Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
13/09/2024, 08:59
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-13_8782efe2d5bc7dfccb84cb749e540415_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-09-13_8782efe2d5bc7dfccb84cb749e540415_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-13_8782efe2d5bc7dfccb84cb749e540415_mafia.exe
-
Size
520KB
-
MD5
8782efe2d5bc7dfccb84cb749e540415
-
SHA1
3e0188b4877fc8988b87949c9e7494a65ebd653c
-
SHA256
9fa2c0ee6a1a1d758a3f88cc5b976f1cecbd77d40071b27fe176967669eb642b
-
SHA512
04367fbd4556f7ab3b9ac8c5fae08994e6f9a78eaa707e4fd9c3d4b37affb1b2c1a002fd025a4005ca01584be51f8dd51fb70d4a6a328386d58a6dc34b6dba1b
-
SSDEEP
12288:gj8fuxR21t5i8fAEGjC4as6XuZbPe+jUo21JT9JIYrHKNZ:gj8fuK1GYAEGjC4ZZbPe+oUHN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2644 DA04.tmp 3092 DA72.tmp 1524 DACF.tmp 4960 DB5C.tmp 3940 DBC9.tmp 1668 DC18.tmp 4808 DC85.tmp 2428 DD02.tmp 3528 DD50.tmp 3352 DDAE.tmp 2896 DDFC.tmp 1688 DE5A.tmp 3452 DEC7.tmp 3980 DF15.tmp 3096 DF73.tmp 908 DFC1.tmp 1692 E01F.tmp 3744 E08C.tmp 2076 E0FA.tmp 3880 E148.tmp 3040 E196.tmp 1456 E203.tmp 4484 E271.tmp 3612 E2BF.tmp 2672 E30D.tmp 3436 E37A.tmp 996 E3C8.tmp 4672 E436.tmp 1840 E4A3.tmp 4680 E501.tmp 3804 E57E.tmp 116 E5FB.tmp 4208 E678.tmp 2568 E6C6.tmp 2216 E724.tmp 2820 E772.tmp 1852 E7DF.tmp 4976 E82D.tmp 3168 E87B.tmp 2332 E8CA.tmp 4984 E918.tmp 2744 E975.tmp 2380 E9C4.tmp 1100 EA12.tmp 4568 EA7F.tmp 3312 EACD.tmp 3916 EB1B.tmp 2540 EB69.tmp 4696 EBC7.tmp 2536 EC15.tmp 1872 EC73.tmp 3368 ECD1.tmp 1208 ED1F.tmp 864 ED6D.tmp 1080 EDBB.tmp 4288 EE09.tmp 2040 EE67.tmp 1056 EEB5.tmp 2368 EF03.tmp 2980 EF51.tmp 1808 EFA0.tmp 1248 EFDE.tmp 2588 F03C.tmp 1976 F08A.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F42.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6ADA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4198.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C147.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2006.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 139E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 146D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F690.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7191.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F29.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 863.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F58.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F89.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2CF7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E2D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 814.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5EE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4457.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E46F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5FDE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2824 wrote to memory of 2644 2824 2024-09-13_8782efe2d5bc7dfccb84cb749e540415_mafia.exe 85 PID 2824 wrote to memory of 2644 2824 2024-09-13_8782efe2d5bc7dfccb84cb749e540415_mafia.exe 85 PID 2824 wrote to memory of 2644 2824 2024-09-13_8782efe2d5bc7dfccb84cb749e540415_mafia.exe 85 PID 2644 wrote to memory of 3092 2644 DA04.tmp 87 PID 2644 wrote to memory of 3092 2644 DA04.tmp 87 PID 2644 wrote to memory of 3092 2644 DA04.tmp 87 PID 3092 wrote to memory of 1524 3092 DA72.tmp 88 PID 3092 wrote to memory of 1524 3092 DA72.tmp 88 PID 3092 wrote to memory of 1524 3092 DA72.tmp 88 PID 1524 wrote to memory of 4960 1524 DACF.tmp 90 PID 1524 wrote to memory of 4960 1524 DACF.tmp 90 PID 1524 wrote to memory of 4960 1524 DACF.tmp 90 PID 4960 wrote to memory of 3940 4960 DB5C.tmp 92 PID 4960 wrote to memory of 3940 4960 DB5C.tmp 92 PID 4960 wrote to memory of 3940 4960 DB5C.tmp 92 PID 3940 wrote to memory of 1668 3940 DBC9.tmp 93 PID 3940 wrote to memory of 1668 3940 DBC9.tmp 93 PID 3940 wrote to memory of 1668 3940 DBC9.tmp 93 PID 1668 wrote to memory of 4808 1668 DC18.tmp 94 PID 1668 wrote to memory of 4808 1668 DC18.tmp 94 PID 1668 wrote to memory of 4808 1668 DC18.tmp 94 PID 4808 wrote to memory of 2428 4808 DC85.tmp 95 PID 4808 wrote to memory of 2428 4808 DC85.tmp 95 PID 4808 wrote to memory of 2428 4808 DC85.tmp 95 PID 2428 wrote to memory of 3528 2428 DD02.tmp 96 PID 2428 wrote to memory of 3528 2428 DD02.tmp 96 PID 2428 wrote to memory of 3528 2428 DD02.tmp 96 PID 3528 wrote to memory of 3352 3528 DD50.tmp 97 PID 3528 wrote to memory of 3352 3528 DD50.tmp 97 PID 3528 wrote to memory of 3352 3528 DD50.tmp 97 PID 3352 wrote to memory of 2896 3352 DDAE.tmp 98 PID 3352 wrote to memory of 2896 3352 DDAE.tmp 98 PID 3352 wrote to memory of 2896 3352 DDAE.tmp 98 PID 2896 wrote to memory of 1688 2896 DDFC.tmp 99 PID 2896 wrote to memory of 1688 2896 DDFC.tmp 99 PID 2896 wrote to memory of 1688 2896 DDFC.tmp 99 PID 1688 wrote to memory of 3452 1688 DE5A.tmp 100 PID 1688 wrote to memory of 3452 1688 DE5A.tmp 100 PID 1688 wrote to memory of 3452 1688 DE5A.tmp 100 PID 3452 wrote to memory of 3980 3452 DEC7.tmp 101 PID 3452 wrote to memory of 3980 3452 DEC7.tmp 101 PID 3452 wrote to memory of 3980 3452 DEC7.tmp 101 PID 3980 wrote to memory of 3096 3980 DF15.tmp 102 PID 3980 wrote to memory of 3096 3980 DF15.tmp 102 PID 3980 wrote to memory of 3096 3980 DF15.tmp 102 PID 3096 wrote to memory of 908 3096 DF73.tmp 103 PID 3096 wrote to memory of 908 3096 DF73.tmp 103 PID 3096 wrote to memory of 908 3096 DF73.tmp 103 PID 908 wrote to memory of 1692 908 DFC1.tmp 104 PID 908 wrote to memory of 1692 908 DFC1.tmp 104 PID 908 wrote to memory of 1692 908 DFC1.tmp 104 PID 1692 wrote to memory of 3744 1692 E01F.tmp 105 PID 1692 wrote to memory of 3744 1692 E01F.tmp 105 PID 1692 wrote to memory of 3744 1692 E01F.tmp 105 PID 3744 wrote to memory of 2076 3744 E08C.tmp 106 PID 3744 wrote to memory of 2076 3744 E08C.tmp 106 PID 3744 wrote to memory of 2076 3744 E08C.tmp 106 PID 2076 wrote to memory of 3880 2076 E0FA.tmp 107 PID 2076 wrote to memory of 3880 2076 E0FA.tmp 107 PID 2076 wrote to memory of 3880 2076 E0FA.tmp 107 PID 3880 wrote to memory of 3040 3880 E148.tmp 108 PID 3880 wrote to memory of 3040 3880 E148.tmp 108 PID 3880 wrote to memory of 3040 3880 E148.tmp 108 PID 3040 wrote to memory of 1456 3040 E196.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_8782efe2d5bc7dfccb84cb749e540415_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-13_8782efe2d5bc7dfccb84cb749e540415_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\DA04.tmp"C:\Users\Admin\AppData\Local\Temp\DA04.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\DA72.tmp"C:\Users\Admin\AppData\Local\Temp\DA72.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\DACF.tmp"C:\Users\Admin\AppData\Local\Temp\DACF.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\DB5C.tmp"C:\Users\Admin\AppData\Local\Temp\DB5C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\DBC9.tmp"C:\Users\Admin\AppData\Local\Temp\DBC9.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\DC18.tmp"C:\Users\Admin\AppData\Local\Temp\DC18.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\DC85.tmp"C:\Users\Admin\AppData\Local\Temp\DC85.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\DD02.tmp"C:\Users\Admin\AppData\Local\Temp\DD02.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\DD50.tmp"C:\Users\Admin\AppData\Local\Temp\DD50.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\DDAE.tmp"C:\Users\Admin\AppData\Local\Temp\DDAE.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\DDFC.tmp"C:\Users\Admin\AppData\Local\Temp\DDFC.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\DE5A.tmp"C:\Users\Admin\AppData\Local\Temp\DE5A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\DEC7.tmp"C:\Users\Admin\AppData\Local\Temp\DEC7.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\DF15.tmp"C:\Users\Admin\AppData\Local\Temp\DF15.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\DF73.tmp"C:\Users\Admin\AppData\Local\Temp\DF73.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\DFC1.tmp"C:\Users\Admin\AppData\Local\Temp\DFC1.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Users\Admin\AppData\Local\Temp\E01F.tmp"C:\Users\Admin\AppData\Local\Temp\E01F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\E08C.tmp"C:\Users\Admin\AppData\Local\Temp\E08C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\E0FA.tmp"C:\Users\Admin\AppData\Local\Temp\E0FA.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\E148.tmp"C:\Users\Admin\AppData\Local\Temp\E148.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\E196.tmp"C:\Users\Admin\AppData\Local\Temp\E196.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\E203.tmp"C:\Users\Admin\AppData\Local\Temp\E203.tmp"23⤵
- Executes dropped EXE
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\E271.tmp"C:\Users\Admin\AppData\Local\Temp\E271.tmp"24⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\E2BF.tmp"C:\Users\Admin\AppData\Local\Temp\E2BF.tmp"25⤵
- Executes dropped EXE
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\E30D.tmp"C:\Users\Admin\AppData\Local\Temp\E30D.tmp"26⤵
- Executes dropped EXE
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\E37A.tmp"C:\Users\Admin\AppData\Local\Temp\E37A.tmp"27⤵
- Executes dropped EXE
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\E3C8.tmp"C:\Users\Admin\AppData\Local\Temp\E3C8.tmp"28⤵
- Executes dropped EXE
PID:996 -
C:\Users\Admin\AppData\Local\Temp\E436.tmp"C:\Users\Admin\AppData\Local\Temp\E436.tmp"29⤵
- Executes dropped EXE
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\E4A3.tmp"C:\Users\Admin\AppData\Local\Temp\E4A3.tmp"30⤵
- Executes dropped EXE
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\E501.tmp"C:\Users\Admin\AppData\Local\Temp\E501.tmp"31⤵
- Executes dropped EXE
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\E57E.tmp"C:\Users\Admin\AppData\Local\Temp\E57E.tmp"32⤵
- Executes dropped EXE
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\E5FB.tmp"C:\Users\Admin\AppData\Local\Temp\E5FB.tmp"33⤵
- Executes dropped EXE
PID:116 -
C:\Users\Admin\AppData\Local\Temp\E678.tmp"C:\Users\Admin\AppData\Local\Temp\E678.tmp"34⤵
- Executes dropped EXE
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\E6C6.tmp"C:\Users\Admin\AppData\Local\Temp\E6C6.tmp"35⤵
- Executes dropped EXE
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\E724.tmp"C:\Users\Admin\AppData\Local\Temp\E724.tmp"36⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\E772.tmp"C:\Users\Admin\AppData\Local\Temp\E772.tmp"37⤵
- Executes dropped EXE
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\E7DF.tmp"C:\Users\Admin\AppData\Local\Temp\E7DF.tmp"38⤵
- Executes dropped EXE
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\E82D.tmp"C:\Users\Admin\AppData\Local\Temp\E82D.tmp"39⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\E87B.tmp"C:\Users\Admin\AppData\Local\Temp\E87B.tmp"40⤵
- Executes dropped EXE
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\E8CA.tmp"C:\Users\Admin\AppData\Local\Temp\E8CA.tmp"41⤵
- Executes dropped EXE
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\E918.tmp"C:\Users\Admin\AppData\Local\Temp\E918.tmp"42⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\E975.tmp"C:\Users\Admin\AppData\Local\Temp\E975.tmp"43⤵
- Executes dropped EXE
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\E9C4.tmp"C:\Users\Admin\AppData\Local\Temp\E9C4.tmp"44⤵
- Executes dropped EXE
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\EA12.tmp"C:\Users\Admin\AppData\Local\Temp\EA12.tmp"45⤵
- Executes dropped EXE
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\EA7F.tmp"C:\Users\Admin\AppData\Local\Temp\EA7F.tmp"46⤵
- Executes dropped EXE
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\EACD.tmp"C:\Users\Admin\AppData\Local\Temp\EACD.tmp"47⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\EB1B.tmp"C:\Users\Admin\AppData\Local\Temp\EB1B.tmp"48⤵
- Executes dropped EXE
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\EB69.tmp"C:\Users\Admin\AppData\Local\Temp\EB69.tmp"49⤵
- Executes dropped EXE
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\EBC7.tmp"C:\Users\Admin\AppData\Local\Temp\EBC7.tmp"50⤵
- Executes dropped EXE
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\EC15.tmp"C:\Users\Admin\AppData\Local\Temp\EC15.tmp"51⤵
- Executes dropped EXE
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\EC73.tmp"C:\Users\Admin\AppData\Local\Temp\EC73.tmp"52⤵
- Executes dropped EXE
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\ECD1.tmp"C:\Users\Admin\AppData\Local\Temp\ECD1.tmp"53⤵
- Executes dropped EXE
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\ED1F.tmp"C:\Users\Admin\AppData\Local\Temp\ED1F.tmp"54⤵
- Executes dropped EXE
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\ED6D.tmp"C:\Users\Admin\AppData\Local\Temp\ED6D.tmp"55⤵
- Executes dropped EXE
PID:864 -
C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"56⤵
- Executes dropped EXE
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\EE09.tmp"C:\Users\Admin\AppData\Local\Temp\EE09.tmp"57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\EE67.tmp"C:\Users\Admin\AppData\Local\Temp\EE67.tmp"58⤵
- Executes dropped EXE
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\EEB5.tmp"C:\Users\Admin\AppData\Local\Temp\EEB5.tmp"59⤵
- Executes dropped EXE
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\EF03.tmp"C:\Users\Admin\AppData\Local\Temp\EF03.tmp"60⤵
- Executes dropped EXE
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\EF51.tmp"C:\Users\Admin\AppData\Local\Temp\EF51.tmp"61⤵
- Executes dropped EXE
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\EFA0.tmp"C:\Users\Admin\AppData\Local\Temp\EFA0.tmp"62⤵
- Executes dropped EXE
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\EFDE.tmp"C:\Users\Admin\AppData\Local\Temp\EFDE.tmp"63⤵
- Executes dropped EXE
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\F03C.tmp"C:\Users\Admin\AppData\Local\Temp\F03C.tmp"64⤵
- Executes dropped EXE
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\F08A.tmp"C:\Users\Admin\AppData\Local\Temp\F08A.tmp"65⤵
- Executes dropped EXE
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\F0D8.tmp"C:\Users\Admin\AppData\Local\Temp\F0D8.tmp"66⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\F136.tmp"C:\Users\Admin\AppData\Local\Temp\F136.tmp"67⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\F184.tmp"C:\Users\Admin\AppData\Local\Temp\F184.tmp"68⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\F1E2.tmp"C:\Users\Admin\AppData\Local\Temp\F1E2.tmp"69⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\F230.tmp"C:\Users\Admin\AppData\Local\Temp\F230.tmp"70⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\F28E.tmp"C:\Users\Admin\AppData\Local\Temp\F28E.tmp"71⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\F2EB.tmp"C:\Users\Admin\AppData\Local\Temp\F2EB.tmp"72⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\F349.tmp"C:\Users\Admin\AppData\Local\Temp\F349.tmp"73⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\F3A7.tmp"C:\Users\Admin\AppData\Local\Temp\F3A7.tmp"74⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\F405.tmp"C:\Users\Admin\AppData\Local\Temp\F405.tmp"75⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\F453.tmp"C:\Users\Admin\AppData\Local\Temp\F453.tmp"76⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\F4B0.tmp"C:\Users\Admin\AppData\Local\Temp\F4B0.tmp"77⤵
- System Location Discovery: System Language Discovery
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\F4FF.tmp"C:\Users\Admin\AppData\Local\Temp\F4FF.tmp"78⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\F54D.tmp"C:\Users\Admin\AppData\Local\Temp\F54D.tmp"79⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\F59B.tmp"C:\Users\Admin\AppData\Local\Temp\F59B.tmp"80⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\F5E9.tmp"C:\Users\Admin\AppData\Local\Temp\F5E9.tmp"81⤵
- System Location Discovery: System Language Discovery
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\F637.tmp"C:\Users\Admin\AppData\Local\Temp\F637.tmp"82⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\F685.tmp"C:\Users\Admin\AppData\Local\Temp\F685.tmp"83⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\F6E3.tmp"C:\Users\Admin\AppData\Local\Temp\F6E3.tmp"84⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\F731.tmp"C:\Users\Admin\AppData\Local\Temp\F731.tmp"85⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\F77F.tmp"C:\Users\Admin\AppData\Local\Temp\F77F.tmp"86⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"87⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\F82B.tmp"C:\Users\Admin\AppData\Local\Temp\F82B.tmp"88⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\F879.tmp"C:\Users\Admin\AppData\Local\Temp\F879.tmp"89⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\F8D7.tmp"C:\Users\Admin\AppData\Local\Temp\F8D7.tmp"90⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\F935.tmp"C:\Users\Admin\AppData\Local\Temp\F935.tmp"91⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\F983.tmp"C:\Users\Admin\AppData\Local\Temp\F983.tmp"92⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\F9E1.tmp"C:\Users\Admin\AppData\Local\Temp\F9E1.tmp"93⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\FA3E.tmp"C:\Users\Admin\AppData\Local\Temp\FA3E.tmp"94⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\FA8C.tmp"C:\Users\Admin\AppData\Local\Temp\FA8C.tmp"95⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\FADB.tmp"C:\Users\Admin\AppData\Local\Temp\FADB.tmp"96⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\FB29.tmp"C:\Users\Admin\AppData\Local\Temp\FB29.tmp"97⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\FB77.tmp"C:\Users\Admin\AppData\Local\Temp\FB77.tmp"98⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\FBC5.tmp"C:\Users\Admin\AppData\Local\Temp\FBC5.tmp"99⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\FC23.tmp"C:\Users\Admin\AppData\Local\Temp\FC23.tmp"100⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\FC71.tmp"C:\Users\Admin\AppData\Local\Temp\FC71.tmp"101⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\FCCF.tmp"C:\Users\Admin\AppData\Local\Temp\FCCF.tmp"102⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\FD1D.tmp"C:\Users\Admin\AppData\Local\Temp\FD1D.tmp"103⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\FD7A.tmp"C:\Users\Admin\AppData\Local\Temp\FD7A.tmp"104⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\FDC9.tmp"C:\Users\Admin\AppData\Local\Temp\FDC9.tmp"105⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\FE26.tmp"C:\Users\Admin\AppData\Local\Temp\FE26.tmp"106⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\FE74.tmp"C:\Users\Admin\AppData\Local\Temp\FE74.tmp"107⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\FEC3.tmp"C:\Users\Admin\AppData\Local\Temp\FEC3.tmp"108⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\FF20.tmp"C:\Users\Admin\AppData\Local\Temp\FF20.tmp"109⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\FF7E.tmp"C:\Users\Admin\AppData\Local\Temp\FF7E.tmp"110⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\FFDC.tmp"C:\Users\Admin\AppData\Local\Temp\FFDC.tmp"111⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\2A.tmp"C:\Users\Admin\AppData\Local\Temp\2A.tmp"112⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\78.tmp"C:\Users\Admin\AppData\Local\Temp\78.tmp"113⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\D6.tmp"C:\Users\Admin\AppData\Local\Temp\D6.tmp"114⤵
- System Location Discovery: System Language Discovery
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\134.tmp"C:\Users\Admin\AppData\Local\Temp\134.tmp"115⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\191.tmp"C:\Users\Admin\AppData\Local\Temp\191.tmp"116⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\1EF.tmp"C:\Users\Admin\AppData\Local\Temp\1EF.tmp"117⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\23D.tmp"C:\Users\Admin\AppData\Local\Temp\23D.tmp"118⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\28B.tmp"C:\Users\Admin\AppData\Local\Temp\28B.tmp"119⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\2E9.tmp"C:\Users\Admin\AppData\Local\Temp\2E9.tmp"120⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\347.tmp"C:\Users\Admin\AppData\Local\Temp\347.tmp"121⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\3A5.tmp"C:\Users\Admin\AppData\Local\Temp\3A5.tmp"122⤵PID:3380
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-