Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
02-08-2024 12:45
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-02_e3d4ac7035ec4642277dc36a152a9c3a_mafia.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2024-08-02_e3d4ac7035ec4642277dc36a152a9c3a_mafia.exe
Resource
win10v2004-20240730-en
General
-
Target
2024-08-02_e3d4ac7035ec4642277dc36a152a9c3a_mafia.exe
-
Size
520KB
-
MD5
e3d4ac7035ec4642277dc36a152a9c3a
-
SHA1
ba08e3913e3783bc018adc799ffc74d3b1db887a
-
SHA256
0a6c3713728b350b7109090e08db77efe4965f884c45ce6b283959894ab163d4
-
SHA512
7bb4f6ed8de0ebfe5d1f7c62257156c8a6c57e2b0799ebd81f9cbd4e5133879ce423b9fbd4f6e0c55cfe99571490045d4a517ed73a59425105f4308112fded5e
-
SSDEEP
12288:gj8fuxR21t5i8fp3op4v3Go0JNgO12ILyTS5AqklNZ:gj8fuK1GYpYuvW5gO1HyTOAq4N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1520 CE4C.tmp 4584 CEE9.tmp 4332 CF75.tmp 4668 D040.tmp 1584 D0AE.tmp 5052 D12B.tmp 3644 D198.tmp 4988 D215.tmp 2964 D292.tmp 3200 D31F.tmp 4832 D3BB.tmp 3304 D428.tmp 3168 D496.tmp 3988 D513.tmp 3252 D59F.tmp 368 D60D.tmp 1924 D6C8.tmp 4204 D745.tmp 4848 D7B3.tmp 4208 D830.tmp 1936 D8BC.tmp 2968 D949.tmp 3144 D9C6.tmp 3260 DA43.tmp 5088 DAC0.tmp 4348 DB2D.tmp 3020 DBBA.tmp 1844 DC46.tmp 4592 DCD3.tmp 1836 DD6F.tmp 4916 DDCD.tmp 2004 DE3A.tmp 1148 DEA8.tmp 956 DF06.tmp 4260 DF63.tmp 3428 DFB1.tmp 1200 E00F.tmp 2392 E06D.tmp 4404 E0BB.tmp 1172 E119.tmp 3400 E186.tmp 4952 E1E4.tmp 2520 E232.tmp 4552 E280.tmp 1588 E2DE.tmp 2280 E32C.tmp 3500 E3E8.tmp 2276 E455.tmp 1508 E4A3.tmp 2152 E4F1.tmp 2220 E53F.tmp 4476 E59D.tmp 4740 E5EB.tmp 3012 E649.tmp 2700 E6A7.tmp 2660 E6F5.tmp 2096 E753.tmp 1584 E7A1.tmp 472 E7EF.tmp 4904 E83D.tmp 2488 E88B.tmp 4880 E8E9.tmp 2988 E937.tmp 3664 E995.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F77A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1870.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7088.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D59F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 640.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 124B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BD9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D8C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5138.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2ACF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1095.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 693.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 605B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E598.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4978.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 536A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E654.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6647.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1544 wrote to memory of 1520 1544 2024-08-02_e3d4ac7035ec4642277dc36a152a9c3a_mafia.exe 83 PID 1544 wrote to memory of 1520 1544 2024-08-02_e3d4ac7035ec4642277dc36a152a9c3a_mafia.exe 83 PID 1544 wrote to memory of 1520 1544 2024-08-02_e3d4ac7035ec4642277dc36a152a9c3a_mafia.exe 83 PID 1520 wrote to memory of 4584 1520 CE4C.tmp 85 PID 1520 wrote to memory of 4584 1520 CE4C.tmp 85 PID 1520 wrote to memory of 4584 1520 CE4C.tmp 85 PID 4584 wrote to memory of 4332 4584 CEE9.tmp 87 PID 4584 wrote to memory of 4332 4584 CEE9.tmp 87 PID 4584 wrote to memory of 4332 4584 CEE9.tmp 87 PID 4332 wrote to memory of 4668 4332 CF75.tmp 89 PID 4332 wrote to memory of 4668 4332 CF75.tmp 89 PID 4332 wrote to memory of 4668 4332 CF75.tmp 89 PID 4668 wrote to memory of 1584 4668 D040.tmp 90 PID 4668 wrote to memory of 1584 4668 D040.tmp 90 PID 4668 wrote to memory of 1584 4668 D040.tmp 90 PID 1584 wrote to memory of 5052 1584 D0AE.tmp 91 PID 1584 wrote to memory of 5052 1584 D0AE.tmp 91 PID 1584 wrote to memory of 5052 1584 D0AE.tmp 91 PID 5052 wrote to memory of 3644 5052 D12B.tmp 92 PID 5052 wrote to memory of 3644 5052 D12B.tmp 92 PID 5052 wrote to memory of 3644 5052 D12B.tmp 92 PID 3644 wrote to memory of 4988 3644 D198.tmp 93 PID 3644 wrote to memory of 4988 3644 D198.tmp 93 PID 3644 wrote to memory of 4988 3644 D198.tmp 93 PID 4988 wrote to memory of 2964 4988 D215.tmp 94 PID 4988 wrote to memory of 2964 4988 D215.tmp 94 PID 4988 wrote to memory of 2964 4988 D215.tmp 94 PID 2964 wrote to memory of 3200 2964 D292.tmp 95 PID 2964 wrote to memory of 3200 2964 D292.tmp 95 PID 2964 wrote to memory of 3200 2964 D292.tmp 95 PID 3200 wrote to memory of 4832 3200 D31F.tmp 96 PID 3200 wrote to memory of 4832 3200 D31F.tmp 96 PID 3200 wrote to memory of 4832 3200 D31F.tmp 96 PID 4832 wrote to memory of 3304 4832 D3BB.tmp 97 PID 4832 wrote to memory of 3304 4832 D3BB.tmp 97 PID 4832 wrote to memory of 3304 4832 D3BB.tmp 97 PID 3304 wrote to memory of 3168 3304 D428.tmp 98 PID 3304 wrote to memory of 3168 3304 D428.tmp 98 PID 3304 wrote to memory of 3168 3304 D428.tmp 98 PID 3168 wrote to memory of 3988 3168 D496.tmp 99 PID 3168 wrote to memory of 3988 3168 D496.tmp 99 PID 3168 wrote to memory of 3988 3168 D496.tmp 99 PID 3988 wrote to memory of 3252 3988 D513.tmp 100 PID 3988 wrote to memory of 3252 3988 D513.tmp 100 PID 3988 wrote to memory of 3252 3988 D513.tmp 100 PID 3252 wrote to memory of 368 3252 D59F.tmp 101 PID 3252 wrote to memory of 368 3252 D59F.tmp 101 PID 3252 wrote to memory of 368 3252 D59F.tmp 101 PID 368 wrote to memory of 1924 368 D60D.tmp 102 PID 368 wrote to memory of 1924 368 D60D.tmp 102 PID 368 wrote to memory of 1924 368 D60D.tmp 102 PID 1924 wrote to memory of 4204 1924 D6C8.tmp 103 PID 1924 wrote to memory of 4204 1924 D6C8.tmp 103 PID 1924 wrote to memory of 4204 1924 D6C8.tmp 103 PID 4204 wrote to memory of 4848 4204 D745.tmp 104 PID 4204 wrote to memory of 4848 4204 D745.tmp 104 PID 4204 wrote to memory of 4848 4204 D745.tmp 104 PID 4848 wrote to memory of 4208 4848 D7B3.tmp 105 PID 4848 wrote to memory of 4208 4848 D7B3.tmp 105 PID 4848 wrote to memory of 4208 4848 D7B3.tmp 105 PID 4208 wrote to memory of 1936 4208 D830.tmp 106 PID 4208 wrote to memory of 1936 4208 D830.tmp 106 PID 4208 wrote to memory of 1936 4208 D830.tmp 106 PID 1936 wrote to memory of 2968 1936 D8BC.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-02_e3d4ac7035ec4642277dc36a152a9c3a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-02_e3d4ac7035ec4642277dc36a152a9c3a_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\CE4C.tmp"C:\Users\Admin\AppData\Local\Temp\CE4C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\CEE9.tmp"C:\Users\Admin\AppData\Local\Temp\CEE9.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\CF75.tmp"C:\Users\Admin\AppData\Local\Temp\CF75.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\D040.tmp"C:\Users\Admin\AppData\Local\Temp\D040.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\D12B.tmp"C:\Users\Admin\AppData\Local\Temp\D12B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\D198.tmp"C:\Users\Admin\AppData\Local\Temp\D198.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\D215.tmp"C:\Users\Admin\AppData\Local\Temp\D215.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\D292.tmp"C:\Users\Admin\AppData\Local\Temp\D292.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\D31F.tmp"C:\Users\Admin\AppData\Local\Temp\D31F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\D3BB.tmp"C:\Users\Admin\AppData\Local\Temp\D3BB.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\D428.tmp"C:\Users\Admin\AppData\Local\Temp\D428.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\D496.tmp"C:\Users\Admin\AppData\Local\Temp\D496.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\D513.tmp"C:\Users\Admin\AppData\Local\Temp\D513.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\D59F.tmp"C:\Users\Admin\AppData\Local\Temp\D59F.tmp"16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\D60D.tmp"C:\Users\Admin\AppData\Local\Temp\D60D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Users\Admin\AppData\Local\Temp\D6C8.tmp"C:\Users\Admin\AppData\Local\Temp\D6C8.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\D745.tmp"C:\Users\Admin\AppData\Local\Temp\D745.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\D7B3.tmp"C:\Users\Admin\AppData\Local\Temp\D7B3.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\D830.tmp"C:\Users\Admin\AppData\Local\Temp\D830.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\D8BC.tmp"C:\Users\Admin\AppData\Local\Temp\D8BC.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\D949.tmp"C:\Users\Admin\AppData\Local\Temp\D949.tmp"23⤵
- Executes dropped EXE
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\D9C6.tmp"C:\Users\Admin\AppData\Local\Temp\D9C6.tmp"24⤵
- Executes dropped EXE
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\DA43.tmp"C:\Users\Admin\AppData\Local\Temp\DA43.tmp"25⤵
- Executes dropped EXE
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\DAC0.tmp"C:\Users\Admin\AppData\Local\Temp\DAC0.tmp"26⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\DB2D.tmp"C:\Users\Admin\AppData\Local\Temp\DB2D.tmp"27⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\DBBA.tmp"C:\Users\Admin\AppData\Local\Temp\DBBA.tmp"28⤵
- Executes dropped EXE
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\DC46.tmp"C:\Users\Admin\AppData\Local\Temp\DC46.tmp"29⤵
- Executes dropped EXE
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\DCD3.tmp"C:\Users\Admin\AppData\Local\Temp\DCD3.tmp"30⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\DD6F.tmp"C:\Users\Admin\AppData\Local\Temp\DD6F.tmp"31⤵
- Executes dropped EXE
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\DDCD.tmp"C:\Users\Admin\AppData\Local\Temp\DDCD.tmp"32⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\DE3A.tmp"C:\Users\Admin\AppData\Local\Temp\DE3A.tmp"33⤵
- Executes dropped EXE
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"34⤵
- Executes dropped EXE
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\DF06.tmp"C:\Users\Admin\AppData\Local\Temp\DF06.tmp"35⤵
- Executes dropped EXE
PID:956 -
C:\Users\Admin\AppData\Local\Temp\DF63.tmp"C:\Users\Admin\AppData\Local\Temp\DF63.tmp"36⤵
- Executes dropped EXE
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\DFB1.tmp"C:\Users\Admin\AppData\Local\Temp\DFB1.tmp"37⤵
- Executes dropped EXE
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\E00F.tmp"C:\Users\Admin\AppData\Local\Temp\E00F.tmp"38⤵
- Executes dropped EXE
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\E06D.tmp"C:\Users\Admin\AppData\Local\Temp\E06D.tmp"39⤵
- Executes dropped EXE
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\E0BB.tmp"C:\Users\Admin\AppData\Local\Temp\E0BB.tmp"40⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\E119.tmp"C:\Users\Admin\AppData\Local\Temp\E119.tmp"41⤵
- Executes dropped EXE
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\E186.tmp"C:\Users\Admin\AppData\Local\Temp\E186.tmp"42⤵
- Executes dropped EXE
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\E1E4.tmp"C:\Users\Admin\AppData\Local\Temp\E1E4.tmp"43⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\E232.tmp"C:\Users\Admin\AppData\Local\Temp\E232.tmp"44⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\E280.tmp"C:\Users\Admin\AppData\Local\Temp\E280.tmp"45⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\E2DE.tmp"C:\Users\Admin\AppData\Local\Temp\E2DE.tmp"46⤵
- Executes dropped EXE
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\E32C.tmp"C:\Users\Admin\AppData\Local\Temp\E32C.tmp"47⤵
- Executes dropped EXE
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\E37A.tmp"C:\Users\Admin\AppData\Local\Temp\E37A.tmp"48⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\E3E8.tmp"C:\Users\Admin\AppData\Local\Temp\E3E8.tmp"49⤵
- Executes dropped EXE
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\E455.tmp"C:\Users\Admin\AppData\Local\Temp\E455.tmp"50⤵
- Executes dropped EXE
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\E4A3.tmp"C:\Users\Admin\AppData\Local\Temp\E4A3.tmp"51⤵
- Executes dropped EXE
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\E4F1.tmp"C:\Users\Admin\AppData\Local\Temp\E4F1.tmp"52⤵
- Executes dropped EXE
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\E53F.tmp"C:\Users\Admin\AppData\Local\Temp\E53F.tmp"53⤵
- Executes dropped EXE
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\E59D.tmp"C:\Users\Admin\AppData\Local\Temp\E59D.tmp"54⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\E5EB.tmp"C:\Users\Admin\AppData\Local\Temp\E5EB.tmp"55⤵
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\E649.tmp"C:\Users\Admin\AppData\Local\Temp\E649.tmp"56⤵
- Executes dropped EXE
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"57⤵
- Executes dropped EXE
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"58⤵
- Executes dropped EXE
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\E753.tmp"C:\Users\Admin\AppData\Local\Temp\E753.tmp"59⤵
- Executes dropped EXE
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"60⤵
- Executes dropped EXE
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"61⤵
- Executes dropped EXE
PID:472 -
C:\Users\Admin\AppData\Local\Temp\E83D.tmp"C:\Users\Admin\AppData\Local\Temp\E83D.tmp"62⤵
- Executes dropped EXE
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\E88B.tmp"C:\Users\Admin\AppData\Local\Temp\E88B.tmp"63⤵
- Executes dropped EXE
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\E8E9.tmp"C:\Users\Admin\AppData\Local\Temp\E8E9.tmp"64⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\E937.tmp"C:\Users\Admin\AppData\Local\Temp\E937.tmp"65⤵
- Executes dropped EXE
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\E995.tmp"C:\Users\Admin\AppData\Local\Temp\E995.tmp"66⤵
- Executes dropped EXE
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\E9F2.tmp"C:\Users\Admin\AppData\Local\Temp\E9F2.tmp"67⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\EA50.tmp"C:\Users\Admin\AppData\Local\Temp\EA50.tmp"68⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\EAAE.tmp"C:\Users\Admin\AppData\Local\Temp\EAAE.tmp"69⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\EB0C.tmp"C:\Users\Admin\AppData\Local\Temp\EB0C.tmp"70⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\EB5A.tmp"C:\Users\Admin\AppData\Local\Temp\EB5A.tmp"71⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\EBB8.tmp"C:\Users\Admin\AppData\Local\Temp\EBB8.tmp"72⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\EC06.tmp"C:\Users\Admin\AppData\Local\Temp\EC06.tmp"73⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\EC54.tmp"C:\Users\Admin\AppData\Local\Temp\EC54.tmp"74⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\ECB2.tmp"C:\Users\Admin\AppData\Local\Temp\ECB2.tmp"75⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\ED0F.tmp"C:\Users\Admin\AppData\Local\Temp\ED0F.tmp"76⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\ED5D.tmp"C:\Users\Admin\AppData\Local\Temp\ED5D.tmp"77⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"78⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\EE09.tmp"C:\Users\Admin\AppData\Local\Temp\EE09.tmp"79⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\EE67.tmp"C:\Users\Admin\AppData\Local\Temp\EE67.tmp"80⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\EEB5.tmp"C:\Users\Admin\AppData\Local\Temp\EEB5.tmp"81⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\EF13.tmp"C:\Users\Admin\AppData\Local\Temp\EF13.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\EF61.tmp"C:\Users\Admin\AppData\Local\Temp\EF61.tmp"83⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\EFCE.tmp"C:\Users\Admin\AppData\Local\Temp\EFCE.tmp"84⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\F02C.tmp"C:\Users\Admin\AppData\Local\Temp\F02C.tmp"85⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\F08A.tmp"C:\Users\Admin\AppData\Local\Temp\F08A.tmp"86⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\F0D8.tmp"C:\Users\Admin\AppData\Local\Temp\F0D8.tmp"87⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\F126.tmp"C:\Users\Admin\AppData\Local\Temp\F126.tmp"88⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\F174.tmp"C:\Users\Admin\AppData\Local\Temp\F174.tmp"89⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\F1C2.tmp"C:\Users\Admin\AppData\Local\Temp\F1C2.tmp"90⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\F220.tmp"C:\Users\Admin\AppData\Local\Temp\F220.tmp"91⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\F27E.tmp"C:\Users\Admin\AppData\Local\Temp\F27E.tmp"92⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\F2CC.tmp"C:\Users\Admin\AppData\Local\Temp\F2CC.tmp"93⤵PID:524
-
C:\Users\Admin\AppData\Local\Temp\F32A.tmp"C:\Users\Admin\AppData\Local\Temp\F32A.tmp"94⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\F397.tmp"C:\Users\Admin\AppData\Local\Temp\F397.tmp"95⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\F3F5.tmp"C:\Users\Admin\AppData\Local\Temp\F3F5.tmp"96⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\F443.tmp"C:\Users\Admin\AppData\Local\Temp\F443.tmp"97⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\F4B0.tmp"C:\Users\Admin\AppData\Local\Temp\F4B0.tmp"98⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\F4FF.tmp"C:\Users\Admin\AppData\Local\Temp\F4FF.tmp"99⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\F54D.tmp"C:\Users\Admin\AppData\Local\Temp\F54D.tmp"100⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\F5BA.tmp"C:\Users\Admin\AppData\Local\Temp\F5BA.tmp"101⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\F618.tmp"C:\Users\Admin\AppData\Local\Temp\F618.tmp"102⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\F676.tmp"C:\Users\Admin\AppData\Local\Temp\F676.tmp"103⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\F6C4.tmp"C:\Users\Admin\AppData\Local\Temp\F6C4.tmp"104⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\F712.tmp"C:\Users\Admin\AppData\Local\Temp\F712.tmp"105⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\F760.tmp"C:\Users\Admin\AppData\Local\Temp\F760.tmp"106⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\F7BE.tmp"C:\Users\Admin\AppData\Local\Temp\F7BE.tmp"107⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\F81B.tmp"C:\Users\Admin\AppData\Local\Temp\F81B.tmp"108⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\F879.tmp"C:\Users\Admin\AppData\Local\Temp\F879.tmp"109⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\F8D7.tmp"C:\Users\Admin\AppData\Local\Temp\F8D7.tmp"110⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\F925.tmp"C:\Users\Admin\AppData\Local\Temp\F925.tmp"111⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\F983.tmp"C:\Users\Admin\AppData\Local\Temp\F983.tmp"112⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\F9E1.tmp"C:\Users\Admin\AppData\Local\Temp\F9E1.tmp"113⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\FA4E.tmp"C:\Users\Admin\AppData\Local\Temp\FA4E.tmp"114⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\FA9C.tmp"C:\Users\Admin\AppData\Local\Temp\FA9C.tmp"115⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"116⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\FB48.tmp"C:\Users\Admin\AppData\Local\Temp\FB48.tmp"117⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\FB96.tmp"C:\Users\Admin\AppData\Local\Temp\FB96.tmp"118⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\FBF4.tmp"C:\Users\Admin\AppData\Local\Temp\FBF4.tmp"119⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\FC61.tmp"C:\Users\Admin\AppData\Local\Temp\FC61.tmp"120⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\FCAF.tmp"C:\Users\Admin\AppData\Local\Temp\FCAF.tmp"121⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\FD1D.tmp"C:\Users\Admin\AppData\Local\Temp\FD1D.tmp"122⤵PID:4476
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-