Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/10/2024, 06:06
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-10_e7deac1179e1aeab51ead60df19636a2_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-10_e7deac1179e1aeab51ead60df19636a2_mafia.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-10_e7deac1179e1aeab51ead60df19636a2_mafia.exe
-
Size
765KB
-
MD5
e7deac1179e1aeab51ead60df19636a2
-
SHA1
5627d15b3a4f1eaa8f02f1c572de8261e45fcfd6
-
SHA256
47cac21b35725fd4fd3378a9d07ebc454250b9dc84282fb3a63fe8b68316ef9a
-
SHA512
bb8063c8f10d1b0d227088bed29619194fc57e1d24bea3cb4944757d525e7467046e972e35e75e026ab0dfaafc9fa0427fafefe5836cc53f8db675e0b3d0c0ca
-
SSDEEP
12288:ZU5rCOTeiDzI9QUrOOn3lL3lD70hdznUrdQU3ZF5rn5rLOa54U5w5A:ZUQOJDzl8Ln3p3lD4ha13vh5Oa+UOS
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4860 AA4A.tmp 4612 AAC7.tmp 4260 AB34.tmp 2036 ABC1.tmp 3096 AC2E.tmp 3212 AC7C.tmp 1340 ACCA.tmp 1440 AD38.tmp 1592 AD95.tmp 3492 ADF3.tmp 1348 AE60.tmp 2412 AEED.tmp 2052 AF4B.tmp 1616 AFD7.tmp 2272 B026.tmp 1556 B093.tmp 4500 B100.tmp 4868 B17D.tmp 3240 B1DB.tmp 2112 B268.tmp 3772 B2C5.tmp 2332 B323.tmp 5012 B381.tmp 2672 B3DF.tmp 4496 B42D.tmp 3156 B48B.tmp 1572 B4D9.tmp 4784 B565.tmp 3196 B5C3.tmp 1808 B630.tmp 2656 B6AD.tmp 3112 B72A.tmp 3036 B798.tmp 4404 B7E6.tmp 1904 B834.tmp 2596 B8A1.tmp 4920 B8FF.tmp 1568 B94D.tmp 3064 B9AB.tmp 3068 BA09.tmp 2020 BA67.tmp 716 BAC4.tmp 3944 BB12.tmp 4456 BB61.tmp 4836 BBAF.tmp 1688 BBFD.tmp 4504 BC5B.tmp 3368 BCA9.tmp 1304 BCF7.tmp 3784 BD45.tmp 4860 BDA3.tmp 3792 BE00.tmp 3940 BE4F.tmp 4712 BE9D.tmp 4612 BEFA.tmp 4716 BF49.tmp 4544 BFA6.tmp 5060 C004.tmp 1300 C052.tmp 672 C0B0.tmp 2972 C10E.tmp 3304 C16B.tmp 4548 C1BA.tmp 2660 C208.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F74C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3246.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6675.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C55E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9805.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3EAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5975.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D292.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 211F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D32A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E450.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BBE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 682B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5493.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D145.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D54C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCDE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C908.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5167.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2376 wrote to memory of 4860 2376 2024-10-10_e7deac1179e1aeab51ead60df19636a2_mafia.exe 84 PID 2376 wrote to memory of 4860 2376 2024-10-10_e7deac1179e1aeab51ead60df19636a2_mafia.exe 84 PID 2376 wrote to memory of 4860 2376 2024-10-10_e7deac1179e1aeab51ead60df19636a2_mafia.exe 84 PID 4860 wrote to memory of 4612 4860 AA4A.tmp 86 PID 4860 wrote to memory of 4612 4860 AA4A.tmp 86 PID 4860 wrote to memory of 4612 4860 AA4A.tmp 86 PID 4612 wrote to memory of 4260 4612 AAC7.tmp 88 PID 4612 wrote to memory of 4260 4612 AAC7.tmp 88 PID 4612 wrote to memory of 4260 4612 AAC7.tmp 88 PID 4260 wrote to memory of 2036 4260 AB34.tmp 89 PID 4260 wrote to memory of 2036 4260 AB34.tmp 89 PID 4260 wrote to memory of 2036 4260 AB34.tmp 89 PID 2036 wrote to memory of 3096 2036 ABC1.tmp 90 PID 2036 wrote to memory of 3096 2036 ABC1.tmp 90 PID 2036 wrote to memory of 3096 2036 ABC1.tmp 90 PID 3096 wrote to memory of 3212 3096 AC2E.tmp 91 PID 3096 wrote to memory of 3212 3096 AC2E.tmp 91 PID 3096 wrote to memory of 3212 3096 AC2E.tmp 91 PID 3212 wrote to memory of 1340 3212 AC7C.tmp 92 PID 3212 wrote to memory of 1340 3212 AC7C.tmp 92 PID 3212 wrote to memory of 1340 3212 AC7C.tmp 92 PID 1340 wrote to memory of 1440 1340 ACCA.tmp 93 PID 1340 wrote to memory of 1440 1340 ACCA.tmp 93 PID 1340 wrote to memory of 1440 1340 ACCA.tmp 93 PID 1440 wrote to memory of 1592 1440 AD38.tmp 94 PID 1440 wrote to memory of 1592 1440 AD38.tmp 94 PID 1440 wrote to memory of 1592 1440 AD38.tmp 94 PID 1592 wrote to memory of 3492 1592 AD95.tmp 95 PID 1592 wrote to memory of 3492 1592 AD95.tmp 95 PID 1592 wrote to memory of 3492 1592 AD95.tmp 95 PID 3492 wrote to memory of 1348 3492 ADF3.tmp 96 PID 3492 wrote to memory of 1348 3492 ADF3.tmp 96 PID 3492 wrote to memory of 1348 3492 ADF3.tmp 96 PID 1348 wrote to memory of 2412 1348 AE60.tmp 97 PID 1348 wrote to memory of 2412 1348 AE60.tmp 97 PID 1348 wrote to memory of 2412 1348 AE60.tmp 97 PID 2412 wrote to memory of 2052 2412 AEED.tmp 98 PID 2412 wrote to memory of 2052 2412 AEED.tmp 98 PID 2412 wrote to memory of 2052 2412 AEED.tmp 98 PID 2052 wrote to memory of 1616 2052 AF4B.tmp 99 PID 2052 wrote to memory of 1616 2052 AF4B.tmp 99 PID 2052 wrote to memory of 1616 2052 AF4B.tmp 99 PID 1616 wrote to memory of 2272 1616 AFD7.tmp 100 PID 1616 wrote to memory of 2272 1616 AFD7.tmp 100 PID 1616 wrote to memory of 2272 1616 AFD7.tmp 100 PID 2272 wrote to memory of 1556 2272 B026.tmp 101 PID 2272 wrote to memory of 1556 2272 B026.tmp 101 PID 2272 wrote to memory of 1556 2272 B026.tmp 101 PID 1556 wrote to memory of 4500 1556 B093.tmp 102 PID 1556 wrote to memory of 4500 1556 B093.tmp 102 PID 1556 wrote to memory of 4500 1556 B093.tmp 102 PID 4500 wrote to memory of 4868 4500 B100.tmp 103 PID 4500 wrote to memory of 4868 4500 B100.tmp 103 PID 4500 wrote to memory of 4868 4500 B100.tmp 103 PID 4868 wrote to memory of 3240 4868 B17D.tmp 104 PID 4868 wrote to memory of 3240 4868 B17D.tmp 104 PID 4868 wrote to memory of 3240 4868 B17D.tmp 104 PID 3240 wrote to memory of 2112 3240 B1DB.tmp 105 PID 3240 wrote to memory of 2112 3240 B1DB.tmp 105 PID 3240 wrote to memory of 2112 3240 B1DB.tmp 105 PID 2112 wrote to memory of 3772 2112 B268.tmp 106 PID 2112 wrote to memory of 3772 2112 B268.tmp 106 PID 2112 wrote to memory of 3772 2112 B268.tmp 106 PID 3772 wrote to memory of 2332 3772 B2C5.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-10_e7deac1179e1aeab51ead60df19636a2_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-10_e7deac1179e1aeab51ead60df19636a2_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\AB34.tmp"C:\Users\Admin\AppData\Local\Temp\AB34.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\AD38.tmp"C:\Users\Admin\AppData\Local\Temp\AD38.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\AD95.tmp"C:\Users\Admin\AppData\Local\Temp\AD95.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\AE60.tmp"C:\Users\Admin\AppData\Local\Temp\AE60.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\AEED.tmp"C:\Users\Admin\AppData\Local\Temp\AEED.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\B026.tmp"C:\Users\Admin\AppData\Local\Temp\B026.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\B093.tmp"C:\Users\Admin\AppData\Local\Temp\B093.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\B100.tmp"C:\Users\Admin\AppData\Local\Temp\B100.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\B17D.tmp"C:\Users\Admin\AppData\Local\Temp\B17D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\B268.tmp"C:\Users\Admin\AppData\Local\Temp\B268.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\B323.tmp"C:\Users\Admin\AppData\Local\Temp\B323.tmp"23⤵
- Executes dropped EXE
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\B381.tmp"C:\Users\Admin\AppData\Local\Temp\B381.tmp"24⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"25⤵
- Executes dropped EXE
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\B42D.tmp"C:\Users\Admin\AppData\Local\Temp\B42D.tmp"26⤵
- Executes dropped EXE
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\B48B.tmp"C:\Users\Admin\AppData\Local\Temp\B48B.tmp"27⤵
- Executes dropped EXE
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"28⤵
- Executes dropped EXE
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\B565.tmp"C:\Users\Admin\AppData\Local\Temp\B565.tmp"29⤵
- Executes dropped EXE
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"30⤵
- Executes dropped EXE
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\B630.tmp"C:\Users\Admin\AppData\Local\Temp\B630.tmp"31⤵
- Executes dropped EXE
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"32⤵
- Executes dropped EXE
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\B72A.tmp"C:\Users\Admin\AppData\Local\Temp\B72A.tmp"33⤵
- Executes dropped EXE
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\B798.tmp"C:\Users\Admin\AppData\Local\Temp\B798.tmp"34⤵
- Executes dropped EXE
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"35⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\B834.tmp"C:\Users\Admin\AppData\Local\Temp\B834.tmp"36⤵
- Executes dropped EXE
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"37⤵
- Executes dropped EXE
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"38⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\B94D.tmp"C:\Users\Admin\AppData\Local\Temp\B94D.tmp"39⤵
- Executes dropped EXE
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"40⤵
- Executes dropped EXE
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\BA09.tmp"C:\Users\Admin\AppData\Local\Temp\BA09.tmp"41⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\BA67.tmp"C:\Users\Admin\AppData\Local\Temp\BA67.tmp"42⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"43⤵
- Executes dropped EXE
PID:716 -
C:\Users\Admin\AppData\Local\Temp\BB12.tmp"C:\Users\Admin\AppData\Local\Temp\BB12.tmp"44⤵
- Executes dropped EXE
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\BB61.tmp"C:\Users\Admin\AppData\Local\Temp\BB61.tmp"45⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\BBAF.tmp"C:\Users\Admin\AppData\Local\Temp\BBAF.tmp"46⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"47⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"48⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\BCF7.tmp"C:\Users\Admin\AppData\Local\Temp\BCF7.tmp"50⤵
- Executes dropped EXE
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\BD45.tmp"C:\Users\Admin\AppData\Local\Temp\BD45.tmp"51⤵
- Executes dropped EXE
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"52⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\BE00.tmp"C:\Users\Admin\AppData\Local\Temp\BE00.tmp"53⤵
- Executes dropped EXE
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"54⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"55⤵
- Executes dropped EXE
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"56⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\BF49.tmp"C:\Users\Admin\AppData\Local\Temp\BF49.tmp"57⤵
- Executes dropped EXE
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"58⤵
- Executes dropped EXE
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\C004.tmp"C:\Users\Admin\AppData\Local\Temp\C004.tmp"59⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\C052.tmp"C:\Users\Admin\AppData\Local\Temp\C052.tmp"60⤵
- Executes dropped EXE
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"61⤵
- Executes dropped EXE
PID:672 -
C:\Users\Admin\AppData\Local\Temp\C10E.tmp"C:\Users\Admin\AppData\Local\Temp\C10E.tmp"62⤵
- Executes dropped EXE
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\C16B.tmp"C:\Users\Admin\AppData\Local\Temp\C16B.tmp"63⤵
- Executes dropped EXE
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"64⤵
- Executes dropped EXE
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\C208.tmp"C:\Users\Admin\AppData\Local\Temp\C208.tmp"65⤵
- Executes dropped EXE
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\C256.tmp"C:\Users\Admin\AppData\Local\Temp\C256.tmp"66⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\C2A4.tmp"C:\Users\Admin\AppData\Local\Temp\C2A4.tmp"67⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\C302.tmp"C:\Users\Admin\AppData\Local\Temp\C302.tmp"68⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\C350.tmp"C:\Users\Admin\AppData\Local\Temp\C350.tmp"69⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\C39E.tmp"C:\Users\Admin\AppData\Local\Temp\C39E.tmp"70⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"71⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\C44A.tmp"C:\Users\Admin\AppData\Local\Temp\C44A.tmp"72⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\C498.tmp"C:\Users\Admin\AppData\Local\Temp\C498.tmp"73⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\C4E6.tmp"C:\Users\Admin\AppData\Local\Temp\C4E6.tmp"74⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\C544.tmp"C:\Users\Admin\AppData\Local\Temp\C544.tmp"75⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"76⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\C5F0.tmp"C:\Users\Admin\AppData\Local\Temp\C5F0.tmp"77⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\C63E.tmp"C:\Users\Admin\AppData\Local\Temp\C63E.tmp"78⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\C69C.tmp"C:\Users\Admin\AppData\Local\Temp\C69C.tmp"79⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\C6EA.tmp"C:\Users\Admin\AppData\Local\Temp\C6EA.tmp"80⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\C738.tmp"C:\Users\Admin\AppData\Local\Temp\C738.tmp"81⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\C786.tmp"C:\Users\Admin\AppData\Local\Temp\C786.tmp"82⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\C7D4.tmp"C:\Users\Admin\AppData\Local\Temp\C7D4.tmp"83⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\C841.tmp"C:\Users\Admin\AppData\Local\Temp\C841.tmp"84⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\C89F.tmp"C:\Users\Admin\AppData\Local\Temp\C89F.tmp"85⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\C8FD.tmp"C:\Users\Admin\AppData\Local\Temp\C8FD.tmp"86⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\C94B.tmp"C:\Users\Admin\AppData\Local\Temp\C94B.tmp"87⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\C999.tmp"C:\Users\Admin\AppData\Local\Temp\C999.tmp"88⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"89⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\CA35.tmp"C:\Users\Admin\AppData\Local\Temp\CA35.tmp"90⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\CA84.tmp"C:\Users\Admin\AppData\Local\Temp\CA84.tmp"91⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\CAD2.tmp"C:\Users\Admin\AppData\Local\Temp\CAD2.tmp"92⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\CB20.tmp"C:\Users\Admin\AppData\Local\Temp\CB20.tmp"93⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\CB7E.tmp"C:\Users\Admin\AppData\Local\Temp\CB7E.tmp"94⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\CBCC.tmp"C:\Users\Admin\AppData\Local\Temp\CBCC.tmp"95⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\CC29.tmp"C:\Users\Admin\AppData\Local\Temp\CC29.tmp"96⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\CC87.tmp"C:\Users\Admin\AppData\Local\Temp\CC87.tmp"97⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\CCD5.tmp"C:\Users\Admin\AppData\Local\Temp\CCD5.tmp"98⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\CD33.tmp"C:\Users\Admin\AppData\Local\Temp\CD33.tmp"99⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\CD81.tmp"C:\Users\Admin\AppData\Local\Temp\CD81.tmp"100⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\CDCF.tmp"C:\Users\Admin\AppData\Local\Temp\CDCF.tmp"101⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\CE1D.tmp"C:\Users\Admin\AppData\Local\Temp\CE1D.tmp"102⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\CE6C.tmp"C:\Users\Admin\AppData\Local\Temp\CE6C.tmp"103⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\CEBA.tmp"C:\Users\Admin\AppData\Local\Temp\CEBA.tmp"104⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\CF17.tmp"C:\Users\Admin\AppData\Local\Temp\CF17.tmp"105⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\CF75.tmp"C:\Users\Admin\AppData\Local\Temp\CF75.tmp"106⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\CFD3.tmp"C:\Users\Admin\AppData\Local\Temp\CFD3.tmp"107⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\D031.tmp"C:\Users\Admin\AppData\Local\Temp\D031.tmp"108⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\D08E.tmp"C:\Users\Admin\AppData\Local\Temp\D08E.tmp"109⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\D0DD.tmp"C:\Users\Admin\AppData\Local\Temp\D0DD.tmp"110⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\D14A.tmp"C:\Users\Admin\AppData\Local\Temp\D14A.tmp"111⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\D1A8.tmp"C:\Users\Admin\AppData\Local\Temp\D1A8.tmp"112⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\D1F6.tmp"C:\Users\Admin\AppData\Local\Temp\D1F6.tmp"113⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\D244.tmp"C:\Users\Admin\AppData\Local\Temp\D244.tmp"114⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\D292.tmp"C:\Users\Admin\AppData\Local\Temp\D292.tmp"115⤵
- System Location Discovery: System Language Discovery
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\D2F0.tmp"C:\Users\Admin\AppData\Local\Temp\D2F0.tmp"116⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\D33E.tmp"C:\Users\Admin\AppData\Local\Temp\D33E.tmp"117⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\D39C.tmp"C:\Users\Admin\AppData\Local\Temp\D39C.tmp"118⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\D3EA.tmp"C:\Users\Admin\AppData\Local\Temp\D3EA.tmp"119⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\D448.tmp"C:\Users\Admin\AppData\Local\Temp\D448.tmp"120⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\D4A5.tmp"C:\Users\Admin\AppData\Local\Temp\D4A5.tmp"121⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\D4F3.tmp"C:\Users\Admin\AppData\Local\Temp\D4F3.tmp"122⤵PID:2968
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-