Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-10-2024 09:53
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-18_215c0e5873d60c17ac84fd95d64ab3f1_mafia.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2024-10-18_215c0e5873d60c17ac84fd95d64ab3f1_mafia.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-18_215c0e5873d60c17ac84fd95d64ab3f1_mafia.exe
-
Size
520KB
-
MD5
215c0e5873d60c17ac84fd95d64ab3f1
-
SHA1
16b6021c5419d8e4dbb406fcd96cfd046a560a13
-
SHA256
b95a3330c43672370c97f855f0db570129b9f464e06b32162c08c48563f20970
-
SHA512
0d4edd277476040d1fc143eb0284d7751200c3152cf9150a924e2fd12b508106df8d9a65b78cbe100b46596f3a09461e86fb7e802686af4046c4ea913d249f5d
-
SSDEEP
12288:roRXOQjmOyx/qndDyMefveEes9gTGrAwNZ:rogQ9yxydDy9fTXgMN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1956 CF46.tmp 4936 CFD3.tmp 4664 D040.tmp 1840 D0BD.tmp 1004 D13A.tmp 3688 D1A8.tmp 1796 D205.tmp 2720 D282.tmp 3196 D2E0.tmp 4264 D34E.tmp 3104 D3BB.tmp 3888 D419.tmp 3544 D486.tmp 2856 D4F3.tmp 3224 D570.tmp 2316 D5CE.tmp 808 D62C.tmp 1588 D699.tmp 2232 D6F7.tmp 2428 D764.tmp 2696 D7B3.tmp 440 D801.tmp 4140 D87E.tmp 3120 D90A.tmp 4396 D997.tmp 2944 DA04.tmp 2352 DA62.tmp 1372 DAC0.tmp 4500 DB3D.tmp 3296 DB9B.tmp 3616 DC18.tmp 4300 DC75.tmp 4320 DCD3.tmp 4516 DD31.tmp 1360 DD8F.tmp 2716 DDDD.tmp 692 DE2B.tmp 2164 DE89.tmp 1512 DED7.tmp 1448 DF34.tmp 4432 DFA2.tmp 4868 E000.tmp 1364 E05D.tmp 1988 E0CB.tmp 2588 E128.tmp 2552 E177.tmp 1044 E1E4.tmp 1756 E242.tmp 5028 E2BF.tmp 2476 E30D.tmp 1796 E36B.tmp 4252 E3C8.tmp 5044 E436.tmp 5016 E493.tmp 2580 E4E2.tmp 3820 E530.tmp 2324 E58D.tmp 3440 E5EB.tmp 5112 E649.tmp 2596 E6A7.tmp 1964 E714.tmp 3348 E762.tmp 3856 E7C0.tmp 3980 E80E.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1652.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 294D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 680C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E26C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D29D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8299.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E6E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2853.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3EC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8018.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F925.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1827.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 267.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7579.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F141.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ACD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BC5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 408E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF56.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2244 wrote to memory of 1956 2244 2024-10-18_215c0e5873d60c17ac84fd95d64ab3f1_mafia.exe 84 PID 2244 wrote to memory of 1956 2244 2024-10-18_215c0e5873d60c17ac84fd95d64ab3f1_mafia.exe 84 PID 2244 wrote to memory of 1956 2244 2024-10-18_215c0e5873d60c17ac84fd95d64ab3f1_mafia.exe 84 PID 1956 wrote to memory of 4936 1956 CF46.tmp 85 PID 1956 wrote to memory of 4936 1956 CF46.tmp 85 PID 1956 wrote to memory of 4936 1956 CF46.tmp 85 PID 4936 wrote to memory of 4664 4936 CFD3.tmp 87 PID 4936 wrote to memory of 4664 4936 CFD3.tmp 87 PID 4936 wrote to memory of 4664 4936 CFD3.tmp 87 PID 4664 wrote to memory of 1840 4664 D040.tmp 89 PID 4664 wrote to memory of 1840 4664 D040.tmp 89 PID 4664 wrote to memory of 1840 4664 D040.tmp 89 PID 1840 wrote to memory of 1004 1840 D0BD.tmp 91 PID 1840 wrote to memory of 1004 1840 D0BD.tmp 91 PID 1840 wrote to memory of 1004 1840 D0BD.tmp 91 PID 1004 wrote to memory of 3688 1004 D13A.tmp 92 PID 1004 wrote to memory of 3688 1004 D13A.tmp 92 PID 1004 wrote to memory of 3688 1004 D13A.tmp 92 PID 3688 wrote to memory of 1796 3688 D1A8.tmp 93 PID 3688 wrote to memory of 1796 3688 D1A8.tmp 93 PID 3688 wrote to memory of 1796 3688 D1A8.tmp 93 PID 1796 wrote to memory of 2720 1796 D205.tmp 94 PID 1796 wrote to memory of 2720 1796 D205.tmp 94 PID 1796 wrote to memory of 2720 1796 D205.tmp 94 PID 2720 wrote to memory of 3196 2720 D282.tmp 95 PID 2720 wrote to memory of 3196 2720 D282.tmp 95 PID 2720 wrote to memory of 3196 2720 D282.tmp 95 PID 3196 wrote to memory of 4264 3196 D2E0.tmp 96 PID 3196 wrote to memory of 4264 3196 D2E0.tmp 96 PID 3196 wrote to memory of 4264 3196 D2E0.tmp 96 PID 4264 wrote to memory of 3104 4264 D34E.tmp 97 PID 4264 wrote to memory of 3104 4264 D34E.tmp 97 PID 4264 wrote to memory of 3104 4264 D34E.tmp 97 PID 3104 wrote to memory of 3888 3104 D3BB.tmp 98 PID 3104 wrote to memory of 3888 3104 D3BB.tmp 98 PID 3104 wrote to memory of 3888 3104 D3BB.tmp 98 PID 3888 wrote to memory of 3544 3888 D419.tmp 99 PID 3888 wrote to memory of 3544 3888 D419.tmp 99 PID 3888 wrote to memory of 3544 3888 D419.tmp 99 PID 3544 wrote to memory of 2856 3544 D486.tmp 100 PID 3544 wrote to memory of 2856 3544 D486.tmp 100 PID 3544 wrote to memory of 2856 3544 D486.tmp 100 PID 2856 wrote to memory of 3224 2856 D4F3.tmp 101 PID 2856 wrote to memory of 3224 2856 D4F3.tmp 101 PID 2856 wrote to memory of 3224 2856 D4F3.tmp 101 PID 3224 wrote to memory of 2316 3224 D570.tmp 102 PID 3224 wrote to memory of 2316 3224 D570.tmp 102 PID 3224 wrote to memory of 2316 3224 D570.tmp 102 PID 2316 wrote to memory of 808 2316 D5CE.tmp 103 PID 2316 wrote to memory of 808 2316 D5CE.tmp 103 PID 2316 wrote to memory of 808 2316 D5CE.tmp 103 PID 808 wrote to memory of 1588 808 D62C.tmp 104 PID 808 wrote to memory of 1588 808 D62C.tmp 104 PID 808 wrote to memory of 1588 808 D62C.tmp 104 PID 1588 wrote to memory of 2232 1588 D699.tmp 105 PID 1588 wrote to memory of 2232 1588 D699.tmp 105 PID 1588 wrote to memory of 2232 1588 D699.tmp 105 PID 2232 wrote to memory of 2428 2232 D6F7.tmp 106 PID 2232 wrote to memory of 2428 2232 D6F7.tmp 106 PID 2232 wrote to memory of 2428 2232 D6F7.tmp 106 PID 2428 wrote to memory of 2696 2428 D764.tmp 107 PID 2428 wrote to memory of 2696 2428 D764.tmp 107 PID 2428 wrote to memory of 2696 2428 D764.tmp 107 PID 2696 wrote to memory of 440 2696 D7B3.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-18_215c0e5873d60c17ac84fd95d64ab3f1_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-18_215c0e5873d60c17ac84fd95d64ab3f1_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\CF46.tmp"C:\Users\Admin\AppData\Local\Temp\CF46.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\CFD3.tmp"C:\Users\Admin\AppData\Local\Temp\CFD3.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\D040.tmp"C:\Users\Admin\AppData\Local\Temp\D040.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\D0BD.tmp"C:\Users\Admin\AppData\Local\Temp\D0BD.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\D13A.tmp"C:\Users\Admin\AppData\Local\Temp\D13A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\D1A8.tmp"C:\Users\Admin\AppData\Local\Temp\D1A8.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\D205.tmp"C:\Users\Admin\AppData\Local\Temp\D205.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\D282.tmp"C:\Users\Admin\AppData\Local\Temp\D282.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\D2E0.tmp"C:\Users\Admin\AppData\Local\Temp\D2E0.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\D34E.tmp"C:\Users\Admin\AppData\Local\Temp\D34E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\D3BB.tmp"C:\Users\Admin\AppData\Local\Temp\D3BB.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\D419.tmp"C:\Users\Admin\AppData\Local\Temp\D419.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\D486.tmp"C:\Users\Admin\AppData\Local\Temp\D486.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\D4F3.tmp"C:\Users\Admin\AppData\Local\Temp\D4F3.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\D570.tmp"C:\Users\Admin\AppData\Local\Temp\D570.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\D5CE.tmp"C:\Users\Admin\AppData\Local\Temp\D5CE.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\D62C.tmp"C:\Users\Admin\AppData\Local\Temp\D62C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Users\Admin\AppData\Local\Temp\D699.tmp"C:\Users\Admin\AppData\Local\Temp\D699.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\D6F7.tmp"C:\Users\Admin\AppData\Local\Temp\D6F7.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\D764.tmp"C:\Users\Admin\AppData\Local\Temp\D764.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\D7B3.tmp"C:\Users\Admin\AppData\Local\Temp\D7B3.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\D801.tmp"C:\Users\Admin\AppData\Local\Temp\D801.tmp"23⤵
- Executes dropped EXE
PID:440 -
C:\Users\Admin\AppData\Local\Temp\D87E.tmp"C:\Users\Admin\AppData\Local\Temp\D87E.tmp"24⤵
- Executes dropped EXE
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\D90A.tmp"C:\Users\Admin\AppData\Local\Temp\D90A.tmp"25⤵
- Executes dropped EXE
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\D997.tmp"C:\Users\Admin\AppData\Local\Temp\D997.tmp"26⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\DA04.tmp"C:\Users\Admin\AppData\Local\Temp\DA04.tmp"27⤵
- Executes dropped EXE
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\DA62.tmp"C:\Users\Admin\AppData\Local\Temp\DA62.tmp"28⤵
- Executes dropped EXE
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\DAC0.tmp"C:\Users\Admin\AppData\Local\Temp\DAC0.tmp"29⤵
- Executes dropped EXE
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\DB3D.tmp"C:\Users\Admin\AppData\Local\Temp\DB3D.tmp"30⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\DB9B.tmp"C:\Users\Admin\AppData\Local\Temp\DB9B.tmp"31⤵
- Executes dropped EXE
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\DC18.tmp"C:\Users\Admin\AppData\Local\Temp\DC18.tmp"32⤵
- Executes dropped EXE
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\DC75.tmp"C:\Users\Admin\AppData\Local\Temp\DC75.tmp"33⤵
- Executes dropped EXE
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\DCD3.tmp"C:\Users\Admin\AppData\Local\Temp\DCD3.tmp"34⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\DD31.tmp"C:\Users\Admin\AppData\Local\Temp\DD31.tmp"35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\DD8F.tmp"C:\Users\Admin\AppData\Local\Temp\DD8F.tmp"36⤵
- Executes dropped EXE
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\DDDD.tmp"C:\Users\Admin\AppData\Local\Temp\DDDD.tmp"37⤵
- Executes dropped EXE
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\DE2B.tmp"C:\Users\Admin\AppData\Local\Temp\DE2B.tmp"38⤵
- Executes dropped EXE
PID:692 -
C:\Users\Admin\AppData\Local\Temp\DE89.tmp"C:\Users\Admin\AppData\Local\Temp\DE89.tmp"39⤵
- Executes dropped EXE
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\DED7.tmp"C:\Users\Admin\AppData\Local\Temp\DED7.tmp"40⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\DF34.tmp"C:\Users\Admin\AppData\Local\Temp\DF34.tmp"41⤵
- Executes dropped EXE
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\DFA2.tmp"C:\Users\Admin\AppData\Local\Temp\DFA2.tmp"42⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\E000.tmp"C:\Users\Admin\AppData\Local\Temp\E000.tmp"43⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\E05D.tmp"C:\Users\Admin\AppData\Local\Temp\E05D.tmp"44⤵
- Executes dropped EXE
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\E0CB.tmp"C:\Users\Admin\AppData\Local\Temp\E0CB.tmp"45⤵
- Executes dropped EXE
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\E128.tmp"C:\Users\Admin\AppData\Local\Temp\E128.tmp"46⤵
- Executes dropped EXE
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\E177.tmp"C:\Users\Admin\AppData\Local\Temp\E177.tmp"47⤵
- Executes dropped EXE
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\E1E4.tmp"C:\Users\Admin\AppData\Local\Temp\E1E4.tmp"48⤵
- Executes dropped EXE
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\E242.tmp"C:\Users\Admin\AppData\Local\Temp\E242.tmp"49⤵
- Executes dropped EXE
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\E2BF.tmp"C:\Users\Admin\AppData\Local\Temp\E2BF.tmp"50⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\E30D.tmp"C:\Users\Admin\AppData\Local\Temp\E30D.tmp"51⤵
- Executes dropped EXE
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\E36B.tmp"C:\Users\Admin\AppData\Local\Temp\E36B.tmp"52⤵
- Executes dropped EXE
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\E3C8.tmp"C:\Users\Admin\AppData\Local\Temp\E3C8.tmp"53⤵
- Executes dropped EXE
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\E436.tmp"C:\Users\Admin\AppData\Local\Temp\E436.tmp"54⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\E493.tmp"C:\Users\Admin\AppData\Local\Temp\E493.tmp"55⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\E4E2.tmp"C:\Users\Admin\AppData\Local\Temp\E4E2.tmp"56⤵
- Executes dropped EXE
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\E530.tmp"C:\Users\Admin\AppData\Local\Temp\E530.tmp"57⤵
- Executes dropped EXE
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\E58D.tmp"C:\Users\Admin\AppData\Local\Temp\E58D.tmp"58⤵
- Executes dropped EXE
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\E5EB.tmp"C:\Users\Admin\AppData\Local\Temp\E5EB.tmp"59⤵
- Executes dropped EXE
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\E649.tmp"C:\Users\Admin\AppData\Local\Temp\E649.tmp"60⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"61⤵
- Executes dropped EXE
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\E714.tmp"C:\Users\Admin\AppData\Local\Temp\E714.tmp"62⤵
- Executes dropped EXE
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\E762.tmp"C:\Users\Admin\AppData\Local\Temp\E762.tmp"63⤵
- Executes dropped EXE
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\E7C0.tmp"C:\Users\Admin\AppData\Local\Temp\E7C0.tmp"64⤵
- Executes dropped EXE
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\E80E.tmp"C:\Users\Admin\AppData\Local\Temp\E80E.tmp"65⤵
- Executes dropped EXE
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\E86C.tmp"C:\Users\Admin\AppData\Local\Temp\E86C.tmp"66⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"67⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\E918.tmp"C:\Users\Admin\AppData\Local\Temp\E918.tmp"68⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\E966.tmp"C:\Users\Admin\AppData\Local\Temp\E966.tmp"69⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\E9C4.tmp"C:\Users\Admin\AppData\Local\Temp\E9C4.tmp"70⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\EA21.tmp"C:\Users\Admin\AppData\Local\Temp\EA21.tmp"71⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\EA7F.tmp"C:\Users\Admin\AppData\Local\Temp\EA7F.tmp"72⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\EADD.tmp"C:\Users\Admin\AppData\Local\Temp\EADD.tmp"73⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\EB3B.tmp"C:\Users\Admin\AppData\Local\Temp\EB3B.tmp"74⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\EB89.tmp"C:\Users\Admin\AppData\Local\Temp\EB89.tmp"75⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\EBF6.tmp"C:\Users\Admin\AppData\Local\Temp\EBF6.tmp"76⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\EC54.tmp"C:\Users\Admin\AppData\Local\Temp\EC54.tmp"77⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\ECB2.tmp"C:\Users\Admin\AppData\Local\Temp\ECB2.tmp"78⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\ED0F.tmp"C:\Users\Admin\AppData\Local\Temp\ED0F.tmp"79⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\ED6D.tmp"C:\Users\Admin\AppData\Local\Temp\ED6D.tmp"80⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\EDCB.tmp"C:\Users\Admin\AppData\Local\Temp\EDCB.tmp"81⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\EE29.tmp"C:\Users\Admin\AppData\Local\Temp\EE29.tmp"82⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\EE86.tmp"C:\Users\Admin\AppData\Local\Temp\EE86.tmp"83⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\EEF4.tmp"C:\Users\Admin\AppData\Local\Temp\EEF4.tmp"84⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\EF51.tmp"C:\Users\Admin\AppData\Local\Temp\EF51.tmp"85⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\EFAF.tmp"C:\Users\Admin\AppData\Local\Temp\EFAF.tmp"86⤵
- System Location Discovery: System Language Discovery
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\F00D.tmp"C:\Users\Admin\AppData\Local\Temp\F00D.tmp"87⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\F07A.tmp"C:\Users\Admin\AppData\Local\Temp\F07A.tmp"88⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\F0D8.tmp"C:\Users\Admin\AppData\Local\Temp\F0D8.tmp"89⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\F136.tmp"C:\Users\Admin\AppData\Local\Temp\F136.tmp"90⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\F194.tmp"C:\Users\Admin\AppData\Local\Temp\F194.tmp"91⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\F201.tmp"C:\Users\Admin\AppData\Local\Temp\F201.tmp"92⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\F25F.tmp"C:\Users\Admin\AppData\Local\Temp\F25F.tmp"93⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\F2BC.tmp"C:\Users\Admin\AppData\Local\Temp\F2BC.tmp"94⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\F31A.tmp"C:\Users\Admin\AppData\Local\Temp\F31A.tmp"95⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\F378.tmp"C:\Users\Admin\AppData\Local\Temp\F378.tmp"96⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\F3E5.tmp"C:\Users\Admin\AppData\Local\Temp\F3E5.tmp"97⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\F443.tmp"C:\Users\Admin\AppData\Local\Temp\F443.tmp"98⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\F4A1.tmp"C:\Users\Admin\AppData\Local\Temp\F4A1.tmp"99⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\F4FF.tmp"C:\Users\Admin\AppData\Local\Temp\F4FF.tmp"100⤵
- System Location Discovery: System Language Discovery
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\F55C.tmp"C:\Users\Admin\AppData\Local\Temp\F55C.tmp"101⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\F5CA.tmp"C:\Users\Admin\AppData\Local\Temp\F5CA.tmp"102⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\F627.tmp"C:\Users\Admin\AppData\Local\Temp\F627.tmp"103⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\F685.tmp"C:\Users\Admin\AppData\Local\Temp\F685.tmp"104⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\F6D3.tmp"C:\Users\Admin\AppData\Local\Temp\F6D3.tmp"105⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\F721.tmp"C:\Users\Admin\AppData\Local\Temp\F721.tmp"106⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\F77F.tmp"C:\Users\Admin\AppData\Local\Temp\F77F.tmp"107⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\F83B.tmp"C:\Users\Admin\AppData\Local\Temp\F83B.tmp"109⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\F889.tmp"C:\Users\Admin\AppData\Local\Temp\F889.tmp"110⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\F8D7.tmp"C:\Users\Admin\AppData\Local\Temp\F8D7.tmp"111⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\F925.tmp"C:\Users\Admin\AppData\Local\Temp\F925.tmp"112⤵
- System Location Discovery: System Language Discovery
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\F973.tmp"C:\Users\Admin\AppData\Local\Temp\F973.tmp"113⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\F9D1.tmp"C:\Users\Admin\AppData\Local\Temp\F9D1.tmp"114⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\FA2F.tmp"C:\Users\Admin\AppData\Local\Temp\FA2F.tmp"115⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\FA8C.tmp"C:\Users\Admin\AppData\Local\Temp\FA8C.tmp"116⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\FADB.tmp"C:\Users\Admin\AppData\Local\Temp\FADB.tmp"117⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\FB48.tmp"C:\Users\Admin\AppData\Local\Temp\FB48.tmp"118⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\FBA6.tmp"C:\Users\Admin\AppData\Local\Temp\FBA6.tmp"119⤵
- System Location Discovery: System Language Discovery
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\FC03.tmp"C:\Users\Admin\AppData\Local\Temp\FC03.tmp"120⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\FC61.tmp"C:\Users\Admin\AppData\Local\Temp\FC61.tmp"121⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\FCBF.tmp"C:\Users\Admin\AppData\Local\Temp\FCBF.tmp"122⤵PID:2428
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-