Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2024, 03:54
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-19_50e954b72185e9c64a8978e16dbc96a9_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-19_50e954b72185e9c64a8978e16dbc96a9_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-19_50e954b72185e9c64a8978e16dbc96a9_mafia.exe
-
Size
765KB
-
MD5
50e954b72185e9c64a8978e16dbc96a9
-
SHA1
f7243c8b0a7f60a024fe2a7d5a37bc11b7f68edc
-
SHA256
b0a8e45cc311ab21636ed08da89ecebabf52c5e261dc666a2cc41d720d42b3c9
-
SHA512
a63383e9c3b7e2680ab652b2d2bbeeca25825a6fe4bb2c77b936990e03bfdf90ae112a6f95d4451a033fc65f6cc390ec354580d8b398333c453d5300acfd8021
-
SSDEEP
12288:ZU5rCOTeiD7ywSqd9DSYiikEgH4a4g9YUtIO3ZF5rn5rLOa54U5w5A:ZUQOJDtnx5kEeyPUT3vh5Oa+UOS
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2652 BFF4.tmp 2008 C071.tmp 636 C0FE.tmp 4696 C1AA.tmp 3984 C217.tmp 2192 C275.tmp 4884 C2F2.tmp 1396 C35F.tmp 1876 C3CD.tmp 940 C42B.tmp 4036 C4B7.tmp 4556 C515.tmp 2268 C5B1.tmp 2392 C61F.tmp 1568 C66D.tmp 2592 C709.tmp 2284 C767.tmp 2820 C7E4.tmp 3448 C832.tmp 3088 C8BE.tmp 2704 C95B.tmp 4484 C9C8.tmp 1860 CA35.tmp 3948 CA84.tmp 3280 CB10.tmp 680 CB5E.tmp 4104 CBBC.tmp 740 CC58.tmp 3508 CCE5.tmp 4268 CD72.tmp 2116 CDDF.tmp 1364 CE4C.tmp 4980 CED9.tmp 4280 CF37.tmp 2236 CF94.tmp 3464 CFF2.tmp 2012 D040.tmp 2740 D09E.tmp 3396 D0EC.tmp 1576 D14A.tmp 1584 D1A8.tmp 1564 D1F6.tmp 4668 D254.tmp 3596 D2A2.tmp 3412 D2FF.tmp 4800 D34E.tmp 2180 D39C.tmp 4572 D3F9.tmp 3064 D457.tmp 3060 D4A5.tmp 4964 D503.tmp 3908 D551.tmp 4384 D5AF.tmp 4724 D5FD.tmp 4408 D64B.tmp 1708 D6A9.tmp 3428 D6F7.tmp 4860 D755.tmp 4664 D7B3.tmp 5028 D810.tmp 4564 D86E.tmp 4296 D8CC.tmp 3620 D91A.tmp 3676 D978.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2074.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B31E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C82D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1284.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5196.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E72F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E60A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A97A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1AA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BBE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1831.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DADF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 584C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E598.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7980.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4225.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4124 wrote to memory of 2652 4124 2024-09-19_50e954b72185e9c64a8978e16dbc96a9_mafia.exe 83 PID 4124 wrote to memory of 2652 4124 2024-09-19_50e954b72185e9c64a8978e16dbc96a9_mafia.exe 83 PID 4124 wrote to memory of 2652 4124 2024-09-19_50e954b72185e9c64a8978e16dbc96a9_mafia.exe 83 PID 2652 wrote to memory of 2008 2652 BFF4.tmp 84 PID 2652 wrote to memory of 2008 2652 BFF4.tmp 84 PID 2652 wrote to memory of 2008 2652 BFF4.tmp 84 PID 2008 wrote to memory of 636 2008 C071.tmp 85 PID 2008 wrote to memory of 636 2008 C071.tmp 85 PID 2008 wrote to memory of 636 2008 C071.tmp 85 PID 636 wrote to memory of 4696 636 C0FE.tmp 86 PID 636 wrote to memory of 4696 636 C0FE.tmp 86 PID 636 wrote to memory of 4696 636 C0FE.tmp 86 PID 4696 wrote to memory of 3984 4696 C1AA.tmp 87 PID 4696 wrote to memory of 3984 4696 C1AA.tmp 87 PID 4696 wrote to memory of 3984 4696 C1AA.tmp 87 PID 3984 wrote to memory of 2192 3984 C217.tmp 88 PID 3984 wrote to memory of 2192 3984 C217.tmp 88 PID 3984 wrote to memory of 2192 3984 C217.tmp 88 PID 2192 wrote to memory of 4884 2192 C275.tmp 89 PID 2192 wrote to memory of 4884 2192 C275.tmp 89 PID 2192 wrote to memory of 4884 2192 C275.tmp 89 PID 4884 wrote to memory of 1396 4884 C2F2.tmp 90 PID 4884 wrote to memory of 1396 4884 C2F2.tmp 90 PID 4884 wrote to memory of 1396 4884 C2F2.tmp 90 PID 1396 wrote to memory of 1876 1396 C35F.tmp 91 PID 1396 wrote to memory of 1876 1396 C35F.tmp 91 PID 1396 wrote to memory of 1876 1396 C35F.tmp 91 PID 1876 wrote to memory of 940 1876 C3CD.tmp 92 PID 1876 wrote to memory of 940 1876 C3CD.tmp 92 PID 1876 wrote to memory of 940 1876 C3CD.tmp 92 PID 940 wrote to memory of 4036 940 C42B.tmp 93 PID 940 wrote to memory of 4036 940 C42B.tmp 93 PID 940 wrote to memory of 4036 940 C42B.tmp 93 PID 4036 wrote to memory of 4556 4036 C4B7.tmp 94 PID 4036 wrote to memory of 4556 4036 C4B7.tmp 94 PID 4036 wrote to memory of 4556 4036 C4B7.tmp 94 PID 4556 wrote to memory of 2268 4556 C515.tmp 95 PID 4556 wrote to memory of 2268 4556 C515.tmp 95 PID 4556 wrote to memory of 2268 4556 C515.tmp 95 PID 2268 wrote to memory of 2392 2268 C5B1.tmp 96 PID 2268 wrote to memory of 2392 2268 C5B1.tmp 96 PID 2268 wrote to memory of 2392 2268 C5B1.tmp 96 PID 2392 wrote to memory of 1568 2392 C61F.tmp 97 PID 2392 wrote to memory of 1568 2392 C61F.tmp 97 PID 2392 wrote to memory of 1568 2392 C61F.tmp 97 PID 1568 wrote to memory of 2592 1568 C66D.tmp 100 PID 1568 wrote to memory of 2592 1568 C66D.tmp 100 PID 1568 wrote to memory of 2592 1568 C66D.tmp 100 PID 2592 wrote to memory of 2284 2592 C709.tmp 101 PID 2592 wrote to memory of 2284 2592 C709.tmp 101 PID 2592 wrote to memory of 2284 2592 C709.tmp 101 PID 2284 wrote to memory of 2820 2284 C767.tmp 102 PID 2284 wrote to memory of 2820 2284 C767.tmp 102 PID 2284 wrote to memory of 2820 2284 C767.tmp 102 PID 2820 wrote to memory of 3448 2820 C7E4.tmp 103 PID 2820 wrote to memory of 3448 2820 C7E4.tmp 103 PID 2820 wrote to memory of 3448 2820 C7E4.tmp 103 PID 3448 wrote to memory of 3088 3448 C832.tmp 104 PID 3448 wrote to memory of 3088 3448 C832.tmp 104 PID 3448 wrote to memory of 3088 3448 C832.tmp 104 PID 3088 wrote to memory of 2704 3088 C8BE.tmp 105 PID 3088 wrote to memory of 2704 3088 C8BE.tmp 105 PID 3088 wrote to memory of 2704 3088 C8BE.tmp 105 PID 2704 wrote to memory of 4484 2704 C95B.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_50e954b72185e9c64a8978e16dbc96a9_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_50e954b72185e9c64a8978e16dbc96a9_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\C071.tmp"C:\Users\Admin\AppData\Local\Temp\C071.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\C217.tmp"C:\Users\Admin\AppData\Local\Temp\C217.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\C275.tmp"C:\Users\Admin\AppData\Local\Temp\C275.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\C35F.tmp"C:\Users\Admin\AppData\Local\Temp\C35F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\C42B.tmp"C:\Users\Admin\AppData\Local\Temp\C42B.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\C4B7.tmp"C:\Users\Admin\AppData\Local\Temp\C4B7.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\C515.tmp"C:\Users\Admin\AppData\Local\Temp\C515.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\C5B1.tmp"C:\Users\Admin\AppData\Local\Temp\C5B1.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\C61F.tmp"C:\Users\Admin\AppData\Local\Temp\C61F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\C66D.tmp"C:\Users\Admin\AppData\Local\Temp\C66D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\C709.tmp"C:\Users\Admin\AppData\Local\Temp\C709.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\C767.tmp"C:\Users\Admin\AppData\Local\Temp\C767.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\C7E4.tmp"C:\Users\Admin\AppData\Local\Temp\C7E4.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\C832.tmp"C:\Users\Admin\AppData\Local\Temp\C832.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\C95B.tmp"C:\Users\Admin\AppData\Local\Temp\C95B.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\C9C8.tmp"C:\Users\Admin\AppData\Local\Temp\C9C8.tmp"23⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\CA35.tmp"C:\Users\Admin\AppData\Local\Temp\CA35.tmp"24⤵
- Executes dropped EXE
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\CA84.tmp"C:\Users\Admin\AppData\Local\Temp\CA84.tmp"25⤵
- Executes dropped EXE
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\CB10.tmp"C:\Users\Admin\AppData\Local\Temp\CB10.tmp"26⤵
- Executes dropped EXE
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\CB5E.tmp"C:\Users\Admin\AppData\Local\Temp\CB5E.tmp"27⤵
- Executes dropped EXE
PID:680 -
C:\Users\Admin\AppData\Local\Temp\CBBC.tmp"C:\Users\Admin\AppData\Local\Temp\CBBC.tmp"28⤵
- Executes dropped EXE
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\CC58.tmp"C:\Users\Admin\AppData\Local\Temp\CC58.tmp"29⤵
- Executes dropped EXE
PID:740 -
C:\Users\Admin\AppData\Local\Temp\CCE5.tmp"C:\Users\Admin\AppData\Local\Temp\CCE5.tmp"30⤵
- Executes dropped EXE
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\CD72.tmp"C:\Users\Admin\AppData\Local\Temp\CD72.tmp"31⤵
- Executes dropped EXE
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\CDDF.tmp"C:\Users\Admin\AppData\Local\Temp\CDDF.tmp"32⤵
- Executes dropped EXE
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\CE4C.tmp"C:\Users\Admin\AppData\Local\Temp\CE4C.tmp"33⤵
- Executes dropped EXE
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\CED9.tmp"C:\Users\Admin\AppData\Local\Temp\CED9.tmp"34⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\CF37.tmp"C:\Users\Admin\AppData\Local\Temp\CF37.tmp"35⤵
- Executes dropped EXE
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\CF94.tmp"C:\Users\Admin\AppData\Local\Temp\CF94.tmp"36⤵
- Executes dropped EXE
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\CFF2.tmp"C:\Users\Admin\AppData\Local\Temp\CFF2.tmp"37⤵
- Executes dropped EXE
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\D040.tmp"C:\Users\Admin\AppData\Local\Temp\D040.tmp"38⤵
- Executes dropped EXE
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\D09E.tmp"C:\Users\Admin\AppData\Local\Temp\D09E.tmp"39⤵
- Executes dropped EXE
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\D0EC.tmp"C:\Users\Admin\AppData\Local\Temp\D0EC.tmp"40⤵
- Executes dropped EXE
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\D14A.tmp"C:\Users\Admin\AppData\Local\Temp\D14A.tmp"41⤵
- Executes dropped EXE
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\D1A8.tmp"C:\Users\Admin\AppData\Local\Temp\D1A8.tmp"42⤵
- Executes dropped EXE
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\D1F6.tmp"C:\Users\Admin\AppData\Local\Temp\D1F6.tmp"43⤵
- Executes dropped EXE
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\D254.tmp"C:\Users\Admin\AppData\Local\Temp\D254.tmp"44⤵
- Executes dropped EXE
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\D2A2.tmp"C:\Users\Admin\AppData\Local\Temp\D2A2.tmp"45⤵
- Executes dropped EXE
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\D2FF.tmp"C:\Users\Admin\AppData\Local\Temp\D2FF.tmp"46⤵
- Executes dropped EXE
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\D34E.tmp"C:\Users\Admin\AppData\Local\Temp\D34E.tmp"47⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\D39C.tmp"C:\Users\Admin\AppData\Local\Temp\D39C.tmp"48⤵
- Executes dropped EXE
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\D3F9.tmp"C:\Users\Admin\AppData\Local\Temp\D3F9.tmp"49⤵
- Executes dropped EXE
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\D457.tmp"C:\Users\Admin\AppData\Local\Temp\D457.tmp"50⤵
- Executes dropped EXE
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\D4A5.tmp"C:\Users\Admin\AppData\Local\Temp\D4A5.tmp"51⤵
- Executes dropped EXE
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\D503.tmp"C:\Users\Admin\AppData\Local\Temp\D503.tmp"52⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\D551.tmp"C:\Users\Admin\AppData\Local\Temp\D551.tmp"53⤵
- Executes dropped EXE
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"54⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\D5FD.tmp"C:\Users\Admin\AppData\Local\Temp\D5FD.tmp"55⤵
- Executes dropped EXE
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\D64B.tmp"C:\Users\Admin\AppData\Local\Temp\D64B.tmp"56⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\D6A9.tmp"C:\Users\Admin\AppData\Local\Temp\D6A9.tmp"57⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\D6F7.tmp"C:\Users\Admin\AppData\Local\Temp\D6F7.tmp"58⤵
- Executes dropped EXE
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\D755.tmp"C:\Users\Admin\AppData\Local\Temp\D755.tmp"59⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\D7B3.tmp"C:\Users\Admin\AppData\Local\Temp\D7B3.tmp"60⤵
- Executes dropped EXE
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\D810.tmp"C:\Users\Admin\AppData\Local\Temp\D810.tmp"61⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\D86E.tmp"C:\Users\Admin\AppData\Local\Temp\D86E.tmp"62⤵
- Executes dropped EXE
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\D8CC.tmp"C:\Users\Admin\AppData\Local\Temp\D8CC.tmp"63⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\D91A.tmp"C:\Users\Admin\AppData\Local\Temp\D91A.tmp"64⤵
- Executes dropped EXE
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\D978.tmp"C:\Users\Admin\AppData\Local\Temp\D978.tmp"65⤵
- Executes dropped EXE
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\D9D5.tmp"C:\Users\Admin\AppData\Local\Temp\D9D5.tmp"66⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\DA33.tmp"C:\Users\Admin\AppData\Local\Temp\DA33.tmp"67⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\DA81.tmp"C:\Users\Admin\AppData\Local\Temp\DA81.tmp"68⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\DADF.tmp"C:\Users\Admin\AppData\Local\Temp\DADF.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\DB3D.tmp"C:\Users\Admin\AppData\Local\Temp\DB3D.tmp"70⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\DB9B.tmp"C:\Users\Admin\AppData\Local\Temp\DB9B.tmp"71⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\DBF8.tmp"C:\Users\Admin\AppData\Local\Temp\DBF8.tmp"72⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\DC56.tmp"C:\Users\Admin\AppData\Local\Temp\DC56.tmp"73⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\DCB4.tmp"C:\Users\Admin\AppData\Local\Temp\DCB4.tmp"74⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\DD12.tmp"C:\Users\Admin\AppData\Local\Temp\DD12.tmp"75⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\DD60.tmp"C:\Users\Admin\AppData\Local\Temp\DD60.tmp"76⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\DDBD.tmp"C:\Users\Admin\AppData\Local\Temp\DDBD.tmp"77⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\DE1B.tmp"C:\Users\Admin\AppData\Local\Temp\DE1B.tmp"78⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\DE79.tmp"C:\Users\Admin\AppData\Local\Temp\DE79.tmp"79⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\DED7.tmp"C:\Users\Admin\AppData\Local\Temp\DED7.tmp"80⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\DF34.tmp"C:\Users\Admin\AppData\Local\Temp\DF34.tmp"81⤵
- System Location Discovery: System Language Discovery
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\DF92.tmp"C:\Users\Admin\AppData\Local\Temp\DF92.tmp"82⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"83⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\E04E.tmp"C:\Users\Admin\AppData\Local\Temp\E04E.tmp"84⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\E0AB.tmp"C:\Users\Admin\AppData\Local\Temp\E0AB.tmp"85⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\E109.tmp"C:\Users\Admin\AppData\Local\Temp\E109.tmp"86⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\E167.tmp"C:\Users\Admin\AppData\Local\Temp\E167.tmp"87⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\E1C5.tmp"C:\Users\Admin\AppData\Local\Temp\E1C5.tmp"88⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\E213.tmp"C:\Users\Admin\AppData\Local\Temp\E213.tmp"89⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\E271.tmp"C:\Users\Admin\AppData\Local\Temp\E271.tmp"90⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\E2CE.tmp"C:\Users\Admin\AppData\Local\Temp\E2CE.tmp"91⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\E31C.tmp"C:\Users\Admin\AppData\Local\Temp\E31C.tmp"92⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\E36B.tmp"C:\Users\Admin\AppData\Local\Temp\E36B.tmp"93⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\E3C8.tmp"C:\Users\Admin\AppData\Local\Temp\E3C8.tmp"94⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\E426.tmp"C:\Users\Admin\AppData\Local\Temp\E426.tmp"95⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\E493.tmp"C:\Users\Admin\AppData\Local\Temp\E493.tmp"96⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\E4F1.tmp"C:\Users\Admin\AppData\Local\Temp\E4F1.tmp"97⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\E54F.tmp"C:\Users\Admin\AppData\Local\Temp\E54F.tmp"98⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\E5AD.tmp"C:\Users\Admin\AppData\Local\Temp\E5AD.tmp"99⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\E60A.tmp"C:\Users\Admin\AppData\Local\Temp\E60A.tmp"100⤵
- System Location Discovery: System Language Discovery
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\E659.tmp"C:\Users\Admin\AppData\Local\Temp\E659.tmp"101⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\E6B6.tmp"C:\Users\Admin\AppData\Local\Temp\E6B6.tmp"102⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\E704.tmp"C:\Users\Admin\AppData\Local\Temp\E704.tmp"103⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\E753.tmp"C:\Users\Admin\AppData\Local\Temp\E753.tmp"104⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"105⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\E7FE.tmp"C:\Users\Admin\AppData\Local\Temp\E7FE.tmp"106⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\E84D.tmp"C:\Users\Admin\AppData\Local\Temp\E84D.tmp"107⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\E89B.tmp"C:\Users\Admin\AppData\Local\Temp\E89B.tmp"108⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\E8E9.tmp"C:\Users\Admin\AppData\Local\Temp\E8E9.tmp"109⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\E937.tmp"C:\Users\Admin\AppData\Local\Temp\E937.tmp"110⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\E995.tmp"C:\Users\Admin\AppData\Local\Temp\E995.tmp"111⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\E9E3.tmp"C:\Users\Admin\AppData\Local\Temp\E9E3.tmp"112⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\EA41.tmp"C:\Users\Admin\AppData\Local\Temp\EA41.tmp"113⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\EA9E.tmp"C:\Users\Admin\AppData\Local\Temp\EA9E.tmp"114⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\EAEC.tmp"C:\Users\Admin\AppData\Local\Temp\EAEC.tmp"115⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\EB4A.tmp"C:\Users\Admin\AppData\Local\Temp\EB4A.tmp"116⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\EBA8.tmp"C:\Users\Admin\AppData\Local\Temp\EBA8.tmp"117⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\EBF6.tmp"C:\Users\Admin\AppData\Local\Temp\EBF6.tmp"118⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\EC54.tmp"C:\Users\Admin\AppData\Local\Temp\EC54.tmp"119⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\ECA2.tmp"C:\Users\Admin\AppData\Local\Temp\ECA2.tmp"120⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\ED00.tmp"C:\Users\Admin\AppData\Local\Temp\ED00.tmp"121⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\ED4E.tmp"C:\Users\Admin\AppData\Local\Temp\ED4E.tmp"122⤵PID:4860
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-