Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
09/09/2024, 03:54
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-09_50de947d20035e0d489eb0ef6f8b844e_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-09-09_50de947d20035e0d489eb0ef6f8b844e_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-09_50de947d20035e0d489eb0ef6f8b844e_mafia.exe
-
Size
712KB
-
MD5
50de947d20035e0d489eb0ef6f8b844e
-
SHA1
2ef1cc2dfeeff816d519dc5cc5aab8f820a209d2
-
SHA256
017eed220c7b168a0b8321c47d706683e43ad2389b8396ecaf82163c21b04e45
-
SHA512
0bfdc816ffea063d17b2fb8f541e3cceed358f7f13cc0a6f7bd41dfbe7b05ffe0ad73eae895b6d02feeef1200897cb2b1581b1d3e3b94a6545f3317bd61f47f9
-
SSDEEP
12288:FU5rCOTeiDp8IjWv8hX6YKVN4qNbWYjNZdCvq5TJLCvY90D8/LVBlVk736Y79GWm:FUQOJDLjWvNYKrRWYjNnCvq5TJLCvY93
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 644 EF6B.tmp 1564 F008.tmp 5000 F0C3.tmp 4564 F17F.tmp 1696 F20B.tmp 520 F2A7.tmp 4464 F334.tmp 3240 F3F0.tmp 3996 F49B.tmp 4068 F538.tmp 3308 F5B5.tmp 1180 F651.tmp 4916 F6ED.tmp 4276 F76A.tmp 2716 F816.tmp 5116 F893.tmp 3236 F94F.tmp 1692 FA0A.tmp 4220 FA97.tmp 2856 FB43.tmp 2728 FBDF.tmp 3840 FC6B.tmp 3056 FCE8.tmp 1968 FD85.tmp 888 FE11.tmp 3340 FEBD.tmp 2040 FF79.tmp 1124 25.tmp 4000 C1.tmp 3032 12E.tmp 4600 1DA.tmp 3504 267.tmp 1088 2F3.tmp 2992 341.tmp 3372 39F.tmp 3480 40D.tmp 1588 47A.tmp 4928 4E7.tmp 4764 545.tmp 336 5B2.tmp 4920 610.tmp 1180 67E.tmp 4916 6EB.tmp 4376 749.tmp 5012 7B6.tmp 3924 823.tmp 1716 881.tmp 1540 8DF.tmp 2240 94C.tmp 3392 9AA.tmp 4200 A17.tmp 2092 A75.tmp 2856 AE3.tmp 2728 B50.tmp 4908 BAE.tmp 2572 C0B.tmp 1816 C79.tmp 1580 CD7.tmp 2268 D44.tmp 3040 DA2.tmp 2392 DFF.tmp 4460 E4E.tmp 4448 EAB.tmp 2532 F19.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDC5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C91.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FD0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F008.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 521.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAC3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 691B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2698.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3960.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A31B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C44F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4065.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6344.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D29.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA0A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3464.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2356 wrote to memory of 644 2356 2024-09-09_50de947d20035e0d489eb0ef6f8b844e_mafia.exe 91 PID 2356 wrote to memory of 644 2356 2024-09-09_50de947d20035e0d489eb0ef6f8b844e_mafia.exe 91 PID 2356 wrote to memory of 644 2356 2024-09-09_50de947d20035e0d489eb0ef6f8b844e_mafia.exe 91 PID 644 wrote to memory of 1564 644 EF6B.tmp 93 PID 644 wrote to memory of 1564 644 EF6B.tmp 93 PID 644 wrote to memory of 1564 644 EF6B.tmp 93 PID 1564 wrote to memory of 5000 1564 F008.tmp 94 PID 1564 wrote to memory of 5000 1564 F008.tmp 94 PID 1564 wrote to memory of 5000 1564 F008.tmp 94 PID 5000 wrote to memory of 4564 5000 F0C3.tmp 96 PID 5000 wrote to memory of 4564 5000 F0C3.tmp 96 PID 5000 wrote to memory of 4564 5000 F0C3.tmp 96 PID 4564 wrote to memory of 1696 4564 F17F.tmp 97 PID 4564 wrote to memory of 1696 4564 F17F.tmp 97 PID 4564 wrote to memory of 1696 4564 F17F.tmp 97 PID 1696 wrote to memory of 520 1696 F20B.tmp 98 PID 1696 wrote to memory of 520 1696 F20B.tmp 98 PID 1696 wrote to memory of 520 1696 F20B.tmp 98 PID 520 wrote to memory of 4464 520 F2A7.tmp 99 PID 520 wrote to memory of 4464 520 F2A7.tmp 99 PID 520 wrote to memory of 4464 520 F2A7.tmp 99 PID 4464 wrote to memory of 3240 4464 F334.tmp 100 PID 4464 wrote to memory of 3240 4464 F334.tmp 100 PID 4464 wrote to memory of 3240 4464 F334.tmp 100 PID 3240 wrote to memory of 3996 3240 F3F0.tmp 101 PID 3240 wrote to memory of 3996 3240 F3F0.tmp 101 PID 3240 wrote to memory of 3996 3240 F3F0.tmp 101 PID 3996 wrote to memory of 4068 3996 F49B.tmp 102 PID 3996 wrote to memory of 4068 3996 F49B.tmp 102 PID 3996 wrote to memory of 4068 3996 F49B.tmp 102 PID 4068 wrote to memory of 3308 4068 F538.tmp 103 PID 4068 wrote to memory of 3308 4068 F538.tmp 103 PID 4068 wrote to memory of 3308 4068 F538.tmp 103 PID 3308 wrote to memory of 1180 3308 F5B5.tmp 104 PID 3308 wrote to memory of 1180 3308 F5B5.tmp 104 PID 3308 wrote to memory of 1180 3308 F5B5.tmp 104 PID 1180 wrote to memory of 4916 1180 F651.tmp 105 PID 1180 wrote to memory of 4916 1180 F651.tmp 105 PID 1180 wrote to memory of 4916 1180 F651.tmp 105 PID 4916 wrote to memory of 4276 4916 F6ED.tmp 106 PID 4916 wrote to memory of 4276 4916 F6ED.tmp 106 PID 4916 wrote to memory of 4276 4916 F6ED.tmp 106 PID 4276 wrote to memory of 2716 4276 F76A.tmp 107 PID 4276 wrote to memory of 2716 4276 F76A.tmp 107 PID 4276 wrote to memory of 2716 4276 F76A.tmp 107 PID 2716 wrote to memory of 5116 2716 F816.tmp 108 PID 2716 wrote to memory of 5116 2716 F816.tmp 108 PID 2716 wrote to memory of 5116 2716 F816.tmp 108 PID 5116 wrote to memory of 3236 5116 F893.tmp 109 PID 5116 wrote to memory of 3236 5116 F893.tmp 109 PID 5116 wrote to memory of 3236 5116 F893.tmp 109 PID 3236 wrote to memory of 1692 3236 F94F.tmp 110 PID 3236 wrote to memory of 1692 3236 F94F.tmp 110 PID 3236 wrote to memory of 1692 3236 F94F.tmp 110 PID 1692 wrote to memory of 4220 1692 FA0A.tmp 111 PID 1692 wrote to memory of 4220 1692 FA0A.tmp 111 PID 1692 wrote to memory of 4220 1692 FA0A.tmp 111 PID 4220 wrote to memory of 2856 4220 FA97.tmp 112 PID 4220 wrote to memory of 2856 4220 FA97.tmp 112 PID 4220 wrote to memory of 2856 4220 FA97.tmp 112 PID 2856 wrote to memory of 2728 2856 FB43.tmp 113 PID 2856 wrote to memory of 2728 2856 FB43.tmp 113 PID 2856 wrote to memory of 2728 2856 FB43.tmp 113 PID 2728 wrote to memory of 3840 2728 FBDF.tmp 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-09_50de947d20035e0d489eb0ef6f8b844e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-09_50de947d20035e0d489eb0ef6f8b844e_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\EF6B.tmp"C:\Users\Admin\AppData\Local\Temp\EF6B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Users\Admin\AppData\Local\Temp\F008.tmp"C:\Users\Admin\AppData\Local\Temp\F008.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\F0C3.tmp"C:\Users\Admin\AppData\Local\Temp\F0C3.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\F17F.tmp"C:\Users\Admin\AppData\Local\Temp\F17F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\F20B.tmp"C:\Users\Admin\AppData\Local\Temp\F20B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\F2A7.tmp"C:\Users\Admin\AppData\Local\Temp\F2A7.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:520 -
C:\Users\Admin\AppData\Local\Temp\F334.tmp"C:\Users\Admin\AppData\Local\Temp\F334.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\F3F0.tmp"C:\Users\Admin\AppData\Local\Temp\F3F0.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\F49B.tmp"C:\Users\Admin\AppData\Local\Temp\F49B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\F538.tmp"C:\Users\Admin\AppData\Local\Temp\F538.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\F5B5.tmp"C:\Users\Admin\AppData\Local\Temp\F5B5.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\F651.tmp"C:\Users\Admin\AppData\Local\Temp\F651.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\F6ED.tmp"C:\Users\Admin\AppData\Local\Temp\F6ED.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\F76A.tmp"C:\Users\Admin\AppData\Local\Temp\F76A.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\F816.tmp"C:\Users\Admin\AppData\Local\Temp\F816.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\F893.tmp"C:\Users\Admin\AppData\Local\Temp\F893.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\F94F.tmp"C:\Users\Admin\AppData\Local\Temp\F94F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\FA0A.tmp"C:\Users\Admin\AppData\Local\Temp\FA0A.tmp"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\FA97.tmp"C:\Users\Admin\AppData\Local\Temp\FA97.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\FB43.tmp"C:\Users\Admin\AppData\Local\Temp\FB43.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\FBDF.tmp"C:\Users\Admin\AppData\Local\Temp\FBDF.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\FC6B.tmp"C:\Users\Admin\AppData\Local\Temp\FC6B.tmp"23⤵
- Executes dropped EXE
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\FCE8.tmp"C:\Users\Admin\AppData\Local\Temp\FCE8.tmp"24⤵
- Executes dropped EXE
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\FD85.tmp"C:\Users\Admin\AppData\Local\Temp\FD85.tmp"25⤵
- Executes dropped EXE
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\FE11.tmp"C:\Users\Admin\AppData\Local\Temp\FE11.tmp"26⤵
- Executes dropped EXE
PID:888 -
C:\Users\Admin\AppData\Local\Temp\FEBD.tmp"C:\Users\Admin\AppData\Local\Temp\FEBD.tmp"27⤵
- Executes dropped EXE
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\FF79.tmp"C:\Users\Admin\AppData\Local\Temp\FF79.tmp"28⤵
- Executes dropped EXE
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\25.tmp"C:\Users\Admin\AppData\Local\Temp\25.tmp"29⤵
- Executes dropped EXE
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\C1.tmp"C:\Users\Admin\AppData\Local\Temp\C1.tmp"30⤵
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\12E.tmp"C:\Users\Admin\AppData\Local\Temp\12E.tmp"31⤵
- Executes dropped EXE
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\1DA.tmp"C:\Users\Admin\AppData\Local\Temp\1DA.tmp"32⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\267.tmp"C:\Users\Admin\AppData\Local\Temp\267.tmp"33⤵
- Executes dropped EXE
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\2F3.tmp"C:\Users\Admin\AppData\Local\Temp\2F3.tmp"34⤵
- Executes dropped EXE
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\341.tmp"C:\Users\Admin\AppData\Local\Temp\341.tmp"35⤵
- Executes dropped EXE
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\39F.tmp"C:\Users\Admin\AppData\Local\Temp\39F.tmp"36⤵
- Executes dropped EXE
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\40D.tmp"C:\Users\Admin\AppData\Local\Temp\40D.tmp"37⤵
- Executes dropped EXE
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\47A.tmp"C:\Users\Admin\AppData\Local\Temp\47A.tmp"38⤵
- Executes dropped EXE
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\4E7.tmp"C:\Users\Admin\AppData\Local\Temp\4E7.tmp"39⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\545.tmp"C:\Users\Admin\AppData\Local\Temp\545.tmp"40⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\5B2.tmp"C:\Users\Admin\AppData\Local\Temp\5B2.tmp"41⤵
- Executes dropped EXE
PID:336 -
C:\Users\Admin\AppData\Local\Temp\610.tmp"C:\Users\Admin\AppData\Local\Temp\610.tmp"42⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\67E.tmp"C:\Users\Admin\AppData\Local\Temp\67E.tmp"43⤵
- Executes dropped EXE
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\6EB.tmp"C:\Users\Admin\AppData\Local\Temp\6EB.tmp"44⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\749.tmp"C:\Users\Admin\AppData\Local\Temp\749.tmp"45⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\7B6.tmp"C:\Users\Admin\AppData\Local\Temp\7B6.tmp"46⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\823.tmp"C:\Users\Admin\AppData\Local\Temp\823.tmp"47⤵
- Executes dropped EXE
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\881.tmp"C:\Users\Admin\AppData\Local\Temp\881.tmp"48⤵
- Executes dropped EXE
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\8DF.tmp"C:\Users\Admin\AppData\Local\Temp\8DF.tmp"49⤵
- Executes dropped EXE
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\94C.tmp"C:\Users\Admin\AppData\Local\Temp\94C.tmp"50⤵
- Executes dropped EXE
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\9AA.tmp"C:\Users\Admin\AppData\Local\Temp\9AA.tmp"51⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\A17.tmp"C:\Users\Admin\AppData\Local\Temp\A17.tmp"52⤵
- Executes dropped EXE
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\A75.tmp"C:\Users\Admin\AppData\Local\Temp\A75.tmp"53⤵
- Executes dropped EXE
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\AE3.tmp"C:\Users\Admin\AppData\Local\Temp\AE3.tmp"54⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\B50.tmp"C:\Users\Admin\AppData\Local\Temp\B50.tmp"55⤵
- Executes dropped EXE
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\BAE.tmp"C:\Users\Admin\AppData\Local\Temp\BAE.tmp"56⤵
- Executes dropped EXE
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\C0B.tmp"C:\Users\Admin\AppData\Local\Temp\C0B.tmp"57⤵
- Executes dropped EXE
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\C79.tmp"C:\Users\Admin\AppData\Local\Temp\C79.tmp"58⤵
- Executes dropped EXE
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\CD7.tmp"C:\Users\Admin\AppData\Local\Temp\CD7.tmp"59⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\D44.tmp"C:\Users\Admin\AppData\Local\Temp\D44.tmp"60⤵
- Executes dropped EXE
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\DA2.tmp"C:\Users\Admin\AppData\Local\Temp\DA2.tmp"61⤵
- Executes dropped EXE
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\DFF.tmp"C:\Users\Admin\AppData\Local\Temp\DFF.tmp"62⤵
- Executes dropped EXE
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\E4E.tmp"C:\Users\Admin\AppData\Local\Temp\E4E.tmp"63⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\EAB.tmp"C:\Users\Admin\AppData\Local\Temp\EAB.tmp"64⤵
- Executes dropped EXE
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\F19.tmp"C:\Users\Admin\AppData\Local\Temp\F19.tmp"65⤵
- Executes dropped EXE
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\F86.tmp"C:\Users\Admin\AppData\Local\Temp\F86.tmp"66⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\FF3.tmp"C:\Users\Admin\AppData\Local\Temp\FF3.tmp"67⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\1051.tmp"C:\Users\Admin\AppData\Local\Temp\1051.tmp"68⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\10AF.tmp"C:\Users\Admin\AppData\Local\Temp\10AF.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\110D.tmp"C:\Users\Admin\AppData\Local\Temp\110D.tmp"70⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\117A.tmp"C:\Users\Admin\AppData\Local\Temp\117A.tmp"71⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\11E7.tmp"C:\Users\Admin\AppData\Local\Temp\11E7.tmp"72⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\1245.tmp"C:\Users\Admin\AppData\Local\Temp\1245.tmp"73⤵PID:520
-
C:\Users\Admin\AppData\Local\Temp\12B3.tmp"C:\Users\Admin\AppData\Local\Temp\12B3.tmp"74⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\1301.tmp"C:\Users\Admin\AppData\Local\Temp\1301.tmp"75⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\136E.tmp"C:\Users\Admin\AppData\Local\Temp\136E.tmp"76⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\13DB.tmp"C:\Users\Admin\AppData\Local\Temp\13DB.tmp"77⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\1449.tmp"C:\Users\Admin\AppData\Local\Temp\1449.tmp"78⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\1497.tmp"C:\Users\Admin\AppData\Local\Temp\1497.tmp"79⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\14F5.tmp"C:\Users\Admin\AppData\Local\Temp\14F5.tmp"80⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\1562.tmp"C:\Users\Admin\AppData\Local\Temp\1562.tmp"81⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\15C0.tmp"C:\Users\Admin\AppData\Local\Temp\15C0.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:704 -
C:\Users\Admin\AppData\Local\Temp\162D.tmp"C:\Users\Admin\AppData\Local\Temp\162D.tmp"83⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\169B.tmp"C:\Users\Admin\AppData\Local\Temp\169B.tmp"84⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\1718.tmp"C:\Users\Admin\AppData\Local\Temp\1718.tmp"85⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\1775.tmp"C:\Users\Admin\AppData\Local\Temp\1775.tmp"86⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\17D3.tmp"C:\Users\Admin\AppData\Local\Temp\17D3.tmp"87⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\1840.tmp"C:\Users\Admin\AppData\Local\Temp\1840.tmp"88⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\18AE.tmp"C:\Users\Admin\AppData\Local\Temp\18AE.tmp"89⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\190C.tmp"C:\Users\Admin\AppData\Local\Temp\190C.tmp"90⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\1969.tmp"C:\Users\Admin\AppData\Local\Temp\1969.tmp"91⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\19B7.tmp"C:\Users\Admin\AppData\Local\Temp\19B7.tmp"92⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\1A06.tmp"C:\Users\Admin\AppData\Local\Temp\1A06.tmp"93⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\1A63.tmp"C:\Users\Admin\AppData\Local\Temp\1A63.tmp"94⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"95⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"96⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\1B8C.tmp"C:\Users\Admin\AppData\Local\Temp\1B8C.tmp"97⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\1BFA.tmp"C:\Users\Admin\AppData\Local\Temp\1BFA.tmp"98⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\1C48.tmp"C:\Users\Admin\AppData\Local\Temp\1C48.tmp"99⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\1CB5.tmp"C:\Users\Admin\AppData\Local\Temp\1CB5.tmp"100⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\1D13.tmp"C:\Users\Admin\AppData\Local\Temp\1D13.tmp"101⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\1D71.tmp"C:\Users\Admin\AppData\Local\Temp\1D71.tmp"102⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\1DCE.tmp"C:\Users\Admin\AppData\Local\Temp\1DCE.tmp"103⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\1E3C.tmp"C:\Users\Admin\AppData\Local\Temp\1E3C.tmp"104⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\1EA9.tmp"C:\Users\Admin\AppData\Local\Temp\1EA9.tmp"105⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\1EF7.tmp"C:\Users\Admin\AppData\Local\Temp\1EF7.tmp"106⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\1F55.tmp"C:\Users\Admin\AppData\Local\Temp\1F55.tmp"107⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\1FB3.tmp"C:\Users\Admin\AppData\Local\Temp\1FB3.tmp"108⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\2010.tmp"C:\Users\Admin\AppData\Local\Temp\2010.tmp"109⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\207E.tmp"C:\Users\Admin\AppData\Local\Temp\207E.tmp"110⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\20EB.tmp"C:\Users\Admin\AppData\Local\Temp\20EB.tmp"111⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\2159.tmp"C:\Users\Admin\AppData\Local\Temp\2159.tmp"112⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\21B6.tmp"C:\Users\Admin\AppData\Local\Temp\21B6.tmp"113⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\2214.tmp"C:\Users\Admin\AppData\Local\Temp\2214.tmp"114⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\2281.tmp"C:\Users\Admin\AppData\Local\Temp\2281.tmp"115⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\22EF.tmp"C:\Users\Admin\AppData\Local\Temp\22EF.tmp"116⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\233D.tmp"C:\Users\Admin\AppData\Local\Temp\233D.tmp"117⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\238B.tmp"C:\Users\Admin\AppData\Local\Temp\238B.tmp"118⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\23F8.tmp"C:\Users\Admin\AppData\Local\Temp\23F8.tmp"119⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\2447.tmp"C:\Users\Admin\AppData\Local\Temp\2447.tmp"120⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\2495.tmp"C:\Users\Admin\AppData\Local\Temp\2495.tmp"121⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\24E3.tmp"C:\Users\Admin\AppData\Local\Temp\24E3.tmp"122⤵PID:4628
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-