Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01/09/2024, 06:12
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-01_e7334e495ca720a255d73cc17d66fe2a_mafia.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-09-01_e7334e495ca720a255d73cc17d66fe2a_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-01_e7334e495ca720a255d73cc17d66fe2a_mafia.exe
-
Size
530KB
-
MD5
e7334e495ca720a255d73cc17d66fe2a
-
SHA1
42ca69fc1d4d94bbabfc71b2c48f5d17f1fa74b2
-
SHA256
d865d1e762e93b3869b8cceaef0062d8d990931178d9d112fe8bec5ad061a944
-
SHA512
2c90528392d02daf89e6582c14afd1dfc62609183a352270e5e6aef47b2a4176de81693e18b7c7bc0a3778b390e9d2fd8d2432043deb0767e8fe1d27893b620a
-
SSDEEP
12288:AU5rCOTeioBeLf9MgY1hupYe+PEZfINZulFVg0M1:AUQOJoBeLi3ulCNclFV/M1
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3560 79F3.tmp 4112 7A70.tmp 2464 7AFC.tmp 1344 7B89.tmp 3736 7C15.tmp 220 7CA2.tmp 3636 7D0F.tmp 4960 7DAC.tmp 1340 7E29.tmp 2972 7EB5.tmp 1984 7F61.tmp 2128 7FFD.tmp 4760 805B.tmp 3316 80B9.tmp 1032 8117.tmp 4632 8184.tmp 2208 8211.tmp 928 828E.tmp 2132 82FB.tmp 1836 8378.tmp 4844 8414.tmp 3548 84A1.tmp 4092 850E.tmp 3660 858B.tmp 3772 8608.tmp 1880 8656.tmp 3380 86C4.tmp 4068 8760.tmp 4560 87BE.tmp 5000 884A.tmp 1008 88B8.tmp 3828 8916.tmp 4484 89A2.tmp 4916 8A10.tmp 3496 8A5E.tmp 1416 8ACB.tmp 4832 8B29.tmp 5080 8B77.tmp 2852 8BD5.tmp 4980 8C42.tmp 1440 8CAF.tmp 5032 8D0D.tmp 768 8D6B.tmp 1752 8DC9.tmp 3704 8E26.tmp 4680 8E84.tmp 1652 8EE2.tmp 2128 8F40.tmp 1764 8F9D.tmp 4908 900B.tmp 2704 9069.tmp 2720 90E6.tmp 3288 9143.tmp 1644 91A1.tmp 2280 91FF.tmp 4968 925D.tmp 4796 92AB.tmp 1680 9308.tmp 4556 9366.tmp 528 93C4.tmp 4360 9422.tmp 624 947F.tmp 4576 94DD.tmp 3960 953B.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 673.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2536.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A24B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B561.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A930.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E55F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1279.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A41F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8623.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D666.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 896F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC61.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4428.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC29.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2016.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB0E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F48.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F31A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C1C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1827.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BC7.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3272 wrote to memory of 3560 3272 2024-09-01_e7334e495ca720a255d73cc17d66fe2a_mafia.exe 84 PID 3272 wrote to memory of 3560 3272 2024-09-01_e7334e495ca720a255d73cc17d66fe2a_mafia.exe 84 PID 3272 wrote to memory of 3560 3272 2024-09-01_e7334e495ca720a255d73cc17d66fe2a_mafia.exe 84 PID 3560 wrote to memory of 4112 3560 79F3.tmp 85 PID 3560 wrote to memory of 4112 3560 79F3.tmp 85 PID 3560 wrote to memory of 4112 3560 79F3.tmp 85 PID 4112 wrote to memory of 2464 4112 7A70.tmp 86 PID 4112 wrote to memory of 2464 4112 7A70.tmp 86 PID 4112 wrote to memory of 2464 4112 7A70.tmp 86 PID 2464 wrote to memory of 1344 2464 7AFC.tmp 88 PID 2464 wrote to memory of 1344 2464 7AFC.tmp 88 PID 2464 wrote to memory of 1344 2464 7AFC.tmp 88 PID 1344 wrote to memory of 3736 1344 7B89.tmp 89 PID 1344 wrote to memory of 3736 1344 7B89.tmp 89 PID 1344 wrote to memory of 3736 1344 7B89.tmp 89 PID 3736 wrote to memory of 220 3736 7C15.tmp 91 PID 3736 wrote to memory of 220 3736 7C15.tmp 91 PID 3736 wrote to memory of 220 3736 7C15.tmp 91 PID 220 wrote to memory of 3636 220 7CA2.tmp 93 PID 220 wrote to memory of 3636 220 7CA2.tmp 93 PID 220 wrote to memory of 3636 220 7CA2.tmp 93 PID 3636 wrote to memory of 4960 3636 7D0F.tmp 94 PID 3636 wrote to memory of 4960 3636 7D0F.tmp 94 PID 3636 wrote to memory of 4960 3636 7D0F.tmp 94 PID 4960 wrote to memory of 1340 4960 7DAC.tmp 95 PID 4960 wrote to memory of 1340 4960 7DAC.tmp 95 PID 4960 wrote to memory of 1340 4960 7DAC.tmp 95 PID 1340 wrote to memory of 2972 1340 7E29.tmp 96 PID 1340 wrote to memory of 2972 1340 7E29.tmp 96 PID 1340 wrote to memory of 2972 1340 7E29.tmp 96 PID 2972 wrote to memory of 1984 2972 7EB5.tmp 97 PID 2972 wrote to memory of 1984 2972 7EB5.tmp 97 PID 2972 wrote to memory of 1984 2972 7EB5.tmp 97 PID 1984 wrote to memory of 2128 1984 7F61.tmp 98 PID 1984 wrote to memory of 2128 1984 7F61.tmp 98 PID 1984 wrote to memory of 2128 1984 7F61.tmp 98 PID 2128 wrote to memory of 4760 2128 7FFD.tmp 99 PID 2128 wrote to memory of 4760 2128 7FFD.tmp 99 PID 2128 wrote to memory of 4760 2128 7FFD.tmp 99 PID 4760 wrote to memory of 3316 4760 805B.tmp 100 PID 4760 wrote to memory of 3316 4760 805B.tmp 100 PID 4760 wrote to memory of 3316 4760 805B.tmp 100 PID 3316 wrote to memory of 1032 3316 80B9.tmp 101 PID 3316 wrote to memory of 1032 3316 80B9.tmp 101 PID 3316 wrote to memory of 1032 3316 80B9.tmp 101 PID 1032 wrote to memory of 4632 1032 8117.tmp 102 PID 1032 wrote to memory of 4632 1032 8117.tmp 102 PID 1032 wrote to memory of 4632 1032 8117.tmp 102 PID 4632 wrote to memory of 2208 4632 8184.tmp 103 PID 4632 wrote to memory of 2208 4632 8184.tmp 103 PID 4632 wrote to memory of 2208 4632 8184.tmp 103 PID 2208 wrote to memory of 928 2208 8211.tmp 104 PID 2208 wrote to memory of 928 2208 8211.tmp 104 PID 2208 wrote to memory of 928 2208 8211.tmp 104 PID 928 wrote to memory of 2132 928 828E.tmp 105 PID 928 wrote to memory of 2132 928 828E.tmp 105 PID 928 wrote to memory of 2132 928 828E.tmp 105 PID 2132 wrote to memory of 1836 2132 82FB.tmp 106 PID 2132 wrote to memory of 1836 2132 82FB.tmp 106 PID 2132 wrote to memory of 1836 2132 82FB.tmp 106 PID 1836 wrote to memory of 4844 1836 8378.tmp 107 PID 1836 wrote to memory of 4844 1836 8378.tmp 107 PID 1836 wrote to memory of 4844 1836 8378.tmp 107 PID 4844 wrote to memory of 3548 4844 8414.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-01_e7334e495ca720a255d73cc17d66fe2a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-01_e7334e495ca720a255d73cc17d66fe2a_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\79F3.tmp"C:\Users\Admin\AppData\Local\Temp\79F3.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\7A70.tmp"C:\Users\Admin\AppData\Local\Temp\7A70.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\7B89.tmp"C:\Users\Admin\AppData\Local\Temp\7B89.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\7C15.tmp"C:\Users\Admin\AppData\Local\Temp\7C15.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\7E29.tmp"C:\Users\Admin\AppData\Local\Temp\7E29.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\7EB5.tmp"C:\Users\Admin\AppData\Local\Temp\7EB5.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\7F61.tmp"C:\Users\Admin\AppData\Local\Temp\7F61.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\805B.tmp"C:\Users\Admin\AppData\Local\Temp\805B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\80B9.tmp"C:\Users\Admin\AppData\Local\Temp\80B9.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\8117.tmp"C:\Users\Admin\AppData\Local\Temp\8117.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\8184.tmp"C:\Users\Admin\AppData\Local\Temp\8184.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\8211.tmp"C:\Users\Admin\AppData\Local\Temp\8211.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\828E.tmp"C:\Users\Admin\AppData\Local\Temp\828E.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Users\Admin\AppData\Local\Temp\82FB.tmp"C:\Users\Admin\AppData\Local\Temp\82FB.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\8378.tmp"C:\Users\Admin\AppData\Local\Temp\8378.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\8414.tmp"C:\Users\Admin\AppData\Local\Temp\8414.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\84A1.tmp"C:\Users\Admin\AppData\Local\Temp\84A1.tmp"23⤵
- Executes dropped EXE
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\850E.tmp"C:\Users\Admin\AppData\Local\Temp\850E.tmp"24⤵
- Executes dropped EXE
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\858B.tmp"C:\Users\Admin\AppData\Local\Temp\858B.tmp"25⤵
- Executes dropped EXE
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\8608.tmp"C:\Users\Admin\AppData\Local\Temp\8608.tmp"26⤵
- Executes dropped EXE
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\8656.tmp"C:\Users\Admin\AppData\Local\Temp\8656.tmp"27⤵
- Executes dropped EXE
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\86C4.tmp"C:\Users\Admin\AppData\Local\Temp\86C4.tmp"28⤵
- Executes dropped EXE
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\8760.tmp"C:\Users\Admin\AppData\Local\Temp\8760.tmp"29⤵
- Executes dropped EXE
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\87BE.tmp"C:\Users\Admin\AppData\Local\Temp\87BE.tmp"30⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\884A.tmp"C:\Users\Admin\AppData\Local\Temp\884A.tmp"31⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\88B8.tmp"C:\Users\Admin\AppData\Local\Temp\88B8.tmp"32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\8916.tmp"C:\Users\Admin\AppData\Local\Temp\8916.tmp"33⤵
- Executes dropped EXE
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\89A2.tmp"C:\Users\Admin\AppData\Local\Temp\89A2.tmp"34⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\8A10.tmp"C:\Users\Admin\AppData\Local\Temp\8A10.tmp"35⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"36⤵
- Executes dropped EXE
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"37⤵
- Executes dropped EXE
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\8B29.tmp"C:\Users\Admin\AppData\Local\Temp\8B29.tmp"38⤵
- Executes dropped EXE
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\8B77.tmp"C:\Users\Admin\AppData\Local\Temp\8B77.tmp"39⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"40⤵
- Executes dropped EXE
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\8C42.tmp"C:\Users\Admin\AppData\Local\Temp\8C42.tmp"41⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\8CAF.tmp"C:\Users\Admin\AppData\Local\Temp\8CAF.tmp"42⤵
- Executes dropped EXE
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"43⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"44⤵
- Executes dropped EXE
PID:768 -
C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"45⤵
- Executes dropped EXE
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\8E26.tmp"C:\Users\Admin\AppData\Local\Temp\8E26.tmp"46⤵
- Executes dropped EXE
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\8E84.tmp"C:\Users\Admin\AppData\Local\Temp\8E84.tmp"47⤵
- Executes dropped EXE
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\8EE2.tmp"C:\Users\Admin\AppData\Local\Temp\8EE2.tmp"48⤵
- Executes dropped EXE
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\8F40.tmp"C:\Users\Admin\AppData\Local\Temp\8F40.tmp"49⤵
- Executes dropped EXE
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"50⤵
- Executes dropped EXE
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\900B.tmp"C:\Users\Admin\AppData\Local\Temp\900B.tmp"51⤵
- Executes dropped EXE
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\9069.tmp"C:\Users\Admin\AppData\Local\Temp\9069.tmp"52⤵
- Executes dropped EXE
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\90E6.tmp"C:\Users\Admin\AppData\Local\Temp\90E6.tmp"53⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\9143.tmp"C:\Users\Admin\AppData\Local\Temp\9143.tmp"54⤵
- Executes dropped EXE
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\91A1.tmp"C:\Users\Admin\AppData\Local\Temp\91A1.tmp"55⤵
- Executes dropped EXE
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\91FF.tmp"C:\Users\Admin\AppData\Local\Temp\91FF.tmp"56⤵
- Executes dropped EXE
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\925D.tmp"C:\Users\Admin\AppData\Local\Temp\925D.tmp"57⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\92AB.tmp"C:\Users\Admin\AppData\Local\Temp\92AB.tmp"58⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\9308.tmp"C:\Users\Admin\AppData\Local\Temp\9308.tmp"59⤵
- Executes dropped EXE
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\9366.tmp"C:\Users\Admin\AppData\Local\Temp\9366.tmp"60⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\93C4.tmp"C:\Users\Admin\AppData\Local\Temp\93C4.tmp"61⤵
- Executes dropped EXE
PID:528 -
C:\Users\Admin\AppData\Local\Temp\9422.tmp"C:\Users\Admin\AppData\Local\Temp\9422.tmp"62⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\947F.tmp"C:\Users\Admin\AppData\Local\Temp\947F.tmp"63⤵
- Executes dropped EXE
PID:624 -
C:\Users\Admin\AppData\Local\Temp\94DD.tmp"C:\Users\Admin\AppData\Local\Temp\94DD.tmp"64⤵
- Executes dropped EXE
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\953B.tmp"C:\Users\Admin\AppData\Local\Temp\953B.tmp"65⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\95A8.tmp"C:\Users\Admin\AppData\Local\Temp\95A8.tmp"66⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\9616.tmp"C:\Users\Admin\AppData\Local\Temp\9616.tmp"67⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\9673.tmp"C:\Users\Admin\AppData\Local\Temp\9673.tmp"68⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\96D1.tmp"C:\Users\Admin\AppData\Local\Temp\96D1.tmp"69⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\972F.tmp"C:\Users\Admin\AppData\Local\Temp\972F.tmp"70⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\979C.tmp"C:\Users\Admin\AppData\Local\Temp\979C.tmp"71⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\97FA.tmp"C:\Users\Admin\AppData\Local\Temp\97FA.tmp"72⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\9858.tmp"C:\Users\Admin\AppData\Local\Temp\9858.tmp"73⤵PID:720
-
C:\Users\Admin\AppData\Local\Temp\98B6.tmp"C:\Users\Admin\AppData\Local\Temp\98B6.tmp"74⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\9913.tmp"C:\Users\Admin\AppData\Local\Temp\9913.tmp"75⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\9971.tmp"C:\Users\Admin\AppData\Local\Temp\9971.tmp"76⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\99CF.tmp"C:\Users\Admin\AppData\Local\Temp\99CF.tmp"77⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"78⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"79⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"80⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"81⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"82⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\9C01.tmp"C:\Users\Admin\AppData\Local\Temp\9C01.tmp"83⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"84⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"85⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"86⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\9D69.tmp"C:\Users\Admin\AppData\Local\Temp\9D69.tmp"87⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"88⤵PID:100
-
C:\Users\Admin\AppData\Local\Temp\9E24.tmp"C:\Users\Admin\AppData\Local\Temp\9E24.tmp"89⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\9E92.tmp"C:\Users\Admin\AppData\Local\Temp\9E92.tmp"90⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"91⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"92⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"93⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\A028.tmp"C:\Users\Admin\AppData\Local\Temp\A028.tmp"94⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\A086.tmp"C:\Users\Admin\AppData\Local\Temp\A086.tmp"95⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"96⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\A141.tmp"C:\Users\Admin\AppData\Local\Temp\A141.tmp"97⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\A19F.tmp"C:\Users\Admin\AppData\Local\Temp\A19F.tmp"98⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"99⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\A24B.tmp"C:\Users\Admin\AppData\Local\Temp\A24B.tmp"100⤵
- System Location Discovery: System Language Discovery
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\A299.tmp"C:\Users\Admin\AppData\Local\Temp\A299.tmp"101⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"102⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\A354.tmp"C:\Users\Admin\AppData\Local\Temp\A354.tmp"103⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"104⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\A41F.tmp"C:\Users\Admin\AppData\Local\Temp\A41F.tmp"105⤵
- System Location Discovery: System Language Discovery
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\A47D.tmp"C:\Users\Admin\AppData\Local\Temp\A47D.tmp"106⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"107⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\A529.tmp"C:\Users\Admin\AppData\Local\Temp\A529.tmp"108⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\A596.tmp"C:\Users\Admin\AppData\Local\Temp\A596.tmp"109⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"110⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\A652.tmp"C:\Users\Admin\AppData\Local\Temp\A652.tmp"111⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"112⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"113⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\A74C.tmp"C:\Users\Admin\AppData\Local\Temp\A74C.tmp"114⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"115⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\A817.tmp"C:\Users\Admin\AppData\Local\Temp\A817.tmp"116⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\A865.tmp"C:\Users\Admin\AppData\Local\Temp\A865.tmp"117⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"118⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\A930.tmp"C:\Users\Admin\AppData\Local\Temp\A930.tmp"119⤵
- System Location Discovery: System Language Discovery
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\A98E.tmp"C:\Users\Admin\AppData\Local\Temp\A98E.tmp"120⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"121⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"122⤵PID:612
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-