Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
26-08-2024 18:22
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-11_a62a27859c134979a69e87cc0a27d14f_mafia.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2024-06-11_a62a27859c134979a69e87cc0a27d14f_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-06-11_a62a27859c134979a69e87cc0a27d14f_mafia.exe
-
Size
527KB
-
MD5
a62a27859c134979a69e87cc0a27d14f
-
SHA1
8862e802c4105036bdcf88855fa701d865dd2b68
-
SHA256
df749b13dcfb7caa1d09738207d08dbef5505fbd8a6834802244ba67e1479db5
-
SHA512
ddba5b945b66459e48bb3f8c66ecc9c149499b75b5aeffcbbcf35ac19e763f9ebb7cf235e01ca071130178e3b947ec93af5b4450b529e01f68b96fa4016dacce
-
SSDEEP
6144:yorf3lPvovsgZnqG2C7mOTeiLRDYTBzy9BXc6FTDaVImDH+Q+rrYvb+LIgMr5aBv:fU5rCOTeidim9W0PcI5AOMr5aGDZu
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3096 5DFA.tmp 4224 5E67.tmp 4820 5F03.tmp 1928 5F9F.tmp 752 602C.tmp 1016 6099.tmp 4440 6136.tmp 3300 61D2.tmp 2340 626E.tmp 3656 631A.tmp 4392 63A7.tmp 2772 6424.tmp 4528 64C0.tmp 1244 655C.tmp 3164 65CA.tmp 3620 6637.tmp 3364 66B4.tmp 4448 6750.tmp 3980 67DD.tmp 4292 685A.tmp 2440 68F6.tmp 336 6992.tmp 1532 6A2F.tmp 3500 6ABB.tmp 1576 6B38.tmp 4028 6BA6.tmp 440 6C42.tmp 2340 6CBF.tmp 2420 6D3C.tmp 4392 6DC8.tmp 4076 6E45.tmp 1528 6ED2.tmp 3680 71DF.tmp 3648 723D.tmp 3048 729B.tmp 3620 72F9.tmp 3932 7356.tmp 3952 73B4.tmp 1040 7412.tmp 3988 7460.tmp 3040 74BE.tmp 1928 752B.tmp 336 7598.tmp 764 75F6.tmp 2868 7644.tmp 3552 76A2.tmp 3500 7700.tmp 1328 776D.tmp 1432 77DB.tmp 3564 7838.tmp 4496 7896.tmp 4948 7903.tmp 440 7961.tmp 2792 79CF.tmp 1916 7A3C.tmp 3192 7A9A.tmp 4528 7AF7.tmp 1436 7B55.tmp 4636 7BB3.tmp 740 7C20.tmp 2144 7C7E.tmp 3280 7CCC.tmp 1780 7D3A.tmp 4752 7D97.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C896.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC56.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA8C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9958.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C26C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8112.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8558.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6680.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8013.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE76.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 640F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C191.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 797C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C54F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 482B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B51D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9EE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4378.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC4D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE24.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 354F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8255.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9100.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B04B.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2296 wrote to memory of 3096 2296 2024-06-11_a62a27859c134979a69e87cc0a27d14f_mafia.exe 91 PID 2296 wrote to memory of 3096 2296 2024-06-11_a62a27859c134979a69e87cc0a27d14f_mafia.exe 91 PID 2296 wrote to memory of 3096 2296 2024-06-11_a62a27859c134979a69e87cc0a27d14f_mafia.exe 91 PID 3096 wrote to memory of 4224 3096 5DFA.tmp 92 PID 3096 wrote to memory of 4224 3096 5DFA.tmp 92 PID 3096 wrote to memory of 4224 3096 5DFA.tmp 92 PID 4224 wrote to memory of 4820 4224 5E67.tmp 93 PID 4224 wrote to memory of 4820 4224 5E67.tmp 93 PID 4224 wrote to memory of 4820 4224 5E67.tmp 93 PID 4820 wrote to memory of 1928 4820 5F03.tmp 95 PID 4820 wrote to memory of 1928 4820 5F03.tmp 95 PID 4820 wrote to memory of 1928 4820 5F03.tmp 95 PID 1928 wrote to memory of 752 1928 5F9F.tmp 96 PID 1928 wrote to memory of 752 1928 5F9F.tmp 96 PID 1928 wrote to memory of 752 1928 5F9F.tmp 96 PID 752 wrote to memory of 1016 752 602C.tmp 97 PID 752 wrote to memory of 1016 752 602C.tmp 97 PID 752 wrote to memory of 1016 752 602C.tmp 97 PID 1016 wrote to memory of 4440 1016 6099.tmp 99 PID 1016 wrote to memory of 4440 1016 6099.tmp 99 PID 1016 wrote to memory of 4440 1016 6099.tmp 99 PID 4440 wrote to memory of 3300 4440 6136.tmp 100 PID 4440 wrote to memory of 3300 4440 6136.tmp 100 PID 4440 wrote to memory of 3300 4440 6136.tmp 100 PID 3300 wrote to memory of 2340 3300 61D2.tmp 102 PID 3300 wrote to memory of 2340 3300 61D2.tmp 102 PID 3300 wrote to memory of 2340 3300 61D2.tmp 102 PID 2340 wrote to memory of 3656 2340 626E.tmp 105 PID 2340 wrote to memory of 3656 2340 626E.tmp 105 PID 2340 wrote to memory of 3656 2340 626E.tmp 105 PID 3656 wrote to memory of 4392 3656 631A.tmp 106 PID 3656 wrote to memory of 4392 3656 631A.tmp 106 PID 3656 wrote to memory of 4392 3656 631A.tmp 106 PID 4392 wrote to memory of 2772 4392 63A7.tmp 107 PID 4392 wrote to memory of 2772 4392 63A7.tmp 107 PID 4392 wrote to memory of 2772 4392 63A7.tmp 107 PID 2772 wrote to memory of 4528 2772 6424.tmp 108 PID 2772 wrote to memory of 4528 2772 6424.tmp 108 PID 2772 wrote to memory of 4528 2772 6424.tmp 108 PID 4528 wrote to memory of 1244 4528 64C0.tmp 109 PID 4528 wrote to memory of 1244 4528 64C0.tmp 109 PID 4528 wrote to memory of 1244 4528 64C0.tmp 109 PID 1244 wrote to memory of 3164 1244 655C.tmp 110 PID 1244 wrote to memory of 3164 1244 655C.tmp 110 PID 1244 wrote to memory of 3164 1244 655C.tmp 110 PID 3164 wrote to memory of 3620 3164 65CA.tmp 111 PID 3164 wrote to memory of 3620 3164 65CA.tmp 111 PID 3164 wrote to memory of 3620 3164 65CA.tmp 111 PID 3620 wrote to memory of 3364 3620 6637.tmp 112 PID 3620 wrote to memory of 3364 3620 6637.tmp 112 PID 3620 wrote to memory of 3364 3620 6637.tmp 112 PID 3364 wrote to memory of 4448 3364 66B4.tmp 114 PID 3364 wrote to memory of 4448 3364 66B4.tmp 114 PID 3364 wrote to memory of 4448 3364 66B4.tmp 114 PID 4448 wrote to memory of 3980 4448 6750.tmp 116 PID 4448 wrote to memory of 3980 4448 6750.tmp 116 PID 4448 wrote to memory of 3980 4448 6750.tmp 116 PID 3980 wrote to memory of 4292 3980 67DD.tmp 117 PID 3980 wrote to memory of 4292 3980 67DD.tmp 117 PID 3980 wrote to memory of 4292 3980 67DD.tmp 117 PID 4292 wrote to memory of 2440 4292 685A.tmp 118 PID 4292 wrote to memory of 2440 4292 685A.tmp 118 PID 4292 wrote to memory of 2440 4292 685A.tmp 118 PID 2440 wrote to memory of 336 2440 68F6.tmp 120
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_a62a27859c134979a69e87cc0a27d14f_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-11_a62a27859c134979a69e87cc0a27d14f_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\5DFA.tmp"C:\Users\Admin\AppData\Local\Temp\5DFA.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\5E67.tmp"C:\Users\Admin\AppData\Local\Temp\5E67.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\5F03.tmp"C:\Users\Admin\AppData\Local\Temp\5F03.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\5F9F.tmp"C:\Users\Admin\AppData\Local\Temp\5F9F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\602C.tmp"C:\Users\Admin\AppData\Local\Temp\602C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\6099.tmp"C:\Users\Admin\AppData\Local\Temp\6099.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\6136.tmp"C:\Users\Admin\AppData\Local\Temp\6136.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\61D2.tmp"C:\Users\Admin\AppData\Local\Temp\61D2.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\626E.tmp"C:\Users\Admin\AppData\Local\Temp\626E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\631A.tmp"C:\Users\Admin\AppData\Local\Temp\631A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\63A7.tmp"C:\Users\Admin\AppData\Local\Temp\63A7.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\6424.tmp"C:\Users\Admin\AppData\Local\Temp\6424.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\64C0.tmp"C:\Users\Admin\AppData\Local\Temp\64C0.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\655C.tmp"C:\Users\Admin\AppData\Local\Temp\655C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\65CA.tmp"C:\Users\Admin\AppData\Local\Temp\65CA.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\6637.tmp"C:\Users\Admin\AppData\Local\Temp\6637.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\66B4.tmp"C:\Users\Admin\AppData\Local\Temp\66B4.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\6750.tmp"C:\Users\Admin\AppData\Local\Temp\6750.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\67DD.tmp"C:\Users\Admin\AppData\Local\Temp\67DD.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\685A.tmp"C:\Users\Admin\AppData\Local\Temp\685A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\68F6.tmp"C:\Users\Admin\AppData\Local\Temp\68F6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\6992.tmp"C:\Users\Admin\AppData\Local\Temp\6992.tmp"23⤵
- Executes dropped EXE
PID:336 -
C:\Users\Admin\AppData\Local\Temp\6A2F.tmp"C:\Users\Admin\AppData\Local\Temp\6A2F.tmp"24⤵
- Executes dropped EXE
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\6ABB.tmp"C:\Users\Admin\AppData\Local\Temp\6ABB.tmp"25⤵
- Executes dropped EXE
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\6B38.tmp"C:\Users\Admin\AppData\Local\Temp\6B38.tmp"26⤵
- Executes dropped EXE
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\6BA6.tmp"C:\Users\Admin\AppData\Local\Temp\6BA6.tmp"27⤵
- Executes dropped EXE
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\6C42.tmp"C:\Users\Admin\AppData\Local\Temp\6C42.tmp"28⤵
- Executes dropped EXE
PID:440 -
C:\Users\Admin\AppData\Local\Temp\6CBF.tmp"C:\Users\Admin\AppData\Local\Temp\6CBF.tmp"29⤵
- Executes dropped EXE
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\6D3C.tmp"C:\Users\Admin\AppData\Local\Temp\6D3C.tmp"30⤵
- Executes dropped EXE
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\6DC8.tmp"C:\Users\Admin\AppData\Local\Temp\6DC8.tmp"31⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\6E45.tmp"C:\Users\Admin\AppData\Local\Temp\6E45.tmp"32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\6ED2.tmp"C:\Users\Admin\AppData\Local\Temp\6ED2.tmp"33⤵
- Executes dropped EXE
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\71DF.tmp"C:\Users\Admin\AppData\Local\Temp\71DF.tmp"34⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\723D.tmp"C:\Users\Admin\AppData\Local\Temp\723D.tmp"35⤵
- Executes dropped EXE
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\729B.tmp"C:\Users\Admin\AppData\Local\Temp\729B.tmp"36⤵
- Executes dropped EXE
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\72F9.tmp"C:\Users\Admin\AppData\Local\Temp\72F9.tmp"37⤵
- Executes dropped EXE
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\7356.tmp"C:\Users\Admin\AppData\Local\Temp\7356.tmp"38⤵
- Executes dropped EXE
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\73B4.tmp"C:\Users\Admin\AppData\Local\Temp\73B4.tmp"39⤵
- Executes dropped EXE
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\7412.tmp"C:\Users\Admin\AppData\Local\Temp\7412.tmp"40⤵
- Executes dropped EXE
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\7460.tmp"C:\Users\Admin\AppData\Local\Temp\7460.tmp"41⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\74BE.tmp"C:\Users\Admin\AppData\Local\Temp\74BE.tmp"42⤵
- Executes dropped EXE
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\752B.tmp"C:\Users\Admin\AppData\Local\Temp\752B.tmp"43⤵
- Executes dropped EXE
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\7598.tmp"C:\Users\Admin\AppData\Local\Temp\7598.tmp"44⤵
- Executes dropped EXE
PID:336 -
C:\Users\Admin\AppData\Local\Temp\75F6.tmp"C:\Users\Admin\AppData\Local\Temp\75F6.tmp"45⤵
- Executes dropped EXE
PID:764 -
C:\Users\Admin\AppData\Local\Temp\7644.tmp"C:\Users\Admin\AppData\Local\Temp\7644.tmp"46⤵
- Executes dropped EXE
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\76A2.tmp"C:\Users\Admin\AppData\Local\Temp\76A2.tmp"47⤵
- Executes dropped EXE
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\7700.tmp"C:\Users\Admin\AppData\Local\Temp\7700.tmp"48⤵
- Executes dropped EXE
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\776D.tmp"C:\Users\Admin\AppData\Local\Temp\776D.tmp"49⤵
- Executes dropped EXE
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\77DB.tmp"C:\Users\Admin\AppData\Local\Temp\77DB.tmp"50⤵
- Executes dropped EXE
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\7838.tmp"C:\Users\Admin\AppData\Local\Temp\7838.tmp"51⤵
- Executes dropped EXE
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\7896.tmp"C:\Users\Admin\AppData\Local\Temp\7896.tmp"52⤵
- Executes dropped EXE
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\7903.tmp"C:\Users\Admin\AppData\Local\Temp\7903.tmp"53⤵
- Executes dropped EXE
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\7961.tmp"C:\Users\Admin\AppData\Local\Temp\7961.tmp"54⤵
- Executes dropped EXE
PID:440 -
C:\Users\Admin\AppData\Local\Temp\79CF.tmp"C:\Users\Admin\AppData\Local\Temp\79CF.tmp"55⤵
- Executes dropped EXE
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\7A3C.tmp"C:\Users\Admin\AppData\Local\Temp\7A3C.tmp"56⤵
- Executes dropped EXE
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\7A9A.tmp"C:\Users\Admin\AppData\Local\Temp\7A9A.tmp"57⤵
- Executes dropped EXE
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\7AF7.tmp"C:\Users\Admin\AppData\Local\Temp\7AF7.tmp"58⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\7B55.tmp"C:\Users\Admin\AppData\Local\Temp\7B55.tmp"59⤵
- Executes dropped EXE
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\7BB3.tmp"C:\Users\Admin\AppData\Local\Temp\7BB3.tmp"60⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\7C20.tmp"C:\Users\Admin\AppData\Local\Temp\7C20.tmp"61⤵
- Executes dropped EXE
PID:740 -
C:\Users\Admin\AppData\Local\Temp\7C7E.tmp"C:\Users\Admin\AppData\Local\Temp\7C7E.tmp"62⤵
- Executes dropped EXE
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\7CCC.tmp"C:\Users\Admin\AppData\Local\Temp\7CCC.tmp"63⤵
- Executes dropped EXE
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\7D3A.tmp"C:\Users\Admin\AppData\Local\Temp\7D3A.tmp"64⤵
- Executes dropped EXE
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\7D97.tmp"C:\Users\Admin\AppData\Local\Temp\7D97.tmp"65⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\7DF5.tmp"C:\Users\Admin\AppData\Local\Temp\7DF5.tmp"66⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\7E62.tmp"C:\Users\Admin\AppData\Local\Temp\7E62.tmp"67⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\7ED0.tmp"C:\Users\Admin\AppData\Local\Temp\7ED0.tmp"68⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\7F2E.tmp"C:\Users\Admin\AppData\Local\Temp\7F2E.tmp"69⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\7F7C.tmp"C:\Users\Admin\AppData\Local\Temp\7F7C.tmp"70⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\7FCA.tmp"C:\Users\Admin\AppData\Local\Temp\7FCA.tmp"71⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\8018.tmp"C:\Users\Admin\AppData\Local\Temp\8018.tmp"72⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\8066.tmp"C:\Users\Admin\AppData\Local\Temp\8066.tmp"73⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\80B4.tmp"C:\Users\Admin\AppData\Local\Temp\80B4.tmp"74⤵PID:32
-
C:\Users\Admin\AppData\Local\Temp\8112.tmp"C:\Users\Admin\AppData\Local\Temp\8112.tmp"75⤵
- System Location Discovery: System Language Discovery
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\819F.tmp"C:\Users\Admin\AppData\Local\Temp\819F.tmp"76⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\820C.tmp"C:\Users\Admin\AppData\Local\Temp\820C.tmp"77⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\826A.tmp"C:\Users\Admin\AppData\Local\Temp\826A.tmp"78⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\82C7.tmp"C:\Users\Admin\AppData\Local\Temp\82C7.tmp"79⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\8325.tmp"C:\Users\Admin\AppData\Local\Temp\8325.tmp"80⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\8393.tmp"C:\Users\Admin\AppData\Local\Temp\8393.tmp"81⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\83F0.tmp"C:\Users\Admin\AppData\Local\Temp\83F0.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\843E.tmp"C:\Users\Admin\AppData\Local\Temp\843E.tmp"83⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\849C.tmp"C:\Users\Admin\AppData\Local\Temp\849C.tmp"84⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\84FA.tmp"C:\Users\Admin\AppData\Local\Temp\84FA.tmp"85⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\8558.tmp"C:\Users\Admin\AppData\Local\Temp\8558.tmp"86⤵
- System Location Discovery: System Language Discovery
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\85A6.tmp"C:\Users\Admin\AppData\Local\Temp\85A6.tmp"87⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\8613.tmp"C:\Users\Admin\AppData\Local\Temp\8613.tmp"88⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\8681.tmp"C:\Users\Admin\AppData\Local\Temp\8681.tmp"89⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\86EE.tmp"C:\Users\Admin\AppData\Local\Temp\86EE.tmp"90⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\875B.tmp"C:\Users\Admin\AppData\Local\Temp\875B.tmp"91⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\87C9.tmp"C:\Users\Admin\AppData\Local\Temp\87C9.tmp"92⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\8836.tmp"C:\Users\Admin\AppData\Local\Temp\8836.tmp"93⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\88A3.tmp"C:\Users\Admin\AppData\Local\Temp\88A3.tmp"94⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\8911.tmp"C:\Users\Admin\AppData\Local\Temp\8911.tmp"95⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\895F.tmp"C:\Users\Admin\AppData\Local\Temp\895F.tmp"96⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\89BD.tmp"C:\Users\Admin\AppData\Local\Temp\89BD.tmp"97⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\8A1A.tmp"C:\Users\Admin\AppData\Local\Temp\8A1A.tmp"98⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\8A88.tmp"C:\Users\Admin\AppData\Local\Temp\8A88.tmp"99⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\8AE6.tmp"C:\Users\Admin\AppData\Local\Temp\8AE6.tmp"100⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\8B53.tmp"C:\Users\Admin\AppData\Local\Temp\8B53.tmp"101⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\8BA1.tmp"C:\Users\Admin\AppData\Local\Temp\8BA1.tmp"102⤵
- System Location Discovery: System Language Discovery
PID:440 -
C:\Users\Admin\AppData\Local\Temp\8C1E.tmp"C:\Users\Admin\AppData\Local\Temp\8C1E.tmp"103⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\8C6C.tmp"C:\Users\Admin\AppData\Local\Temp\8C6C.tmp"104⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\8CBA.tmp"C:\Users\Admin\AppData\Local\Temp\8CBA.tmp"105⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\8D08.tmp"C:\Users\Admin\AppData\Local\Temp\8D08.tmp"106⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\8D76.tmp"C:\Users\Admin\AppData\Local\Temp\8D76.tmp"107⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\8DD4.tmp"C:\Users\Admin\AppData\Local\Temp\8DD4.tmp"108⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\8E22.tmp"C:\Users\Admin\AppData\Local\Temp\8E22.tmp"109⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\8E8F.tmp"C:\Users\Admin\AppData\Local\Temp\8E8F.tmp"110⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\8EED.tmp"C:\Users\Admin\AppData\Local\Temp\8EED.tmp"111⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\8F4B.tmp"C:\Users\Admin\AppData\Local\Temp\8F4B.tmp"112⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\8FA8.tmp"C:\Users\Admin\AppData\Local\Temp\8FA8.tmp"113⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\8FF6.tmp"C:\Users\Admin\AppData\Local\Temp\8FF6.tmp"114⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\9054.tmp"C:\Users\Admin\AppData\Local\Temp\9054.tmp"115⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\90A2.tmp"C:\Users\Admin\AppData\Local\Temp\90A2.tmp"116⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\9100.tmp"C:\Users\Admin\AppData\Local\Temp\9100.tmp"117⤵
- System Location Discovery: System Language Discovery
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\916D.tmp"C:\Users\Admin\AppData\Local\Temp\916D.tmp"118⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\91CB.tmp"C:\Users\Admin\AppData\Local\Temp\91CB.tmp"119⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\9229.tmp"C:\Users\Admin\AppData\Local\Temp\9229.tmp"120⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\9277.tmp"C:\Users\Admin\AppData\Local\Temp\9277.tmp"121⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\92C5.tmp"C:\Users\Admin\AppData\Local\Temp\92C5.tmp"122⤵PID:2208
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-