Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2024, 03:54
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-19_518e36dd78801c19d703065d51b97f41_mafia.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-09-19_518e36dd78801c19d703065d51b97f41_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-19_518e36dd78801c19d703065d51b97f41_mafia.exe
-
Size
712KB
-
MD5
518e36dd78801c19d703065d51b97f41
-
SHA1
7f7024a6f8d2a4b4b5c9ad7252d4024496158965
-
SHA256
3c236b3de69e639f426edf6e2b63a873e4004b098ca54530ee69ce6eed79999d
-
SHA512
7fabd7467c208d81adb55e66f160c8bbba0898c873c511d8e4840124a4ae20b8d3d5bbee98dc6a01be21e6077f1373fbc9106663f4d0a91493a2267dd42384df
-
SSDEEP
12288:FU5rCOTeiDaLA7xPdHw6jMOl1y5aWI9wR/Ul8syZQhNZdCvq5TJLCvY90D8/LVBN:FUQOJDas1PIM45aWIWRcCsyZoNnCvq55
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4440 CA55.tmp 4720 CB10.tmp 4048 CB8D.tmp 1336 CC1A.tmp 4220 CC78.tmp 1092 CCE5.tmp 3660 CD43.tmp 4824 CDC0.tmp 4164 CE3D.tmp 4960 CEAA.tmp 4016 CF27.tmp 4244 CFB4.tmp 1740 D040.tmp 3576 D0AE.tmp 2520 D0FC.tmp 4544 D169.tmp 5068 D1C7.tmp 980 D225.tmp 5092 D292.tmp 4808 D30F.tmp 1548 D36D.tmp 5040 D3F9.tmp 2160 D476.tmp 2800 D503.tmp 4408 D580.tmp 2072 D5ED.tmp 1480 D67A.tmp 696 D6F7.tmp 3856 D764.tmp 4580 D7E1.tmp 3804 D87E.tmp 5020 D8DB.tmp 5084 D958.tmp 4968 D9A7.tmp 3332 D9F5.tmp 2100 DA52.tmp 3724 DAB0.tmp 1784 DAFE.tmp 4020 DB5C.tmp 5052 DBBA.tmp 2360 DC18.tmp 4256 DC66.tmp 3416 DCC3.tmp 4444 DD21.tmp 4716 DD7F.tmp 3436 DDDD.tmp 2516 DE3A.tmp 3228 DE98.tmp 2364 DEE6.tmp 1128 DF44.tmp 4396 DF92.tmp 3036 DFF0.tmp 2416 E04E.tmp 3276 E0AB.tmp 2200 E109.tmp 704 E167.tmp 4376 E1C5.tmp 3268 E222.tmp 2484 E280.tmp 544 E2CE.tmp 3376 E32C.tmp 1052 E37A.tmp 3720 E3C8.tmp 3784 E426.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2248.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1373.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B64B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E20E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C87B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B021.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 584C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 997C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3350.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5436.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4273.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1633.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B39B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 339E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A4E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E848.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACF4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E589.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4169.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 437C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D040.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 313C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 319A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 396A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 537A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 120C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F79A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE7.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 528 wrote to memory of 4440 528 2024-09-19_518e36dd78801c19d703065d51b97f41_mafia.exe 82 PID 528 wrote to memory of 4440 528 2024-09-19_518e36dd78801c19d703065d51b97f41_mafia.exe 82 PID 528 wrote to memory of 4440 528 2024-09-19_518e36dd78801c19d703065d51b97f41_mafia.exe 82 PID 4440 wrote to memory of 4720 4440 CA55.tmp 83 PID 4440 wrote to memory of 4720 4440 CA55.tmp 83 PID 4440 wrote to memory of 4720 4440 CA55.tmp 83 PID 4720 wrote to memory of 4048 4720 CB10.tmp 84 PID 4720 wrote to memory of 4048 4720 CB10.tmp 84 PID 4720 wrote to memory of 4048 4720 CB10.tmp 84 PID 4048 wrote to memory of 1336 4048 CB8D.tmp 85 PID 4048 wrote to memory of 1336 4048 CB8D.tmp 85 PID 4048 wrote to memory of 1336 4048 CB8D.tmp 85 PID 1336 wrote to memory of 4220 1336 CC1A.tmp 86 PID 1336 wrote to memory of 4220 1336 CC1A.tmp 86 PID 1336 wrote to memory of 4220 1336 CC1A.tmp 86 PID 4220 wrote to memory of 1092 4220 CC78.tmp 87 PID 4220 wrote to memory of 1092 4220 CC78.tmp 87 PID 4220 wrote to memory of 1092 4220 CC78.tmp 87 PID 1092 wrote to memory of 3660 1092 CCE5.tmp 88 PID 1092 wrote to memory of 3660 1092 CCE5.tmp 88 PID 1092 wrote to memory of 3660 1092 CCE5.tmp 88 PID 3660 wrote to memory of 4824 3660 CD43.tmp 89 PID 3660 wrote to memory of 4824 3660 CD43.tmp 89 PID 3660 wrote to memory of 4824 3660 CD43.tmp 89 PID 4824 wrote to memory of 4164 4824 CDC0.tmp 90 PID 4824 wrote to memory of 4164 4824 CDC0.tmp 90 PID 4824 wrote to memory of 4164 4824 CDC0.tmp 90 PID 4164 wrote to memory of 4960 4164 CE3D.tmp 91 PID 4164 wrote to memory of 4960 4164 CE3D.tmp 91 PID 4164 wrote to memory of 4960 4164 CE3D.tmp 91 PID 4960 wrote to memory of 4016 4960 CEAA.tmp 92 PID 4960 wrote to memory of 4016 4960 CEAA.tmp 92 PID 4960 wrote to memory of 4016 4960 CEAA.tmp 92 PID 4016 wrote to memory of 4244 4016 CF27.tmp 93 PID 4016 wrote to memory of 4244 4016 CF27.tmp 93 PID 4016 wrote to memory of 4244 4016 CF27.tmp 93 PID 4244 wrote to memory of 1740 4244 CFB4.tmp 94 PID 4244 wrote to memory of 1740 4244 CFB4.tmp 94 PID 4244 wrote to memory of 1740 4244 CFB4.tmp 94 PID 1740 wrote to memory of 3576 1740 D040.tmp 95 PID 1740 wrote to memory of 3576 1740 D040.tmp 95 PID 1740 wrote to memory of 3576 1740 D040.tmp 95 PID 3576 wrote to memory of 2520 3576 D0AE.tmp 96 PID 3576 wrote to memory of 2520 3576 D0AE.tmp 96 PID 3576 wrote to memory of 2520 3576 D0AE.tmp 96 PID 2520 wrote to memory of 4544 2520 D0FC.tmp 97 PID 2520 wrote to memory of 4544 2520 D0FC.tmp 97 PID 2520 wrote to memory of 4544 2520 D0FC.tmp 97 PID 4544 wrote to memory of 5068 4544 D169.tmp 98 PID 4544 wrote to memory of 5068 4544 D169.tmp 98 PID 4544 wrote to memory of 5068 4544 D169.tmp 98 PID 5068 wrote to memory of 980 5068 D1C7.tmp 99 PID 5068 wrote to memory of 980 5068 D1C7.tmp 99 PID 5068 wrote to memory of 980 5068 D1C7.tmp 99 PID 980 wrote to memory of 5092 980 D225.tmp 100 PID 980 wrote to memory of 5092 980 D225.tmp 100 PID 980 wrote to memory of 5092 980 D225.tmp 100 PID 5092 wrote to memory of 4808 5092 D292.tmp 101 PID 5092 wrote to memory of 4808 5092 D292.tmp 101 PID 5092 wrote to memory of 4808 5092 D292.tmp 101 PID 4808 wrote to memory of 1548 4808 D30F.tmp 102 PID 4808 wrote to memory of 1548 4808 D30F.tmp 102 PID 4808 wrote to memory of 1548 4808 D30F.tmp 102 PID 1548 wrote to memory of 5040 1548 D36D.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_518e36dd78801c19d703065d51b97f41_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_518e36dd78801c19d703065d51b97f41_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Users\Admin\AppData\Local\Temp\CA55.tmp"C:\Users\Admin\AppData\Local\Temp\CA55.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\CB10.tmp"C:\Users\Admin\AppData\Local\Temp\CB10.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\CB8D.tmp"C:\Users\Admin\AppData\Local\Temp\CB8D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\CC1A.tmp"C:\Users\Admin\AppData\Local\Temp\CC1A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\CC78.tmp"C:\Users\Admin\AppData\Local\Temp\CC78.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\CCE5.tmp"C:\Users\Admin\AppData\Local\Temp\CCE5.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\CD43.tmp"C:\Users\Admin\AppData\Local\Temp\CD43.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\CDC0.tmp"C:\Users\Admin\AppData\Local\Temp\CDC0.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\CE3D.tmp"C:\Users\Admin\AppData\Local\Temp\CE3D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\CEAA.tmp"C:\Users\Admin\AppData\Local\Temp\CEAA.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\CF27.tmp"C:\Users\Admin\AppData\Local\Temp\CF27.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\CFB4.tmp"C:\Users\Admin\AppData\Local\Temp\CFB4.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\D040.tmp"C:\Users\Admin\AppData\Local\Temp\D040.tmp"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\D0FC.tmp"C:\Users\Admin\AppData\Local\Temp\D0FC.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\D169.tmp"C:\Users\Admin\AppData\Local\Temp\D169.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\D225.tmp"C:\Users\Admin\AppData\Local\Temp\D225.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Users\Admin\AppData\Local\Temp\D292.tmp"C:\Users\Admin\AppData\Local\Temp\D292.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\D30F.tmp"C:\Users\Admin\AppData\Local\Temp\D30F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\D36D.tmp"C:\Users\Admin\AppData\Local\Temp\D36D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\D3F9.tmp"C:\Users\Admin\AppData\Local\Temp\D3F9.tmp"23⤵
- Executes dropped EXE
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\D476.tmp"C:\Users\Admin\AppData\Local\Temp\D476.tmp"24⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\D503.tmp"C:\Users\Admin\AppData\Local\Temp\D503.tmp"25⤵
- Executes dropped EXE
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\D580.tmp"C:\Users\Admin\AppData\Local\Temp\D580.tmp"26⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\D5ED.tmp"C:\Users\Admin\AppData\Local\Temp\D5ED.tmp"27⤵
- Executes dropped EXE
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\D67A.tmp"C:\Users\Admin\AppData\Local\Temp\D67A.tmp"28⤵
- Executes dropped EXE
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\D6F7.tmp"C:\Users\Admin\AppData\Local\Temp\D6F7.tmp"29⤵
- Executes dropped EXE
PID:696 -
C:\Users\Admin\AppData\Local\Temp\D764.tmp"C:\Users\Admin\AppData\Local\Temp\D764.tmp"30⤵
- Executes dropped EXE
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\D7E1.tmp"C:\Users\Admin\AppData\Local\Temp\D7E1.tmp"31⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\D87E.tmp"C:\Users\Admin\AppData\Local\Temp\D87E.tmp"32⤵
- Executes dropped EXE
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\D8DB.tmp"C:\Users\Admin\AppData\Local\Temp\D8DB.tmp"33⤵
- Executes dropped EXE
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\D958.tmp"C:\Users\Admin\AppData\Local\Temp\D958.tmp"34⤵
- Executes dropped EXE
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\D9A7.tmp"C:\Users\Admin\AppData\Local\Temp\D9A7.tmp"35⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\D9F5.tmp"C:\Users\Admin\AppData\Local\Temp\D9F5.tmp"36⤵
- Executes dropped EXE
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\DA52.tmp"C:\Users\Admin\AppData\Local\Temp\DA52.tmp"37⤵
- Executes dropped EXE
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\DAB0.tmp"C:\Users\Admin\AppData\Local\Temp\DAB0.tmp"38⤵
- Executes dropped EXE
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\DAFE.tmp"C:\Users\Admin\AppData\Local\Temp\DAFE.tmp"39⤵
- Executes dropped EXE
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\DB5C.tmp"C:\Users\Admin\AppData\Local\Temp\DB5C.tmp"40⤵
- Executes dropped EXE
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\DBBA.tmp"C:\Users\Admin\AppData\Local\Temp\DBBA.tmp"41⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\DC18.tmp"C:\Users\Admin\AppData\Local\Temp\DC18.tmp"42⤵
- Executes dropped EXE
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\DC66.tmp"C:\Users\Admin\AppData\Local\Temp\DC66.tmp"43⤵
- Executes dropped EXE
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\DCC3.tmp"C:\Users\Admin\AppData\Local\Temp\DCC3.tmp"44⤵
- Executes dropped EXE
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\DD21.tmp"C:\Users\Admin\AppData\Local\Temp\DD21.tmp"45⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\DD7F.tmp"C:\Users\Admin\AppData\Local\Temp\DD7F.tmp"46⤵
- Executes dropped EXE
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\DDDD.tmp"C:\Users\Admin\AppData\Local\Temp\DDDD.tmp"47⤵
- Executes dropped EXE
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\DE3A.tmp"C:\Users\Admin\AppData\Local\Temp\DE3A.tmp"48⤵
- Executes dropped EXE
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\DE98.tmp"C:\Users\Admin\AppData\Local\Temp\DE98.tmp"49⤵
- Executes dropped EXE
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\DEE6.tmp"C:\Users\Admin\AppData\Local\Temp\DEE6.tmp"50⤵
- Executes dropped EXE
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\DF44.tmp"C:\Users\Admin\AppData\Local\Temp\DF44.tmp"51⤵
- Executes dropped EXE
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\DF92.tmp"C:\Users\Admin\AppData\Local\Temp\DF92.tmp"52⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"53⤵
- Executes dropped EXE
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\E04E.tmp"C:\Users\Admin\AppData\Local\Temp\E04E.tmp"54⤵
- Executes dropped EXE
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\E0AB.tmp"C:\Users\Admin\AppData\Local\Temp\E0AB.tmp"55⤵
- Executes dropped EXE
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\E109.tmp"C:\Users\Admin\AppData\Local\Temp\E109.tmp"56⤵
- Executes dropped EXE
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\E167.tmp"C:\Users\Admin\AppData\Local\Temp\E167.tmp"57⤵
- Executes dropped EXE
PID:704 -
C:\Users\Admin\AppData\Local\Temp\E1C5.tmp"C:\Users\Admin\AppData\Local\Temp\E1C5.tmp"58⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\E222.tmp"C:\Users\Admin\AppData\Local\Temp\E222.tmp"59⤵
- Executes dropped EXE
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\E280.tmp"C:\Users\Admin\AppData\Local\Temp\E280.tmp"60⤵
- Executes dropped EXE
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\E2CE.tmp"C:\Users\Admin\AppData\Local\Temp\E2CE.tmp"61⤵
- Executes dropped EXE
PID:544 -
C:\Users\Admin\AppData\Local\Temp\E32C.tmp"C:\Users\Admin\AppData\Local\Temp\E32C.tmp"62⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\E37A.tmp"C:\Users\Admin\AppData\Local\Temp\E37A.tmp"63⤵
- Executes dropped EXE
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\E3C8.tmp"C:\Users\Admin\AppData\Local\Temp\E3C8.tmp"64⤵
- Executes dropped EXE
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\E426.tmp"C:\Users\Admin\AppData\Local\Temp\E426.tmp"65⤵
- Executes dropped EXE
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\E474.tmp"C:\Users\Admin\AppData\Local\Temp\E474.tmp"66⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\E4D2.tmp"C:\Users\Admin\AppData\Local\Temp\E4D2.tmp"67⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\E520.tmp"C:\Users\Admin\AppData\Local\Temp\E520.tmp"68⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\E57E.tmp"C:\Users\Admin\AppData\Local\Temp\E57E.tmp"69⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\E5DC.tmp"C:\Users\Admin\AppData\Local\Temp\E5DC.tmp"70⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\E639.tmp"C:\Users\Admin\AppData\Local\Temp\E639.tmp"71⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\E687.tmp"C:\Users\Admin\AppData\Local\Temp\E687.tmp"72⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\E6E5.tmp"C:\Users\Admin\AppData\Local\Temp\E6E5.tmp"73⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\E743.tmp"C:\Users\Admin\AppData\Local\Temp\E743.tmp"74⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"75⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"76⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\E84D.tmp"C:\Users\Admin\AppData\Local\Temp\E84D.tmp"77⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\E89B.tmp"C:\Users\Admin\AppData\Local\Temp\E89B.tmp"78⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\E8E9.tmp"C:\Users\Admin\AppData\Local\Temp\E8E9.tmp"79⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\E947.tmp"C:\Users\Admin\AppData\Local\Temp\E947.tmp"80⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\E9A4.tmp"C:\Users\Admin\AppData\Local\Temp\E9A4.tmp"81⤵
- System Location Discovery: System Language Discovery
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\E9F2.tmp"C:\Users\Admin\AppData\Local\Temp\E9F2.tmp"82⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\EA50.tmp"C:\Users\Admin\AppData\Local\Temp\EA50.tmp"83⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\EA9E.tmp"C:\Users\Admin\AppData\Local\Temp\EA9E.tmp"84⤵
- System Location Discovery: System Language Discovery
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\EAFC.tmp"C:\Users\Admin\AppData\Local\Temp\EAFC.tmp"85⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\EB5A.tmp"C:\Users\Admin\AppData\Local\Temp\EB5A.tmp"86⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\EBB8.tmp"C:\Users\Admin\AppData\Local\Temp\EBB8.tmp"87⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\EC06.tmp"C:\Users\Admin\AppData\Local\Temp\EC06.tmp"88⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\EC63.tmp"C:\Users\Admin\AppData\Local\Temp\EC63.tmp"89⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\ECB2.tmp"C:\Users\Admin\AppData\Local\Temp\ECB2.tmp"90⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\ED0F.tmp"C:\Users\Admin\AppData\Local\Temp\ED0F.tmp"91⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\ED5D.tmp"C:\Users\Admin\AppData\Local\Temp\ED5D.tmp"92⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"93⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\EE19.tmp"C:\Users\Admin\AppData\Local\Temp\EE19.tmp"94⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\EE86.tmp"C:\Users\Admin\AppData\Local\Temp\EE86.tmp"95⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\EED4.tmp"C:\Users\Admin\AppData\Local\Temp\EED4.tmp"96⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\EF32.tmp"C:\Users\Admin\AppData\Local\Temp\EF32.tmp"97⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\EF80.tmp"C:\Users\Admin\AppData\Local\Temp\EF80.tmp"98⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\EFCE.tmp"C:\Users\Admin\AppData\Local\Temp\EFCE.tmp"99⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\F02C.tmp"C:\Users\Admin\AppData\Local\Temp\F02C.tmp"100⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\F08A.tmp"C:\Users\Admin\AppData\Local\Temp\F08A.tmp"101⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\F0D8.tmp"C:\Users\Admin\AppData\Local\Temp\F0D8.tmp"102⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\F126.tmp"C:\Users\Admin\AppData\Local\Temp\F126.tmp"103⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\F174.tmp"C:\Users\Admin\AppData\Local\Temp\F174.tmp"104⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\F1D2.tmp"C:\Users\Admin\AppData\Local\Temp\F1D2.tmp"105⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\F220.tmp"C:\Users\Admin\AppData\Local\Temp\F220.tmp"106⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\F26E.tmp"C:\Users\Admin\AppData\Local\Temp\F26E.tmp"107⤵PID:492
-
C:\Users\Admin\AppData\Local\Temp\F2CC.tmp"C:\Users\Admin\AppData\Local\Temp\F2CC.tmp"108⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\F32A.tmp"C:\Users\Admin\AppData\Local\Temp\F32A.tmp"109⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\F378.tmp"C:\Users\Admin\AppData\Local\Temp\F378.tmp"110⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\F3C6.tmp"C:\Users\Admin\AppData\Local\Temp\F3C6.tmp"111⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\F414.tmp"C:\Users\Admin\AppData\Local\Temp\F414.tmp"112⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\F472.tmp"C:\Users\Admin\AppData\Local\Temp\F472.tmp"113⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\F4D0.tmp"C:\Users\Admin\AppData\Local\Temp\F4D0.tmp"114⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\F52D.tmp"C:\Users\Admin\AppData\Local\Temp\F52D.tmp"115⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\F57C.tmp"C:\Users\Admin\AppData\Local\Temp\F57C.tmp"116⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\F5D9.tmp"C:\Users\Admin\AppData\Local\Temp\F5D9.tmp"117⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\F627.tmp"C:\Users\Admin\AppData\Local\Temp\F627.tmp"118⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\F676.tmp"C:\Users\Admin\AppData\Local\Temp\F676.tmp"119⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\F6E3.tmp"C:\Users\Admin\AppData\Local\Temp\F6E3.tmp"120⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\F750.tmp"C:\Users\Admin\AppData\Local\Temp\F750.tmp"121⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\F7AE.tmp"C:\Users\Admin\AppData\Local\Temp\F7AE.tmp"122⤵PID:4364
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-