Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2024, 04:05
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-19_ba5483b11eff2a0e6e80bbec3ef05e05_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-19_ba5483b11eff2a0e6e80bbec3ef05e05_mafia.exe
Resource
win10v2004-20240910-en
General
-
Target
2024-09-19_ba5483b11eff2a0e6e80bbec3ef05e05_mafia.exe
-
Size
536KB
-
MD5
ba5483b11eff2a0e6e80bbec3ef05e05
-
SHA1
153e8e40ffc4f3626b26cf52c543034be2754dc6
-
SHA256
9123c175a009bc98c152758906253e6174f463c63f2222e4a8dc1c699e45c052
-
SHA512
b2cb7b7187906b0f61c73aa2bc7bf387f50dc8075b2270dec099610c922dc08e3d8236da26348c9b1caa1c235c54044b2105ba43de074dcb0ca78d15276321f8
-
SSDEEP
12288:wU5rCOTeiUdXrP15DGRRghK0vezex8oCl7fIZxVJ0ZT9:wUQOJUdXn1hlveiWocfIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4136 BCD8.tmp 4592 BD83.tmp 2308 BE4F.tmp 3912 BF1A.tmp 4348 BFD5.tmp 3120 C071.tmp 100 C0FE.tmp 3876 C18B.tmp 3440 C208.tmp 2076 C285.tmp 3092 C2F2.tmp 2876 C38E.tmp 5028 C42B.tmp 4736 C498.tmp 3508 C534.tmp 2276 C5B1.tmp 2240 C6CA.tmp 4316 C747.tmp 1452 C7D4.tmp 3872 C880.tmp 1448 C90D.tmp 3660 C9A9.tmp 3088 CA45.tmp 4884 CAA3.tmp 4932 CB3F.tmp 3456 CBAC.tmp 3988 CC39.tmp 1408 CCF5.tmp 1684 CDA0.tmp 4836 CE6C.tmp 4352 CEE9.tmp 4060 CF94.tmp 464 D021.tmp 1936 D08E.tmp 4048 D10B.tmp 2760 D169.tmp 4384 D205.tmp 3648 D292.tmp 5004 D2E0.tmp 1812 D34E.tmp 4512 D3BB.tmp 1080 D448.tmp 3120 D4C5.tmp 884 D522.tmp 4276 D580.tmp 1708 D60D.tmp 720 D68A.tmp 4332 D716.tmp 3448 D7A3.tmp 5108 D7F1.tmp 4396 D84F.tmp 2812 D8AD.tmp 548 D90A.tmp 3508 D968.tmp 756 D9B6.tmp 3672 DA14.tmp 4464 DA72.tmp 4156 DACF.tmp 4164 DB1E.tmp 4452 DB7B.tmp 3412 DBC9.tmp 1736 DC18.tmp 544 DC75.tmp 3088 DCC3.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C88B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C3F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 153.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1855.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B755.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3EC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8930.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F26A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4AC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C35B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C04D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2352.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 701A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2546.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DACF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9229.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D424.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D34E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BC5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1567.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3524.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D637.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E455.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1311.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1484 wrote to memory of 4136 1484 2024-09-19_ba5483b11eff2a0e6e80bbec3ef05e05_mafia.exe 85 PID 1484 wrote to memory of 4136 1484 2024-09-19_ba5483b11eff2a0e6e80bbec3ef05e05_mafia.exe 85 PID 1484 wrote to memory of 4136 1484 2024-09-19_ba5483b11eff2a0e6e80bbec3ef05e05_mafia.exe 85 PID 4136 wrote to memory of 4592 4136 BCD8.tmp 87 PID 4136 wrote to memory of 4592 4136 BCD8.tmp 87 PID 4136 wrote to memory of 4592 4136 BCD8.tmp 87 PID 4592 wrote to memory of 2308 4592 BD83.tmp 89 PID 4592 wrote to memory of 2308 4592 BD83.tmp 89 PID 4592 wrote to memory of 2308 4592 BD83.tmp 89 PID 2308 wrote to memory of 3912 2308 BE4F.tmp 91 PID 2308 wrote to memory of 3912 2308 BE4F.tmp 91 PID 2308 wrote to memory of 3912 2308 BE4F.tmp 91 PID 3912 wrote to memory of 4348 3912 BF1A.tmp 92 PID 3912 wrote to memory of 4348 3912 BF1A.tmp 92 PID 3912 wrote to memory of 4348 3912 BF1A.tmp 92 PID 4348 wrote to memory of 3120 4348 BFD5.tmp 93 PID 4348 wrote to memory of 3120 4348 BFD5.tmp 93 PID 4348 wrote to memory of 3120 4348 BFD5.tmp 93 PID 3120 wrote to memory of 100 3120 C071.tmp 94 PID 3120 wrote to memory of 100 3120 C071.tmp 94 PID 3120 wrote to memory of 100 3120 C071.tmp 94 PID 100 wrote to memory of 3876 100 C0FE.tmp 95 PID 100 wrote to memory of 3876 100 C0FE.tmp 95 PID 100 wrote to memory of 3876 100 C0FE.tmp 95 PID 3876 wrote to memory of 3440 3876 C18B.tmp 96 PID 3876 wrote to memory of 3440 3876 C18B.tmp 96 PID 3876 wrote to memory of 3440 3876 C18B.tmp 96 PID 3440 wrote to memory of 2076 3440 C208.tmp 97 PID 3440 wrote to memory of 2076 3440 C208.tmp 97 PID 3440 wrote to memory of 2076 3440 C208.tmp 97 PID 2076 wrote to memory of 3092 2076 C285.tmp 98 PID 2076 wrote to memory of 3092 2076 C285.tmp 98 PID 2076 wrote to memory of 3092 2076 C285.tmp 98 PID 3092 wrote to memory of 2876 3092 C2F2.tmp 99 PID 3092 wrote to memory of 2876 3092 C2F2.tmp 99 PID 3092 wrote to memory of 2876 3092 C2F2.tmp 99 PID 2876 wrote to memory of 5028 2876 C38E.tmp 100 PID 2876 wrote to memory of 5028 2876 C38E.tmp 100 PID 2876 wrote to memory of 5028 2876 C38E.tmp 100 PID 5028 wrote to memory of 4736 5028 C42B.tmp 101 PID 5028 wrote to memory of 4736 5028 C42B.tmp 101 PID 5028 wrote to memory of 4736 5028 C42B.tmp 101 PID 4736 wrote to memory of 3508 4736 C498.tmp 102 PID 4736 wrote to memory of 3508 4736 C498.tmp 102 PID 4736 wrote to memory of 3508 4736 C498.tmp 102 PID 3508 wrote to memory of 2276 3508 C534.tmp 103 PID 3508 wrote to memory of 2276 3508 C534.tmp 103 PID 3508 wrote to memory of 2276 3508 C534.tmp 103 PID 2276 wrote to memory of 2240 2276 C5B1.tmp 106 PID 2276 wrote to memory of 2240 2276 C5B1.tmp 106 PID 2276 wrote to memory of 2240 2276 C5B1.tmp 106 PID 2240 wrote to memory of 4316 2240 C6CA.tmp 107 PID 2240 wrote to memory of 4316 2240 C6CA.tmp 107 PID 2240 wrote to memory of 4316 2240 C6CA.tmp 107 PID 4316 wrote to memory of 1452 4316 C747.tmp 108 PID 4316 wrote to memory of 1452 4316 C747.tmp 108 PID 4316 wrote to memory of 1452 4316 C747.tmp 108 PID 1452 wrote to memory of 3872 1452 C7D4.tmp 109 PID 1452 wrote to memory of 3872 1452 C7D4.tmp 109 PID 1452 wrote to memory of 3872 1452 C7D4.tmp 109 PID 3872 wrote to memory of 1448 3872 C880.tmp 110 PID 3872 wrote to memory of 1448 3872 C880.tmp 110 PID 3872 wrote to memory of 1448 3872 C880.tmp 110 PID 1448 wrote to memory of 3660 1448 C90D.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_ba5483b11eff2a0e6e80bbec3ef05e05_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_ba5483b11eff2a0e6e80bbec3ef05e05_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\BCD8.tmp"C:\Users\Admin\AppData\Local\Temp\BCD8.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\BD83.tmp"C:\Users\Admin\AppData\Local\Temp\BD83.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\BFD5.tmp"C:\Users\Admin\AppData\Local\Temp\BFD5.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\C071.tmp"C:\Users\Admin\AppData\Local\Temp\C071.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:100 -
C:\Users\Admin\AppData\Local\Temp\C18B.tmp"C:\Users\Admin\AppData\Local\Temp\C18B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\C208.tmp"C:\Users\Admin\AppData\Local\Temp\C208.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\C285.tmp"C:\Users\Admin\AppData\Local\Temp\C285.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\C38E.tmp"C:\Users\Admin\AppData\Local\Temp\C38E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\C42B.tmp"C:\Users\Admin\AppData\Local\Temp\C42B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\C498.tmp"C:\Users\Admin\AppData\Local\Temp\C498.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\C534.tmp"C:\Users\Admin\AppData\Local\Temp\C534.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\C5B1.tmp"C:\Users\Admin\AppData\Local\Temp\C5B1.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\C6CA.tmp"C:\Users\Admin\AppData\Local\Temp\C6CA.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\C747.tmp"C:\Users\Admin\AppData\Local\Temp\C747.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\C7D4.tmp"C:\Users\Admin\AppData\Local\Temp\C7D4.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\C880.tmp"C:\Users\Admin\AppData\Local\Temp\C880.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\C90D.tmp"C:\Users\Admin\AppData\Local\Temp\C90D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\C9A9.tmp"C:\Users\Admin\AppData\Local\Temp\C9A9.tmp"23⤵
- Executes dropped EXE
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\CA45.tmp"C:\Users\Admin\AppData\Local\Temp\CA45.tmp"24⤵
- Executes dropped EXE
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\CAA3.tmp"C:\Users\Admin\AppData\Local\Temp\CAA3.tmp"25⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\CB3F.tmp"C:\Users\Admin\AppData\Local\Temp\CB3F.tmp"26⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\CBAC.tmp"C:\Users\Admin\AppData\Local\Temp\CBAC.tmp"27⤵
- Executes dropped EXE
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\CC39.tmp"C:\Users\Admin\AppData\Local\Temp\CC39.tmp"28⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\CCF5.tmp"C:\Users\Admin\AppData\Local\Temp\CCF5.tmp"29⤵
- Executes dropped EXE
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\CDA0.tmp"C:\Users\Admin\AppData\Local\Temp\CDA0.tmp"30⤵
- Executes dropped EXE
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\CE6C.tmp"C:\Users\Admin\AppData\Local\Temp\CE6C.tmp"31⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\CEE9.tmp"C:\Users\Admin\AppData\Local\Temp\CEE9.tmp"32⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\CF94.tmp"C:\Users\Admin\AppData\Local\Temp\CF94.tmp"33⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\D021.tmp"C:\Users\Admin\AppData\Local\Temp\D021.tmp"34⤵
- Executes dropped EXE
PID:464 -
C:\Users\Admin\AppData\Local\Temp\D08E.tmp"C:\Users\Admin\AppData\Local\Temp\D08E.tmp"35⤵
- Executes dropped EXE
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\D10B.tmp"C:\Users\Admin\AppData\Local\Temp\D10B.tmp"36⤵
- Executes dropped EXE
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\D169.tmp"C:\Users\Admin\AppData\Local\Temp\D169.tmp"37⤵
- Executes dropped EXE
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\D205.tmp"C:\Users\Admin\AppData\Local\Temp\D205.tmp"38⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\D292.tmp"C:\Users\Admin\AppData\Local\Temp\D292.tmp"39⤵
- Executes dropped EXE
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\D2E0.tmp"C:\Users\Admin\AppData\Local\Temp\D2E0.tmp"40⤵
- Executes dropped EXE
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\D34E.tmp"C:\Users\Admin\AppData\Local\Temp\D34E.tmp"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\D3BB.tmp"C:\Users\Admin\AppData\Local\Temp\D3BB.tmp"42⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\D448.tmp"C:\Users\Admin\AppData\Local\Temp\D448.tmp"43⤵
- Executes dropped EXE
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\D4C5.tmp"C:\Users\Admin\AppData\Local\Temp\D4C5.tmp"44⤵
- Executes dropped EXE
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\D522.tmp"C:\Users\Admin\AppData\Local\Temp\D522.tmp"45⤵
- Executes dropped EXE
PID:884 -
C:\Users\Admin\AppData\Local\Temp\D580.tmp"C:\Users\Admin\AppData\Local\Temp\D580.tmp"46⤵
- Executes dropped EXE
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\D60D.tmp"C:\Users\Admin\AppData\Local\Temp\D60D.tmp"47⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\D68A.tmp"C:\Users\Admin\AppData\Local\Temp\D68A.tmp"48⤵
- Executes dropped EXE
PID:720 -
C:\Users\Admin\AppData\Local\Temp\D716.tmp"C:\Users\Admin\AppData\Local\Temp\D716.tmp"49⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\D7A3.tmp"C:\Users\Admin\AppData\Local\Temp\D7A3.tmp"50⤵
- Executes dropped EXE
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\D7F1.tmp"C:\Users\Admin\AppData\Local\Temp\D7F1.tmp"51⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\D84F.tmp"C:\Users\Admin\AppData\Local\Temp\D84F.tmp"52⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\D8AD.tmp"C:\Users\Admin\AppData\Local\Temp\D8AD.tmp"53⤵
- Executes dropped EXE
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\D90A.tmp"C:\Users\Admin\AppData\Local\Temp\D90A.tmp"54⤵
- Executes dropped EXE
PID:548 -
C:\Users\Admin\AppData\Local\Temp\D968.tmp"C:\Users\Admin\AppData\Local\Temp\D968.tmp"55⤵
- Executes dropped EXE
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\D9B6.tmp"C:\Users\Admin\AppData\Local\Temp\D9B6.tmp"56⤵
- Executes dropped EXE
PID:756 -
C:\Users\Admin\AppData\Local\Temp\DA14.tmp"C:\Users\Admin\AppData\Local\Temp\DA14.tmp"57⤵
- Executes dropped EXE
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\DA72.tmp"C:\Users\Admin\AppData\Local\Temp\DA72.tmp"58⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\DACF.tmp"C:\Users\Admin\AppData\Local\Temp\DACF.tmp"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\DB1E.tmp"C:\Users\Admin\AppData\Local\Temp\DB1E.tmp"60⤵
- Executes dropped EXE
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\DB7B.tmp"C:\Users\Admin\AppData\Local\Temp\DB7B.tmp"61⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\DBC9.tmp"C:\Users\Admin\AppData\Local\Temp\DBC9.tmp"62⤵
- Executes dropped EXE
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\DC18.tmp"C:\Users\Admin\AppData\Local\Temp\DC18.tmp"63⤵
- Executes dropped EXE
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\DC75.tmp"C:\Users\Admin\AppData\Local\Temp\DC75.tmp"64⤵
- Executes dropped EXE
PID:544 -
C:\Users\Admin\AppData\Local\Temp\DCC3.tmp"C:\Users\Admin\AppData\Local\Temp\DCC3.tmp"65⤵
- Executes dropped EXE
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\DD12.tmp"C:\Users\Admin\AppData\Local\Temp\DD12.tmp"66⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\DD6F.tmp"C:\Users\Admin\AppData\Local\Temp\DD6F.tmp"67⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\DDCD.tmp"C:\Users\Admin\AppData\Local\Temp\DDCD.tmp"68⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\DE2B.tmp"C:\Users\Admin\AppData\Local\Temp\DE2B.tmp"69⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\DE89.tmp"C:\Users\Admin\AppData\Local\Temp\DE89.tmp"70⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\DEE6.tmp"C:\Users\Admin\AppData\Local\Temp\DEE6.tmp"71⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\DF44.tmp"C:\Users\Admin\AppData\Local\Temp\DF44.tmp"72⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\DFA2.tmp"C:\Users\Admin\AppData\Local\Temp\DFA2.tmp"73⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"74⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\E03E.tmp"C:\Users\Admin\AppData\Local\Temp\E03E.tmp"75⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\E09C.tmp"C:\Users\Admin\AppData\Local\Temp\E09C.tmp"76⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\E0FA.tmp"C:\Users\Admin\AppData\Local\Temp\E0FA.tmp"77⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\E148.tmp"C:\Users\Admin\AppData\Local\Temp\E148.tmp"78⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\E196.tmp"C:\Users\Admin\AppData\Local\Temp\E196.tmp"79⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\E1F4.tmp"C:\Users\Admin\AppData\Local\Temp\E1F4.tmp"80⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\E251.tmp"C:\Users\Admin\AppData\Local\Temp\E251.tmp"81⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\E2AF.tmp"C:\Users\Admin\AppData\Local\Temp\E2AF.tmp"82⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\E2FD.tmp"C:\Users\Admin\AppData\Local\Temp\E2FD.tmp"83⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\E35B.tmp"C:\Users\Admin\AppData\Local\Temp\E35B.tmp"84⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\E3A9.tmp"C:\Users\Admin\AppData\Local\Temp\E3A9.tmp"85⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\E3F7.tmp"C:\Users\Admin\AppData\Local\Temp\E3F7.tmp"86⤵
- System Location Discovery: System Language Discovery
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\E455.tmp"C:\Users\Admin\AppData\Local\Temp\E455.tmp"87⤵
- System Location Discovery: System Language Discovery
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\E4B3.tmp"C:\Users\Admin\AppData\Local\Temp\E4B3.tmp"88⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\E510.tmp"C:\Users\Admin\AppData\Local\Temp\E510.tmp"89⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\E55F.tmp"C:\Users\Admin\AppData\Local\Temp\E55F.tmp"90⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\E5AD.tmp"C:\Users\Admin\AppData\Local\Temp\E5AD.tmp"91⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\E61A.tmp"C:\Users\Admin\AppData\Local\Temp\E61A.tmp"92⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\E668.tmp"C:\Users\Admin\AppData\Local\Temp\E668.tmp"93⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\E6B6.tmp"C:\Users\Admin\AppData\Local\Temp\E6B6.tmp"94⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\E714.tmp"C:\Users\Admin\AppData\Local\Temp\E714.tmp"95⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\E772.tmp"C:\Users\Admin\AppData\Local\Temp\E772.tmp"96⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\E7C0.tmp"C:\Users\Admin\AppData\Local\Temp\E7C0.tmp"97⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\E80E.tmp"C:\Users\Admin\AppData\Local\Temp\E80E.tmp"98⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\E86C.tmp"C:\Users\Admin\AppData\Local\Temp\E86C.tmp"99⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"100⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\E918.tmp"C:\Users\Admin\AppData\Local\Temp\E918.tmp"101⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\E966.tmp"C:\Users\Admin\AppData\Local\Temp\E966.tmp"102⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\E9B4.tmp"C:\Users\Admin\AppData\Local\Temp\E9B4.tmp"103⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\EA12.tmp"C:\Users\Admin\AppData\Local\Temp\EA12.tmp"104⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\EA60.tmp"C:\Users\Admin\AppData\Local\Temp\EA60.tmp"105⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\EABE.tmp"C:\Users\Admin\AppData\Local\Temp\EABE.tmp"106⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\EB0C.tmp"C:\Users\Admin\AppData\Local\Temp\EB0C.tmp"107⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\EB5A.tmp"C:\Users\Admin\AppData\Local\Temp\EB5A.tmp"108⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\EBB8.tmp"C:\Users\Admin\AppData\Local\Temp\EBB8.tmp"109⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\EC15.tmp"C:\Users\Admin\AppData\Local\Temp\EC15.tmp"110⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\EC63.tmp"C:\Users\Admin\AppData\Local\Temp\EC63.tmp"111⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\ECD1.tmp"C:\Users\Admin\AppData\Local\Temp\ECD1.tmp"112⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\ED2F.tmp"C:\Users\Admin\AppData\Local\Temp\ED2F.tmp"113⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\ED8C.tmp"C:\Users\Admin\AppData\Local\Temp\ED8C.tmp"114⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\EDEA.tmp"C:\Users\Admin\AppData\Local\Temp\EDEA.tmp"115⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\EE38.tmp"C:\Users\Admin\AppData\Local\Temp\EE38.tmp"116⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\EE96.tmp"C:\Users\Admin\AppData\Local\Temp\EE96.tmp"117⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\EEE4.tmp"C:\Users\Admin\AppData\Local\Temp\EEE4.tmp"118⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\EF32.tmp"C:\Users\Admin\AppData\Local\Temp\EF32.tmp"119⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\EF80.tmp"C:\Users\Admin\AppData\Local\Temp\EF80.tmp"120⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\EFCE.tmp"C:\Users\Admin\AppData\Local\Temp\EFCE.tmp"121⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\F01D.tmp"C:\Users\Admin\AppData\Local\Temp\F01D.tmp"122⤵PID:2396
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-