Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
25/07/2024, 20:23
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-25_e9b99d24f69f0f4bce73518b9af5671f_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-07-25_e9b99d24f69f0f4bce73518b9af5671f_mafia.exe
Resource
win10v2004-20240709-en
General
-
Target
2024-07-25_e9b99d24f69f0f4bce73518b9af5671f_mafia.exe
-
Size
486KB
-
MD5
e9b99d24f69f0f4bce73518b9af5671f
-
SHA1
393546441aa7f08d4c6accb39e6265d6f66eeef5
-
SHA256
4c2b76c0653de06c1f8c3532434634bea220e54ced1e3725826fb8d0cadf5955
-
SHA512
ec6ef81c8b269a4e37a37703b674ae7bb49d025dd83bfb3e0fcc7fa545d049dd5b7e4d01f19d835dfc167793b8ee98ba3fdca21e2a2a4a9d958e26c9fba3eec5
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7eS3ExpfuJXHoewCaDusLIe8A6/xW1yI4sH3j:/U5rCOTeiDV3QfuONZ8/MoYNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 336 C0CF.tmp 404 C13D.tmp 3632 C19A.tmp 4212 C1E8.tmp 220 C246.tmp 1084 C2A4.tmp 4716 C302.tmp 3760 C35F.tmp 2628 C3AE.tmp 2736 C3FC.tmp 2228 C44A.tmp 3052 C4A8.tmp 4364 C4F6.tmp 1524 C544.tmp 956 C592.tmp 2200 C5F0.tmp 576 C63E.tmp 3308 C69C.tmp 2076 C6EA.tmp 3444 C757.tmp 4992 C7D4.tmp 1872 C851.tmp 3480 C89F.tmp 3148 C8FD.tmp 2212 C95B.tmp 4712 C9B8.tmp 1388 CA07.tmp 4756 CA55.tmp 3580 CAA3.tmp 4524 CAF1.tmp 1680 CB9D.tmp 1440 CBFB.tmp 3408 CC49.tmp 2712 CC97.tmp 3428 CF56.tmp 4516 CFA4.tmp 3168 CFF2.tmp 4612 D040.tmp 2964 D08E.tmp 4980 D0DD.tmp 4536 D12B.tmp 2684 D179.tmp 1768 D1C7.tmp 2316 D215.tmp 4920 D263.tmp 5028 D2B1.tmp 1148 D2FF.tmp 1496 D34E.tmp 4876 D39C.tmp 2628 D3EA.tmp 3424 D438.tmp 824 D486.tmp 1616 D4D4.tmp 2124 D522.tmp 788 D570.tmp 2984 D5AF.tmp 1856 D5FD.tmp 4136 D64B.tmp 3560 D699.tmp 884 D6E7.tmp 1092 D745.tmp 3444 D7D2.tmp 5020 D89D.tmp 4728 D92A.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9788.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4188.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B570.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A44A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F107.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DA5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 411B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6FFB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E2BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E927.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CDC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2630.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4503.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C474.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C99.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69B2.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2468 wrote to memory of 336 2468 2024-07-25_e9b99d24f69f0f4bce73518b9af5671f_mafia.exe 84 PID 2468 wrote to memory of 336 2468 2024-07-25_e9b99d24f69f0f4bce73518b9af5671f_mafia.exe 84 PID 2468 wrote to memory of 336 2468 2024-07-25_e9b99d24f69f0f4bce73518b9af5671f_mafia.exe 84 PID 336 wrote to memory of 404 336 C0CF.tmp 85 PID 336 wrote to memory of 404 336 C0CF.tmp 85 PID 336 wrote to memory of 404 336 C0CF.tmp 85 PID 404 wrote to memory of 3632 404 C13D.tmp 87 PID 404 wrote to memory of 3632 404 C13D.tmp 87 PID 404 wrote to memory of 3632 404 C13D.tmp 87 PID 3632 wrote to memory of 4212 3632 C19A.tmp 89 PID 3632 wrote to memory of 4212 3632 C19A.tmp 89 PID 3632 wrote to memory of 4212 3632 C19A.tmp 89 PID 4212 wrote to memory of 220 4212 C1E8.tmp 90 PID 4212 wrote to memory of 220 4212 C1E8.tmp 90 PID 4212 wrote to memory of 220 4212 C1E8.tmp 90 PID 220 wrote to memory of 1084 220 C246.tmp 92 PID 220 wrote to memory of 1084 220 C246.tmp 92 PID 220 wrote to memory of 1084 220 C246.tmp 92 PID 1084 wrote to memory of 4716 1084 C2A4.tmp 93 PID 1084 wrote to memory of 4716 1084 C2A4.tmp 93 PID 1084 wrote to memory of 4716 1084 C2A4.tmp 93 PID 4716 wrote to memory of 3760 4716 C302.tmp 94 PID 4716 wrote to memory of 3760 4716 C302.tmp 94 PID 4716 wrote to memory of 3760 4716 C302.tmp 94 PID 3760 wrote to memory of 2628 3760 C35F.tmp 140 PID 3760 wrote to memory of 2628 3760 C35F.tmp 140 PID 3760 wrote to memory of 2628 3760 C35F.tmp 140 PID 2628 wrote to memory of 2736 2628 C3AE.tmp 141 PID 2628 wrote to memory of 2736 2628 C3AE.tmp 141 PID 2628 wrote to memory of 2736 2628 C3AE.tmp 141 PID 2736 wrote to memory of 2228 2736 C3FC.tmp 97 PID 2736 wrote to memory of 2228 2736 C3FC.tmp 97 PID 2736 wrote to memory of 2228 2736 C3FC.tmp 97 PID 2228 wrote to memory of 3052 2228 C44A.tmp 98 PID 2228 wrote to memory of 3052 2228 C44A.tmp 98 PID 2228 wrote to memory of 3052 2228 C44A.tmp 98 PID 3052 wrote to memory of 4364 3052 C4A8.tmp 99 PID 3052 wrote to memory of 4364 3052 C4A8.tmp 99 PID 3052 wrote to memory of 4364 3052 C4A8.tmp 99 PID 4364 wrote to memory of 1524 4364 C4F6.tmp 100 PID 4364 wrote to memory of 1524 4364 C4F6.tmp 100 PID 4364 wrote to memory of 1524 4364 C4F6.tmp 100 PID 1524 wrote to memory of 956 1524 C544.tmp 101 PID 1524 wrote to memory of 956 1524 C544.tmp 101 PID 1524 wrote to memory of 956 1524 C544.tmp 101 PID 956 wrote to memory of 2200 956 C592.tmp 102 PID 956 wrote to memory of 2200 956 C592.tmp 102 PID 956 wrote to memory of 2200 956 C592.tmp 102 PID 2200 wrote to memory of 576 2200 C5F0.tmp 104 PID 2200 wrote to memory of 576 2200 C5F0.tmp 104 PID 2200 wrote to memory of 576 2200 C5F0.tmp 104 PID 576 wrote to memory of 3308 576 C63E.tmp 105 PID 576 wrote to memory of 3308 576 C63E.tmp 105 PID 576 wrote to memory of 3308 576 C63E.tmp 105 PID 3308 wrote to memory of 2076 3308 C69C.tmp 106 PID 3308 wrote to memory of 2076 3308 C69C.tmp 106 PID 3308 wrote to memory of 2076 3308 C69C.tmp 106 PID 2076 wrote to memory of 3444 2076 C6EA.tmp 154 PID 2076 wrote to memory of 3444 2076 C6EA.tmp 154 PID 2076 wrote to memory of 3444 2076 C6EA.tmp 154 PID 3444 wrote to memory of 4992 3444 C757.tmp 109 PID 3444 wrote to memory of 4992 3444 C757.tmp 109 PID 3444 wrote to memory of 4992 3444 C757.tmp 109 PID 4992 wrote to memory of 1872 4992 C7D4.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-25_e9b99d24f69f0f4bce73518b9af5671f_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-25_e9b99d24f69f0f4bce73518b9af5671f_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:336 -
C:\Users\Admin\AppData\Local\Temp\C13D.tmp"C:\Users\Admin\AppData\Local\Temp\C13D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Users\Admin\AppData\Local\Temp\C19A.tmp"C:\Users\Admin\AppData\Local\Temp\C19A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\C246.tmp"C:\Users\Admin\AppData\Local\Temp\C246.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\C2A4.tmp"C:\Users\Admin\AppData\Local\Temp\C2A4.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\C302.tmp"C:\Users\Admin\AppData\Local\Temp\C302.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\C35F.tmp"C:\Users\Admin\AppData\Local\Temp\C35F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\C3AE.tmp"C:\Users\Admin\AppData\Local\Temp\C3AE.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\C44A.tmp"C:\Users\Admin\AppData\Local\Temp\C44A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\C544.tmp"C:\Users\Admin\AppData\Local\Temp\C544.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\C592.tmp"C:\Users\Admin\AppData\Local\Temp\C592.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\C5F0.tmp"C:\Users\Admin\AppData\Local\Temp\C5F0.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\C63E.tmp"C:\Users\Admin\AppData\Local\Temp\C63E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Users\Admin\AppData\Local\Temp\C69C.tmp"C:\Users\Admin\AppData\Local\Temp\C69C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\C6EA.tmp"C:\Users\Admin\AppData\Local\Temp\C6EA.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\C757.tmp"C:\Users\Admin\AppData\Local\Temp\C757.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\C7D4.tmp"C:\Users\Admin\AppData\Local\Temp\C7D4.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\C851.tmp"C:\Users\Admin\AppData\Local\Temp\C851.tmp"23⤵
- Executes dropped EXE
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\C89F.tmp"C:\Users\Admin\AppData\Local\Temp\C89F.tmp"24⤵
- Executes dropped EXE
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\C8FD.tmp"C:\Users\Admin\AppData\Local\Temp\C8FD.tmp"25⤵
- Executes dropped EXE
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\C95B.tmp"C:\Users\Admin\AppData\Local\Temp\C95B.tmp"26⤵
- Executes dropped EXE
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\C9B8.tmp"C:\Users\Admin\AppData\Local\Temp\C9B8.tmp"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\CA07.tmp"C:\Users\Admin\AppData\Local\Temp\CA07.tmp"28⤵
- Executes dropped EXE
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\CA55.tmp"C:\Users\Admin\AppData\Local\Temp\CA55.tmp"29⤵
- Executes dropped EXE
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\CAA3.tmp"C:\Users\Admin\AppData\Local\Temp\CAA3.tmp"30⤵
- Executes dropped EXE
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\CAF1.tmp"C:\Users\Admin\AppData\Local\Temp\CAF1.tmp"31⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\CB9D.tmp"C:\Users\Admin\AppData\Local\Temp\CB9D.tmp"32⤵
- Executes dropped EXE
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\CBFB.tmp"C:\Users\Admin\AppData\Local\Temp\CBFB.tmp"33⤵
- Executes dropped EXE
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\CC49.tmp"C:\Users\Admin\AppData\Local\Temp\CC49.tmp"34⤵
- Executes dropped EXE
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\CC97.tmp"C:\Users\Admin\AppData\Local\Temp\CC97.tmp"35⤵
- Executes dropped EXE
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\CF56.tmp"C:\Users\Admin\AppData\Local\Temp\CF56.tmp"36⤵
- Executes dropped EXE
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\CFA4.tmp"C:\Users\Admin\AppData\Local\Temp\CFA4.tmp"37⤵
- Executes dropped EXE
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\CFF2.tmp"C:\Users\Admin\AppData\Local\Temp\CFF2.tmp"38⤵
- Executes dropped EXE
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\D040.tmp"C:\Users\Admin\AppData\Local\Temp\D040.tmp"39⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\D08E.tmp"C:\Users\Admin\AppData\Local\Temp\D08E.tmp"40⤵
- Executes dropped EXE
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\D0DD.tmp"C:\Users\Admin\AppData\Local\Temp\D0DD.tmp"41⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\D12B.tmp"C:\Users\Admin\AppData\Local\Temp\D12B.tmp"42⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\D179.tmp"C:\Users\Admin\AppData\Local\Temp\D179.tmp"43⤵
- Executes dropped EXE
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"44⤵
- Executes dropped EXE
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\D215.tmp"C:\Users\Admin\AppData\Local\Temp\D215.tmp"45⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\D263.tmp"C:\Users\Admin\AppData\Local\Temp\D263.tmp"46⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\D2B1.tmp"C:\Users\Admin\AppData\Local\Temp\D2B1.tmp"47⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\D2FF.tmp"C:\Users\Admin\AppData\Local\Temp\D2FF.tmp"48⤵
- Executes dropped EXE
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\D34E.tmp"C:\Users\Admin\AppData\Local\Temp\D34E.tmp"49⤵
- Executes dropped EXE
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\D39C.tmp"C:\Users\Admin\AppData\Local\Temp\D39C.tmp"50⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\D3EA.tmp"C:\Users\Admin\AppData\Local\Temp\D3EA.tmp"51⤵
- Executes dropped EXE
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\D438.tmp"C:\Users\Admin\AppData\Local\Temp\D438.tmp"52⤵
- Executes dropped EXE
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\D486.tmp"C:\Users\Admin\AppData\Local\Temp\D486.tmp"53⤵
- Executes dropped EXE
PID:824 -
C:\Users\Admin\AppData\Local\Temp\D4D4.tmp"C:\Users\Admin\AppData\Local\Temp\D4D4.tmp"54⤵
- Executes dropped EXE
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\D522.tmp"C:\Users\Admin\AppData\Local\Temp\D522.tmp"55⤵
- Executes dropped EXE
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\D570.tmp"C:\Users\Admin\AppData\Local\Temp\D570.tmp"56⤵
- Executes dropped EXE
PID:788 -
C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"57⤵
- Executes dropped EXE
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\D5FD.tmp"C:\Users\Admin\AppData\Local\Temp\D5FD.tmp"58⤵
- Executes dropped EXE
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\D64B.tmp"C:\Users\Admin\AppData\Local\Temp\D64B.tmp"59⤵
- Executes dropped EXE
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\D699.tmp"C:\Users\Admin\AppData\Local\Temp\D699.tmp"60⤵
- Executes dropped EXE
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\D6E7.tmp"C:\Users\Admin\AppData\Local\Temp\D6E7.tmp"61⤵
- Executes dropped EXE
PID:884 -
C:\Users\Admin\AppData\Local\Temp\D745.tmp"C:\Users\Admin\AppData\Local\Temp\D745.tmp"62⤵
- Executes dropped EXE
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\D7D2.tmp"C:\Users\Admin\AppData\Local\Temp\D7D2.tmp"63⤵
- Executes dropped EXE
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\D89D.tmp"C:\Users\Admin\AppData\Local\Temp\D89D.tmp"64⤵
- Executes dropped EXE
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\D92A.tmp"C:\Users\Admin\AppData\Local\Temp\D92A.tmp"65⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\D9D5.tmp"C:\Users\Admin\AppData\Local\Temp\D9D5.tmp"66⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\DA43.tmp"C:\Users\Admin\AppData\Local\Temp\DA43.tmp"67⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\DACF.tmp"C:\Users\Admin\AppData\Local\Temp\DACF.tmp"68⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\DB7B.tmp"C:\Users\Admin\AppData\Local\Temp\DB7B.tmp"69⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\DBF8.tmp"C:\Users\Admin\AppData\Local\Temp\DBF8.tmp"70⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\DC95.tmp"C:\Users\Admin\AppData\Local\Temp\DC95.tmp"71⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\DD21.tmp"C:\Users\Admin\AppData\Local\Temp\DD21.tmp"72⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\DDFC.tmp"C:\Users\Admin\AppData\Local\Temp\DDFC.tmp"73⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\DE5A.tmp"C:\Users\Admin\AppData\Local\Temp\DE5A.tmp"74⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\DEB7.tmp"C:\Users\Admin\AppData\Local\Temp\DEB7.tmp"75⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\DF15.tmp"C:\Users\Admin\AppData\Local\Temp\DF15.tmp"76⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\DF73.tmp"C:\Users\Admin\AppData\Local\Temp\DF73.tmp"77⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\DFD1.tmp"C:\Users\Admin\AppData\Local\Temp\DFD1.tmp"78⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\E02E.tmp"C:\Users\Admin\AppData\Local\Temp\E02E.tmp"79⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\E09C.tmp"C:\Users\Admin\AppData\Local\Temp\E09C.tmp"80⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\E0FA.tmp"C:\Users\Admin\AppData\Local\Temp\E0FA.tmp"81⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\E157.tmp"C:\Users\Admin\AppData\Local\Temp\E157.tmp"82⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\E1C5.tmp"C:\Users\Admin\AppData\Local\Temp\E1C5.tmp"83⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\E222.tmp"C:\Users\Admin\AppData\Local\Temp\E222.tmp"84⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\E271.tmp"C:\Users\Admin\AppData\Local\Temp\E271.tmp"85⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\E2BF.tmp"C:\Users\Admin\AppData\Local\Temp\E2BF.tmp"86⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\E31C.tmp"C:\Users\Admin\AppData\Local\Temp\E31C.tmp"87⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\E37A.tmp"C:\Users\Admin\AppData\Local\Temp\E37A.tmp"88⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\E3D8.tmp"C:\Users\Admin\AppData\Local\Temp\E3D8.tmp"89⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\E436.tmp"C:\Users\Admin\AppData\Local\Temp\E436.tmp"90⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\E493.tmp"C:\Users\Admin\AppData\Local\Temp\E493.tmp"91⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\E4F1.tmp"C:\Users\Admin\AppData\Local\Temp\E4F1.tmp"92⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\E54F.tmp"C:\Users\Admin\AppData\Local\Temp\E54F.tmp"93⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\E5AD.tmp"C:\Users\Admin\AppData\Local\Temp\E5AD.tmp"94⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\E60A.tmp"C:\Users\Admin\AppData\Local\Temp\E60A.tmp"95⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\E668.tmp"C:\Users\Admin\AppData\Local\Temp\E668.tmp"96⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\E6C6.tmp"C:\Users\Admin\AppData\Local\Temp\E6C6.tmp"97⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\E724.tmp"C:\Users\Admin\AppData\Local\Temp\E724.tmp"98⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\E772.tmp"C:\Users\Admin\AppData\Local\Temp\E772.tmp"99⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\E7C0.tmp"C:\Users\Admin\AppData\Local\Temp\E7C0.tmp"100⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\E80E.tmp"C:\Users\Admin\AppData\Local\Temp\E80E.tmp"101⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\E85C.tmp"C:\Users\Admin\AppData\Local\Temp\E85C.tmp"102⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"103⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\E927.tmp"C:\Users\Admin\AppData\Local\Temp\E927.tmp"104⤵
- System Location Discovery: System Language Discovery
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\E985.tmp"C:\Users\Admin\AppData\Local\Temp\E985.tmp"105⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\E9E3.tmp"C:\Users\Admin\AppData\Local\Temp\E9E3.tmp"106⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\EA50.tmp"C:\Users\Admin\AppData\Local\Temp\EA50.tmp"107⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\EA9E.tmp"C:\Users\Admin\AppData\Local\Temp\EA9E.tmp"108⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\EAFC.tmp"C:\Users\Admin\AppData\Local\Temp\EAFC.tmp"109⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\EB5A.tmp"C:\Users\Admin\AppData\Local\Temp\EB5A.tmp"110⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\EBA8.tmp"C:\Users\Admin\AppData\Local\Temp\EBA8.tmp"111⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\EBF6.tmp"C:\Users\Admin\AppData\Local\Temp\EBF6.tmp"112⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\EC44.tmp"C:\Users\Admin\AppData\Local\Temp\EC44.tmp"113⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\EC92.tmp"C:\Users\Admin\AppData\Local\Temp\EC92.tmp"114⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\ECF0.tmp"C:\Users\Admin\AppData\Local\Temp\ECF0.tmp"115⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\ED4E.tmp"C:\Users\Admin\AppData\Local\Temp\ED4E.tmp"116⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\ED9C.tmp"C:\Users\Admin\AppData\Local\Temp\ED9C.tmp"117⤵
- System Location Discovery: System Language Discovery
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\EDEA.tmp"C:\Users\Admin\AppData\Local\Temp\EDEA.tmp"118⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\EE48.tmp"C:\Users\Admin\AppData\Local\Temp\EE48.tmp"119⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\EEA6.tmp"C:\Users\Admin\AppData\Local\Temp\EEA6.tmp"120⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\EF03.tmp"C:\Users\Admin\AppData\Local\Temp\EF03.tmp"121⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\EF51.tmp"C:\Users\Admin\AppData\Local\Temp\EF51.tmp"122⤵PID:4756
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-