Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14-10-2024 16:02
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-14_b4d5e13b7badb06ba6c8913f230fa378_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-14_b4d5e13b7badb06ba6c8913f230fa378_mafia.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-14_b4d5e13b7badb06ba6c8913f230fa378_mafia.exe
-
Size
520KB
-
MD5
b4d5e13b7badb06ba6c8913f230fa378
-
SHA1
da2965549cf031aa150eede13f3a54f514d66bff
-
SHA256
c612cb006d2be07a9e692f2435a693aacc39a453e3442ed17cc6c8b9456bcf86
-
SHA512
0bc87aef5123033053620e39b9dce97c26c00bb2af9fc2ba2085cfcb2bb18c87a56088c6c1aa640da85d25d1b3454288ed75c0ac512803cb28c5e516515bb8c8
-
SSDEEP
12288:roRXOQjmOygUjW1H7pouC/JBQQJlNsuo138blr0f6NZ:rogQ9yiQ/YQJho138blq6N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4436 B9F9.tmp 4148 BA57.tmp 4084 BAB5.tmp 2272 BB12.tmp 2124 BB70.tmp 1496 BBCE.tmp 2552 BC1C.tmp 1604 BC7A.tmp 4896 BCF7.tmp 2800 BD55.tmp 640 BDA3.tmp 1648 BDF1.tmp 552 BE3F.tmp 512 BEBC.tmp 4648 BF39.tmp 3380 BFA6.tmp 4632 C023.tmp 4016 C081.tmp 3180 C0EE.tmp 3236 C15C.tmp 4228 C1AA.tmp 3892 C208.tmp 3904 C246.tmp 3548 C2A4.tmp 4100 C2F2.tmp 1364 C35F.tmp 3584 C3AE.tmp 2716 C3FC.tmp 3388 C44A.tmp 4420 C498.tmp 3744 C505.tmp 4876 C553.tmp 3544 C5C1.tmp 3024 C61F.tmp 5116 C66D.tmp 3500 C6CA.tmp 4920 C719.tmp 1064 C767.tmp 1476 C7C4.tmp 1800 C851.tmp 1996 C89F.tmp 2012 C8FD.tmp 3492 C95B.tmp 756 C9A9.tmp 5020 C9F7.tmp 4384 CA45.tmp 1712 CA93.tmp 844 CAF1.tmp 3456 CB3F.tmp 1232 CB8D.tmp 4132 CBDB.tmp 4156 CC39.tmp 3340 CC87.tmp 4728 CCF5.tmp 396 CD52.tmp 3760 CDB0.tmp 4768 CE0E.tmp 8 CE5C.tmp 3088 CEAA.tmp 1496 CF08.tmp 2100 CF66.tmp 3980 CFB4.tmp 4092 D002.tmp 4892 D060.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F00D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1170.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E366.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C61F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6136.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E318.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E857.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5724.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F56C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 162.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E10.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A68C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3563.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A44A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFA2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B987.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C81D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCDE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C86C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E6E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F201.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2594.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD02.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3452 wrote to memory of 4436 3452 2024-10-14_b4d5e13b7badb06ba6c8913f230fa378_mafia.exe 82 PID 3452 wrote to memory of 4436 3452 2024-10-14_b4d5e13b7badb06ba6c8913f230fa378_mafia.exe 82 PID 3452 wrote to memory of 4436 3452 2024-10-14_b4d5e13b7badb06ba6c8913f230fa378_mafia.exe 82 PID 4436 wrote to memory of 4148 4436 B9F9.tmp 83 PID 4436 wrote to memory of 4148 4436 B9F9.tmp 83 PID 4436 wrote to memory of 4148 4436 B9F9.tmp 83 PID 4148 wrote to memory of 4084 4148 BA57.tmp 85 PID 4148 wrote to memory of 4084 4148 BA57.tmp 85 PID 4148 wrote to memory of 4084 4148 BA57.tmp 85 PID 4084 wrote to memory of 2272 4084 BAB5.tmp 86 PID 4084 wrote to memory of 2272 4084 BAB5.tmp 86 PID 4084 wrote to memory of 2272 4084 BAB5.tmp 86 PID 2272 wrote to memory of 2124 2272 BB12.tmp 88 PID 2272 wrote to memory of 2124 2272 BB12.tmp 88 PID 2272 wrote to memory of 2124 2272 BB12.tmp 88 PID 2124 wrote to memory of 1496 2124 BB70.tmp 90 PID 2124 wrote to memory of 1496 2124 BB70.tmp 90 PID 2124 wrote to memory of 1496 2124 BB70.tmp 90 PID 1496 wrote to memory of 2552 1496 BBCE.tmp 91 PID 1496 wrote to memory of 2552 1496 BBCE.tmp 91 PID 1496 wrote to memory of 2552 1496 BBCE.tmp 91 PID 2552 wrote to memory of 1604 2552 BC1C.tmp 92 PID 2552 wrote to memory of 1604 2552 BC1C.tmp 92 PID 2552 wrote to memory of 1604 2552 BC1C.tmp 92 PID 1604 wrote to memory of 4896 1604 BC7A.tmp 93 PID 1604 wrote to memory of 4896 1604 BC7A.tmp 93 PID 1604 wrote to memory of 4896 1604 BC7A.tmp 93 PID 4896 wrote to memory of 2800 4896 BCF7.tmp 94 PID 4896 wrote to memory of 2800 4896 BCF7.tmp 94 PID 4896 wrote to memory of 2800 4896 BCF7.tmp 94 PID 2800 wrote to memory of 640 2800 BD55.tmp 95 PID 2800 wrote to memory of 640 2800 BD55.tmp 95 PID 2800 wrote to memory of 640 2800 BD55.tmp 95 PID 640 wrote to memory of 1648 640 BDA3.tmp 96 PID 640 wrote to memory of 1648 640 BDA3.tmp 96 PID 640 wrote to memory of 1648 640 BDA3.tmp 96 PID 1648 wrote to memory of 552 1648 BDF1.tmp 97 PID 1648 wrote to memory of 552 1648 BDF1.tmp 97 PID 1648 wrote to memory of 552 1648 BDF1.tmp 97 PID 552 wrote to memory of 512 552 BE3F.tmp 98 PID 552 wrote to memory of 512 552 BE3F.tmp 98 PID 552 wrote to memory of 512 552 BE3F.tmp 98 PID 512 wrote to memory of 4648 512 BEBC.tmp 99 PID 512 wrote to memory of 4648 512 BEBC.tmp 99 PID 512 wrote to memory of 4648 512 BEBC.tmp 99 PID 4648 wrote to memory of 3380 4648 BF39.tmp 100 PID 4648 wrote to memory of 3380 4648 BF39.tmp 100 PID 4648 wrote to memory of 3380 4648 BF39.tmp 100 PID 3380 wrote to memory of 4632 3380 BFA6.tmp 101 PID 3380 wrote to memory of 4632 3380 BFA6.tmp 101 PID 3380 wrote to memory of 4632 3380 BFA6.tmp 101 PID 4632 wrote to memory of 4016 4632 C023.tmp 102 PID 4632 wrote to memory of 4016 4632 C023.tmp 102 PID 4632 wrote to memory of 4016 4632 C023.tmp 102 PID 4016 wrote to memory of 3180 4016 C081.tmp 103 PID 4016 wrote to memory of 3180 4016 C081.tmp 103 PID 4016 wrote to memory of 3180 4016 C081.tmp 103 PID 3180 wrote to memory of 3236 3180 C0EE.tmp 104 PID 3180 wrote to memory of 3236 3180 C0EE.tmp 104 PID 3180 wrote to memory of 3236 3180 C0EE.tmp 104 PID 3236 wrote to memory of 4228 3236 C15C.tmp 105 PID 3236 wrote to memory of 4228 3236 C15C.tmp 105 PID 3236 wrote to memory of 4228 3236 C15C.tmp 105 PID 4228 wrote to memory of 3892 4228 C1AA.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-14_b4d5e13b7badb06ba6c8913f230fa378_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-14_b4d5e13b7badb06ba6c8913f230fa378_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\B9F9.tmp"C:\Users\Admin\AppData\Local\Temp\B9F9.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\BA57.tmp"C:\Users\Admin\AppData\Local\Temp\BA57.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\BB12.tmp"C:\Users\Admin\AppData\Local\Temp\BB12.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\BB70.tmp"C:\Users\Admin\AppData\Local\Temp\BB70.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\BCF7.tmp"C:\Users\Admin\AppData\Local\Temp\BCF7.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\BD55.tmp"C:\Users\Admin\AppData\Local\Temp\BD55.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Users\Admin\AppData\Local\Temp\BDF1.tmp"C:\Users\Admin\AppData\Local\Temp\BDF1.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\BEBC.tmp"C:\Users\Admin\AppData\Local\Temp\BEBC.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:512 -
C:\Users\Admin\AppData\Local\Temp\BF39.tmp"C:\Users\Admin\AppData\Local\Temp\BF39.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\C023.tmp"C:\Users\Admin\AppData\Local\Temp\C023.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\C081.tmp"C:\Users\Admin\AppData\Local\Temp\C081.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\C15C.tmp"C:\Users\Admin\AppData\Local\Temp\C15C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\C208.tmp"C:\Users\Admin\AppData\Local\Temp\C208.tmp"23⤵
- Executes dropped EXE
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\C246.tmp"C:\Users\Admin\AppData\Local\Temp\C246.tmp"24⤵
- Executes dropped EXE
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\C2A4.tmp"C:\Users\Admin\AppData\Local\Temp\C2A4.tmp"25⤵
- Executes dropped EXE
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"26⤵
- Executes dropped EXE
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\C35F.tmp"C:\Users\Admin\AppData\Local\Temp\C35F.tmp"27⤵
- Executes dropped EXE
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\C3AE.tmp"C:\Users\Admin\AppData\Local\Temp\C3AE.tmp"28⤵
- Executes dropped EXE
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"29⤵
- Executes dropped EXE
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\C44A.tmp"C:\Users\Admin\AppData\Local\Temp\C44A.tmp"30⤵
- Executes dropped EXE
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\C498.tmp"C:\Users\Admin\AppData\Local\Temp\C498.tmp"31⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\C505.tmp"C:\Users\Admin\AppData\Local\Temp\C505.tmp"32⤵
- Executes dropped EXE
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\C553.tmp"C:\Users\Admin\AppData\Local\Temp\C553.tmp"33⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"34⤵
- Executes dropped EXE
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\C61F.tmp"C:\Users\Admin\AppData\Local\Temp\C61F.tmp"35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\C66D.tmp"C:\Users\Admin\AppData\Local\Temp\C66D.tmp"36⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\C6CA.tmp"C:\Users\Admin\AppData\Local\Temp\C6CA.tmp"37⤵
- Executes dropped EXE
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\C719.tmp"C:\Users\Admin\AppData\Local\Temp\C719.tmp"38⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\C767.tmp"C:\Users\Admin\AppData\Local\Temp\C767.tmp"39⤵
- Executes dropped EXE
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"40⤵
- Executes dropped EXE
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\C851.tmp"C:\Users\Admin\AppData\Local\Temp\C851.tmp"41⤵
- Executes dropped EXE
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\C89F.tmp"C:\Users\Admin\AppData\Local\Temp\C89F.tmp"42⤵
- Executes dropped EXE
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\C8FD.tmp"C:\Users\Admin\AppData\Local\Temp\C8FD.tmp"43⤵
- Executes dropped EXE
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\C95B.tmp"C:\Users\Admin\AppData\Local\Temp\C95B.tmp"44⤵
- Executes dropped EXE
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\C9A9.tmp"C:\Users\Admin\AppData\Local\Temp\C9A9.tmp"45⤵
- Executes dropped EXE
PID:756 -
C:\Users\Admin\AppData\Local\Temp\C9F7.tmp"C:\Users\Admin\AppData\Local\Temp\C9F7.tmp"46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\CA45.tmp"C:\Users\Admin\AppData\Local\Temp\CA45.tmp"47⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\CA93.tmp"C:\Users\Admin\AppData\Local\Temp\CA93.tmp"48⤵
- Executes dropped EXE
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\CAF1.tmp"C:\Users\Admin\AppData\Local\Temp\CAF1.tmp"49⤵
- Executes dropped EXE
PID:844 -
C:\Users\Admin\AppData\Local\Temp\CB3F.tmp"C:\Users\Admin\AppData\Local\Temp\CB3F.tmp"50⤵
- Executes dropped EXE
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\CB8D.tmp"C:\Users\Admin\AppData\Local\Temp\CB8D.tmp"51⤵
- Executes dropped EXE
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\CBDB.tmp"C:\Users\Admin\AppData\Local\Temp\CBDB.tmp"52⤵
- Executes dropped EXE
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\CC39.tmp"C:\Users\Admin\AppData\Local\Temp\CC39.tmp"53⤵
- Executes dropped EXE
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\CC87.tmp"C:\Users\Admin\AppData\Local\Temp\CC87.tmp"54⤵
- Executes dropped EXE
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\CCF5.tmp"C:\Users\Admin\AppData\Local\Temp\CCF5.tmp"55⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\CD52.tmp"C:\Users\Admin\AppData\Local\Temp\CD52.tmp"56⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\CDB0.tmp"C:\Users\Admin\AppData\Local\Temp\CDB0.tmp"57⤵
- Executes dropped EXE
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\CE0E.tmp"C:\Users\Admin\AppData\Local\Temp\CE0E.tmp"58⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\CE5C.tmp"C:\Users\Admin\AppData\Local\Temp\CE5C.tmp"59⤵
- Executes dropped EXE
PID:8 -
C:\Users\Admin\AppData\Local\Temp\CEAA.tmp"C:\Users\Admin\AppData\Local\Temp\CEAA.tmp"60⤵
- Executes dropped EXE
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\CF08.tmp"C:\Users\Admin\AppData\Local\Temp\CF08.tmp"61⤵
- Executes dropped EXE
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\CF66.tmp"C:\Users\Admin\AppData\Local\Temp\CF66.tmp"62⤵
- Executes dropped EXE
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\CFB4.tmp"C:\Users\Admin\AppData\Local\Temp\CFB4.tmp"63⤵
- Executes dropped EXE
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\D002.tmp"C:\Users\Admin\AppData\Local\Temp\D002.tmp"64⤵
- Executes dropped EXE
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\D060.tmp"C:\Users\Admin\AppData\Local\Temp\D060.tmp"65⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"66⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\D10B.tmp"C:\Users\Admin\AppData\Local\Temp\D10B.tmp"67⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\D15A.tmp"C:\Users\Admin\AppData\Local\Temp\D15A.tmp"68⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\D1B7.tmp"C:\Users\Admin\AppData\Local\Temp\D1B7.tmp"69⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\D205.tmp"C:\Users\Admin\AppData\Local\Temp\D205.tmp"70⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\D263.tmp"C:\Users\Admin\AppData\Local\Temp\D263.tmp"71⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\D2C1.tmp"C:\Users\Admin\AppData\Local\Temp\D2C1.tmp"72⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\D31F.tmp"C:\Users\Admin\AppData\Local\Temp\D31F.tmp"73⤵PID:512
-
C:\Users\Admin\AppData\Local\Temp\D37C.tmp"C:\Users\Admin\AppData\Local\Temp\D37C.tmp"74⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\D3DA.tmp"C:\Users\Admin\AppData\Local\Temp\D3DA.tmp"75⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\D428.tmp"C:\Users\Admin\AppData\Local\Temp\D428.tmp"76⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\D476.tmp"C:\Users\Admin\AppData\Local\Temp\D476.tmp"77⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\D4C5.tmp"C:\Users\Admin\AppData\Local\Temp\D4C5.tmp"78⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\D513.tmp"C:\Users\Admin\AppData\Local\Temp\D513.tmp"79⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\D561.tmp"C:\Users\Admin\AppData\Local\Temp\D561.tmp"80⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"81⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\D60D.tmp"C:\Users\Admin\AppData\Local\Temp\D60D.tmp"82⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\D65B.tmp"C:\Users\Admin\AppData\Local\Temp\D65B.tmp"83⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\D6A9.tmp"C:\Users\Admin\AppData\Local\Temp\D6A9.tmp"84⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\D707.tmp"C:\Users\Admin\AppData\Local\Temp\D707.tmp"85⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\D764.tmp"C:\Users\Admin\AppData\Local\Temp\D764.tmp"86⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\D7C2.tmp"C:\Users\Admin\AppData\Local\Temp\D7C2.tmp"87⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\D810.tmp"C:\Users\Admin\AppData\Local\Temp\D810.tmp"88⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\D85E.tmp"C:\Users\Admin\AppData\Local\Temp\D85E.tmp"89⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\D8BC.tmp"C:\Users\Admin\AppData\Local\Temp\D8BC.tmp"90⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\D90A.tmp"C:\Users\Admin\AppData\Local\Temp\D90A.tmp"91⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\D958.tmp"C:\Users\Admin\AppData\Local\Temp\D958.tmp"92⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\D9A7.tmp"C:\Users\Admin\AppData\Local\Temp\D9A7.tmp"93⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\DA04.tmp"C:\Users\Admin\AppData\Local\Temp\DA04.tmp"94⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\DA52.tmp"C:\Users\Admin\AppData\Local\Temp\DA52.tmp"95⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\DAA1.tmp"C:\Users\Admin\AppData\Local\Temp\DAA1.tmp"96⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\DAEF.tmp"C:\Users\Admin\AppData\Local\Temp\DAEF.tmp"97⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\DB4C.tmp"C:\Users\Admin\AppData\Local\Temp\DB4C.tmp"98⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\DB9B.tmp"C:\Users\Admin\AppData\Local\Temp\DB9B.tmp"99⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\DBF8.tmp"C:\Users\Admin\AppData\Local\Temp\DBF8.tmp"100⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\DC56.tmp"C:\Users\Admin\AppData\Local\Temp\DC56.tmp"101⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\DCB4.tmp"C:\Users\Admin\AppData\Local\Temp\DCB4.tmp"102⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\DD02.tmp"C:\Users\Admin\AppData\Local\Temp\DD02.tmp"103⤵
- System Location Discovery: System Language Discovery
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\DD60.tmp"C:\Users\Admin\AppData\Local\Temp\DD60.tmp"104⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\DDAE.tmp"C:\Users\Admin\AppData\Local\Temp\DDAE.tmp"105⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\DDFC.tmp"C:\Users\Admin\AppData\Local\Temp\DDFC.tmp"106⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\DE4A.tmp"C:\Users\Admin\AppData\Local\Temp\DE4A.tmp"107⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"108⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\DEF6.tmp"C:\Users\Admin\AppData\Local\Temp\DEF6.tmp"109⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\DF44.tmp"C:\Users\Admin\AppData\Local\Temp\DF44.tmp"110⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\DFA2.tmp"C:\Users\Admin\AppData\Local\Temp\DFA2.tmp"111⤵
- System Location Discovery: System Language Discovery
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"112⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\E03E.tmp"C:\Users\Admin\AppData\Local\Temp\E03E.tmp"113⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\E09C.tmp"C:\Users\Admin\AppData\Local\Temp\E09C.tmp"114⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\E0FA.tmp"C:\Users\Admin\AppData\Local\Temp\E0FA.tmp"115⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\E148.tmp"C:\Users\Admin\AppData\Local\Temp\E148.tmp"116⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\E196.tmp"C:\Users\Admin\AppData\Local\Temp\E196.tmp"117⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\E1F4.tmp"C:\Users\Admin\AppData\Local\Temp\E1F4.tmp"118⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\E251.tmp"C:\Users\Admin\AppData\Local\Temp\E251.tmp"119⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\E2AF.tmp"C:\Users\Admin\AppData\Local\Temp\E2AF.tmp"120⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\E2FD.tmp"C:\Users\Admin\AppData\Local\Temp\E2FD.tmp"121⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\E35B.tmp"C:\Users\Admin\AppData\Local\Temp\E35B.tmp"122⤵PID:4156
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-