Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2024, 04:02
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-19_a31ede456bdc857c75e0158cbba5a2b5_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-09-19_a31ede456bdc857c75e0158cbba5a2b5_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-19_a31ede456bdc857c75e0158cbba5a2b5_mafia.exe
-
Size
487KB
-
MD5
a31ede456bdc857c75e0158cbba5a2b5
-
SHA1
803887b0bfca1da616b533162423af5d51c699bc
-
SHA256
1c46ddf8b2dbc13d68960766d621df7030bf583218f895be357d9fa7eb18e9b6
-
SHA512
25afdb35764d1df14811c772ea32af030ff1264cc2c8ee63e7cd13e0f2ec215dd3c6cc8d34b8c7ce883c7285fb2564412f75c0b4986d475a849dce7f79210de7
-
SSDEEP
12288:HU5rCOTeiJifWOr6zuCP94XimymkRC5oNZ:HUQOJJifWOWKCPeXimymkdN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3572 9AC9.tmp 4636 9B36.tmp 1700 9BA4.tmp 3184 9C21.tmp 3652 9C8E.tmp 5016 9CFB.tmp 3380 9D69.tmp 2992 9DC6.tmp 4224 9E15.tmp 968 9F4D.tmp 4848 9F9B.tmp 2396 9FF9.tmp 1900 A047.tmp 4556 A095.tmp 4208 A0E3.tmp 3136 A131.tmp 1192 A19F.tmp 368 A1FD.tmp 2640 A25A.tmp 1508 A2D7.tmp 1116 A335.tmp 2224 A383.tmp 2164 A3F1.tmp 4236 A45E.tmp 4760 A4CB.tmp 3808 A539.tmp 644 A5A6.tmp 1860 A604.tmp 1132 A662.tmp 5052 A6B0.tmp 2008 A70D.tmp 2240 A75C.tmp 2464 A7B9.tmp 872 A807.tmp 4808 A856.tmp 2292 A8A4.tmp 1876 A911.tmp 2056 A95F.tmp 1464 A9AD.tmp 2796 A9FB.tmp 4544 AA4A.tmp 2988 AA98.tmp 3220 AAD6.tmp 3648 AB24.tmp 2248 AB72.tmp 1276 ABB1.tmp 4120 ABFF.tmp 4880 AC4D.tmp 3104 AC9B.tmp 440 ACE9.tmp 3040 AD38.tmp 2528 AD95.tmp 3612 ADE3.tmp 4704 AE32.tmp 4416 AE80.tmp 4688 AECE.tmp 2704 AF6A.tmp 4140 AFB8.tmp 4464 B006.tmp 1708 B054.tmp 1612 B0A3.tmp 4276 B0F1.tmp 4604 B14E.tmp 8 B19D.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7182.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B561.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DABB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 600D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C29F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 819.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F4D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C3CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A69B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F48.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B287.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6155.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1623.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2DC.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4700 wrote to memory of 3572 4700 2024-09-19_a31ede456bdc857c75e0158cbba5a2b5_mafia.exe 82 PID 4700 wrote to memory of 3572 4700 2024-09-19_a31ede456bdc857c75e0158cbba5a2b5_mafia.exe 82 PID 4700 wrote to memory of 3572 4700 2024-09-19_a31ede456bdc857c75e0158cbba5a2b5_mafia.exe 82 PID 3572 wrote to memory of 4636 3572 9AC9.tmp 83 PID 3572 wrote to memory of 4636 3572 9AC9.tmp 83 PID 3572 wrote to memory of 4636 3572 9AC9.tmp 83 PID 4636 wrote to memory of 1700 4636 9B36.tmp 84 PID 4636 wrote to memory of 1700 4636 9B36.tmp 84 PID 4636 wrote to memory of 1700 4636 9B36.tmp 84 PID 1700 wrote to memory of 3184 1700 9BA4.tmp 85 PID 1700 wrote to memory of 3184 1700 9BA4.tmp 85 PID 1700 wrote to memory of 3184 1700 9BA4.tmp 85 PID 3184 wrote to memory of 3652 3184 9C21.tmp 86 PID 3184 wrote to memory of 3652 3184 9C21.tmp 86 PID 3184 wrote to memory of 3652 3184 9C21.tmp 86 PID 3652 wrote to memory of 5016 3652 9C8E.tmp 87 PID 3652 wrote to memory of 5016 3652 9C8E.tmp 87 PID 3652 wrote to memory of 5016 3652 9C8E.tmp 87 PID 5016 wrote to memory of 3380 5016 9CFB.tmp 88 PID 5016 wrote to memory of 3380 5016 9CFB.tmp 88 PID 5016 wrote to memory of 3380 5016 9CFB.tmp 88 PID 3380 wrote to memory of 2992 3380 9D69.tmp 89 PID 3380 wrote to memory of 2992 3380 9D69.tmp 89 PID 3380 wrote to memory of 2992 3380 9D69.tmp 89 PID 2992 wrote to memory of 4224 2992 9DC6.tmp 90 PID 2992 wrote to memory of 4224 2992 9DC6.tmp 90 PID 2992 wrote to memory of 4224 2992 9DC6.tmp 90 PID 4224 wrote to memory of 968 4224 9E15.tmp 91 PID 4224 wrote to memory of 968 4224 9E15.tmp 91 PID 4224 wrote to memory of 968 4224 9E15.tmp 91 PID 968 wrote to memory of 4848 968 9F4D.tmp 92 PID 968 wrote to memory of 4848 968 9F4D.tmp 92 PID 968 wrote to memory of 4848 968 9F4D.tmp 92 PID 4848 wrote to memory of 2396 4848 9F9B.tmp 93 PID 4848 wrote to memory of 2396 4848 9F9B.tmp 93 PID 4848 wrote to memory of 2396 4848 9F9B.tmp 93 PID 2396 wrote to memory of 1900 2396 9FF9.tmp 94 PID 2396 wrote to memory of 1900 2396 9FF9.tmp 94 PID 2396 wrote to memory of 1900 2396 9FF9.tmp 94 PID 1900 wrote to memory of 4556 1900 A047.tmp 95 PID 1900 wrote to memory of 4556 1900 A047.tmp 95 PID 1900 wrote to memory of 4556 1900 A047.tmp 95 PID 4556 wrote to memory of 4208 4556 A095.tmp 96 PID 4556 wrote to memory of 4208 4556 A095.tmp 96 PID 4556 wrote to memory of 4208 4556 A095.tmp 96 PID 4208 wrote to memory of 3136 4208 A0E3.tmp 97 PID 4208 wrote to memory of 3136 4208 A0E3.tmp 97 PID 4208 wrote to memory of 3136 4208 A0E3.tmp 97 PID 3136 wrote to memory of 1192 3136 A131.tmp 98 PID 3136 wrote to memory of 1192 3136 A131.tmp 98 PID 3136 wrote to memory of 1192 3136 A131.tmp 98 PID 1192 wrote to memory of 368 1192 A19F.tmp 99 PID 1192 wrote to memory of 368 1192 A19F.tmp 99 PID 1192 wrote to memory of 368 1192 A19F.tmp 99 PID 368 wrote to memory of 2640 368 A1FD.tmp 100 PID 368 wrote to memory of 2640 368 A1FD.tmp 100 PID 368 wrote to memory of 2640 368 A1FD.tmp 100 PID 2640 wrote to memory of 1508 2640 A25A.tmp 101 PID 2640 wrote to memory of 1508 2640 A25A.tmp 101 PID 2640 wrote to memory of 1508 2640 A25A.tmp 101 PID 1508 wrote to memory of 1116 1508 A2D7.tmp 102 PID 1508 wrote to memory of 1116 1508 A2D7.tmp 102 PID 1508 wrote to memory of 1116 1508 A2D7.tmp 102 PID 1116 wrote to memory of 2224 1116 A335.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_a31ede456bdc857c75e0158cbba5a2b5_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_a31ede456bdc857c75e0158cbba5a2b5_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\9C21.tmp"C:\Users\Admin\AppData\Local\Temp\9C21.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\9D69.tmp"C:\Users\Admin\AppData\Local\Temp\9D69.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\9E15.tmp"C:\Users\Admin\AppData\Local\Temp\9E15.tmp"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\A047.tmp"C:\Users\Admin\AppData\Local\Temp\A047.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\A095.tmp"C:\Users\Admin\AppData\Local\Temp\A095.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\A131.tmp"C:\Users\Admin\AppData\Local\Temp\A131.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\A19F.tmp"C:\Users\Admin\AppData\Local\Temp\A19F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Users\Admin\AppData\Local\Temp\A25A.tmp"C:\Users\Admin\AppData\Local\Temp\A25A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\A335.tmp"C:\Users\Admin\AppData\Local\Temp\A335.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\A383.tmp"C:\Users\Admin\AppData\Local\Temp\A383.tmp"23⤵
- Executes dropped EXE
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"24⤵
- Executes dropped EXE
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\A45E.tmp"C:\Users\Admin\AppData\Local\Temp\A45E.tmp"25⤵
- Executes dropped EXE
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"26⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\A539.tmp"C:\Users\Admin\AppData\Local\Temp\A539.tmp"27⤵
- Executes dropped EXE
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\A5A6.tmp"C:\Users\Admin\AppData\Local\Temp\A5A6.tmp"28⤵
- Executes dropped EXE
PID:644 -
C:\Users\Admin\AppData\Local\Temp\A604.tmp"C:\Users\Admin\AppData\Local\Temp\A604.tmp"29⤵
- Executes dropped EXE
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\A662.tmp"C:\Users\Admin\AppData\Local\Temp\A662.tmp"30⤵
- Executes dropped EXE
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"31⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\A70D.tmp"C:\Users\Admin\AppData\Local\Temp\A70D.tmp"32⤵
- Executes dropped EXE
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\A75C.tmp"C:\Users\Admin\AppData\Local\Temp\A75C.tmp"33⤵
- Executes dropped EXE
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"34⤵
- Executes dropped EXE
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\A807.tmp"C:\Users\Admin\AppData\Local\Temp\A807.tmp"35⤵
- Executes dropped EXE
PID:872 -
C:\Users\Admin\AppData\Local\Temp\A856.tmp"C:\Users\Admin\AppData\Local\Temp\A856.tmp"36⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"37⤵
- Executes dropped EXE
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\A911.tmp"C:\Users\Admin\AppData\Local\Temp\A911.tmp"38⤵
- Executes dropped EXE
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\A95F.tmp"C:\Users\Admin\AppData\Local\Temp\A95F.tmp"39⤵
- Executes dropped EXE
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\A9AD.tmp"C:\Users\Admin\AppData\Local\Temp\A9AD.tmp"40⤵
- Executes dropped EXE
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"41⤵
- Executes dropped EXE
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"42⤵
- Executes dropped EXE
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\AA98.tmp"C:\Users\Admin\AppData\Local\Temp\AA98.tmp"43⤵
- Executes dropped EXE
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"44⤵
- Executes dropped EXE
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\AB24.tmp"C:\Users\Admin\AppData\Local\Temp\AB24.tmp"45⤵
- Executes dropped EXE
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\AB72.tmp"C:\Users\Admin\AppData\Local\Temp\AB72.tmp"46⤵
- Executes dropped EXE
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"47⤵
- Executes dropped EXE
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"48⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"49⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"50⤵
- Executes dropped EXE
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"51⤵
- Executes dropped EXE
PID:440 -
C:\Users\Admin\AppData\Local\Temp\AD38.tmp"C:\Users\Admin\AppData\Local\Temp\AD38.tmp"52⤵
- Executes dropped EXE
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\AD95.tmp"C:\Users\Admin\AppData\Local\Temp\AD95.tmp"53⤵
- Executes dropped EXE
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"54⤵
- Executes dropped EXE
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\AE32.tmp"C:\Users\Admin\AppData\Local\Temp\AE32.tmp"55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\AE80.tmp"C:\Users\Admin\AppData\Local\Temp\AE80.tmp"56⤵
- Executes dropped EXE
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\AECE.tmp"C:\Users\Admin\AppData\Local\Temp\AECE.tmp"57⤵
- Executes dropped EXE
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"58⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\AF6A.tmp"C:\Users\Admin\AppData\Local\Temp\AF6A.tmp"59⤵
- Executes dropped EXE
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"60⤵
- Executes dropped EXE
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\B006.tmp"C:\Users\Admin\AppData\Local\Temp\B006.tmp"61⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\B054.tmp"C:\Users\Admin\AppData\Local\Temp\B054.tmp"62⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"63⤵
- Executes dropped EXE
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\B0F1.tmp"C:\Users\Admin\AppData\Local\Temp\B0F1.tmp"64⤵
- Executes dropped EXE
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\B14E.tmp"C:\Users\Admin\AppData\Local\Temp\B14E.tmp"65⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\B19D.tmp"C:\Users\Admin\AppData\Local\Temp\B19D.tmp"66⤵
- Executes dropped EXE
PID:8 -
C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"67⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\B239.tmp"C:\Users\Admin\AppData\Local\Temp\B239.tmp"68⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\B287.tmp"C:\Users\Admin\AppData\Local\Temp\B287.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"70⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\B342.tmp"C:\Users\Admin\AppData\Local\Temp\B342.tmp"71⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"72⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"73⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\B44C.tmp"C:\Users\Admin\AppData\Local\Temp\B44C.tmp"74⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"75⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\B508.tmp"C:\Users\Admin\AppData\Local\Temp\B508.tmp"76⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\B556.tmp"C:\Users\Admin\AppData\Local\Temp\B556.tmp"77⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"78⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"79⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\B640.tmp"C:\Users\Admin\AppData\Local\Temp\B640.tmp"80⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\B68E.tmp"C:\Users\Admin\AppData\Local\Temp\B68E.tmp"81⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"82⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\B72A.tmp"C:\Users\Admin\AppData\Local\Temp\B72A.tmp"83⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\B779.tmp"C:\Users\Admin\AppData\Local\Temp\B779.tmp"84⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"85⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\B824.tmp"C:\Users\Admin\AppData\Local\Temp\B824.tmp"86⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\B882.tmp"C:\Users\Admin\AppData\Local\Temp\B882.tmp"87⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\B8E0.tmp"C:\Users\Admin\AppData\Local\Temp\B8E0.tmp"88⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\B93E.tmp"C:\Users\Admin\AppData\Local\Temp\B93E.tmp"89⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\B99B.tmp"C:\Users\Admin\AppData\Local\Temp\B99B.tmp"90⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\B9F9.tmp"C:\Users\Admin\AppData\Local\Temp\B9F9.tmp"91⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\BA57.tmp"C:\Users\Admin\AppData\Local\Temp\BA57.tmp"92⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"93⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\BB03.tmp"C:\Users\Admin\AppData\Local\Temp\BB03.tmp"94⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\BB51.tmp"C:\Users\Admin\AppData\Local\Temp\BB51.tmp"95⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\BBAF.tmp"C:\Users\Admin\AppData\Local\Temp\BBAF.tmp"96⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"97⤵
- System Location Discovery: System Language Discovery
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\BC6A.tmp"C:\Users\Admin\AppData\Local\Temp\BC6A.tmp"98⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"99⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\BD26.tmp"C:\Users\Admin\AppData\Local\Temp\BD26.tmp"100⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\BD83.tmp"C:\Users\Admin\AppData\Local\Temp\BD83.tmp"101⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"102⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\BE20.tmp"C:\Users\Admin\AppData\Local\Temp\BE20.tmp"103⤵PID:512
-
C:\Users\Admin\AppData\Local\Temp\BE7D.tmp"C:\Users\Admin\AppData\Local\Temp\BE7D.tmp"104⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"105⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\BF29.tmp"C:\Users\Admin\AppData\Local\Temp\BF29.tmp"106⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\BF77.tmp"C:\Users\Admin\AppData\Local\Temp\BF77.tmp"107⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\BFD5.tmp"C:\Users\Admin\AppData\Local\Temp\BFD5.tmp"108⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\C023.tmp"C:\Users\Admin\AppData\Local\Temp\C023.tmp"109⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\C081.tmp"C:\Users\Admin\AppData\Local\Temp\C081.tmp"110⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"111⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\C13D.tmp"C:\Users\Admin\AppData\Local\Temp\C13D.tmp"112⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\C19A.tmp"C:\Users\Admin\AppData\Local\Temp\C19A.tmp"113⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"114⤵
- System Location Discovery: System Language Discovery
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\C237.tmp"C:\Users\Admin\AppData\Local\Temp\C237.tmp"115⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\C285.tmp"C:\Users\Admin\AppData\Local\Temp\C285.tmp"116⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"117⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\C321.tmp"C:\Users\Admin\AppData\Local\Temp\C321.tmp"118⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\C37F.tmp"C:\Users\Admin\AppData\Local\Temp\C37F.tmp"119⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"120⤵
- System Location Discovery: System Language Discovery
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\C41B.tmp"C:\Users\Admin\AppData\Local\Temp\C41B.tmp"121⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\C479.tmp"C:\Users\Admin\AppData\Local\Temp\C479.tmp"122⤵PID:2328
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-