Analysis
-
max time kernel
150s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04-10-2024 10:58
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-04_658d222590ba23c57cf7da249859feff_mafia.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-10-04_658d222590ba23c57cf7da249859feff_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-10-04_658d222590ba23c57cf7da249859feff_mafia.exe
-
Size
520KB
-
MD5
658d222590ba23c57cf7da249859feff
-
SHA1
64a458a6e6366c400035a68b56f1254da67ca230
-
SHA256
1db8d2c1d4e88223d59b578abf4ffbd6f63800657c3d550809bdb7eb21f1be03
-
SHA512
3091f5fb6c341b810a4d80fbad408525af2b39612e96b78ff1091fb843e3b3610fa08f9615e7e58c89bd1906ff845377541d0182a183fec7ddabbee77b33d645
-
SSDEEP
12288:roRXOQjmOy4QUg2DXvEqOawPYX6S7a4x4+7kCNZ:rogQ9y41g2DXvEmwm6SV4+7hN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3528 B8C1.tmp 1200 B93E.tmp 2272 B99B.tmp 852 BA18.tmp 4228 BA76.tmp 3460 BAE4.tmp 3032 BB51.tmp 3860 BBCE.tmp 4136 BC2C.tmp 2756 BC99.tmp 3500 BCF7.tmp 2524 BD64.tmp 4188 BDC2.tmp 4568 BE4F.tmp 4076 BEBC.tmp 2984 BF29.tmp 4384 BF87.tmp 1864 BFF4.tmp 2208 C071.tmp 4456 C0CF.tmp 320 C14C.tmp 3056 C1E8.tmp 540 C237.tmp 1748 C2B4.tmp 4576 C340.tmp 628 C3AE.tmp 640 C42B.tmp 1644 C4A8.tmp 452 C505.tmp 752 C582.tmp 4444 C5D0.tmp 4836 C62E.tmp 652 C6AB.tmp 3060 C709.tmp 3344 C757.tmp 4716 C7A5.tmp 3932 C7F3.tmp 4544 C841.tmp 2812 C890.tmp 2468 C8DE.tmp 3632 C93B.tmp 1872 C98A.tmp 2772 C9E7.tmp 4480 CA35.tmp 3848 CA93.tmp 1624 CAF1.tmp 3516 CB4F.tmp 4556 CB9D.tmp 1604 CBFB.tmp 952 CC58.tmp 60 CCB6.tmp 1112 CD04.tmp 3148 CD62.tmp 4416 CDB0.tmp 4712 CE0E.tmp 4844 CE5C.tmp 4400 CEBA.tmp 2836 CF17.tmp 5072 CF66.tmp 1168 CFB4.tmp 3912 D002.tmp 4320 D050.tmp 4308 D0AE.tmp 3464 D0FC.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C98A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6AAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C890.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5781.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C757.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D869.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E271.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4793.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D77F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE79.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E673.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2805.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5222.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB2D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 407F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC29.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCA4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D448.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1279.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC34.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3464 wrote to memory of 3528 3464 2024-10-04_658d222590ba23c57cf7da249859feff_mafia.exe 82 PID 3464 wrote to memory of 3528 3464 2024-10-04_658d222590ba23c57cf7da249859feff_mafia.exe 82 PID 3464 wrote to memory of 3528 3464 2024-10-04_658d222590ba23c57cf7da249859feff_mafia.exe 82 PID 3528 wrote to memory of 1200 3528 B8C1.tmp 83 PID 3528 wrote to memory of 1200 3528 B8C1.tmp 83 PID 3528 wrote to memory of 1200 3528 B8C1.tmp 83 PID 1200 wrote to memory of 2272 1200 B93E.tmp 84 PID 1200 wrote to memory of 2272 1200 B93E.tmp 84 PID 1200 wrote to memory of 2272 1200 B93E.tmp 84 PID 2272 wrote to memory of 852 2272 B99B.tmp 85 PID 2272 wrote to memory of 852 2272 B99B.tmp 85 PID 2272 wrote to memory of 852 2272 B99B.tmp 85 PID 852 wrote to memory of 4228 852 BA18.tmp 86 PID 852 wrote to memory of 4228 852 BA18.tmp 86 PID 852 wrote to memory of 4228 852 BA18.tmp 86 PID 4228 wrote to memory of 3460 4228 BA76.tmp 87 PID 4228 wrote to memory of 3460 4228 BA76.tmp 87 PID 4228 wrote to memory of 3460 4228 BA76.tmp 87 PID 3460 wrote to memory of 3032 3460 BAE4.tmp 88 PID 3460 wrote to memory of 3032 3460 BAE4.tmp 88 PID 3460 wrote to memory of 3032 3460 BAE4.tmp 88 PID 3032 wrote to memory of 3860 3032 BB51.tmp 89 PID 3032 wrote to memory of 3860 3032 BB51.tmp 89 PID 3032 wrote to memory of 3860 3032 BB51.tmp 89 PID 3860 wrote to memory of 4136 3860 BBCE.tmp 90 PID 3860 wrote to memory of 4136 3860 BBCE.tmp 90 PID 3860 wrote to memory of 4136 3860 BBCE.tmp 90 PID 4136 wrote to memory of 2756 4136 BC2C.tmp 91 PID 4136 wrote to memory of 2756 4136 BC2C.tmp 91 PID 4136 wrote to memory of 2756 4136 BC2C.tmp 91 PID 2756 wrote to memory of 3500 2756 BC99.tmp 92 PID 2756 wrote to memory of 3500 2756 BC99.tmp 92 PID 2756 wrote to memory of 3500 2756 BC99.tmp 92 PID 3500 wrote to memory of 2524 3500 BCF7.tmp 93 PID 3500 wrote to memory of 2524 3500 BCF7.tmp 93 PID 3500 wrote to memory of 2524 3500 BCF7.tmp 93 PID 2524 wrote to memory of 4188 2524 BD64.tmp 94 PID 2524 wrote to memory of 4188 2524 BD64.tmp 94 PID 2524 wrote to memory of 4188 2524 BD64.tmp 94 PID 4188 wrote to memory of 4568 4188 BDC2.tmp 95 PID 4188 wrote to memory of 4568 4188 BDC2.tmp 95 PID 4188 wrote to memory of 4568 4188 BDC2.tmp 95 PID 4568 wrote to memory of 4076 4568 BE4F.tmp 96 PID 4568 wrote to memory of 4076 4568 BE4F.tmp 96 PID 4568 wrote to memory of 4076 4568 BE4F.tmp 96 PID 4076 wrote to memory of 2984 4076 BEBC.tmp 97 PID 4076 wrote to memory of 2984 4076 BEBC.tmp 97 PID 4076 wrote to memory of 2984 4076 BEBC.tmp 97 PID 2984 wrote to memory of 4384 2984 BF29.tmp 98 PID 2984 wrote to memory of 4384 2984 BF29.tmp 98 PID 2984 wrote to memory of 4384 2984 BF29.tmp 98 PID 4384 wrote to memory of 1864 4384 BF87.tmp 99 PID 4384 wrote to memory of 1864 4384 BF87.tmp 99 PID 4384 wrote to memory of 1864 4384 BF87.tmp 99 PID 1864 wrote to memory of 2208 1864 BFF4.tmp 100 PID 1864 wrote to memory of 2208 1864 BFF4.tmp 100 PID 1864 wrote to memory of 2208 1864 BFF4.tmp 100 PID 2208 wrote to memory of 4456 2208 C071.tmp 101 PID 2208 wrote to memory of 4456 2208 C071.tmp 101 PID 2208 wrote to memory of 4456 2208 C071.tmp 101 PID 4456 wrote to memory of 320 4456 C0CF.tmp 102 PID 4456 wrote to memory of 320 4456 C0CF.tmp 102 PID 4456 wrote to memory of 320 4456 C0CF.tmp 102 PID 320 wrote to memory of 3056 320 C14C.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-04_658d222590ba23c57cf7da249859feff_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-04_658d222590ba23c57cf7da249859feff_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\B93E.tmp"C:\Users\Admin\AppData\Local\Temp\B93E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\B99B.tmp"C:\Users\Admin\AppData\Local\Temp\B99B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\BA18.tmp"C:\Users\Admin\AppData\Local\Temp\BA18.tmp"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Users\Admin\AppData\Local\Temp\BA76.tmp"C:\Users\Admin\AppData\Local\Temp\BA76.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\BB51.tmp"C:\Users\Admin\AppData\Local\Temp\BB51.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\BC2C.tmp"C:\Users\Admin\AppData\Local\Temp\BC2C.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\BC99.tmp"C:\Users\Admin\AppData\Local\Temp\BC99.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\BCF7.tmp"C:\Users\Admin\AppData\Local\Temp\BCF7.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\BD64.tmp"C:\Users\Admin\AppData\Local\Temp\BD64.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\BEBC.tmp"C:\Users\Admin\AppData\Local\Temp\BEBC.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\BF29.tmp"C:\Users\Admin\AppData\Local\Temp\BF29.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\BF87.tmp"C:\Users\Admin\AppData\Local\Temp\BF87.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\C071.tmp"C:\Users\Admin\AppData\Local\Temp\C071.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\C14C.tmp"C:\Users\Admin\AppData\Local\Temp\C14C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"23⤵
- Executes dropped EXE
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\C237.tmp"C:\Users\Admin\AppData\Local\Temp\C237.tmp"24⤵
- Executes dropped EXE
PID:540 -
C:\Users\Admin\AppData\Local\Temp\C2B4.tmp"C:\Users\Admin\AppData\Local\Temp\C2B4.tmp"25⤵
- Executes dropped EXE
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\C340.tmp"C:\Users\Admin\AppData\Local\Temp\C340.tmp"26⤵
- Executes dropped EXE
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\C3AE.tmp"C:\Users\Admin\AppData\Local\Temp\C3AE.tmp"27⤵
- Executes dropped EXE
PID:628 -
C:\Users\Admin\AppData\Local\Temp\C42B.tmp"C:\Users\Admin\AppData\Local\Temp\C42B.tmp"28⤵
- Executes dropped EXE
PID:640 -
C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"29⤵
- Executes dropped EXE
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\C505.tmp"C:\Users\Admin\AppData\Local\Temp\C505.tmp"30⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\C582.tmp"C:\Users\Admin\AppData\Local\Temp\C582.tmp"31⤵
- Executes dropped EXE
PID:752 -
C:\Users\Admin\AppData\Local\Temp\C5D0.tmp"C:\Users\Admin\AppData\Local\Temp\C5D0.tmp"32⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\C62E.tmp"C:\Users\Admin\AppData\Local\Temp\C62E.tmp"33⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"34⤵
- Executes dropped EXE
PID:652 -
C:\Users\Admin\AppData\Local\Temp\C709.tmp"C:\Users\Admin\AppData\Local\Temp\C709.tmp"35⤵
- Executes dropped EXE
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\C757.tmp"C:\Users\Admin\AppData\Local\Temp\C757.tmp"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\C7A5.tmp"C:\Users\Admin\AppData\Local\Temp\C7A5.tmp"37⤵
- Executes dropped EXE
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"38⤵
- Executes dropped EXE
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\C841.tmp"C:\Users\Admin\AppData\Local\Temp\C841.tmp"39⤵
- Executes dropped EXE
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\C890.tmp"C:\Users\Admin\AppData\Local\Temp\C890.tmp"40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\C8DE.tmp"C:\Users\Admin\AppData\Local\Temp\C8DE.tmp"41⤵
- Executes dropped EXE
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\C93B.tmp"C:\Users\Admin\AppData\Local\Temp\C93B.tmp"42⤵
- Executes dropped EXE
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\C98A.tmp"C:\Users\Admin\AppData\Local\Temp\C98A.tmp"43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"44⤵
- Executes dropped EXE
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\CA35.tmp"C:\Users\Admin\AppData\Local\Temp\CA35.tmp"45⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\CA93.tmp"C:\Users\Admin\AppData\Local\Temp\CA93.tmp"46⤵
- Executes dropped EXE
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\CAF1.tmp"C:\Users\Admin\AppData\Local\Temp\CAF1.tmp"47⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\CB4F.tmp"C:\Users\Admin\AppData\Local\Temp\CB4F.tmp"48⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\CB9D.tmp"C:\Users\Admin\AppData\Local\Temp\CB9D.tmp"49⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\CBFB.tmp"C:\Users\Admin\AppData\Local\Temp\CBFB.tmp"50⤵
- Executes dropped EXE
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\CC58.tmp"C:\Users\Admin\AppData\Local\Temp\CC58.tmp"51⤵
- Executes dropped EXE
PID:952 -
C:\Users\Admin\AppData\Local\Temp\CCB6.tmp"C:\Users\Admin\AppData\Local\Temp\CCB6.tmp"52⤵
- Executes dropped EXE
PID:60 -
C:\Users\Admin\AppData\Local\Temp\CD04.tmp"C:\Users\Admin\AppData\Local\Temp\CD04.tmp"53⤵
- Executes dropped EXE
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\CD62.tmp"C:\Users\Admin\AppData\Local\Temp\CD62.tmp"54⤵
- Executes dropped EXE
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\CDB0.tmp"C:\Users\Admin\AppData\Local\Temp\CDB0.tmp"55⤵
- Executes dropped EXE
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\CE0E.tmp"C:\Users\Admin\AppData\Local\Temp\CE0E.tmp"56⤵
- Executes dropped EXE
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\CE5C.tmp"C:\Users\Admin\AppData\Local\Temp\CE5C.tmp"57⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\CEBA.tmp"C:\Users\Admin\AppData\Local\Temp\CEBA.tmp"58⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\CF17.tmp"C:\Users\Admin\AppData\Local\Temp\CF17.tmp"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\CF66.tmp"C:\Users\Admin\AppData\Local\Temp\CF66.tmp"60⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\CFB4.tmp"C:\Users\Admin\AppData\Local\Temp\CFB4.tmp"61⤵
- Executes dropped EXE
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\D002.tmp"C:\Users\Admin\AppData\Local\Temp\D002.tmp"62⤵
- Executes dropped EXE
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\D050.tmp"C:\Users\Admin\AppData\Local\Temp\D050.tmp"63⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"64⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\D0FC.tmp"C:\Users\Admin\AppData\Local\Temp\D0FC.tmp"65⤵
- Executes dropped EXE
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\D14A.tmp"C:\Users\Admin\AppData\Local\Temp\D14A.tmp"66⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\D198.tmp"C:\Users\Admin\AppData\Local\Temp\D198.tmp"67⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\D1F6.tmp"C:\Users\Admin\AppData\Local\Temp\D1F6.tmp"68⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\D244.tmp"C:\Users\Admin\AppData\Local\Temp\D244.tmp"69⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\D2A2.tmp"C:\Users\Admin\AppData\Local\Temp\D2A2.tmp"70⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\D2F0.tmp"C:\Users\Admin\AppData\Local\Temp\D2F0.tmp"71⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\D33E.tmp"C:\Users\Admin\AppData\Local\Temp\D33E.tmp"72⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\D39C.tmp"C:\Users\Admin\AppData\Local\Temp\D39C.tmp"73⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\D3F9.tmp"C:\Users\Admin\AppData\Local\Temp\D3F9.tmp"74⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\D448.tmp"C:\Users\Admin\AppData\Local\Temp\D448.tmp"75⤵
- System Location Discovery: System Language Discovery
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\D496.tmp"C:\Users\Admin\AppData\Local\Temp\D496.tmp"76⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\D4E4.tmp"C:\Users\Admin\AppData\Local\Temp\D4E4.tmp"77⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\D532.tmp"C:\Users\Admin\AppData\Local\Temp\D532.tmp"78⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\D590.tmp"C:\Users\Admin\AppData\Local\Temp\D590.tmp"79⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\D5ED.tmp"C:\Users\Admin\AppData\Local\Temp\D5ED.tmp"80⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\D63C.tmp"C:\Users\Admin\AppData\Local\Temp\D63C.tmp"81⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\D699.tmp"C:\Users\Admin\AppData\Local\Temp\D699.tmp"82⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\D6E7.tmp"C:\Users\Admin\AppData\Local\Temp\D6E7.tmp"83⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\D745.tmp"C:\Users\Admin\AppData\Local\Temp\D745.tmp"84⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\D7A3.tmp"C:\Users\Admin\AppData\Local\Temp\D7A3.tmp"85⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\D801.tmp"C:\Users\Admin\AppData\Local\Temp\D801.tmp"86⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\D85E.tmp"C:\Users\Admin\AppData\Local\Temp\D85E.tmp"87⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\D8AD.tmp"C:\Users\Admin\AppData\Local\Temp\D8AD.tmp"88⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\D90A.tmp"C:\Users\Admin\AppData\Local\Temp\D90A.tmp"89⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\D968.tmp"C:\Users\Admin\AppData\Local\Temp\D968.tmp"90⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\D9C6.tmp"C:\Users\Admin\AppData\Local\Temp\D9C6.tmp"91⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\DA24.tmp"C:\Users\Admin\AppData\Local\Temp\DA24.tmp"92⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\DA81.tmp"C:\Users\Admin\AppData\Local\Temp\DA81.tmp"93⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\DADF.tmp"C:\Users\Admin\AppData\Local\Temp\DADF.tmp"94⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\DB2D.tmp"C:\Users\Admin\AppData\Local\Temp\DB2D.tmp"95⤵
- System Location Discovery: System Language Discovery
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\DB8B.tmp"C:\Users\Admin\AppData\Local\Temp\DB8B.tmp"96⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\DBD9.tmp"C:\Users\Admin\AppData\Local\Temp\DBD9.tmp"97⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\DC37.tmp"C:\Users\Admin\AppData\Local\Temp\DC37.tmp"98⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\DC85.tmp"C:\Users\Admin\AppData\Local\Temp\DC85.tmp"99⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\DCD3.tmp"C:\Users\Admin\AppData\Local\Temp\DCD3.tmp"100⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\DD21.tmp"C:\Users\Admin\AppData\Local\Temp\DD21.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\DD6F.tmp"C:\Users\Admin\AppData\Local\Temp\DD6F.tmp"102⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\DDCD.tmp"C:\Users\Admin\AppData\Local\Temp\DDCD.tmp"103⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\DE2B.tmp"C:\Users\Admin\AppData\Local\Temp\DE2B.tmp"104⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\DE79.tmp"C:\Users\Admin\AppData\Local\Temp\DE79.tmp"105⤵
- System Location Discovery: System Language Discovery
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\DED7.tmp"C:\Users\Admin\AppData\Local\Temp\DED7.tmp"106⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\DF34.tmp"C:\Users\Admin\AppData\Local\Temp\DF34.tmp"107⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\DF92.tmp"C:\Users\Admin\AppData\Local\Temp\DF92.tmp"108⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\DFE0.tmp"C:\Users\Admin\AppData\Local\Temp\DFE0.tmp"109⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\E02E.tmp"C:\Users\Admin\AppData\Local\Temp\E02E.tmp"110⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\E07D.tmp"C:\Users\Admin\AppData\Local\Temp\E07D.tmp"111⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\E0CB.tmp"C:\Users\Admin\AppData\Local\Temp\E0CB.tmp"112⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\E119.tmp"C:\Users\Admin\AppData\Local\Temp\E119.tmp"113⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\E167.tmp"C:\Users\Admin\AppData\Local\Temp\E167.tmp"114⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\E1C5.tmp"C:\Users\Admin\AppData\Local\Temp\E1C5.tmp"115⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\E213.tmp"C:\Users\Admin\AppData\Local\Temp\E213.tmp"116⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\E271.tmp"C:\Users\Admin\AppData\Local\Temp\E271.tmp"117⤵
- System Location Discovery: System Language Discovery
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\E2BF.tmp"C:\Users\Admin\AppData\Local\Temp\E2BF.tmp"118⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\E30D.tmp"C:\Users\Admin\AppData\Local\Temp\E30D.tmp"119⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\E35B.tmp"C:\Users\Admin\AppData\Local\Temp\E35B.tmp"120⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\E3A9.tmp"C:\Users\Admin\AppData\Local\Temp\E3A9.tmp"121⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\E407.tmp"C:\Users\Admin\AppData\Local\Temp\E407.tmp"122⤵PID:1736
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-