Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-10-2024 01:37
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-13_b58d943c26dc616b434518a5b1d4780f_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-13_b58d943c26dc616b434518a5b1d4780f_mafia.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-13_b58d943c26dc616b434518a5b1d4780f_mafia.exe
-
Size
765KB
-
MD5
b58d943c26dc616b434518a5b1d4780f
-
SHA1
f8c8ce0e3e699636c83b5eac2ec08ff2631f96ec
-
SHA256
b6a9583b6d215c27e3bcad45d22c3d5d4ed15b9c31da1f5c2101dae3aad96d4a
-
SHA512
5cdcd4a256cc3d81dcf59a266909868eec6487bfdc96d1c752bdcc899b2242a208bd9309861def1acaf79cb2918f6e09bd5c8dabb1b17a30ea953be6619cdea6
-
SSDEEP
12288:ZU5rCOTeiDmnJCdBvG7xzlo6D9r7RPC3ZF5rn5rLOa54U5w5A:ZUQOJDMAByrosPC3vh5Oa+UOS
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2488 8D5B.tmp 3972 8E07.tmp 4536 8EA3.tmp 4808 8F4F.tmp 3636 8FDC.tmp 3028 9069.tmp 4692 90D6.tmp 3428 9134.tmp 4420 91A1.tmp 2408 921E.tmp 2436 927C.tmp 5048 92F9.tmp 4584 9376.tmp 4208 93D4.tmp 448 9470.tmp 2728 94CE.tmp 2968 954B.tmp 2344 95A8.tmp 1960 9606.tmp 4768 96A2.tmp 1948 9710.tmp 776 978D.tmp 3988 97EA.tmp 1532 9848.tmp 3048 98B6.tmp 4628 9933.tmp 4624 99BF.tmp 1924 9A5B.tmp 892 9AF8.tmp 68 9B55.tmp 3224 9BC3.tmp 1548 9C4F.tmp 1828 9CDC.tmp 4184 9D3A.tmp 3424 9D98.tmp 3604 9DF5.tmp 4944 9E43.tmp 1928 9E92.tmp 1648 9EEF.tmp 1316 9F4D.tmp 2560 9FAB.tmp 2796 A009.tmp 4160 A057.tmp 3836 A0B4.tmp 4300 A112.tmp 5044 A170.tmp 2128 A1CE.tmp 2760 A22B.tmp 4804 A27A.tmp 2104 A2C8.tmp 4876 A325.tmp 4708 A374.tmp 636 A3D1.tmp 2036 A41F.tmp 1716 A46E.tmp 5112 A4BC.tmp 4392 A50A.tmp 1588 A568.tmp 1612 A5B6.tmp 1748 A613.tmp 3180 A662.tmp 4728 A6B0.tmp 3028 A70D.tmp 3120 A76B.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 337.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B89D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACDA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F666.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A294.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E114.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF68.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F29.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D91.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 978D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A009.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 268E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DABB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7579.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 297C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5176.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7097.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F211.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6983.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E956.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3472 wrote to memory of 2488 3472 2024-10-13_b58d943c26dc616b434518a5b1d4780f_mafia.exe 85 PID 3472 wrote to memory of 2488 3472 2024-10-13_b58d943c26dc616b434518a5b1d4780f_mafia.exe 85 PID 3472 wrote to memory of 2488 3472 2024-10-13_b58d943c26dc616b434518a5b1d4780f_mafia.exe 85 PID 2488 wrote to memory of 3972 2488 8D5B.tmp 87 PID 2488 wrote to memory of 3972 2488 8D5B.tmp 87 PID 2488 wrote to memory of 3972 2488 8D5B.tmp 87 PID 3972 wrote to memory of 4536 3972 8E07.tmp 88 PID 3972 wrote to memory of 4536 3972 8E07.tmp 88 PID 3972 wrote to memory of 4536 3972 8E07.tmp 88 PID 4536 wrote to memory of 4808 4536 8EA3.tmp 89 PID 4536 wrote to memory of 4808 4536 8EA3.tmp 89 PID 4536 wrote to memory of 4808 4536 8EA3.tmp 89 PID 4808 wrote to memory of 3636 4808 8F4F.tmp 90 PID 4808 wrote to memory of 3636 4808 8F4F.tmp 90 PID 4808 wrote to memory of 3636 4808 8F4F.tmp 90 PID 3636 wrote to memory of 3028 3636 8FDC.tmp 91 PID 3636 wrote to memory of 3028 3636 8FDC.tmp 91 PID 3636 wrote to memory of 3028 3636 8FDC.tmp 91 PID 3028 wrote to memory of 4692 3028 9069.tmp 92 PID 3028 wrote to memory of 4692 3028 9069.tmp 92 PID 3028 wrote to memory of 4692 3028 9069.tmp 92 PID 4692 wrote to memory of 3428 4692 90D6.tmp 93 PID 4692 wrote to memory of 3428 4692 90D6.tmp 93 PID 4692 wrote to memory of 3428 4692 90D6.tmp 93 PID 3428 wrote to memory of 4420 3428 9134.tmp 94 PID 3428 wrote to memory of 4420 3428 9134.tmp 94 PID 3428 wrote to memory of 4420 3428 9134.tmp 94 PID 4420 wrote to memory of 2408 4420 91A1.tmp 95 PID 4420 wrote to memory of 2408 4420 91A1.tmp 95 PID 4420 wrote to memory of 2408 4420 91A1.tmp 95 PID 2408 wrote to memory of 2436 2408 921E.tmp 96 PID 2408 wrote to memory of 2436 2408 921E.tmp 96 PID 2408 wrote to memory of 2436 2408 921E.tmp 96 PID 2436 wrote to memory of 5048 2436 927C.tmp 97 PID 2436 wrote to memory of 5048 2436 927C.tmp 97 PID 2436 wrote to memory of 5048 2436 927C.tmp 97 PID 5048 wrote to memory of 4584 5048 92F9.tmp 98 PID 5048 wrote to memory of 4584 5048 92F9.tmp 98 PID 5048 wrote to memory of 4584 5048 92F9.tmp 98 PID 4584 wrote to memory of 4208 4584 9376.tmp 99 PID 4584 wrote to memory of 4208 4584 9376.tmp 99 PID 4584 wrote to memory of 4208 4584 9376.tmp 99 PID 4208 wrote to memory of 448 4208 93D4.tmp 100 PID 4208 wrote to memory of 448 4208 93D4.tmp 100 PID 4208 wrote to memory of 448 4208 93D4.tmp 100 PID 448 wrote to memory of 2728 448 9470.tmp 101 PID 448 wrote to memory of 2728 448 9470.tmp 101 PID 448 wrote to memory of 2728 448 9470.tmp 101 PID 2728 wrote to memory of 2968 2728 94CE.tmp 102 PID 2728 wrote to memory of 2968 2728 94CE.tmp 102 PID 2728 wrote to memory of 2968 2728 94CE.tmp 102 PID 2968 wrote to memory of 2344 2968 954B.tmp 103 PID 2968 wrote to memory of 2344 2968 954B.tmp 103 PID 2968 wrote to memory of 2344 2968 954B.tmp 103 PID 2344 wrote to memory of 1960 2344 95A8.tmp 104 PID 2344 wrote to memory of 1960 2344 95A8.tmp 104 PID 2344 wrote to memory of 1960 2344 95A8.tmp 104 PID 1960 wrote to memory of 4768 1960 9606.tmp 105 PID 1960 wrote to memory of 4768 1960 9606.tmp 105 PID 1960 wrote to memory of 4768 1960 9606.tmp 105 PID 4768 wrote to memory of 1948 4768 96A2.tmp 106 PID 4768 wrote to memory of 1948 4768 96A2.tmp 106 PID 4768 wrote to memory of 1948 4768 96A2.tmp 106 PID 1948 wrote to memory of 776 1948 9710.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-13_b58d943c26dc616b434518a5b1d4780f_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-13_b58d943c26dc616b434518a5b1d4780f_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\8D5B.tmp"C:\Users\Admin\AppData\Local\Temp\8D5B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\8E07.tmp"C:\Users\Admin\AppData\Local\Temp\8E07.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\9069.tmp"C:\Users\Admin\AppData\Local\Temp\9069.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\90D6.tmp"C:\Users\Admin\AppData\Local\Temp\90D6.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\9134.tmp"C:\Users\Admin\AppData\Local\Temp\9134.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\91A1.tmp"C:\Users\Admin\AppData\Local\Temp\91A1.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\921E.tmp"C:\Users\Admin\AppData\Local\Temp\921E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\927C.tmp"C:\Users\Admin\AppData\Local\Temp\927C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\92F9.tmp"C:\Users\Admin\AppData\Local\Temp\92F9.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\9376.tmp"C:\Users\Admin\AppData\Local\Temp\9376.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\93D4.tmp"C:\Users\Admin\AppData\Local\Temp\93D4.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\9470.tmp"C:\Users\Admin\AppData\Local\Temp\9470.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Users\Admin\AppData\Local\Temp\94CE.tmp"C:\Users\Admin\AppData\Local\Temp\94CE.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\954B.tmp"C:\Users\Admin\AppData\Local\Temp\954B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\95A8.tmp"C:\Users\Admin\AppData\Local\Temp\95A8.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\9606.tmp"C:\Users\Admin\AppData\Local\Temp\9606.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\96A2.tmp"C:\Users\Admin\AppData\Local\Temp\96A2.tmp"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\9710.tmp"C:\Users\Admin\AppData\Local\Temp\9710.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\978D.tmp"C:\Users\Admin\AppData\Local\Temp\978D.tmp"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:776 -
C:\Users\Admin\AppData\Local\Temp\97EA.tmp"C:\Users\Admin\AppData\Local\Temp\97EA.tmp"24⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\9848.tmp"C:\Users\Admin\AppData\Local\Temp\9848.tmp"25⤵
- Executes dropped EXE
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\98B6.tmp"C:\Users\Admin\AppData\Local\Temp\98B6.tmp"26⤵
- Executes dropped EXE
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\9933.tmp"C:\Users\Admin\AppData\Local\Temp\9933.tmp"27⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\99BF.tmp"C:\Users\Admin\AppData\Local\Temp\99BF.tmp"28⤵
- Executes dropped EXE
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"29⤵
- Executes dropped EXE
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"30⤵
- Executes dropped EXE
PID:892 -
C:\Users\Admin\AppData\Local\Temp\9B55.tmp"C:\Users\Admin\AppData\Local\Temp\9B55.tmp"31⤵
- Executes dropped EXE
PID:68 -
C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"32⤵
- Executes dropped EXE
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"33⤵
- Executes dropped EXE
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"34⤵
- Executes dropped EXE
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"35⤵
- Executes dropped EXE
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\9D98.tmp"C:\Users\Admin\AppData\Local\Temp\9D98.tmp"36⤵
- Executes dropped EXE
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"37⤵
- Executes dropped EXE
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\9E43.tmp"C:\Users\Admin\AppData\Local\Temp\9E43.tmp"38⤵
- Executes dropped EXE
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\9E92.tmp"C:\Users\Admin\AppData\Local\Temp\9E92.tmp"39⤵
- Executes dropped EXE
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"40⤵
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"41⤵
- Executes dropped EXE
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"42⤵
- Executes dropped EXE
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\A009.tmp"C:\Users\Admin\AppData\Local\Temp\A009.tmp"43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\A057.tmp"C:\Users\Admin\AppData\Local\Temp\A057.tmp"44⤵
- Executes dropped EXE
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\A112.tmp"C:\Users\Admin\AppData\Local\Temp\A112.tmp"46⤵
- Executes dropped EXE
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\A170.tmp"C:\Users\Admin\AppData\Local\Temp\A170.tmp"47⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"48⤵
- Executes dropped EXE
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\A22B.tmp"C:\Users\Admin\AppData\Local\Temp\A22B.tmp"49⤵
- Executes dropped EXE
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\A27A.tmp"C:\Users\Admin\AppData\Local\Temp\A27A.tmp"50⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"51⤵
- Executes dropped EXE
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\A325.tmp"C:\Users\Admin\AppData\Local\Temp\A325.tmp"52⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\A374.tmp"C:\Users\Admin\AppData\Local\Temp\A374.tmp"53⤵
- Executes dropped EXE
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"54⤵
- Executes dropped EXE
PID:636 -
C:\Users\Admin\AppData\Local\Temp\A41F.tmp"C:\Users\Admin\AppData\Local\Temp\A41F.tmp"55⤵
- Executes dropped EXE
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\A46E.tmp"C:\Users\Admin\AppData\Local\Temp\A46E.tmp"56⤵
- Executes dropped EXE
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"57⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\A50A.tmp"C:\Users\Admin\AppData\Local\Temp\A50A.tmp"58⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\A568.tmp"C:\Users\Admin\AppData\Local\Temp\A568.tmp"59⤵
- Executes dropped EXE
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"60⤵
- Executes dropped EXE
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\A613.tmp"C:\Users\Admin\AppData\Local\Temp\A613.tmp"61⤵
- Executes dropped EXE
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\A662.tmp"C:\Users\Admin\AppData\Local\Temp\A662.tmp"62⤵
- Executes dropped EXE
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"63⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\A70D.tmp"C:\Users\Admin\AppData\Local\Temp\A70D.tmp"64⤵
- Executes dropped EXE
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\A76B.tmp"C:\Users\Admin\AppData\Local\Temp\A76B.tmp"65⤵
- Executes dropped EXE
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"66⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\A807.tmp"C:\Users\Admin\AppData\Local\Temp\A807.tmp"67⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\A856.tmp"C:\Users\Admin\AppData\Local\Temp\A856.tmp"68⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"69⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"70⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\A940.tmp"C:\Users\Admin\AppData\Local\Temp\A940.tmp"71⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\A98E.tmp"C:\Users\Admin\AppData\Local\Temp\A98E.tmp"72⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"73⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"74⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\AA98.tmp"C:\Users\Admin\AppData\Local\Temp\AA98.tmp"75⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"76⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\AB34.tmp"C:\Users\Admin\AppData\Local\Temp\AB34.tmp"77⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\AB92.tmp"C:\Users\Admin\AppData\Local\Temp\AB92.tmp"78⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"79⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"80⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"81⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\AD38.tmp"C:\Users\Admin\AppData\Local\Temp\AD38.tmp"83⤵
- System Location Discovery: System Language Discovery
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\AD95.tmp"C:\Users\Admin\AppData\Local\Temp\AD95.tmp"84⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"85⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\AE32.tmp"C:\Users\Admin\AppData\Local\Temp\AE32.tmp"86⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"87⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\AEED.tmp"C:\Users\Admin\AppData\Local\Temp\AEED.tmp"88⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"89⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"90⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"91⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\B045.tmp"C:\Users\Admin\AppData\Local\Temp\B045.tmp"92⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"93⤵
- System Location Discovery: System Language Discovery
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\B0F1.tmp"C:\Users\Admin\AppData\Local\Temp\B0F1.tmp"94⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\B13F.tmp"C:\Users\Admin\AppData\Local\Temp\B13F.tmp"95⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\B18D.tmp"C:\Users\Admin\AppData\Local\Temp\B18D.tmp"96⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"97⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\B239.tmp"C:\Users\Admin\AppData\Local\Temp\B239.tmp"98⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\B287.tmp"C:\Users\Admin\AppData\Local\Temp\B287.tmp"99⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"100⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\B342.tmp"C:\Users\Admin\AppData\Local\Temp\B342.tmp"101⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"102⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"103⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\B45C.tmp"C:\Users\Admin\AppData\Local\Temp\B45C.tmp"104⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"105⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\B517.tmp"C:\Users\Admin\AppData\Local\Temp\B517.tmp"106⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\B575.tmp"C:\Users\Admin\AppData\Local\Temp\B575.tmp"107⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\B5D3.tmp"C:\Users\Admin\AppData\Local\Temp\B5D3.tmp"108⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\B630.tmp"C:\Users\Admin\AppData\Local\Temp\B630.tmp"109⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\B67F.tmp"C:\Users\Admin\AppData\Local\Temp\B67F.tmp"110⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"111⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\B73A.tmp"C:\Users\Admin\AppData\Local\Temp\B73A.tmp"112⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\B788.tmp"C:\Users\Admin\AppData\Local\Temp\B788.tmp"113⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"114⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\B844.tmp"C:\Users\Admin\AppData\Local\Temp\B844.tmp"115⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"116⤵
- System Location Discovery: System Language Discovery
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"117⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\B94D.tmp"C:\Users\Admin\AppData\Local\Temp\B94D.tmp"118⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\B99B.tmp"C:\Users\Admin\AppData\Local\Temp\B99B.tmp"119⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\B9F9.tmp"C:\Users\Admin\AppData\Local\Temp\B9F9.tmp"120⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\BA57.tmp"C:\Users\Admin\AppData\Local\Temp\BA57.tmp"121⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\BAA5.tmp"C:\Users\Admin\AppData\Local\Temp\BAA5.tmp"122⤵PID:5088
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-