_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\BD64.tmp"C:\Users\Admin\AppData\Local\Temp\BD64.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\BF39.tmp"C:\Users\Admin\AppData\Local\Temp\BF39.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\BFB6.tmp"C:\Users\Admin\AppData\Local\Temp\BFB6.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\C033.tmp"C:\Users\Admin\AppData\Local\Temp\C033.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\C091.tmp"C:\Users\Admin\AppData\Local\Temp\C091.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\C14C.tmp"C:\Users\Admin\AppData\Local\Temp\C14C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\C1F8.tmp"C:\Users\Admin\AppData\Local\Temp\C1F8.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\C265.tmp"C:\Users\Admin\AppData\Local\Temp\C265.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\C331.tmp"C:\Users\Admin\AppData\Local\Temp\C331.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\C39E.tmp"C:\Users\Admin\AppData\Local\Temp\C39E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\C459.tmp"C:\Users\Admin\AppData\Local\Temp\C459.tmp"23⤵
- Executes dropped EXE
PID:388 -
C:\Users\Admin\AppData\Local\Temp\C4E6.tmp"C:\Users\Admin\AppData\Local\Temp\C4E6.tmp"24⤵
- Executes dropped EXE
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\C553.tmp"C:\Users\Admin\AppData\Local\Temp\C553.tmp"25⤵
- Executes dropped EXE
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\C5B1.tmp"C:\Users\Admin\AppData\Local\Temp\C5B1.tmp"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\C5FF.tmp"C:\Users\Admin\AppData\Local\Temp\C5FF.tmp"27⤵
- Executes dropped EXE
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\C67C.tmp"C:\Users\Admin\AppData\Local\Temp\C67C.tmp"28⤵
- Executes dropped EXE
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\C6F9.tmp"C:\Users\Admin\AppData\Local\Temp\C6F9.tmp"29⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\C757.tmp"C:\Users\Admin\AppData\Local\Temp\C757.tmp"30⤵
- Executes dropped EXE
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\C7B5.tmp"C:\Users\Admin\AppData\Local\Temp\C7B5.tmp"31⤵
- Executes dropped EXE
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\C813.tmp"C:\Users\Admin\AppData\Local\Temp\C813.tmp"32⤵
- Executes dropped EXE
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\C870.tmp"C:\Users\Admin\AppData\Local\Temp\C870.tmp"33⤵
- Executes dropped EXE
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"34⤵
- Executes dropped EXE
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\C90D.tmp"C:\Users\Admin\AppData\Local\Temp\C90D.tmp"35⤵
- Executes dropped EXE
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\C95B.tmp"C:\Users\Admin\AppData\Local\Temp\C95B.tmp"36⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\C9A9.tmp"C:\Users\Admin\AppData\Local\Temp\C9A9.tmp"37⤵
- Executes dropped EXE
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\CA16.tmp"C:\Users\Admin\AppData\Local\Temp\CA16.tmp"38⤵
- Executes dropped EXE
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\CA74.tmp"C:\Users\Admin\AppData\Local\Temp\CA74.tmp"39⤵
- Executes dropped EXE
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\CAC2.tmp"C:\Users\Admin\AppData\Local\Temp\CAC2.tmp"40⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\CB20.tmp"C:\Users\Admin\AppData\Local\Temp\CB20.tmp"41⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\CB6E.tmp"C:\Users\Admin\AppData\Local\Temp\CB6E.tmp"42⤵
- Executes dropped EXE
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\CBBC.tmp"C:\Users\Admin\AppData\Local\Temp\CBBC.tmp"43⤵
- Executes dropped EXE
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\CC1A.tmp"C:\Users\Admin\AppData\Local\Temp\CC1A.tmp"44⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\CC68.tmp"C:\Users\Admin\AppData\Local\Temp\CC68.tmp"45⤵
- Executes dropped EXE
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\CCB6.tmp"C:\Users\Admin\AppData\Local\Temp\CCB6.tmp"46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:872 -
C:\Users\Admin\AppData\Local\Temp\CD14.tmp"C:\Users\Admin\AppData\Local\Temp\CD14.tmp"47⤵
- Executes dropped EXE
PID:112 -
C:\Users\Admin\AppData\Local\Temp\CD72.tmp"C:\Users\Admin\AppData\Local\Temp\CD72.tmp"48⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\CDC0.tmp"C:\Users\Admin\AppData\Local\Temp\CDC0.tmp"49⤵
- Executes dropped EXE
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\CE1D.tmp"C:\Users\Admin\AppData\Local\Temp\CE1D.tmp"50⤵
- Executes dropped EXE
PID:800 -
C:\Users\Admin\AppData\Local\Temp\CE7B.tmp"C:\Users\Admin\AppData\Local\Temp\CE7B.tmp"51⤵
- Executes dropped EXE
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\CED9.tmp"C:\Users\Admin\AppData\Local\Temp\CED9.tmp"52⤵
- Executes dropped EXE
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\CF27.tmp"C:\Users\Admin\AppData\Local\Temp\CF27.tmp"53⤵
- Executes dropped EXE
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\CF85.tmp"C:\Users\Admin\AppData\Local\Temp\CF85.tmp"54⤵
- Executes dropped EXE
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\CFD3.tmp"C:\Users\Admin\AppData\Local\Temp\CFD3.tmp"55⤵
- Executes dropped EXE
PID:864 -
C:\Users\Admin\AppData\Local\Temp\D021.tmp"C:\Users\Admin\AppData\Local\Temp\D021.tmp"56⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\D06F.tmp"C:\Users\Admin\AppData\Local\Temp\D06F.tmp"57⤵
- Executes dropped EXE
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\D0CD.tmp"C:\Users\Admin\AppData\Local\Temp\D0CD.tmp"58⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\D11B.tmp"C:\Users\Admin\AppData\Local\Temp\D11B.tmp"59⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\D169.tmp"C:\Users\Admin\AppData\Local\Temp\D169.tmp"60⤵
- Executes dropped EXE
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"61⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\D225.tmp"C:\Users\Admin\AppData\Local\Temp\D225.tmp"62⤵
- Executes dropped EXE
PID:740 -
C:\Users\Admin\AppData\Local\Temp\D282.tmp"C:\Users\Admin\AppData\Local\Temp\D282.tmp"63⤵
- Executes dropped EXE
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\D2E0.tmp"C:\Users\Admin\AppData\Local\Temp\D2E0.tmp"64⤵
- Executes dropped EXE
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\D32E.tmp"C:\Users\Admin\AppData\Local\Temp\D32E.tmp"65⤵
- Executes dropped EXE
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\D37C.tmp"C:\Users\Admin\AppData\Local\Temp\D37C.tmp"66⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\D3DA.tmp"C:\Users\Admin\AppData\Local\Temp\D3DA.tmp"67⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\D438.tmp"C:\Users\Admin\AppData\Local\Temp\D438.tmp"68⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\D486.tmp"C:\Users\Admin\AppData\Local\Temp\D486.tmp"69⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\D4E4.tmp"C:\Users\Admin\AppData\Local\Temp\D4E4.tmp"70⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\D542.tmp"C:\Users\Admin\AppData\Local\Temp\D542.tmp"71⤵PID:508
-
C:\Users\Admin\AppData\Local\Temp\D590.tmp"C:\Users\Admin\AppData\Local\Temp\D590.tmp"72⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\D5DE.tmp"C:\Users\Admin\AppData\Local\Temp\D5DE.tmp"73⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\D63C.tmp"C:\Users\Admin\AppData\Local\Temp\D63C.tmp"74⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\D699.tmp"C:\Users\Admin\AppData\Local\Temp\D699.tmp"75⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\D6F7.tmp"C:\Users\Admin\AppData\Local\Temp\D6F7.tmp"76⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\D755.tmp"C:\Users\Admin\AppData\Local\Temp\D755.tmp"77⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\D7B3.tmp"C:\Users\Admin\AppData\Local\Temp\D7B3.tmp"78⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\D810.tmp"C:\Users\Admin\AppData\Local\Temp\D810.tmp"79⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\D85E.tmp"C:\Users\Admin\AppData\Local\Temp\D85E.tmp"80⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\D8BC.tmp"C:\Users\Admin\AppData\Local\Temp\D8BC.tmp"81⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\D90A.tmp"C:\Users\Admin\AppData\Local\Temp\D90A.tmp"82⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\D968.tmp"C:\Users\Admin\AppData\Local\Temp\D968.tmp"83⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\D9C6.tmp"C:\Users\Admin\AppData\Local\Temp\D9C6.tmp"84⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\DA24.tmp"C:\Users\Admin\AppData\Local\Temp\DA24.tmp"85⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\DA81.tmp"C:\Users\Admin\AppData\Local\Temp\DA81.tmp"86⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\DADF.tmp"C:\Users\Admin\AppData\Local\Temp\DADF.tmp"87⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\DB3D.tmp"C:\Users\Admin\AppData\Local\Temp\DB3D.tmp"88⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\DB9B.tmp"C:\Users\Admin\AppData\Local\Temp\DB9B.tmp"89⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\DBF8.tmp"C:\Users\Admin\AppData\Local\Temp\DBF8.tmp"90⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\DC56.tmp"C:\Users\Admin\AppData\Local\Temp\DC56.tmp"91⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\DCB4.tmp"C:\Users\Admin\AppData\Local\Temp\DCB4.tmp"92⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\DD12.tmp"C:\Users\Admin\AppData\Local\Temp\DD12.tmp"93⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\DD6F.tmp"C:\Users\Admin\AppData\Local\Temp\DD6F.tmp"94⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\DDCD.tmp"C:\Users\Admin\AppData\Local\Temp\DDCD.tmp"95⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\DE2B.tmp"C:\Users\Admin\AppData\Local\Temp\DE2B.tmp"96⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\DE79.tmp"C:\Users\Admin\AppData\Local\Temp\DE79.tmp"97⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\DEC7.tmp"C:\Users\Admin\AppData\Local\Temp\DEC7.tmp"98⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\DF25.tmp"C:\Users\Admin\AppData\Local\Temp\DF25.tmp"99⤵
- System Location Discovery: System Language Discovery
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\DF73.tmp"C:\Users\Admin\AppData\Local\Temp\DF73.tmp"100⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\DFD1.tmp"C:\Users\Admin\AppData\Local\Temp\DFD1.tmp"101⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\E02E.tmp"C:\Users\Admin\AppData\Local\Temp\E02E.tmp"102⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\E07D.tmp"C:\Users\Admin\AppData\Local\Temp\E07D.tmp"103⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\E0CB.tmp"C:\Users\Admin\AppData\Local\Temp\E0CB.tmp"104⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\E119.tmp"C:\Users\Admin\AppData\Local\Temp\E119.tmp"105⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\E177.tmp"C:\Users\Admin\AppData\Local\Temp\E177.tmp"106⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\E1D4.tmp"C:\Users\Admin\AppData\Local\Temp\E1D4.tmp"107⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\E222.tmp"C:\Users\Admin\AppData\Local\Temp\E222.tmp"108⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\E280.tmp"C:\Users\Admin\AppData\Local\Temp\E280.tmp"109⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\E2DE.tmp"C:\Users\Admin\AppData\Local\Temp\E2DE.tmp"110⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\E32C.tmp"C:\Users\Admin\AppData\Local\Temp\E32C.tmp"111⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\E37A.tmp"C:\Users\Admin\AppData\Local\Temp\E37A.tmp"112⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\E3D8.tmp"C:\Users\Admin\AppData\Local\Temp\E3D8.tmp"113⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\E426.tmp"C:\Users\Admin\AppData\Local\Temp\E426.tmp"114⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\E474.tmp"C:\Users\Admin\AppData\Local\Temp\E474.tmp"115⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\E4C2.tmp"C:\Users\Admin\AppData\Local\Temp\E4C2.tmp"116⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\E510.tmp"C:\Users\Admin\AppData\Local\Temp\E510.tmp"117⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\E55F.tmp"C:\Users\Admin\AppData\Local\Temp\E55F.tmp"118⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\E5AD.tmp"C:\Users\Admin\AppData\Local\Temp\E5AD.tmp"119⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\E5FB.tmp"C:\Users\Admin\AppData\Local\Temp\E5FB.tmp"120⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\E649.tmp"C:\Users\Admin\AppData\Local\Temp\E649.tmp"121⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\E697.tmp"C:\Users\Admin\AppData\Local\Temp\E697.tmp"122⤵PID:2516
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-