Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/10/2024, 08:33
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-05_af95ee4846d025a40a4e0005de4e96bc_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-05_af95ee4846d025a40a4e0005de4e96bc_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-10-05_af95ee4846d025a40a4e0005de4e96bc_mafia.exe
-
Size
487KB
-
MD5
af95ee4846d025a40a4e0005de4e96bc
-
SHA1
244635b8c1efa6ed1c6335552fb34ed7106d7a3a
-
SHA256
d62269a8f1ee81d5c07fca1e014e77e8299fb795c796a262da79a7ec2bc7c6e8
-
SHA512
d13277e1e77dcb47af190540678101213982e55f1d9af2e25de1a9bdc0f7879eaa9936d4a10258e763d931ed8c9afc405df74a0725650b290fd16274a356ecf3
-
SSDEEP
12288:HU5rCOTeiJhXVsjmasPX9xDOzbo+DAEtPQ8JOtEqNZ:HUQOJJhF8gX7DOzNDAEBQCwN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2164 A623.tmp 1616 A690.tmp 1900 A70D.tmp 4792 A77B.tmp 2268 A7E8.tmp 3416 A856.tmp 2348 A8A4.tmp 3720 A911.tmp 2688 A95F.tmp 3708 A9BD.tmp 652 AA3A.tmp 2912 AAB7.tmp 1636 AB34.tmp 5080 ABB1.tmp 4984 AC1E.tmp 2340 AC8C.tmp 3852 ACDA.tmp 3928 AD47.tmp 5000 ADA5.tmp 2188 AE12.tmp 2444 AE70.tmp 3980 AEBE.tmp 4532 AF2C.tmp 3184 AF89.tmp 1548 AFF7.tmp 2328 B064.tmp 4524 B0D1.tmp 4604 B14E.tmp 388 B19D.tmp 4812 B1EB.tmp 4520 B239.tmp 4384 B287.tmp 1140 B2F4.tmp 2820 B342.tmp 2484 B3A0.tmp 5068 B3EE.tmp 2544 B45C.tmp 1076 B4B9.tmp 2136 B508.tmp 716 B556.tmp 1848 B5A4.tmp 4804 B602.tmp 4252 B65F.tmp 1248 B6AD.tmp 1632 B6FC.tmp 1464 B74A.tmp 1756 B798.tmp 4908 B7E6.tmp 3612 B834.tmp 1164 B892.tmp 624 B8E0.tmp 1388 B93E.tmp 2744 B98C.tmp 2068 B9EA.tmp 4364 BA38.tmp 3608 BA86.tmp 4300 BAE4.tmp 1224 BB32.tmp 2992 BB80.tmp 532 BBDE.tmp 4852 BC2C.tmp 4348 BC89.tmp 4332 BCD8.tmp 4616 BD26.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D419.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BEB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4EE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC48.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C435.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4716.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C89A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C97A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBD9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E70F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E975.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 772F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 877B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3870.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 753B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFBF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5791.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E474.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B198.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B6C.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1492 wrote to memory of 2164 1492 2024-10-05_af95ee4846d025a40a4e0005de4e96bc_mafia.exe 82 PID 1492 wrote to memory of 2164 1492 2024-10-05_af95ee4846d025a40a4e0005de4e96bc_mafia.exe 82 PID 1492 wrote to memory of 2164 1492 2024-10-05_af95ee4846d025a40a4e0005de4e96bc_mafia.exe 82 PID 2164 wrote to memory of 1616 2164 A623.tmp 83 PID 2164 wrote to memory of 1616 2164 A623.tmp 83 PID 2164 wrote to memory of 1616 2164 A623.tmp 83 PID 1616 wrote to memory of 1900 1616 A690.tmp 84 PID 1616 wrote to memory of 1900 1616 A690.tmp 84 PID 1616 wrote to memory of 1900 1616 A690.tmp 84 PID 1900 wrote to memory of 4792 1900 A70D.tmp 85 PID 1900 wrote to memory of 4792 1900 A70D.tmp 85 PID 1900 wrote to memory of 4792 1900 A70D.tmp 85 PID 4792 wrote to memory of 2268 4792 A77B.tmp 86 PID 4792 wrote to memory of 2268 4792 A77B.tmp 86 PID 4792 wrote to memory of 2268 4792 A77B.tmp 86 PID 2268 wrote to memory of 3416 2268 A7E8.tmp 87 PID 2268 wrote to memory of 3416 2268 A7E8.tmp 87 PID 2268 wrote to memory of 3416 2268 A7E8.tmp 87 PID 3416 wrote to memory of 2348 3416 A856.tmp 88 PID 3416 wrote to memory of 2348 3416 A856.tmp 88 PID 3416 wrote to memory of 2348 3416 A856.tmp 88 PID 2348 wrote to memory of 3720 2348 A8A4.tmp 89 PID 2348 wrote to memory of 3720 2348 A8A4.tmp 89 PID 2348 wrote to memory of 3720 2348 A8A4.tmp 89 PID 3720 wrote to memory of 2688 3720 A911.tmp 90 PID 3720 wrote to memory of 2688 3720 A911.tmp 90 PID 3720 wrote to memory of 2688 3720 A911.tmp 90 PID 2688 wrote to memory of 3708 2688 A95F.tmp 91 PID 2688 wrote to memory of 3708 2688 A95F.tmp 91 PID 2688 wrote to memory of 3708 2688 A95F.tmp 91 PID 3708 wrote to memory of 652 3708 A9BD.tmp 92 PID 3708 wrote to memory of 652 3708 A9BD.tmp 92 PID 3708 wrote to memory of 652 3708 A9BD.tmp 92 PID 652 wrote to memory of 2912 652 AA3A.tmp 93 PID 652 wrote to memory of 2912 652 AA3A.tmp 93 PID 652 wrote to memory of 2912 652 AA3A.tmp 93 PID 2912 wrote to memory of 1636 2912 AAB7.tmp 94 PID 2912 wrote to memory of 1636 2912 AAB7.tmp 94 PID 2912 wrote to memory of 1636 2912 AAB7.tmp 94 PID 1636 wrote to memory of 5080 1636 AB34.tmp 95 PID 1636 wrote to memory of 5080 1636 AB34.tmp 95 PID 1636 wrote to memory of 5080 1636 AB34.tmp 95 PID 5080 wrote to memory of 4984 5080 ABB1.tmp 96 PID 5080 wrote to memory of 4984 5080 ABB1.tmp 96 PID 5080 wrote to memory of 4984 5080 ABB1.tmp 96 PID 4984 wrote to memory of 2340 4984 AC1E.tmp 97 PID 4984 wrote to memory of 2340 4984 AC1E.tmp 97 PID 4984 wrote to memory of 2340 4984 AC1E.tmp 97 PID 2340 wrote to memory of 3852 2340 AC8C.tmp 98 PID 2340 wrote to memory of 3852 2340 AC8C.tmp 98 PID 2340 wrote to memory of 3852 2340 AC8C.tmp 98 PID 3852 wrote to memory of 3928 3852 ACDA.tmp 99 PID 3852 wrote to memory of 3928 3852 ACDA.tmp 99 PID 3852 wrote to memory of 3928 3852 ACDA.tmp 99 PID 3928 wrote to memory of 5000 3928 AD47.tmp 100 PID 3928 wrote to memory of 5000 3928 AD47.tmp 100 PID 3928 wrote to memory of 5000 3928 AD47.tmp 100 PID 5000 wrote to memory of 2188 5000 ADA5.tmp 101 PID 5000 wrote to memory of 2188 5000 ADA5.tmp 101 PID 5000 wrote to memory of 2188 5000 ADA5.tmp 101 PID 2188 wrote to memory of 2444 2188 AE12.tmp 102 PID 2188 wrote to memory of 2444 2188 AE12.tmp 102 PID 2188 wrote to memory of 2444 2188 AE12.tmp 102 PID 2444 wrote to memory of 3980 2444 AE70.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-05_af95ee4846d025a40a4e0005de4e96bc_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-05_af95ee4846d025a40a4e0005de4e96bc_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\A623.tmp"C:\Users\Admin\AppData\Local\Temp\A623.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\A690.tmp"C:\Users\Admin\AppData\Local\Temp\A690.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\A70D.tmp"C:\Users\Admin\AppData\Local\Temp\A70D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\A77B.tmp"C:\Users\Admin\AppData\Local\Temp\A77B.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\A856.tmp"C:\Users\Admin\AppData\Local\Temp\A856.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\A911.tmp"C:\Users\Admin\AppData\Local\Temp\A911.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\A95F.tmp"C:\Users\Admin\AppData\Local\Temp\A95F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\AB34.tmp"C:\Users\Admin\AppData\Local\Temp\AB34.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\AD47.tmp"C:\Users\Admin\AppData\Local\Temp\AD47.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\AE12.tmp"C:\Users\Admin\AppData\Local\Temp\AE12.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\AE70.tmp"C:\Users\Admin\AppData\Local\Temp\AE70.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"23⤵
- Executes dropped EXE
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"24⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\AF89.tmp"C:\Users\Admin\AppData\Local\Temp\AF89.tmp"25⤵
- Executes dropped EXE
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"26⤵
- Executes dropped EXE
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\B064.tmp"C:\Users\Admin\AppData\Local\Temp\B064.tmp"27⤵
- Executes dropped EXE
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"28⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\B14E.tmp"C:\Users\Admin\AppData\Local\Temp\B14E.tmp"29⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\B19D.tmp"C:\Users\Admin\AppData\Local\Temp\B19D.tmp"30⤵
- Executes dropped EXE
PID:388 -
C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"31⤵
- Executes dropped EXE
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\B239.tmp"C:\Users\Admin\AppData\Local\Temp\B239.tmp"32⤵
- Executes dropped EXE
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\B287.tmp"C:\Users\Admin\AppData\Local\Temp\B287.tmp"33⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"34⤵
- Executes dropped EXE
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\B342.tmp"C:\Users\Admin\AppData\Local\Temp\B342.tmp"35⤵
- Executes dropped EXE
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"36⤵
- Executes dropped EXE
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"37⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\B45C.tmp"C:\Users\Admin\AppData\Local\Temp\B45C.tmp"38⤵
- Executes dropped EXE
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"39⤵
- Executes dropped EXE
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\B508.tmp"C:\Users\Admin\AppData\Local\Temp\B508.tmp"40⤵
- Executes dropped EXE
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\B556.tmp"C:\Users\Admin\AppData\Local\Temp\B556.tmp"41⤵
- Executes dropped EXE
PID:716 -
C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"42⤵
- Executes dropped EXE
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\B602.tmp"C:\Users\Admin\AppData\Local\Temp\B602.tmp"43⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\B65F.tmp"C:\Users\Admin\AppData\Local\Temp\B65F.tmp"44⤵
- Executes dropped EXE
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"45⤵
- Executes dropped EXE
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\B6FC.tmp"C:\Users\Admin\AppData\Local\Temp\B6FC.tmp"46⤵
- Executes dropped EXE
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\B74A.tmp"C:\Users\Admin\AppData\Local\Temp\B74A.tmp"47⤵
- Executes dropped EXE
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\B798.tmp"C:\Users\Admin\AppData\Local\Temp\B798.tmp"48⤵
- Executes dropped EXE
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"49⤵
- Executes dropped EXE
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\B834.tmp"C:\Users\Admin\AppData\Local\Temp\B834.tmp"50⤵
- Executes dropped EXE
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\B892.tmp"C:\Users\Admin\AppData\Local\Temp\B892.tmp"51⤵
- Executes dropped EXE
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\B8E0.tmp"C:\Users\Admin\AppData\Local\Temp\B8E0.tmp"52⤵
- Executes dropped EXE
PID:624 -
C:\Users\Admin\AppData\Local\Temp\B93E.tmp"C:\Users\Admin\AppData\Local\Temp\B93E.tmp"53⤵
- Executes dropped EXE
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\B98C.tmp"C:\Users\Admin\AppData\Local\Temp\B98C.tmp"54⤵
- Executes dropped EXE
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"55⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\BA38.tmp"C:\Users\Admin\AppData\Local\Temp\BA38.tmp"56⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\BA86.tmp"C:\Users\Admin\AppData\Local\Temp\BA86.tmp"57⤵
- Executes dropped EXE
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"58⤵
- Executes dropped EXE
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\BB32.tmp"C:\Users\Admin\AppData\Local\Temp\BB32.tmp"59⤵
- Executes dropped EXE
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\BB80.tmp"C:\Users\Admin\AppData\Local\Temp\BB80.tmp"60⤵
- Executes dropped EXE
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"61⤵
- Executes dropped EXE
PID:532 -
C:\Users\Admin\AppData\Local\Temp\BC2C.tmp"C:\Users\Admin\AppData\Local\Temp\BC2C.tmp"62⤵
- Executes dropped EXE
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\BC89.tmp"C:\Users\Admin\AppData\Local\Temp\BC89.tmp"63⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\BCD8.tmp"C:\Users\Admin\AppData\Local\Temp\BCD8.tmp"64⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\BD26.tmp"C:\Users\Admin\AppData\Local\Temp\BD26.tmp"65⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\BD74.tmp"C:\Users\Admin\AppData\Local\Temp\BD74.tmp"66⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"67⤵
- System Location Discovery: System Language Discovery
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\BE20.tmp"C:\Users\Admin\AppData\Local\Temp\BE20.tmp"68⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\BE6E.tmp"C:\Users\Admin\AppData\Local\Temp\BE6E.tmp"69⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\BEBC.tmp"C:\Users\Admin\AppData\Local\Temp\BEBC.tmp"70⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\BF0A.tmp"C:\Users\Admin\AppData\Local\Temp\BF0A.tmp"71⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\BF58.tmp"C:\Users\Admin\AppData\Local\Temp\BF58.tmp"72⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"73⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"74⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\C052.tmp"C:\Users\Admin\AppData\Local\Temp\C052.tmp"75⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"76⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"77⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\C13D.tmp"C:\Users\Admin\AppData\Local\Temp\C13D.tmp"78⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\C18B.tmp"C:\Users\Admin\AppData\Local\Temp\C18B.tmp"79⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"80⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\C227.tmp"C:\Users\Admin\AppData\Local\Temp\C227.tmp"81⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\C275.tmp"C:\Users\Admin\AppData\Local\Temp\C275.tmp"82⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"83⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\C302.tmp"C:\Users\Admin\AppData\Local\Temp\C302.tmp"84⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\C350.tmp"C:\Users\Admin\AppData\Local\Temp\C350.tmp"85⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\C39E.tmp"C:\Users\Admin\AppData\Local\Temp\C39E.tmp"86⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"87⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\C43A.tmp"C:\Users\Admin\AppData\Local\Temp\C43A.tmp"88⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\C498.tmp"C:\Users\Admin\AppData\Local\Temp\C498.tmp"89⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\C4E6.tmp"C:\Users\Admin\AppData\Local\Temp\C4E6.tmp"90⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\C534.tmp"C:\Users\Admin\AppData\Local\Temp\C534.tmp"91⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\C592.tmp"C:\Users\Admin\AppData\Local\Temp\C592.tmp"92⤵PID:516
-
C:\Users\Admin\AppData\Local\Temp\C5E0.tmp"C:\Users\Admin\AppData\Local\Temp\C5E0.tmp"93⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\C62E.tmp"C:\Users\Admin\AppData\Local\Temp\C62E.tmp"94⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\C67C.tmp"C:\Users\Admin\AppData\Local\Temp\C67C.tmp"95⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\C6CA.tmp"C:\Users\Admin\AppData\Local\Temp\C6CA.tmp"96⤵
- System Location Discovery: System Language Discovery
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\C728.tmp"C:\Users\Admin\AppData\Local\Temp\C728.tmp"97⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\C786.tmp"C:\Users\Admin\AppData\Local\Temp\C786.tmp"98⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\C7D4.tmp"C:\Users\Admin\AppData\Local\Temp\C7D4.tmp"99⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\C822.tmp"C:\Users\Admin\AppData\Local\Temp\C822.tmp"100⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\C880.tmp"C:\Users\Admin\AppData\Local\Temp\C880.tmp"101⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\C8CE.tmp"C:\Users\Admin\AppData\Local\Temp\C8CE.tmp"102⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\C91C.tmp"C:\Users\Admin\AppData\Local\Temp\C91C.tmp"103⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\C97A.tmp"C:\Users\Admin\AppData\Local\Temp\C97A.tmp"104⤵
- System Location Discovery: System Language Discovery
PID:428 -
C:\Users\Admin\AppData\Local\Temp\C9C8.tmp"C:\Users\Admin\AppData\Local\Temp\C9C8.tmp"105⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\CA26.tmp"C:\Users\Admin\AppData\Local\Temp\CA26.tmp"106⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\CA74.tmp"C:\Users\Admin\AppData\Local\Temp\CA74.tmp"107⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\CAD2.tmp"C:\Users\Admin\AppData\Local\Temp\CAD2.tmp"108⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\CB20.tmp"C:\Users\Admin\AppData\Local\Temp\CB20.tmp"109⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\CB7E.tmp"C:\Users\Admin\AppData\Local\Temp\CB7E.tmp"110⤵
- System Location Discovery: System Language Discovery
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\CBCC.tmp"C:\Users\Admin\AppData\Local\Temp\CBCC.tmp"111⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\CC1A.tmp"C:\Users\Admin\AppData\Local\Temp\CC1A.tmp"112⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\CC78.tmp"C:\Users\Admin\AppData\Local\Temp\CC78.tmp"113⤵
- System Location Discovery: System Language Discovery
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\CCC6.tmp"C:\Users\Admin\AppData\Local\Temp\CCC6.tmp"114⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\CD14.tmp"C:\Users\Admin\AppData\Local\Temp\CD14.tmp"115⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\CD72.tmp"C:\Users\Admin\AppData\Local\Temp\CD72.tmp"116⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\CDC0.tmp"C:\Users\Admin\AppData\Local\Temp\CDC0.tmp"117⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\CE0E.tmp"C:\Users\Admin\AppData\Local\Temp\CE0E.tmp"118⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\CE5C.tmp"C:\Users\Admin\AppData\Local\Temp\CE5C.tmp"119⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\CEAA.tmp"C:\Users\Admin\AppData\Local\Temp\CEAA.tmp"120⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\CF08.tmp"C:\Users\Admin\AppData\Local\Temp\CF08.tmp"121⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\CF56.tmp"C:\Users\Admin\AppData\Local\Temp\CF56.tmp"122⤵PID:4420
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-