Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05-09-2024 06:01
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-05_95e77fbf78d8378de02e8ae1ecf9b10d_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-05_95e77fbf78d8378de02e8ae1ecf9b10d_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-05_95e77fbf78d8378de02e8ae1ecf9b10d_mafia.exe
-
Size
541KB
-
MD5
95e77fbf78d8378de02e8ae1ecf9b10d
-
SHA1
4bc716216667f0d6b60ed8d65a98a320916ff5b0
-
SHA256
f9ed4f8c6ebb50a71a6c5a1f0fdf9ca0f093521e56b0d62f08533d95f22e886e
-
SHA512
5fc89facc406f582fa82ab9367fbd6379a20978e06ab3133717bae91b818c602e75d97775f3a3a26974a30f1e1eb3db2debf0f00b1786c51d9c9bf8f16c2a3b4
-
SSDEEP
12288:UU5rCOTeif0t7rTR69+cBR13T5HrZa73ctO:UUQOJf0VrE9HBRdJrU73ctO
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3252 B65F.tmp 3496 B6EC.tmp 4656 B759.tmp 4500 B7D6.tmp 3360 B853.tmp 100 B8B1.tmp 5084 B92E.tmp 3804 B9AB.tmp 1904 BA38.tmp 4592 BA86.tmp 1336 BAF3.tmp 2736 BB70.tmp 2764 BBDE.tmp 4616 BC4B.tmp 4296 BC99.tmp 2696 BD06.tmp 4092 BD74.tmp 1476 BDC2.tmp 3744 BE4F.tmp 2200 BEAC.tmp 4056 BF0A.tmp 3544 BF58.tmp 2712 BFD5.tmp 4236 C062.tmp 3416 C0EE.tmp 3448 C13D.tmp 4136 C1AA.tmp 2596 C208.tmp 3088 C265.tmp 4120 C2C3.tmp 1908 C331.tmp 2044 C38E.tmp 884 C3FC.tmp 4564 C44A.tmp 4412 C4A8.tmp 3076 C505.tmp 1468 C563.tmp 1312 C5B1.tmp 4612 C5FF.tmp 4468 C65D.tmp 2604 C6BB.tmp 4316 C709.tmp 2076 C757.tmp 1884 C7A5.tmp 2100 C7F3.tmp 1564 C841.tmp 2584 C890.tmp 224 C8ED.tmp 2800 C94B.tmp 920 C999.tmp 1076 C9F7.tmp 4636 CA64.tmp 2320 CAC2.tmp 336 CB20.tmp 4600 CBAC.tmp 4764 CBFB.tmp 3020 CC49.tmp 1488 CCA6.tmp 5044 CD04.tmp 3420 CD52.tmp 3956 CDB0.tmp 4800 CDFE.tmp 2300 CE5C.tmp 2560 CEAA.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 361E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1930.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 630A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7644.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CACD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9333.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F68.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 878A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4FE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D472.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D740.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFC3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 967E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C65D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3563.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC73.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-09-05_95e77fbf78d8378de02e8ae1ecf9b10d_mafia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCBF.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1172 wrote to memory of 3252 1172 2024-09-05_95e77fbf78d8378de02e8ae1ecf9b10d_mafia.exe 83 PID 1172 wrote to memory of 3252 1172 2024-09-05_95e77fbf78d8378de02e8ae1ecf9b10d_mafia.exe 83 PID 1172 wrote to memory of 3252 1172 2024-09-05_95e77fbf78d8378de02e8ae1ecf9b10d_mafia.exe 83 PID 3252 wrote to memory of 3496 3252 B65F.tmp 86 PID 3252 wrote to memory of 3496 3252 B65F.tmp 86 PID 3252 wrote to memory of 3496 3252 B65F.tmp 86 PID 3496 wrote to memory of 4656 3496 B6EC.tmp 87 PID 3496 wrote to memory of 4656 3496 B6EC.tmp 87 PID 3496 wrote to memory of 4656 3496 B6EC.tmp 87 PID 4656 wrote to memory of 4500 4656 B759.tmp 89 PID 4656 wrote to memory of 4500 4656 B759.tmp 89 PID 4656 wrote to memory of 4500 4656 B759.tmp 89 PID 4500 wrote to memory of 3360 4500 B7D6.tmp 90 PID 4500 wrote to memory of 3360 4500 B7D6.tmp 90 PID 4500 wrote to memory of 3360 4500 B7D6.tmp 90 PID 3360 wrote to memory of 100 3360 B853.tmp 91 PID 3360 wrote to memory of 100 3360 B853.tmp 91 PID 3360 wrote to memory of 100 3360 B853.tmp 91 PID 100 wrote to memory of 5084 100 B8B1.tmp 92 PID 100 wrote to memory of 5084 100 B8B1.tmp 92 PID 100 wrote to memory of 5084 100 B8B1.tmp 92 PID 5084 wrote to memory of 3804 5084 B92E.tmp 93 PID 5084 wrote to memory of 3804 5084 B92E.tmp 93 PID 5084 wrote to memory of 3804 5084 B92E.tmp 93 PID 3804 wrote to memory of 1904 3804 B9AB.tmp 94 PID 3804 wrote to memory of 1904 3804 B9AB.tmp 94 PID 3804 wrote to memory of 1904 3804 B9AB.tmp 94 PID 1904 wrote to memory of 4592 1904 BA38.tmp 95 PID 1904 wrote to memory of 4592 1904 BA38.tmp 95 PID 1904 wrote to memory of 4592 1904 BA38.tmp 95 PID 4592 wrote to memory of 1336 4592 BA86.tmp 96 PID 4592 wrote to memory of 1336 4592 BA86.tmp 96 PID 4592 wrote to memory of 1336 4592 BA86.tmp 96 PID 1336 wrote to memory of 2736 1336 BAF3.tmp 97 PID 1336 wrote to memory of 2736 1336 BAF3.tmp 97 PID 1336 wrote to memory of 2736 1336 BAF3.tmp 97 PID 2736 wrote to memory of 2764 2736 BB70.tmp 98 PID 2736 wrote to memory of 2764 2736 BB70.tmp 98 PID 2736 wrote to memory of 2764 2736 BB70.tmp 98 PID 2764 wrote to memory of 4616 2764 BBDE.tmp 99 PID 2764 wrote to memory of 4616 2764 BBDE.tmp 99 PID 2764 wrote to memory of 4616 2764 BBDE.tmp 99 PID 4616 wrote to memory of 4296 4616 BC4B.tmp 100 PID 4616 wrote to memory of 4296 4616 BC4B.tmp 100 PID 4616 wrote to memory of 4296 4616 BC4B.tmp 100 PID 4296 wrote to memory of 2696 4296 BC99.tmp 101 PID 4296 wrote to memory of 2696 4296 BC99.tmp 101 PID 4296 wrote to memory of 2696 4296 BC99.tmp 101 PID 2696 wrote to memory of 4092 2696 BD06.tmp 103 PID 2696 wrote to memory of 4092 2696 BD06.tmp 103 PID 2696 wrote to memory of 4092 2696 BD06.tmp 103 PID 4092 wrote to memory of 1476 4092 BD74.tmp 104 PID 4092 wrote to memory of 1476 4092 BD74.tmp 104 PID 4092 wrote to memory of 1476 4092 BD74.tmp 104 PID 1476 wrote to memory of 3744 1476 BDC2.tmp 105 PID 1476 wrote to memory of 3744 1476 BDC2.tmp 105 PID 1476 wrote to memory of 3744 1476 BDC2.tmp 105 PID 3744 wrote to memory of 2200 3744 BE4F.tmp 106 PID 3744 wrote to memory of 2200 3744 BE4F.tmp 106 PID 3744 wrote to memory of 2200 3744 BE4F.tmp 106 PID 2200 wrote to memory of 4056 2200 BEAC.tmp 107 PID 2200 wrote to memory of 4056 2200 BEAC.tmp 107 PID 2200 wrote to memory of 4056 2200 BEAC.tmp 107 PID 4056 wrote to memory of 3544 4056 BF0A.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-05_95e77fbf78d8378de02e8ae1ecf9b10d_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-05_95e77fbf78d8378de02e8ae1ecf9b10d_mafia.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\B65F.tmp"C:\Users\Admin\AppData\Local\Temp\B65F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\B759.tmp"C:\Users\Admin\AppData\Local\Temp\B759.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\B853.tmp"C:\Users\Admin\AppData\Local\Temp\B853.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:100 -
C:\Users\Admin\AppData\Local\Temp\B92E.tmp"C:\Users\Admin\AppData\Local\Temp\B92E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\BA38.tmp"C:\Users\Admin\AppData\Local\Temp\BA38.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\BA86.tmp"C:\Users\Admin\AppData\Local\Temp\BA86.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\BAF3.tmp"C:\Users\Admin\AppData\Local\Temp\BAF3.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\BB70.tmp"C:\Users\Admin\AppData\Local\Temp\BB70.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\BC99.tmp"C:\Users\Admin\AppData\Local\Temp\BC99.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\BD06.tmp"C:\Users\Admin\AppData\Local\Temp\BD06.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\BD74.tmp"C:\Users\Admin\AppData\Local\Temp\BD74.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\BEAC.tmp"C:\Users\Admin\AppData\Local\Temp\BEAC.tmp"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\BF0A.tmp"C:\Users\Admin\AppData\Local\Temp\BF0A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\BF58.tmp"C:\Users\Admin\AppData\Local\Temp\BF58.tmp"23⤵
- Executes dropped EXE
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\BFD5.tmp"C:\Users\Admin\AppData\Local\Temp\BFD5.tmp"24⤵
- Executes dropped EXE
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\C062.tmp"C:\Users\Admin\AppData\Local\Temp\C062.tmp"25⤵
- Executes dropped EXE
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"26⤵
- Executes dropped EXE
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\C13D.tmp"C:\Users\Admin\AppData\Local\Temp\C13D.tmp"27⤵
- Executes dropped EXE
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\C208.tmp"C:\Users\Admin\AppData\Local\Temp\C208.tmp"29⤵
- Executes dropped EXE
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\C265.tmp"C:\Users\Admin\AppData\Local\Temp\C265.tmp"30⤵
- Executes dropped EXE
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"31⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\C331.tmp"C:\Users\Admin\AppData\Local\Temp\C331.tmp"32⤵
- Executes dropped EXE
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\C38E.tmp"C:\Users\Admin\AppData\Local\Temp\C38E.tmp"33⤵
- Executes dropped EXE
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"34⤵
- Executes dropped EXE
PID:884 -
C:\Users\Admin\AppData\Local\Temp\C44A.tmp"C:\Users\Admin\AppData\Local\Temp\C44A.tmp"35⤵
- Executes dropped EXE
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"36⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\C505.tmp"C:\Users\Admin\AppData\Local\Temp\C505.tmp"37⤵
- Executes dropped EXE
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\C563.tmp"C:\Users\Admin\AppData\Local\Temp\C563.tmp"38⤵
- Executes dropped EXE
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\C5B1.tmp"C:\Users\Admin\AppData\Local\Temp\C5B1.tmp"39⤵
- Executes dropped EXE
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\C5FF.tmp"C:\Users\Admin\AppData\Local\Temp\C5FF.tmp"40⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\C65D.tmp"C:\Users\Admin\AppData\Local\Temp\C65D.tmp"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"42⤵
- Executes dropped EXE
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\C709.tmp"C:\Users\Admin\AppData\Local\Temp\C709.tmp"43⤵
- Executes dropped EXE
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\C757.tmp"C:\Users\Admin\AppData\Local\Temp\C757.tmp"44⤵
- Executes dropped EXE
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\C7A5.tmp"C:\Users\Admin\AppData\Local\Temp\C7A5.tmp"45⤵
- Executes dropped EXE
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"46⤵
- Executes dropped EXE
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\C841.tmp"C:\Users\Admin\AppData\Local\Temp\C841.tmp"47⤵
- Executes dropped EXE
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\C890.tmp"C:\Users\Admin\AppData\Local\Temp\C890.tmp"48⤵
- Executes dropped EXE
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\C8ED.tmp"C:\Users\Admin\AppData\Local\Temp\C8ED.tmp"49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:224 -
C:\Users\Admin\AppData\Local\Temp\C94B.tmp"C:\Users\Admin\AppData\Local\Temp\C94B.tmp"50⤵
- Executes dropped EXE
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\C999.tmp"C:\Users\Admin\AppData\Local\Temp\C999.tmp"51⤵
- Executes dropped EXE
PID:920 -
C:\Users\Admin\AppData\Local\Temp\C9F7.tmp"C:\Users\Admin\AppData\Local\Temp\C9F7.tmp"52⤵
- Executes dropped EXE
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\CA64.tmp"C:\Users\Admin\AppData\Local\Temp\CA64.tmp"53⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\CAC2.tmp"C:\Users\Admin\AppData\Local\Temp\CAC2.tmp"54⤵
- Executes dropped EXE
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\CB20.tmp"C:\Users\Admin\AppData\Local\Temp\CB20.tmp"55⤵
- Executes dropped EXE
PID:336 -
C:\Users\Admin\AppData\Local\Temp\CBAC.tmp"C:\Users\Admin\AppData\Local\Temp\CBAC.tmp"56⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\CBFB.tmp"C:\Users\Admin\AppData\Local\Temp\CBFB.tmp"57⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\CC49.tmp"C:\Users\Admin\AppData\Local\Temp\CC49.tmp"58⤵
- Executes dropped EXE
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\CCA6.tmp"C:\Users\Admin\AppData\Local\Temp\CCA6.tmp"59⤵
- Executes dropped EXE
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\CD04.tmp"C:\Users\Admin\AppData\Local\Temp\CD04.tmp"60⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\CD52.tmp"C:\Users\Admin\AppData\Local\Temp\CD52.tmp"61⤵
- Executes dropped EXE
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\CDB0.tmp"C:\Users\Admin\AppData\Local\Temp\CDB0.tmp"62⤵
- Executes dropped EXE
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\CDFE.tmp"C:\Users\Admin\AppData\Local\Temp\CDFE.tmp"63⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\CE5C.tmp"C:\Users\Admin\AppData\Local\Temp\CE5C.tmp"64⤵
- Executes dropped EXE
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\CEAA.tmp"C:\Users\Admin\AppData\Local\Temp\CEAA.tmp"65⤵
- Executes dropped EXE
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\CF08.tmp"C:\Users\Admin\AppData\Local\Temp\CF08.tmp"66⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\CF66.tmp"C:\Users\Admin\AppData\Local\Temp\CF66.tmp"67⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\CFC3.tmp"C:\Users\Admin\AppData\Local\Temp\CFC3.tmp"68⤵
- System Location Discovery: System Language Discovery
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\D021.tmp"C:\Users\Admin\AppData\Local\Temp\D021.tmp"69⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\D07F.tmp"C:\Users\Admin\AppData\Local\Temp\D07F.tmp"70⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\D0CD.tmp"C:\Users\Admin\AppData\Local\Temp\D0CD.tmp"71⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\D12B.tmp"C:\Users\Admin\AppData\Local\Temp\D12B.tmp"72⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\D179.tmp"C:\Users\Admin\AppData\Local\Temp\D179.tmp"73⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"74⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\D225.tmp"C:\Users\Admin\AppData\Local\Temp\D225.tmp"75⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\D273.tmp"C:\Users\Admin\AppData\Local\Temp\D273.tmp"76⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\D2C1.tmp"C:\Users\Admin\AppData\Local\Temp\D2C1.tmp"77⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\D31F.tmp"C:\Users\Admin\AppData\Local\Temp\D31F.tmp"78⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\D37C.tmp"C:\Users\Admin\AppData\Local\Temp\D37C.tmp"79⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\D3CB.tmp"C:\Users\Admin\AppData\Local\Temp\D3CB.tmp"80⤵PID:312
-
C:\Users\Admin\AppData\Local\Temp\D419.tmp"C:\Users\Admin\AppData\Local\Temp\D419.tmp"81⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\D476.tmp"C:\Users\Admin\AppData\Local\Temp\D476.tmp"82⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\D4D4.tmp"C:\Users\Admin\AppData\Local\Temp\D4D4.tmp"83⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\D532.tmp"C:\Users\Admin\AppData\Local\Temp\D532.tmp"84⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\D590.tmp"C:\Users\Admin\AppData\Local\Temp\D590.tmp"85⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\D5ED.tmp"C:\Users\Admin\AppData\Local\Temp\D5ED.tmp"86⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\D64B.tmp"C:\Users\Admin\AppData\Local\Temp\D64B.tmp"87⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\D699.tmp"C:\Users\Admin\AppData\Local\Temp\D699.tmp"88⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\D6F7.tmp"C:\Users\Admin\AppData\Local\Temp\D6F7.tmp"89⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\D745.tmp"C:\Users\Admin\AppData\Local\Temp\D745.tmp"90⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\D7A3.tmp"C:\Users\Admin\AppData\Local\Temp\D7A3.tmp"91⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\D7F1.tmp"C:\Users\Admin\AppData\Local\Temp\D7F1.tmp"92⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\D84F.tmp"C:\Users\Admin\AppData\Local\Temp\D84F.tmp"93⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\D8AD.tmp"C:\Users\Admin\AppData\Local\Temp\D8AD.tmp"94⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\D90A.tmp"C:\Users\Admin\AppData\Local\Temp\D90A.tmp"95⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\D968.tmp"C:\Users\Admin\AppData\Local\Temp\D968.tmp"96⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\D9C6.tmp"C:\Users\Admin\AppData\Local\Temp\D9C6.tmp"97⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\DA24.tmp"C:\Users\Admin\AppData\Local\Temp\DA24.tmp"98⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\DA81.tmp"C:\Users\Admin\AppData\Local\Temp\DA81.tmp"99⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\DACF.tmp"C:\Users\Admin\AppData\Local\Temp\DACF.tmp"100⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\DB2D.tmp"C:\Users\Admin\AppData\Local\Temp\DB2D.tmp"101⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\DB7B.tmp"C:\Users\Admin\AppData\Local\Temp\DB7B.tmp"102⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\DBC9.tmp"C:\Users\Admin\AppData\Local\Temp\DBC9.tmp"103⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\DC27.tmp"C:\Users\Admin\AppData\Local\Temp\DC27.tmp"104⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\DC85.tmp"C:\Users\Admin\AppData\Local\Temp\DC85.tmp"105⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\DCD3.tmp"C:\Users\Admin\AppData\Local\Temp\DCD3.tmp"106⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\DD21.tmp"C:\Users\Admin\AppData\Local\Temp\DD21.tmp"107⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\DD6F.tmp"C:\Users\Admin\AppData\Local\Temp\DD6F.tmp"108⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\DDCD.tmp"C:\Users\Admin\AppData\Local\Temp\DDCD.tmp"109⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\DE2B.tmp"C:\Users\Admin\AppData\Local\Temp\DE2B.tmp"110⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\DE89.tmp"C:\Users\Admin\AppData\Local\Temp\DE89.tmp"111⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\DEE6.tmp"C:\Users\Admin\AppData\Local\Temp\DEE6.tmp"112⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\DF44.tmp"C:\Users\Admin\AppData\Local\Temp\DF44.tmp"113⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\DFA2.tmp"C:\Users\Admin\AppData\Local\Temp\DFA2.tmp"114⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\E000.tmp"C:\Users\Admin\AppData\Local\Temp\E000.tmp"115⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\E04E.tmp"C:\Users\Admin\AppData\Local\Temp\E04E.tmp"116⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\E0AB.tmp"C:\Users\Admin\AppData\Local\Temp\E0AB.tmp"117⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\E0FA.tmp"C:\Users\Admin\AppData\Local\Temp\E0FA.tmp"118⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\E157.tmp"C:\Users\Admin\AppData\Local\Temp\E157.tmp"119⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\E1A5.tmp"C:\Users\Admin\AppData\Local\Temp\E1A5.tmp"120⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\E1F4.tmp"C:\Users\Admin\AppData\Local\Temp\E1F4.tmp"121⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\E242.tmp"C:\Users\Admin\AppData\Local\Temp\E242.tmp"122⤵PID:4020
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-