Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29/08/2024, 07:45
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-29_09b024736bbb87f9f887daa596e2e078_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-08-29_09b024736bbb87f9f887daa596e2e078_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-29_09b024736bbb87f9f887daa596e2e078_mafia.exe
-
Size
536KB
-
MD5
09b024736bbb87f9f887daa596e2e078
-
SHA1
bda64196e25c3ed6195220bbe7ac621bd7d2324c
-
SHA256
448e66c8b993dac27bb4810aecf63cb04756ca4a6872740020ac10d269a3f529
-
SHA512
6ea6e4f2d522af71f6b9f17f4992887e669ed81e3c3c076882f8ff7a0487b26b34de2330c1a147f86b7f42fdeffc7e47cab06088a308aa924b1e618165aad58e
-
SSDEEP
12288:wU5rCOTeiU6xbs0jkX4bw0myuKdYbR6IZxVJ0ZT9:wUQOJUubs0jkIM0myu+YbR6IRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2284 BC2C.tmp 4040 BCA9.tmp 436 BD35.tmp 3568 BDF1.tmp 3284 BE5E.tmp 4872 BECC.tmp 3608 BF77.tmp 2968 C023.tmp 3912 C0A0.tmp 3544 C11D.tmp 1156 C1BA.tmp 628 C237.tmp 3616 C2B4.tmp 888 C311.tmp 2052 C37F.tmp 512 C3EC.tmp 4848 C4B7.tmp 1564 C534.tmp 3780 C5C1.tmp 860 C62E.tmp 3548 C6BB.tmp 116 C738.tmp 3644 C7C4.tmp 520 C851.tmp 3888 C8CE.tmp 4140 C94B.tmp 1076 C9E7.tmp 5112 CA64.tmp 3956 CB10.tmp 4572 CB8D.tmp 4004 CC1A.tmp 3960 CC97.tmp 1628 CD04.tmp 3368 CD62.tmp 3612 CDDF.tmp 2760 CE3D.tmp 4484 CE8B.tmp 3588 CF08.tmp 4732 CFA4.tmp 2144 CFF2.tmp 3904 D050.tmp 3148 D0BD.tmp 1508 D13A.tmp 3540 D1B7.tmp 3408 D234.tmp 1732 D282.tmp 4856 D2FF.tmp 4596 D36D.tmp 2784 D3BB.tmp 3788 D409.tmp 4848 D467.tmp 404 D4C5.tmp 4008 D513.tmp 4384 D570.tmp 3796 D5BF.tmp 2892 D60D.tmp 3140 D65B.tmp 3244 D6A9.tmp 4676 D707.tmp 3760 D764.tmp 3808 D7B3.tmp 560 D810.tmp 4644 D85E.tmp 4076 D8BC.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6359.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1901.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2556.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9EDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B31E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D36D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3488.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 462C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F935.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2239.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E7AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 293E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B59F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D968.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4253.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBF6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFAD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 778C.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4200 wrote to memory of 2284 4200 2024-08-29_09b024736bbb87f9f887daa596e2e078_mafia.exe 84 PID 4200 wrote to memory of 2284 4200 2024-08-29_09b024736bbb87f9f887daa596e2e078_mafia.exe 84 PID 4200 wrote to memory of 2284 4200 2024-08-29_09b024736bbb87f9f887daa596e2e078_mafia.exe 84 PID 2284 wrote to memory of 4040 2284 BC2C.tmp 86 PID 2284 wrote to memory of 4040 2284 BC2C.tmp 86 PID 2284 wrote to memory of 4040 2284 BC2C.tmp 86 PID 4040 wrote to memory of 436 4040 BCA9.tmp 87 PID 4040 wrote to memory of 436 4040 BCA9.tmp 87 PID 4040 wrote to memory of 436 4040 BCA9.tmp 87 PID 436 wrote to memory of 3568 436 BD35.tmp 90 PID 436 wrote to memory of 3568 436 BD35.tmp 90 PID 436 wrote to memory of 3568 436 BD35.tmp 90 PID 3568 wrote to memory of 3284 3568 BDF1.tmp 91 PID 3568 wrote to memory of 3284 3568 BDF1.tmp 91 PID 3568 wrote to memory of 3284 3568 BDF1.tmp 91 PID 3284 wrote to memory of 4872 3284 BE5E.tmp 92 PID 3284 wrote to memory of 4872 3284 BE5E.tmp 92 PID 3284 wrote to memory of 4872 3284 BE5E.tmp 92 PID 4872 wrote to memory of 3608 4872 BECC.tmp 93 PID 4872 wrote to memory of 3608 4872 BECC.tmp 93 PID 4872 wrote to memory of 3608 4872 BECC.tmp 93 PID 3608 wrote to memory of 2968 3608 BF77.tmp 94 PID 3608 wrote to memory of 2968 3608 BF77.tmp 94 PID 3608 wrote to memory of 2968 3608 BF77.tmp 94 PID 2968 wrote to memory of 3912 2968 C023.tmp 95 PID 2968 wrote to memory of 3912 2968 C023.tmp 95 PID 2968 wrote to memory of 3912 2968 C023.tmp 95 PID 3912 wrote to memory of 3544 3912 C0A0.tmp 96 PID 3912 wrote to memory of 3544 3912 C0A0.tmp 96 PID 3912 wrote to memory of 3544 3912 C0A0.tmp 96 PID 3544 wrote to memory of 1156 3544 C11D.tmp 97 PID 3544 wrote to memory of 1156 3544 C11D.tmp 97 PID 3544 wrote to memory of 1156 3544 C11D.tmp 97 PID 1156 wrote to memory of 628 1156 C1BA.tmp 98 PID 1156 wrote to memory of 628 1156 C1BA.tmp 98 PID 1156 wrote to memory of 628 1156 C1BA.tmp 98 PID 628 wrote to memory of 3616 628 C237.tmp 99 PID 628 wrote to memory of 3616 628 C237.tmp 99 PID 628 wrote to memory of 3616 628 C237.tmp 99 PID 3616 wrote to memory of 888 3616 C2B4.tmp 100 PID 3616 wrote to memory of 888 3616 C2B4.tmp 100 PID 3616 wrote to memory of 888 3616 C2B4.tmp 100 PID 888 wrote to memory of 2052 888 C311.tmp 101 PID 888 wrote to memory of 2052 888 C311.tmp 101 PID 888 wrote to memory of 2052 888 C311.tmp 101 PID 2052 wrote to memory of 512 2052 C37F.tmp 102 PID 2052 wrote to memory of 512 2052 C37F.tmp 102 PID 2052 wrote to memory of 512 2052 C37F.tmp 102 PID 512 wrote to memory of 4848 512 C3EC.tmp 104 PID 512 wrote to memory of 4848 512 C3EC.tmp 104 PID 512 wrote to memory of 4848 512 C3EC.tmp 104 PID 4848 wrote to memory of 1564 4848 C4B7.tmp 105 PID 4848 wrote to memory of 1564 4848 C4B7.tmp 105 PID 4848 wrote to memory of 1564 4848 C4B7.tmp 105 PID 1564 wrote to memory of 3780 1564 C534.tmp 106 PID 1564 wrote to memory of 3780 1564 C534.tmp 106 PID 1564 wrote to memory of 3780 1564 C534.tmp 106 PID 3780 wrote to memory of 860 3780 C5C1.tmp 107 PID 3780 wrote to memory of 860 3780 C5C1.tmp 107 PID 3780 wrote to memory of 860 3780 C5C1.tmp 107 PID 860 wrote to memory of 3548 860 C62E.tmp 108 PID 860 wrote to memory of 3548 860 C62E.tmp 108 PID 860 wrote to memory of 3548 860 C62E.tmp 108 PID 3548 wrote to memory of 116 3548 C6BB.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-29_09b024736bbb87f9f887daa596e2e078_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-29_09b024736bbb87f9f887daa596e2e078_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\BC2C.tmp"C:\Users\Admin\AppData\Local\Temp\BC2C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\BD35.tmp"C:\Users\Admin\AppData\Local\Temp\BD35.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Users\Admin\AppData\Local\Temp\BDF1.tmp"C:\Users\Admin\AppData\Local\Temp\BDF1.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\BE5E.tmp"C:\Users\Admin\AppData\Local\Temp\BE5E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\BECC.tmp"C:\Users\Admin\AppData\Local\Temp\BECC.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\BF77.tmp"C:\Users\Admin\AppData\Local\Temp\BF77.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\C023.tmp"C:\Users\Admin\AppData\Local\Temp\C023.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\C11D.tmp"C:\Users\Admin\AppData\Local\Temp\C11D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\C237.tmp"C:\Users\Admin\AppData\Local\Temp\C237.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\C2B4.tmp"C:\Users\Admin\AppData\Local\Temp\C2B4.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\C311.tmp"C:\Users\Admin\AppData\Local\Temp\C311.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Users\Admin\AppData\Local\Temp\C37F.tmp"C:\Users\Admin\AppData\Local\Temp\C37F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:512 -
C:\Users\Admin\AppData\Local\Temp\C4B7.tmp"C:\Users\Admin\AppData\Local\Temp\C4B7.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\C534.tmp"C:\Users\Admin\AppData\Local\Temp\C534.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\C62E.tmp"C:\Users\Admin\AppData\Local\Temp\C62E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\C738.tmp"C:\Users\Admin\AppData\Local\Temp\C738.tmp"23⤵
- Executes dropped EXE
PID:116 -
C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"24⤵
- Executes dropped EXE
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\C851.tmp"C:\Users\Admin\AppData\Local\Temp\C851.tmp"25⤵
- Executes dropped EXE
PID:520 -
C:\Users\Admin\AppData\Local\Temp\C8CE.tmp"C:\Users\Admin\AppData\Local\Temp\C8CE.tmp"26⤵
- Executes dropped EXE
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\C94B.tmp"C:\Users\Admin\AppData\Local\Temp\C94B.tmp"27⤵
- Executes dropped EXE
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"28⤵
- Executes dropped EXE
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\CA64.tmp"C:\Users\Admin\AppData\Local\Temp\CA64.tmp"29⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\CB10.tmp"C:\Users\Admin\AppData\Local\Temp\CB10.tmp"30⤵
- Executes dropped EXE
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\CB8D.tmp"C:\Users\Admin\AppData\Local\Temp\CB8D.tmp"31⤵
- Executes dropped EXE
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\CC1A.tmp"C:\Users\Admin\AppData\Local\Temp\CC1A.tmp"32⤵
- Executes dropped EXE
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\CC97.tmp"C:\Users\Admin\AppData\Local\Temp\CC97.tmp"33⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\CD04.tmp"C:\Users\Admin\AppData\Local\Temp\CD04.tmp"34⤵
- Executes dropped EXE
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\CD62.tmp"C:\Users\Admin\AppData\Local\Temp\CD62.tmp"35⤵
- Executes dropped EXE
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\CDDF.tmp"C:\Users\Admin\AppData\Local\Temp\CDDF.tmp"36⤵
- Executes dropped EXE
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\CE3D.tmp"C:\Users\Admin\AppData\Local\Temp\CE3D.tmp"37⤵
- Executes dropped EXE
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\CE8B.tmp"C:\Users\Admin\AppData\Local\Temp\CE8B.tmp"38⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\CF08.tmp"C:\Users\Admin\AppData\Local\Temp\CF08.tmp"39⤵
- Executes dropped EXE
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\CFA4.tmp"C:\Users\Admin\AppData\Local\Temp\CFA4.tmp"40⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\CFF2.tmp"C:\Users\Admin\AppData\Local\Temp\CFF2.tmp"41⤵
- Executes dropped EXE
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\D050.tmp"C:\Users\Admin\AppData\Local\Temp\D050.tmp"42⤵
- Executes dropped EXE
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\D0BD.tmp"C:\Users\Admin\AppData\Local\Temp\D0BD.tmp"43⤵
- Executes dropped EXE
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\D13A.tmp"C:\Users\Admin\AppData\Local\Temp\D13A.tmp"44⤵
- Executes dropped EXE
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\D1B7.tmp"C:\Users\Admin\AppData\Local\Temp\D1B7.tmp"45⤵
- Executes dropped EXE
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\D234.tmp"C:\Users\Admin\AppData\Local\Temp\D234.tmp"46⤵
- Executes dropped EXE
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\D282.tmp"C:\Users\Admin\AppData\Local\Temp\D282.tmp"47⤵
- Executes dropped EXE
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\D2FF.tmp"C:\Users\Admin\AppData\Local\Temp\D2FF.tmp"48⤵
- Executes dropped EXE
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\D36D.tmp"C:\Users\Admin\AppData\Local\Temp\D36D.tmp"49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\D3BB.tmp"C:\Users\Admin\AppData\Local\Temp\D3BB.tmp"50⤵
- Executes dropped EXE
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\D409.tmp"C:\Users\Admin\AppData\Local\Temp\D409.tmp"51⤵
- Executes dropped EXE
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\D467.tmp"C:\Users\Admin\AppData\Local\Temp\D467.tmp"52⤵
- Executes dropped EXE
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\D4C5.tmp"C:\Users\Admin\AppData\Local\Temp\D4C5.tmp"53⤵
- Executes dropped EXE
PID:404 -
C:\Users\Admin\AppData\Local\Temp\D513.tmp"C:\Users\Admin\AppData\Local\Temp\D513.tmp"54⤵
- Executes dropped EXE
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\D570.tmp"C:\Users\Admin\AppData\Local\Temp\D570.tmp"55⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\D5BF.tmp"C:\Users\Admin\AppData\Local\Temp\D5BF.tmp"56⤵
- Executes dropped EXE
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\D60D.tmp"C:\Users\Admin\AppData\Local\Temp\D60D.tmp"57⤵
- Executes dropped EXE
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\D65B.tmp"C:\Users\Admin\AppData\Local\Temp\D65B.tmp"58⤵
- Executes dropped EXE
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\D6A9.tmp"C:\Users\Admin\AppData\Local\Temp\D6A9.tmp"59⤵
- Executes dropped EXE
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\D707.tmp"C:\Users\Admin\AppData\Local\Temp\D707.tmp"60⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\D764.tmp"C:\Users\Admin\AppData\Local\Temp\D764.tmp"61⤵
- Executes dropped EXE
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\D7B3.tmp"C:\Users\Admin\AppData\Local\Temp\D7B3.tmp"62⤵
- Executes dropped EXE
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\D810.tmp"C:\Users\Admin\AppData\Local\Temp\D810.tmp"63⤵
- Executes dropped EXE
PID:560 -
C:\Users\Admin\AppData\Local\Temp\D85E.tmp"C:\Users\Admin\AppData\Local\Temp\D85E.tmp"64⤵
- Executes dropped EXE
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\D8BC.tmp"C:\Users\Admin\AppData\Local\Temp\D8BC.tmp"65⤵
- Executes dropped EXE
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\D91A.tmp"C:\Users\Admin\AppData\Local\Temp\D91A.tmp"66⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\D968.tmp"C:\Users\Admin\AppData\Local\Temp\D968.tmp"67⤵
- System Location Discovery: System Language Discovery
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\D9B6.tmp"C:\Users\Admin\AppData\Local\Temp\D9B6.tmp"68⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\DA14.tmp"C:\Users\Admin\AppData\Local\Temp\DA14.tmp"69⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\DA62.tmp"C:\Users\Admin\AppData\Local\Temp\DA62.tmp"70⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\DAC0.tmp"C:\Users\Admin\AppData\Local\Temp\DAC0.tmp"71⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\DB0E.tmp"C:\Users\Admin\AppData\Local\Temp\DB0E.tmp"72⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\DB5C.tmp"C:\Users\Admin\AppData\Local\Temp\DB5C.tmp"73⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\DBBA.tmp"C:\Users\Admin\AppData\Local\Temp\DBBA.tmp"74⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\DC08.tmp"C:\Users\Admin\AppData\Local\Temp\DC08.tmp"75⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\DC66.tmp"C:\Users\Admin\AppData\Local\Temp\DC66.tmp"76⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\DCB4.tmp"C:\Users\Admin\AppData\Local\Temp\DCB4.tmp"77⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\DD12.tmp"C:\Users\Admin\AppData\Local\Temp\DD12.tmp"78⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\DD6F.tmp"C:\Users\Admin\AppData\Local\Temp\DD6F.tmp"79⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\DDCD.tmp"C:\Users\Admin\AppData\Local\Temp\DDCD.tmp"80⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\DE1B.tmp"C:\Users\Admin\AppData\Local\Temp\DE1B.tmp"81⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\DE69.tmp"C:\Users\Admin\AppData\Local\Temp\DE69.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\DEC7.tmp"C:\Users\Admin\AppData\Local\Temp\DEC7.tmp"83⤵
- System Location Discovery: System Language Discovery
PID:928 -
C:\Users\Admin\AppData\Local\Temp\DF15.tmp"C:\Users\Admin\AppData\Local\Temp\DF15.tmp"84⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\DF63.tmp"C:\Users\Admin\AppData\Local\Temp\DF63.tmp"85⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\DFB1.tmp"C:\Users\Admin\AppData\Local\Temp\DFB1.tmp"86⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\E00F.tmp"C:\Users\Admin\AppData\Local\Temp\E00F.tmp"87⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\E05D.tmp"C:\Users\Admin\AppData\Local\Temp\E05D.tmp"88⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\E0BB.tmp"C:\Users\Admin\AppData\Local\Temp\E0BB.tmp"89⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\E109.tmp"C:\Users\Admin\AppData\Local\Temp\E109.tmp"90⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\E167.tmp"C:\Users\Admin\AppData\Local\Temp\E167.tmp"91⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\E1C5.tmp"C:\Users\Admin\AppData\Local\Temp\E1C5.tmp"92⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\E222.tmp"C:\Users\Admin\AppData\Local\Temp\E222.tmp"93⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\E271.tmp"C:\Users\Admin\AppData\Local\Temp\E271.tmp"94⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\E2CE.tmp"C:\Users\Admin\AppData\Local\Temp\E2CE.tmp"95⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\E33C.tmp"C:\Users\Admin\AppData\Local\Temp\E33C.tmp"96⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\E399.tmp"C:\Users\Admin\AppData\Local\Temp\E399.tmp"97⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\E3F7.tmp"C:\Users\Admin\AppData\Local\Temp\E3F7.tmp"98⤵
- System Location Discovery: System Language Discovery
PID:116 -
C:\Users\Admin\AppData\Local\Temp\E445.tmp"C:\Users\Admin\AppData\Local\Temp\E445.tmp"99⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\E4A3.tmp"C:\Users\Admin\AppData\Local\Temp\E4A3.tmp"100⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\E4F1.tmp"C:\Users\Admin\AppData\Local\Temp\E4F1.tmp"101⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\E53F.tmp"C:\Users\Admin\AppData\Local\Temp\E53F.tmp"102⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\E58D.tmp"C:\Users\Admin\AppData\Local\Temp\E58D.tmp"103⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\E5DC.tmp"C:\Users\Admin\AppData\Local\Temp\E5DC.tmp"104⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\E62A.tmp"C:\Users\Admin\AppData\Local\Temp\E62A.tmp"105⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\E678.tmp"C:\Users\Admin\AppData\Local\Temp\E678.tmp"106⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\E6D6.tmp"C:\Users\Admin\AppData\Local\Temp\E6D6.tmp"107⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\E733.tmp"C:\Users\Admin\AppData\Local\Temp\E733.tmp"108⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\E781.tmp"C:\Users\Admin\AppData\Local\Temp\E781.tmp"109⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\E7D0.tmp"C:\Users\Admin\AppData\Local\Temp\E7D0.tmp"110⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\E81E.tmp"C:\Users\Admin\AppData\Local\Temp\E81E.tmp"111⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\E87B.tmp"C:\Users\Admin\AppData\Local\Temp\E87B.tmp"112⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"113⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\E927.tmp"C:\Users\Admin\AppData\Local\Temp\E927.tmp"114⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\E975.tmp"C:\Users\Admin\AppData\Local\Temp\E975.tmp"115⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\E9C4.tmp"C:\Users\Admin\AppData\Local\Temp\E9C4.tmp"116⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\EA21.tmp"C:\Users\Admin\AppData\Local\Temp\EA21.tmp"117⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\EA7F.tmp"C:\Users\Admin\AppData\Local\Temp\EA7F.tmp"118⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\EACD.tmp"C:\Users\Admin\AppData\Local\Temp\EACD.tmp"119⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\EB1B.tmp"C:\Users\Admin\AppData\Local\Temp\EB1B.tmp"120⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\EB69.tmp"C:\Users\Admin\AppData\Local\Temp\EB69.tmp"121⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\EBC7.tmp"C:\Users\Admin\AppData\Local\Temp\EBC7.tmp"122⤵PID:4620
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-