Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
25/07/2024, 14:02
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-25_a3e282b09f122eff7fa293698157a970_mafia.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2024-07-25_a3e282b09f122eff7fa293698157a970_mafia.exe
Resource
win10v2004-20240709-en
General
-
Target
2024-07-25_a3e282b09f122eff7fa293698157a970_mafia.exe
-
Size
712KB
-
MD5
a3e282b09f122eff7fa293698157a970
-
SHA1
4dcc3c45b05a532c2020b6bb17e8642623775ebc
-
SHA256
761d6ec203818d95549e6c1adbee1567109079a02e103508b345e999a37551c6
-
SHA512
80a3d42cfddc21755bc06fbed5c53a5ef36d8d927996c72f5a25a096f718e2b4e8d9a2255a05675f03346092e7b7c014d33298a1d8290b3dcf60aaa9c0904887
-
SSDEEP
12288:FU5rCOTeiD1Ilx1RwjGOqQDPSj9Em6xVJNZdCvq5TJLCvY90D8/LVBlVk736Y79m:FUQOJD1IhS7u9aXJNnCvq5TJLCvY90DA
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2852 3092.tmp 2700 30E0.tmp 2840 315D.tmp 2832 31E9.tmp 2572 3266.tmp 2860 32F2.tmp 2580 3360.tmp 3060 33EC.tmp 2304 344A.tmp 2436 34A7.tmp 1604 3505.tmp 408 3591.tmp 2960 360E.tmp 2384 367B.tmp 1712 36E8.tmp 1452 3775.tmp 896 37F2.tmp 2616 388E.tmp 2056 38CC.tmp 1208 3978.tmp 1968 39C6.tmp 1676 3A23.tmp 1200 3AA0.tmp 1748 3ADE.tmp 908 3B2C.tmp 2072 3B7A.tmp 3068 3BE8.tmp 3000 3C36.tmp 2976 3C74.tmp 2372 3CC2.tmp 2296 3D00.tmp 1600 3D4E.tmp 2316 3D9C.tmp 752 3DDB.tmp 2896 3E19.tmp 1356 3E67.tmp 1536 3EB5.tmp 3048 3EF4.tmp 1768 3F32.tmp 1720 3F80.tmp 796 3FBE.tmp 1848 400C.tmp 1860 404B.tmp 292 4089.tmp 2280 40C8.tmp 1480 4116.tmp 2408 4154.tmp 2516 41A2.tmp 756 41E0.tmp 1444 421F.tmp 1544 425D.tmp 556 42AB.tmp 2696 42EA.tmp 2844 4328.tmp 2816 4376.tmp 2672 43C4.tmp 2700 4402.tmp 2808 4441.tmp 2940 447F.tmp 2720 44BE.tmp 2184 450C.tmp 2164 454A.tmp 2560 4588.tmp 2668 45D6.tmp -
Loads dropped DLL 64 IoCs
pid Process 2652 2024-07-25_a3e282b09f122eff7fa293698157a970_mafia.exe 2852 3092.tmp 2700 30E0.tmp 2840 315D.tmp 2832 31E9.tmp 2572 3266.tmp 2860 32F2.tmp 2580 3360.tmp 3060 33EC.tmp 2304 344A.tmp 2436 34A7.tmp 1604 3505.tmp 408 3591.tmp 2960 360E.tmp 2384 367B.tmp 1712 36E8.tmp 1452 3775.tmp 896 37F2.tmp 2616 388E.tmp 2056 38CC.tmp 1208 3978.tmp 1968 39C6.tmp 1676 3A23.tmp 1200 3AA0.tmp 1748 3ADE.tmp 908 3B2C.tmp 2072 3B7A.tmp 3068 3BE8.tmp 3000 3C36.tmp 2976 3C74.tmp 2372 3CC2.tmp 2296 3D00.tmp 1600 3D4E.tmp 2316 3D9C.tmp 752 3DDB.tmp 2896 3E19.tmp 1356 3E67.tmp 1536 3EB5.tmp 3048 3EF4.tmp 1768 3F32.tmp 1720 3F80.tmp 796 3FBE.tmp 1848 400C.tmp 1860 404B.tmp 292 4089.tmp 2280 40C8.tmp 1480 4116.tmp 2408 4154.tmp 2516 41A2.tmp 756 41E0.tmp 1444 421F.tmp 1544 425D.tmp 556 42AB.tmp 2696 42EA.tmp 2844 4328.tmp 2816 4376.tmp 2672 43C4.tmp 2700 4402.tmp 2808 4441.tmp 2940 447F.tmp 2720 44BE.tmp 2184 450C.tmp 2164 454A.tmp 2560 4588.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E2F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E428.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2730.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 712A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC1C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3267.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 866F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A100.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C014.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C38D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E04.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A38F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F392.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4116.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C33F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F595.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3978.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C0E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2923.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1075.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2652 wrote to memory of 2852 2652 2024-07-25_a3e282b09f122eff7fa293698157a970_mafia.exe 30 PID 2652 wrote to memory of 2852 2652 2024-07-25_a3e282b09f122eff7fa293698157a970_mafia.exe 30 PID 2652 wrote to memory of 2852 2652 2024-07-25_a3e282b09f122eff7fa293698157a970_mafia.exe 30 PID 2652 wrote to memory of 2852 2652 2024-07-25_a3e282b09f122eff7fa293698157a970_mafia.exe 30 PID 2852 wrote to memory of 2700 2852 3092.tmp 31 PID 2852 wrote to memory of 2700 2852 3092.tmp 31 PID 2852 wrote to memory of 2700 2852 3092.tmp 31 PID 2852 wrote to memory of 2700 2852 3092.tmp 31 PID 2700 wrote to memory of 2840 2700 30E0.tmp 32 PID 2700 wrote to memory of 2840 2700 30E0.tmp 32 PID 2700 wrote to memory of 2840 2700 30E0.tmp 32 PID 2700 wrote to memory of 2840 2700 30E0.tmp 32 PID 2840 wrote to memory of 2832 2840 315D.tmp 33 PID 2840 wrote to memory of 2832 2840 315D.tmp 33 PID 2840 wrote to memory of 2832 2840 315D.tmp 33 PID 2840 wrote to memory of 2832 2840 315D.tmp 33 PID 2832 wrote to memory of 2572 2832 31E9.tmp 34 PID 2832 wrote to memory of 2572 2832 31E9.tmp 34 PID 2832 wrote to memory of 2572 2832 31E9.tmp 34 PID 2832 wrote to memory of 2572 2832 31E9.tmp 34 PID 2572 wrote to memory of 2860 2572 3266.tmp 35 PID 2572 wrote to memory of 2860 2572 3266.tmp 35 PID 2572 wrote to memory of 2860 2572 3266.tmp 35 PID 2572 wrote to memory of 2860 2572 3266.tmp 35 PID 2860 wrote to memory of 2580 2860 32F2.tmp 36 PID 2860 wrote to memory of 2580 2860 32F2.tmp 36 PID 2860 wrote to memory of 2580 2860 32F2.tmp 36 PID 2860 wrote to memory of 2580 2860 32F2.tmp 36 PID 2580 wrote to memory of 3060 2580 3360.tmp 37 PID 2580 wrote to memory of 3060 2580 3360.tmp 37 PID 2580 wrote to memory of 3060 2580 3360.tmp 37 PID 2580 wrote to memory of 3060 2580 3360.tmp 37 PID 3060 wrote to memory of 2304 3060 33EC.tmp 38 PID 3060 wrote to memory of 2304 3060 33EC.tmp 38 PID 3060 wrote to memory of 2304 3060 33EC.tmp 38 PID 3060 wrote to memory of 2304 3060 33EC.tmp 38 PID 2304 wrote to memory of 2436 2304 344A.tmp 39 PID 2304 wrote to memory of 2436 2304 344A.tmp 39 PID 2304 wrote to memory of 2436 2304 344A.tmp 39 PID 2304 wrote to memory of 2436 2304 344A.tmp 39 PID 2436 wrote to memory of 1604 2436 34A7.tmp 40 PID 2436 wrote to memory of 1604 2436 34A7.tmp 40 PID 2436 wrote to memory of 1604 2436 34A7.tmp 40 PID 2436 wrote to memory of 1604 2436 34A7.tmp 40 PID 1604 wrote to memory of 408 1604 3505.tmp 41 PID 1604 wrote to memory of 408 1604 3505.tmp 41 PID 1604 wrote to memory of 408 1604 3505.tmp 41 PID 1604 wrote to memory of 408 1604 3505.tmp 41 PID 408 wrote to memory of 2960 408 3591.tmp 42 PID 408 wrote to memory of 2960 408 3591.tmp 42 PID 408 wrote to memory of 2960 408 3591.tmp 42 PID 408 wrote to memory of 2960 408 3591.tmp 42 PID 2960 wrote to memory of 2384 2960 360E.tmp 43 PID 2960 wrote to memory of 2384 2960 360E.tmp 43 PID 2960 wrote to memory of 2384 2960 360E.tmp 43 PID 2960 wrote to memory of 2384 2960 360E.tmp 43 PID 2384 wrote to memory of 1712 2384 367B.tmp 44 PID 2384 wrote to memory of 1712 2384 367B.tmp 44 PID 2384 wrote to memory of 1712 2384 367B.tmp 44 PID 2384 wrote to memory of 1712 2384 367B.tmp 44 PID 1712 wrote to memory of 1452 1712 36E8.tmp 45 PID 1712 wrote to memory of 1452 1712 36E8.tmp 45 PID 1712 wrote to memory of 1452 1712 36E8.tmp 45 PID 1712 wrote to memory of 1452 1712 36E8.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-25_a3e282b09f122eff7fa293698157a970_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-25_a3e282b09f122eff7fa293698157a970_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\3092.tmp"C:\Users\Admin\AppData\Local\Temp\3092.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\30E0.tmp"C:\Users\Admin\AppData\Local\Temp\30E0.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\315D.tmp"C:\Users\Admin\AppData\Local\Temp\315D.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\31E9.tmp"C:\Users\Admin\AppData\Local\Temp\31E9.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\3266.tmp"C:\Users\Admin\AppData\Local\Temp\3266.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\32F2.tmp"C:\Users\Admin\AppData\Local\Temp\32F2.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\3360.tmp"C:\Users\Admin\AppData\Local\Temp\3360.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\33EC.tmp"C:\Users\Admin\AppData\Local\Temp\33EC.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\344A.tmp"C:\Users\Admin\AppData\Local\Temp\344A.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\34A7.tmp"C:\Users\Admin\AppData\Local\Temp\34A7.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\3505.tmp"C:\Users\Admin\AppData\Local\Temp\3505.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\3591.tmp"C:\Users\Admin\AppData\Local\Temp\3591.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Users\Admin\AppData\Local\Temp\360E.tmp"C:\Users\Admin\AppData\Local\Temp\360E.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\367B.tmp"C:\Users\Admin\AppData\Local\Temp\367B.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\36E8.tmp"C:\Users\Admin\AppData\Local\Temp\36E8.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\3775.tmp"C:\Users\Admin\AppData\Local\Temp\3775.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\37F2.tmp"C:\Users\Admin\AppData\Local\Temp\37F2.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:896 -
C:\Users\Admin\AppData\Local\Temp\388E.tmp"C:\Users\Admin\AppData\Local\Temp\388E.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\38CC.tmp"C:\Users\Admin\AppData\Local\Temp\38CC.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\3978.tmp"C:\Users\Admin\AppData\Local\Temp\3978.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\39C6.tmp"C:\Users\Admin\AppData\Local\Temp\39C6.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\3A23.tmp"C:\Users\Admin\AppData\Local\Temp\3A23.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\3AA0.tmp"C:\Users\Admin\AppData\Local\Temp\3AA0.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\3ADE.tmp"C:\Users\Admin\AppData\Local\Temp\3ADE.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\3B2C.tmp"C:\Users\Admin\AppData\Local\Temp\3B2C.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:908 -
C:\Users\Admin\AppData\Local\Temp\3B7A.tmp"C:\Users\Admin\AppData\Local\Temp\3B7A.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\3BE8.tmp"C:\Users\Admin\AppData\Local\Temp\3BE8.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\3C36.tmp"C:\Users\Admin\AppData\Local\Temp\3C36.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\3C74.tmp"C:\Users\Admin\AppData\Local\Temp\3C74.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\3CC2.tmp"C:\Users\Admin\AppData\Local\Temp\3CC2.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\3D00.tmp"C:\Users\Admin\AppData\Local\Temp\3D00.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\3D4E.tmp"C:\Users\Admin\AppData\Local\Temp\3D4E.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\3DDB.tmp"C:\Users\Admin\AppData\Local\Temp\3DDB.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:752 -
C:\Users\Admin\AppData\Local\Temp\3E19.tmp"C:\Users\Admin\AppData\Local\Temp\3E19.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\3E67.tmp"C:\Users\Admin\AppData\Local\Temp\3E67.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\3EB5.tmp"C:\Users\Admin\AppData\Local\Temp\3EB5.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\3EF4.tmp"C:\Users\Admin\AppData\Local\Temp\3EF4.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\3F32.tmp"C:\Users\Admin\AppData\Local\Temp\3F32.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\3F80.tmp"C:\Users\Admin\AppData\Local\Temp\3F80.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\3FBE.tmp"C:\Users\Admin\AppData\Local\Temp\3FBE.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:796 -
C:\Users\Admin\AppData\Local\Temp\400C.tmp"C:\Users\Admin\AppData\Local\Temp\400C.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\404B.tmp"C:\Users\Admin\AppData\Local\Temp\404B.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\4089.tmp"C:\Users\Admin\AppData\Local\Temp\4089.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:292 -
C:\Users\Admin\AppData\Local\Temp\40C8.tmp"C:\Users\Admin\AppData\Local\Temp\40C8.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\4116.tmp"C:\Users\Admin\AppData\Local\Temp\4116.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\4154.tmp"C:\Users\Admin\AppData\Local\Temp\4154.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\41A2.tmp"C:\Users\Admin\AppData\Local\Temp\41A2.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\41E0.tmp"C:\Users\Admin\AppData\Local\Temp\41E0.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:756 -
C:\Users\Admin\AppData\Local\Temp\421F.tmp"C:\Users\Admin\AppData\Local\Temp\421F.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\425D.tmp"C:\Users\Admin\AppData\Local\Temp\425D.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\42AB.tmp"C:\Users\Admin\AppData\Local\Temp\42AB.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:556 -
C:\Users\Admin\AppData\Local\Temp\42EA.tmp"C:\Users\Admin\AppData\Local\Temp\42EA.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\4328.tmp"C:\Users\Admin\AppData\Local\Temp\4328.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\4376.tmp"C:\Users\Admin\AppData\Local\Temp\4376.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\43C4.tmp"C:\Users\Admin\AppData\Local\Temp\43C4.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\4402.tmp"C:\Users\Admin\AppData\Local\Temp\4402.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\4441.tmp"C:\Users\Admin\AppData\Local\Temp\4441.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\447F.tmp"C:\Users\Admin\AppData\Local\Temp\447F.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\44BE.tmp"C:\Users\Admin\AppData\Local\Temp\44BE.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\450C.tmp"C:\Users\Admin\AppData\Local\Temp\450C.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\454A.tmp"C:\Users\Admin\AppData\Local\Temp\454A.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\4588.tmp"C:\Users\Admin\AppData\Local\Temp\4588.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\45D6.tmp"C:\Users\Admin\AppData\Local\Temp\45D6.tmp"65⤵
- Executes dropped EXE
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\4615.tmp"C:\Users\Admin\AppData\Local\Temp\4615.tmp"66⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\4653.tmp"C:\Users\Admin\AppData\Local\Temp\4653.tmp"67⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\4692.tmp"C:\Users\Admin\AppData\Local\Temp\4692.tmp"68⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\46D0.tmp"C:\Users\Admin\AppData\Local\Temp\46D0.tmp"69⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\470E.tmp"C:\Users\Admin\AppData\Local\Temp\470E.tmp"70⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\474D.tmp"C:\Users\Admin\AppData\Local\Temp\474D.tmp"71⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\478B.tmp"C:\Users\Admin\AppData\Local\Temp\478B.tmp"72⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\47CA.tmp"C:\Users\Admin\AppData\Local\Temp\47CA.tmp"73⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\4808.tmp"C:\Users\Admin\AppData\Local\Temp\4808.tmp"74⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\4846.tmp"C:\Users\Admin\AppData\Local\Temp\4846.tmp"75⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\4885.tmp"C:\Users\Admin\AppData\Local\Temp\4885.tmp"76⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\48C3.tmp"C:\Users\Admin\AppData\Local\Temp\48C3.tmp"77⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\4902.tmp"C:\Users\Admin\AppData\Local\Temp\4902.tmp"78⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\4940.tmp"C:\Users\Admin\AppData\Local\Temp\4940.tmp"79⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\497E.tmp"C:\Users\Admin\AppData\Local\Temp\497E.tmp"80⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\49BD.tmp"C:\Users\Admin\AppData\Local\Temp\49BD.tmp"81⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\49FB.tmp"C:\Users\Admin\AppData\Local\Temp\49FB.tmp"82⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\4A49.tmp"C:\Users\Admin\AppData\Local\Temp\4A49.tmp"83⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\4A88.tmp"C:\Users\Admin\AppData\Local\Temp\4A88.tmp"84⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\4AC6.tmp"C:\Users\Admin\AppData\Local\Temp\4AC6.tmp"85⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\4B04.tmp"C:\Users\Admin\AppData\Local\Temp\4B04.tmp"86⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\4B52.tmp"C:\Users\Admin\AppData\Local\Temp\4B52.tmp"87⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\4B91.tmp"C:\Users\Admin\AppData\Local\Temp\4B91.tmp"88⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\4BCF.tmp"C:\Users\Admin\AppData\Local\Temp\4BCF.tmp"89⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\4C0E.tmp"C:\Users\Admin\AppData\Local\Temp\4C0E.tmp"90⤵
- System Location Discovery: System Language Discovery
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\4C4C.tmp"C:\Users\Admin\AppData\Local\Temp\4C4C.tmp"91⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"92⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\4CC9.tmp"C:\Users\Admin\AppData\Local\Temp\4CC9.tmp"93⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\4D17.tmp"C:\Users\Admin\AppData\Local\Temp\4D17.tmp"94⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"95⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\4D94.tmp"C:\Users\Admin\AppData\Local\Temp\4D94.tmp"96⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"97⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"98⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"99⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"100⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"101⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"102⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"103⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\4F96.tmp"C:\Users\Admin\AppData\Local\Temp\4F96.tmp"104⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"105⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\5013.tmp"C:\Users\Admin\AppData\Local\Temp\5013.tmp"106⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"107⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\5090.tmp"C:\Users\Admin\AppData\Local\Temp\5090.tmp"108⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\50CE.tmp"C:\Users\Admin\AppData\Local\Temp\50CE.tmp"109⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\510D.tmp"C:\Users\Admin\AppData\Local\Temp\510D.tmp"110⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\514B.tmp"C:\Users\Admin\AppData\Local\Temp\514B.tmp"111⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\518A.tmp"C:\Users\Admin\AppData\Local\Temp\518A.tmp"112⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\51C8.tmp"C:\Users\Admin\AppData\Local\Temp\51C8.tmp"113⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\5206.tmp"C:\Users\Admin\AppData\Local\Temp\5206.tmp"114⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\5245.tmp"C:\Users\Admin\AppData\Local\Temp\5245.tmp"115⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\5283.tmp"C:\Users\Admin\AppData\Local\Temp\5283.tmp"116⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\52C2.tmp"C:\Users\Admin\AppData\Local\Temp\52C2.tmp"117⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\5310.tmp"C:\Users\Admin\AppData\Local\Temp\5310.tmp"118⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\535E.tmp"C:\Users\Admin\AppData\Local\Temp\535E.tmp"119⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\539C.tmp"C:\Users\Admin\AppData\Local\Temp\539C.tmp"120⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\53EA.tmp"C:\Users\Admin\AppData\Local\Temp\53EA.tmp"121⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\5428.tmp"C:\Users\Admin\AppData\Local\Temp\5428.tmp"122⤵PID:2876
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-