Analysis
-
max time kernel
150s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12/09/2024, 03:06
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-12_e1f900bd166d4c6f142263a10bca2594_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-09-12_e1f900bd166d4c6f142263a10bca2594_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-12_e1f900bd166d4c6f142263a10bca2594_mafia.exe
-
Size
541KB
-
MD5
e1f900bd166d4c6f142263a10bca2594
-
SHA1
d077ae516b1c727c2db73203c5455a0aa3af2cc6
-
SHA256
0975a6b8292bfaa8e92692961acd438cfd388e968a70e5953101f4066186fa25
-
SHA512
2e7321f7b16cd51cb458b751690f80a1320c8e5f646c25fd6694fce1bb141ef3b34cbcc862b1a732aa0e09934db4c62bf863bdbc0bbb23ed811a39cd953ae4d3
-
SSDEEP
12288:UU5rCOTeifWOUWOts+P/rjj6MTQDZfiFyrZa73ctO:UUQOJfWOUWKLPrHTQhBrU73ctO
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2164 A410.tmp 1416 A48D.tmp 4836 A519.tmp 740 A5A6.tmp 3984 A604.tmp 432 A652.tmp 2464 A6B0.tmp 3884 A70D.tmp 5092 A77B.tmp 4592 A7D9.tmp 3020 A827.tmp 4628 A884.tmp 2468 A901.tmp 4844 A96F.tmp 4604 A9DC.tmp 1308 AA3A.tmp 2236 AAA7.tmp 3432 AB15.tmp 2432 AB63.tmp 2212 ABC1.tmp 2372 AC0F.tmp 972 AC5D.tmp 4248 ACCA.tmp 3964 AD18.tmp 4728 AD95.tmp 5068 AE03.tmp 3584 AE70.tmp 2604 AEDD.tmp 3816 AF5A.tmp 3100 AFB8.tmp 3872 B026.tmp 2272 B093.tmp 3128 B100.tmp 3044 B14E.tmp 2820 B19D.tmp 4892 B1EB.tmp 5096 B258.tmp 4492 B2B6.tmp 724 B304.tmp 4456 B362.tmp 4368 B3B0.tmp 1688 B40E.tmp 4908 B45C.tmp 464 B4B9.tmp 4820 B508.tmp 1840 B556.tmp 1680 B5A4.tmp 220 B5F2.tmp 2648 B650.tmp 1704 B6AD.tmp 1684 B6FC.tmp 5060 B74A.tmp 1976 B7A7.tmp 4592 B805.tmp 2732 B863.tmp 4800 B8C1.tmp 1912 B90F.tmp 208 B95D.tmp 1480 B9BB.tmp 1764 BA18.tmp 5116 BA67.tmp 4620 BAC4.tmp 1788 BB12.tmp 1760 BB70.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 700.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A728.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED2A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC0A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E29B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9517.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D801.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 397A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F731.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A330.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB4E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F00D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 292E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4273.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 248A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4AEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 338E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A090.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C4A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1306.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 484F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 776D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D215.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A63E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1A3.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2764 wrote to memory of 2164 2764 2024-09-12_e1f900bd166d4c6f142263a10bca2594_mafia.exe 83 PID 2764 wrote to memory of 2164 2764 2024-09-12_e1f900bd166d4c6f142263a10bca2594_mafia.exe 83 PID 2764 wrote to memory of 2164 2764 2024-09-12_e1f900bd166d4c6f142263a10bca2594_mafia.exe 83 PID 2164 wrote to memory of 1416 2164 A410.tmp 84 PID 2164 wrote to memory of 1416 2164 A410.tmp 84 PID 2164 wrote to memory of 1416 2164 A410.tmp 84 PID 1416 wrote to memory of 4836 1416 A48D.tmp 86 PID 1416 wrote to memory of 4836 1416 A48D.tmp 86 PID 1416 wrote to memory of 4836 1416 A48D.tmp 86 PID 4836 wrote to memory of 740 4836 A519.tmp 88 PID 4836 wrote to memory of 740 4836 A519.tmp 88 PID 4836 wrote to memory of 740 4836 A519.tmp 88 PID 740 wrote to memory of 3984 740 A5A6.tmp 90 PID 740 wrote to memory of 3984 740 A5A6.tmp 90 PID 740 wrote to memory of 3984 740 A5A6.tmp 90 PID 3984 wrote to memory of 432 3984 A604.tmp 91 PID 3984 wrote to memory of 432 3984 A604.tmp 91 PID 3984 wrote to memory of 432 3984 A604.tmp 91 PID 432 wrote to memory of 2464 432 A652.tmp 92 PID 432 wrote to memory of 2464 432 A652.tmp 92 PID 432 wrote to memory of 2464 432 A652.tmp 92 PID 2464 wrote to memory of 3884 2464 A6B0.tmp 93 PID 2464 wrote to memory of 3884 2464 A6B0.tmp 93 PID 2464 wrote to memory of 3884 2464 A6B0.tmp 93 PID 3884 wrote to memory of 5092 3884 A70D.tmp 94 PID 3884 wrote to memory of 5092 3884 A70D.tmp 94 PID 3884 wrote to memory of 5092 3884 A70D.tmp 94 PID 5092 wrote to memory of 4592 5092 A77B.tmp 95 PID 5092 wrote to memory of 4592 5092 A77B.tmp 95 PID 5092 wrote to memory of 4592 5092 A77B.tmp 95 PID 4592 wrote to memory of 3020 4592 A7D9.tmp 96 PID 4592 wrote to memory of 3020 4592 A7D9.tmp 96 PID 4592 wrote to memory of 3020 4592 A7D9.tmp 96 PID 3020 wrote to memory of 4628 3020 A827.tmp 97 PID 3020 wrote to memory of 4628 3020 A827.tmp 97 PID 3020 wrote to memory of 4628 3020 A827.tmp 97 PID 4628 wrote to memory of 2468 4628 A884.tmp 98 PID 4628 wrote to memory of 2468 4628 A884.tmp 98 PID 4628 wrote to memory of 2468 4628 A884.tmp 98 PID 2468 wrote to memory of 4844 2468 A901.tmp 99 PID 2468 wrote to memory of 4844 2468 A901.tmp 99 PID 2468 wrote to memory of 4844 2468 A901.tmp 99 PID 4844 wrote to memory of 4604 4844 A96F.tmp 100 PID 4844 wrote to memory of 4604 4844 A96F.tmp 100 PID 4844 wrote to memory of 4604 4844 A96F.tmp 100 PID 4604 wrote to memory of 1308 4604 A9DC.tmp 101 PID 4604 wrote to memory of 1308 4604 A9DC.tmp 101 PID 4604 wrote to memory of 1308 4604 A9DC.tmp 101 PID 1308 wrote to memory of 2236 1308 AA3A.tmp 102 PID 1308 wrote to memory of 2236 1308 AA3A.tmp 102 PID 1308 wrote to memory of 2236 1308 AA3A.tmp 102 PID 2236 wrote to memory of 3432 2236 AAA7.tmp 104 PID 2236 wrote to memory of 3432 2236 AAA7.tmp 104 PID 2236 wrote to memory of 3432 2236 AAA7.tmp 104 PID 3432 wrote to memory of 2432 3432 AB15.tmp 105 PID 3432 wrote to memory of 2432 3432 AB15.tmp 105 PID 3432 wrote to memory of 2432 3432 AB15.tmp 105 PID 2432 wrote to memory of 2212 2432 AB63.tmp 106 PID 2432 wrote to memory of 2212 2432 AB63.tmp 106 PID 2432 wrote to memory of 2212 2432 AB63.tmp 106 PID 2212 wrote to memory of 2372 2212 ABC1.tmp 107 PID 2212 wrote to memory of 2372 2212 ABC1.tmp 107 PID 2212 wrote to memory of 2372 2212 ABC1.tmp 107 PID 2372 wrote to memory of 972 2372 AC0F.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-12_e1f900bd166d4c6f142263a10bca2594_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-12_e1f900bd166d4c6f142263a10bca2594_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\A410.tmp"C:\Users\Admin\AppData\Local\Temp\A410.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\A48D.tmp"C:\Users\Admin\AppData\Local\Temp\A48D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\A519.tmp"C:\Users\Admin\AppData\Local\Temp\A519.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\A5A6.tmp"C:\Users\Admin\AppData\Local\Temp\A5A6.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Users\Admin\AppData\Local\Temp\A604.tmp"C:\Users\Admin\AppData\Local\Temp\A604.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\A652.tmp"C:\Users\Admin\AppData\Local\Temp\A652.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\A70D.tmp"C:\Users\Admin\AppData\Local\Temp\A70D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\A77B.tmp"C:\Users\Admin\AppData\Local\Temp\A77B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\A827.tmp"C:\Users\Admin\AppData\Local\Temp\A827.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\A884.tmp"C:\Users\Admin\AppData\Local\Temp\A884.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\A901.tmp"C:\Users\Admin\AppData\Local\Temp\A901.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\A96F.tmp"C:\Users\Admin\AppData\Local\Temp\A96F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\AB15.tmp"C:\Users\Admin\AppData\Local\Temp\AB15.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\AB63.tmp"C:\Users\Admin\AppData\Local\Temp\AB63.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"23⤵
- Executes dropped EXE
PID:972 -
C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"24⤵
- Executes dropped EXE
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\AD18.tmp"C:\Users\Admin\AppData\Local\Temp\AD18.tmp"25⤵
- Executes dropped EXE
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\AD95.tmp"C:\Users\Admin\AppData\Local\Temp\AD95.tmp"26⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\AE03.tmp"C:\Users\Admin\AppData\Local\Temp\AE03.tmp"27⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\AE70.tmp"C:\Users\Admin\AppData\Local\Temp\AE70.tmp"28⤵
- Executes dropped EXE
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"29⤵
- Executes dropped EXE
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"30⤵
- Executes dropped EXE
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"31⤵
- Executes dropped EXE
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\B026.tmp"C:\Users\Admin\AppData\Local\Temp\B026.tmp"32⤵
- Executes dropped EXE
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\B093.tmp"C:\Users\Admin\AppData\Local\Temp\B093.tmp"33⤵
- Executes dropped EXE
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\B100.tmp"C:\Users\Admin\AppData\Local\Temp\B100.tmp"34⤵
- Executes dropped EXE
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\B14E.tmp"C:\Users\Admin\AppData\Local\Temp\B14E.tmp"35⤵
- Executes dropped EXE
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\B19D.tmp"C:\Users\Admin\AppData\Local\Temp\B19D.tmp"36⤵
- Executes dropped EXE
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"37⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\B258.tmp"C:\Users\Admin\AppData\Local\Temp\B258.tmp"38⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"39⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\B304.tmp"C:\Users\Admin\AppData\Local\Temp\B304.tmp"40⤵
- Executes dropped EXE
PID:724 -
C:\Users\Admin\AppData\Local\Temp\B362.tmp"C:\Users\Admin\AppData\Local\Temp\B362.tmp"41⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"42⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\B40E.tmp"C:\Users\Admin\AppData\Local\Temp\B40E.tmp"43⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\B45C.tmp"C:\Users\Admin\AppData\Local\Temp\B45C.tmp"44⤵
- Executes dropped EXE
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"45⤵
- Executes dropped EXE
PID:464 -
C:\Users\Admin\AppData\Local\Temp\B508.tmp"C:\Users\Admin\AppData\Local\Temp\B508.tmp"46⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\B556.tmp"C:\Users\Admin\AppData\Local\Temp\B556.tmp"47⤵
- Executes dropped EXE
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"48⤵
- Executes dropped EXE
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"49⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\B650.tmp"C:\Users\Admin\AppData\Local\Temp\B650.tmp"50⤵
- Executes dropped EXE
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"51⤵
- Executes dropped EXE
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\B6FC.tmp"C:\Users\Admin\AppData\Local\Temp\B6FC.tmp"52⤵
- Executes dropped EXE
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\B74A.tmp"C:\Users\Admin\AppData\Local\Temp\B74A.tmp"53⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\B7A7.tmp"C:\Users\Admin\AppData\Local\Temp\B7A7.tmp"54⤵
- Executes dropped EXE
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\B805.tmp"C:\Users\Admin\AppData\Local\Temp\B805.tmp"55⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\B863.tmp"C:\Users\Admin\AppData\Local\Temp\B863.tmp"56⤵
- Executes dropped EXE
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"57⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\B90F.tmp"C:\Users\Admin\AppData\Local\Temp\B90F.tmp"58⤵
- Executes dropped EXE
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\B95D.tmp"C:\Users\Admin\AppData\Local\Temp\B95D.tmp"59⤵
- Executes dropped EXE
PID:208 -
C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"60⤵
- Executes dropped EXE
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\BA18.tmp"C:\Users\Admin\AppData\Local\Temp\BA18.tmp"61⤵
- Executes dropped EXE
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\BA67.tmp"C:\Users\Admin\AppData\Local\Temp\BA67.tmp"62⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"63⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\BB12.tmp"C:\Users\Admin\AppData\Local\Temp\BB12.tmp"64⤵
- Executes dropped EXE
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\BB70.tmp"C:\Users\Admin\AppData\Local\Temp\BB70.tmp"65⤵
- Executes dropped EXE
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"66⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\BC2C.tmp"C:\Users\Admin\AppData\Local\Temp\BC2C.tmp"67⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"68⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\BD06.tmp"C:\Users\Admin\AppData\Local\Temp\BD06.tmp"69⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\BD64.tmp"C:\Users\Admin\AppData\Local\Temp\BD64.tmp"70⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"71⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\BE20.tmp"C:\Users\Admin\AppData\Local\Temp\BE20.tmp"72⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\BE7D.tmp"C:\Users\Admin\AppData\Local\Temp\BE7D.tmp"73⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\BECC.tmp"C:\Users\Admin\AppData\Local\Temp\BECC.tmp"74⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\BF29.tmp"C:\Users\Admin\AppData\Local\Temp\BF29.tmp"75⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\BF87.tmp"C:\Users\Admin\AppData\Local\Temp\BF87.tmp"76⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"77⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\C043.tmp"C:\Users\Admin\AppData\Local\Temp\C043.tmp"78⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\C091.tmp"C:\Users\Admin\AppData\Local\Temp\C091.tmp"79⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"80⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\C14C.tmp"C:\Users\Admin\AppData\Local\Temp\C14C.tmp"81⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"82⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\C217.tmp"C:\Users\Admin\AppData\Local\Temp\C217.tmp"83⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\C285.tmp"C:\Users\Admin\AppData\Local\Temp\C285.tmp"84⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"85⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\C340.tmp"C:\Users\Admin\AppData\Local\Temp\C340.tmp"86⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\C39E.tmp"C:\Users\Admin\AppData\Local\Temp\C39E.tmp"87⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"88⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\C44A.tmp"C:\Users\Admin\AppData\Local\Temp\C44A.tmp"89⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"90⤵
- System Location Discovery: System Language Discovery
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\C505.tmp"C:\Users\Admin\AppData\Local\Temp\C505.tmp"91⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\C563.tmp"C:\Users\Admin\AppData\Local\Temp\C563.tmp"92⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\C5B1.tmp"C:\Users\Admin\AppData\Local\Temp\C5B1.tmp"93⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\C60F.tmp"C:\Users\Admin\AppData\Local\Temp\C60F.tmp"94⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\C66D.tmp"C:\Users\Admin\AppData\Local\Temp\C66D.tmp"95⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\C6CA.tmp"C:\Users\Admin\AppData\Local\Temp\C6CA.tmp"96⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\C719.tmp"C:\Users\Admin\AppData\Local\Temp\C719.tmp"97⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\C767.tmp"C:\Users\Admin\AppData\Local\Temp\C767.tmp"98⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"99⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\C822.tmp"C:\Users\Admin\AppData\Local\Temp\C822.tmp"100⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\C880.tmp"C:\Users\Admin\AppData\Local\Temp\C880.tmp"101⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\C8CE.tmp"C:\Users\Admin\AppData\Local\Temp\C8CE.tmp"102⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\C92C.tmp"C:\Users\Admin\AppData\Local\Temp\C92C.tmp"103⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\C98A.tmp"C:\Users\Admin\AppData\Local\Temp\C98A.tmp"104⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"105⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\CA45.tmp"C:\Users\Admin\AppData\Local\Temp\CA45.tmp"106⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\CAA3.tmp"C:\Users\Admin\AppData\Local\Temp\CAA3.tmp"107⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\CB01.tmp"C:\Users\Admin\AppData\Local\Temp\CB01.tmp"108⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\CB4F.tmp"C:\Users\Admin\AppData\Local\Temp\CB4F.tmp"109⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\CB9D.tmp"C:\Users\Admin\AppData\Local\Temp\CB9D.tmp"110⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\CC0A.tmp"C:\Users\Admin\AppData\Local\Temp\CC0A.tmp"111⤵
- System Location Discovery: System Language Discovery
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\CC68.tmp"C:\Users\Admin\AppData\Local\Temp\CC68.tmp"112⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\CCB6.tmp"C:\Users\Admin\AppData\Local\Temp\CCB6.tmp"113⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\CD14.tmp"C:\Users\Admin\AppData\Local\Temp\CD14.tmp"114⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\CD62.tmp"C:\Users\Admin\AppData\Local\Temp\CD62.tmp"115⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\CDB0.tmp"C:\Users\Admin\AppData\Local\Temp\CDB0.tmp"116⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\CDFE.tmp"C:\Users\Admin\AppData\Local\Temp\CDFE.tmp"117⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\CE5C.tmp"C:\Users\Admin\AppData\Local\Temp\CE5C.tmp"118⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\CEBA.tmp"C:\Users\Admin\AppData\Local\Temp\CEBA.tmp"119⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\CF08.tmp"C:\Users\Admin\AppData\Local\Temp\CF08.tmp"120⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\CF66.tmp"C:\Users\Admin\AppData\Local\Temp\CF66.tmp"121⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\CFB4.tmp"C:\Users\Admin\AppData\Local\Temp\CFB4.tmp"122⤵PID:1928
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-