Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
02/08/2024, 11:42
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-02_f62a2d53dbdef096e0fa90aeb2b00110_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-08-02_f62a2d53dbdef096e0fa90aeb2b00110_mafia.exe
Resource
win10v2004-20240730-en
General
-
Target
2024-08-02_f62a2d53dbdef096e0fa90aeb2b00110_mafia.exe
-
Size
488KB
-
MD5
f62a2d53dbdef096e0fa90aeb2b00110
-
SHA1
b9a5289571110824d34f215e79d9822c9133baaf
-
SHA256
3e52531cb2d44654b3aa6277826a3874f9ed7b52f22a1a213d057e1068d625a7
-
SHA512
ea16c637b6f3fe2b07c5c4d0e33dbfcc03caadd716f4e7223cbc30a4afc9df326609bd94dadb0d0a3e70fc0fa32da6e1eb67e60b006aeedc9f6c369d816248d0
-
SSDEEP
12288:/U5rCOTeiDX51VIG4FEdiTPo/+x6Dg+ml621L/NZ:/UQOJDXC77su625N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2496 A6CA.tmp 112 A728.tmp 2352 A795.tmp 1028 A802.tmp 2128 A86F.tmp 1592 A8DD.tmp 2748 A93A.tmp 2708 A998.tmp 2684 A9F5.tmp 1980 AA63.tmp 3064 AAB1.tmp 2780 AB0E.tmp 2584 AB6C.tmp 2996 ABC9.tmp 3056 AC27.tmp 1244 AC85.tmp 1148 ACE2.tmp 860 AD30.tmp 264 AD8E.tmp 2800 ADEB.tmp 1912 AE68.tmp 1832 AEC6.tmp 1284 AF14.tmp 856 AF52.tmp 1512 AF91.tmp 2976 AFCF.tmp 2408 B00D.tmp 2196 B04C.tmp 2648 B09A.tmp 2236 B0D8.tmp 3060 B126.tmp 2980 B165.tmp 684 B1A3.tmp 1788 B1E1.tmp 1076 B220.tmp 940 B26E.tmp 1852 B2AC.tmp 2972 B2EB.tmp 608 B329.tmp 1048 B367.tmp 1920 B3B5.tmp 1536 B3F4.tmp 936 B432.tmp 2536 B471.tmp 2180 B4AF.tmp 1636 B4ED.tmp 2988 B52C.tmp 2076 B56A.tmp 556 B5A9.tmp 1732 B5E7.tmp 2268 B625.tmp 2304 B664.tmp 1300 B6A2.tmp 2888 B6E1.tmp 1236 B71F.tmp 2348 B75D.tmp 2360 B79C.tmp 2832 B7DA.tmp 2880 B819.tmp 1628 B857.tmp 2128 B895.tmp 2740 B8D4.tmp 1592 B922.tmp 2744 B970.tmp -
Loads dropped DLL 64 IoCs
pid Process 1680 2024-08-02_f62a2d53dbdef096e0fa90aeb2b00110_mafia.exe 2496 A6CA.tmp 112 A728.tmp 2352 A795.tmp 1028 A802.tmp 2128 A86F.tmp 1592 A8DD.tmp 2748 A93A.tmp 2708 A998.tmp 2684 A9F5.tmp 1980 AA63.tmp 3064 AAB1.tmp 2780 AB0E.tmp 2584 AB6C.tmp 2996 ABC9.tmp 3056 AC27.tmp 1244 AC85.tmp 1148 ACE2.tmp 860 AD30.tmp 264 AD8E.tmp 2800 ADEB.tmp 1912 AE68.tmp 1832 AEC6.tmp 1284 AF14.tmp 856 AF52.tmp 1512 AF91.tmp 2976 AFCF.tmp 2408 B00D.tmp 2196 B04C.tmp 2648 B09A.tmp 2236 B0D8.tmp 3060 B126.tmp 2980 B165.tmp 684 B1A3.tmp 1788 B1E1.tmp 1076 B220.tmp 940 B26E.tmp 1852 B2AC.tmp 2972 B2EB.tmp 608 B329.tmp 1048 B367.tmp 1920 B3B5.tmp 1536 B3F4.tmp 936 B432.tmp 2536 B471.tmp 2180 B4AF.tmp 1636 B4ED.tmp 2988 B52C.tmp 2076 B56A.tmp 556 B5A9.tmp 1732 B5E7.tmp 2268 B625.tmp 2304 B664.tmp 1300 B6A2.tmp 2888 B6E1.tmp 1236 B71F.tmp 2348 B75D.tmp 2360 B79C.tmp 2832 B7DA.tmp 2880 B819.tmp 1628 B857.tmp 2128 B895.tmp 2740 B8D4.tmp 1592 B922.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 903E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9379.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F096.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7993.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7629.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3276.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B79C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C65B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D836.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A332.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 840E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7899.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9109.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9405.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE4E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 366C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1680 wrote to memory of 2496 1680 2024-08-02_f62a2d53dbdef096e0fa90aeb2b00110_mafia.exe 30 PID 1680 wrote to memory of 2496 1680 2024-08-02_f62a2d53dbdef096e0fa90aeb2b00110_mafia.exe 30 PID 1680 wrote to memory of 2496 1680 2024-08-02_f62a2d53dbdef096e0fa90aeb2b00110_mafia.exe 30 PID 1680 wrote to memory of 2496 1680 2024-08-02_f62a2d53dbdef096e0fa90aeb2b00110_mafia.exe 30 PID 2496 wrote to memory of 112 2496 A6CA.tmp 31 PID 2496 wrote to memory of 112 2496 A6CA.tmp 31 PID 2496 wrote to memory of 112 2496 A6CA.tmp 31 PID 2496 wrote to memory of 112 2496 A6CA.tmp 31 PID 112 wrote to memory of 2352 112 A728.tmp 32 PID 112 wrote to memory of 2352 112 A728.tmp 32 PID 112 wrote to memory of 2352 112 A728.tmp 32 PID 112 wrote to memory of 2352 112 A728.tmp 32 PID 2352 wrote to memory of 1028 2352 A795.tmp 33 PID 2352 wrote to memory of 1028 2352 A795.tmp 33 PID 2352 wrote to memory of 1028 2352 A795.tmp 33 PID 2352 wrote to memory of 1028 2352 A795.tmp 33 PID 1028 wrote to memory of 2128 1028 A802.tmp 34 PID 1028 wrote to memory of 2128 1028 A802.tmp 34 PID 1028 wrote to memory of 2128 1028 A802.tmp 34 PID 1028 wrote to memory of 2128 1028 A802.tmp 34 PID 2128 wrote to memory of 1592 2128 A86F.tmp 35 PID 2128 wrote to memory of 1592 2128 A86F.tmp 35 PID 2128 wrote to memory of 1592 2128 A86F.tmp 35 PID 2128 wrote to memory of 1592 2128 A86F.tmp 35 PID 1592 wrote to memory of 2748 1592 A8DD.tmp 36 PID 1592 wrote to memory of 2748 1592 A8DD.tmp 36 PID 1592 wrote to memory of 2748 1592 A8DD.tmp 36 PID 1592 wrote to memory of 2748 1592 A8DD.tmp 36 PID 2748 wrote to memory of 2708 2748 A93A.tmp 37 PID 2748 wrote to memory of 2708 2748 A93A.tmp 37 PID 2748 wrote to memory of 2708 2748 A93A.tmp 37 PID 2748 wrote to memory of 2708 2748 A93A.tmp 37 PID 2708 wrote to memory of 2684 2708 A998.tmp 38 PID 2708 wrote to memory of 2684 2708 A998.tmp 38 PID 2708 wrote to memory of 2684 2708 A998.tmp 38 PID 2708 wrote to memory of 2684 2708 A998.tmp 38 PID 2684 wrote to memory of 1980 2684 A9F5.tmp 39 PID 2684 wrote to memory of 1980 2684 A9F5.tmp 39 PID 2684 wrote to memory of 1980 2684 A9F5.tmp 39 PID 2684 wrote to memory of 1980 2684 A9F5.tmp 39 PID 1980 wrote to memory of 3064 1980 AA63.tmp 40 PID 1980 wrote to memory of 3064 1980 AA63.tmp 40 PID 1980 wrote to memory of 3064 1980 AA63.tmp 40 PID 1980 wrote to memory of 3064 1980 AA63.tmp 40 PID 3064 wrote to memory of 2780 3064 AAB1.tmp 41 PID 3064 wrote to memory of 2780 3064 AAB1.tmp 41 PID 3064 wrote to memory of 2780 3064 AAB1.tmp 41 PID 3064 wrote to memory of 2780 3064 AAB1.tmp 41 PID 2780 wrote to memory of 2584 2780 AB0E.tmp 42 PID 2780 wrote to memory of 2584 2780 AB0E.tmp 42 PID 2780 wrote to memory of 2584 2780 AB0E.tmp 42 PID 2780 wrote to memory of 2584 2780 AB0E.tmp 42 PID 2584 wrote to memory of 2996 2584 AB6C.tmp 43 PID 2584 wrote to memory of 2996 2584 AB6C.tmp 43 PID 2584 wrote to memory of 2996 2584 AB6C.tmp 43 PID 2584 wrote to memory of 2996 2584 AB6C.tmp 43 PID 2996 wrote to memory of 3056 2996 ABC9.tmp 44 PID 2996 wrote to memory of 3056 2996 ABC9.tmp 44 PID 2996 wrote to memory of 3056 2996 ABC9.tmp 44 PID 2996 wrote to memory of 3056 2996 ABC9.tmp 44 PID 3056 wrote to memory of 1244 3056 AC27.tmp 45 PID 3056 wrote to memory of 1244 3056 AC27.tmp 45 PID 3056 wrote to memory of 1244 3056 AC27.tmp 45 PID 3056 wrote to memory of 1244 3056 AC27.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-02_f62a2d53dbdef096e0fa90aeb2b00110_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-02_f62a2d53dbdef096e0fa90aeb2b00110_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\A6CA.tmp"C:\Users\Admin\AppData\Local\Temp\A6CA.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\A728.tmp"C:\Users\Admin\AppData\Local\Temp\A728.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Users\Admin\AppData\Local\Temp\A795.tmp"C:\Users\Admin\AppData\Local\Temp\A795.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\A802.tmp"C:\Users\Admin\AppData\Local\Temp\A802.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\A86F.tmp"C:\Users\Admin\AppData\Local\Temp\A86F.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\A8DD.tmp"C:\Users\Admin\AppData\Local\Temp\A8DD.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\A93A.tmp"C:\Users\Admin\AppData\Local\Temp\A93A.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\A998.tmp"C:\Users\Admin\AppData\Local\Temp\A998.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\A9F5.tmp"C:\Users\Admin\AppData\Local\Temp\A9F5.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\AA63.tmp"C:\Users\Admin\AppData\Local\Temp\AA63.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\AAB1.tmp"C:\Users\Admin\AppData\Local\Temp\AAB1.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\AB0E.tmp"C:\Users\Admin\AppData\Local\Temp\AB0E.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\AB6C.tmp"C:\Users\Admin\AppData\Local\Temp\AB6C.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\ABC9.tmp"C:\Users\Admin\AppData\Local\Temp\ABC9.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\AC27.tmp"C:\Users\Admin\AppData\Local\Temp\AC27.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\AC85.tmp"C:\Users\Admin\AppData\Local\Temp\AC85.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\ACE2.tmp"C:\Users\Admin\AppData\Local\Temp\ACE2.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\AD30.tmp"C:\Users\Admin\AppData\Local\Temp\AD30.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:860 -
C:\Users\Admin\AppData\Local\Temp\AD8E.tmp"C:\Users\Admin\AppData\Local\Temp\AD8E.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:264 -
C:\Users\Admin\AppData\Local\Temp\ADEB.tmp"C:\Users\Admin\AppData\Local\Temp\ADEB.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\AE68.tmp"C:\Users\Admin\AppData\Local\Temp\AE68.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\AEC6.tmp"C:\Users\Admin\AppData\Local\Temp\AEC6.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\AF14.tmp"C:\Users\Admin\AppData\Local\Temp\AF14.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\AF52.tmp"C:\Users\Admin\AppData\Local\Temp\AF52.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:856 -
C:\Users\Admin\AppData\Local\Temp\AF91.tmp"C:\Users\Admin\AppData\Local\Temp\AF91.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\AFCF.tmp"C:\Users\Admin\AppData\Local\Temp\AFCF.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\B00D.tmp"C:\Users\Admin\AppData\Local\Temp\B00D.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\B04C.tmp"C:\Users\Admin\AppData\Local\Temp\B04C.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\B09A.tmp"C:\Users\Admin\AppData\Local\Temp\B09A.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\B0D8.tmp"C:\Users\Admin\AppData\Local\Temp\B0D8.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\B126.tmp"C:\Users\Admin\AppData\Local\Temp\B126.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\B165.tmp"C:\Users\Admin\AppData\Local\Temp\B165.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\B1A3.tmp"C:\Users\Admin\AppData\Local\Temp\B1A3.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:684 -
C:\Users\Admin\AppData\Local\Temp\B1E1.tmp"C:\Users\Admin\AppData\Local\Temp\B1E1.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\B220.tmp"C:\Users\Admin\AppData\Local\Temp\B220.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\B26E.tmp"C:\Users\Admin\AppData\Local\Temp\B26E.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:940 -
C:\Users\Admin\AppData\Local\Temp\B2AC.tmp"C:\Users\Admin\AppData\Local\Temp\B2AC.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\B2EB.tmp"C:\Users\Admin\AppData\Local\Temp\B2EB.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\B329.tmp"C:\Users\Admin\AppData\Local\Temp\B329.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:608 -
C:\Users\Admin\AppData\Local\Temp\B367.tmp"C:\Users\Admin\AppData\Local\Temp\B367.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\B3B5.tmp"C:\Users\Admin\AppData\Local\Temp\B3B5.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\B3F4.tmp"C:\Users\Admin\AppData\Local\Temp\B3F4.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\B432.tmp"C:\Users\Admin\AppData\Local\Temp\B432.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:936 -
C:\Users\Admin\AppData\Local\Temp\B471.tmp"C:\Users\Admin\AppData\Local\Temp\B471.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\B4AF.tmp"C:\Users\Admin\AppData\Local\Temp\B4AF.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\B4ED.tmp"C:\Users\Admin\AppData\Local\Temp\B4ED.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\B52C.tmp"C:\Users\Admin\AppData\Local\Temp\B52C.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\B56A.tmp"C:\Users\Admin\AppData\Local\Temp\B56A.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\B5A9.tmp"C:\Users\Admin\AppData\Local\Temp\B5A9.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:556 -
C:\Users\Admin\AppData\Local\Temp\B5E7.tmp"C:\Users\Admin\AppData\Local\Temp\B5E7.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\B625.tmp"C:\Users\Admin\AppData\Local\Temp\B625.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\B664.tmp"C:\Users\Admin\AppData\Local\Temp\B664.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\B6A2.tmp"C:\Users\Admin\AppData\Local\Temp\B6A2.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\B6E1.tmp"C:\Users\Admin\AppData\Local\Temp\B6E1.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\B71F.tmp"C:\Users\Admin\AppData\Local\Temp\B71F.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\B75D.tmp"C:\Users\Admin\AppData\Local\Temp\B75D.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\B79C.tmp"C:\Users\Admin\AppData\Local\Temp\B79C.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\B7DA.tmp"C:\Users\Admin\AppData\Local\Temp\B7DA.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\B819.tmp"C:\Users\Admin\AppData\Local\Temp\B819.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\B857.tmp"C:\Users\Admin\AppData\Local\Temp\B857.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\B895.tmp"C:\Users\Admin\AppData\Local\Temp\B895.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\B8D4.tmp"C:\Users\Admin\AppData\Local\Temp\B8D4.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\B922.tmp"C:\Users\Admin\AppData\Local\Temp\B922.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\B970.tmp"C:\Users\Admin\AppData\Local\Temp\B970.tmp"65⤵
- Executes dropped EXE
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\B9AE.tmp"C:\Users\Admin\AppData\Local\Temp\B9AE.tmp"66⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\B9ED.tmp"C:\Users\Admin\AppData\Local\Temp\B9ED.tmp"67⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\BA4A.tmp"C:\Users\Admin\AppData\Local\Temp\BA4A.tmp"68⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\BA89.tmp"C:\Users\Admin\AppData\Local\Temp\BA89.tmp"69⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\BAC7.tmp"C:\Users\Admin\AppData\Local\Temp\BAC7.tmp"70⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\BB05.tmp"C:\Users\Admin\AppData\Local\Temp\BB05.tmp"71⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\BB44.tmp"C:\Users\Admin\AppData\Local\Temp\BB44.tmp"72⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\BB82.tmp"C:\Users\Admin\AppData\Local\Temp\BB82.tmp"73⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\BBC1.tmp"C:\Users\Admin\AppData\Local\Temp\BBC1.tmp"74⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\BBFF.tmp"C:\Users\Admin\AppData\Local\Temp\BBFF.tmp"75⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\BC3D.tmp"C:\Users\Admin\AppData\Local\Temp\BC3D.tmp"76⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\BC7C.tmp"C:\Users\Admin\AppData\Local\Temp\BC7C.tmp"77⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\BCBA.tmp"C:\Users\Admin\AppData\Local\Temp\BCBA.tmp"78⤵PID:352
-
C:\Users\Admin\AppData\Local\Temp\BCF9.tmp"C:\Users\Admin\AppData\Local\Temp\BCF9.tmp"79⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\BD47.tmp"C:\Users\Admin\AppData\Local\Temp\BD47.tmp"80⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\BD85.tmp"C:\Users\Admin\AppData\Local\Temp\BD85.tmp"81⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\BDC3.tmp"C:\Users\Admin\AppData\Local\Temp\BDC3.tmp"82⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\BE02.tmp"C:\Users\Admin\AppData\Local\Temp\BE02.tmp"83⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\BE40.tmp"C:\Users\Admin\AppData\Local\Temp\BE40.tmp"84⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\BE7F.tmp"C:\Users\Admin\AppData\Local\Temp\BE7F.tmp"85⤵
- System Location Discovery: System Language Discovery
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\BECD.tmp"C:\Users\Admin\AppData\Local\Temp\BECD.tmp"86⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\BF0B.tmp"C:\Users\Admin\AppData\Local\Temp\BF0B.tmp"87⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\BF49.tmp"C:\Users\Admin\AppData\Local\Temp\BF49.tmp"88⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\BF88.tmp"C:\Users\Admin\AppData\Local\Temp\BF88.tmp"89⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"90⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\C005.tmp"C:\Users\Admin\AppData\Local\Temp\C005.tmp"91⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\C043.tmp"C:\Users\Admin\AppData\Local\Temp\C043.tmp"92⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\C081.tmp"C:\Users\Admin\AppData\Local\Temp\C081.tmp"93⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"94⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\C10E.tmp"C:\Users\Admin\AppData\Local\Temp\C10E.tmp"95⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\C14C.tmp"C:\Users\Admin\AppData\Local\Temp\C14C.tmp"96⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\C18B.tmp"C:\Users\Admin\AppData\Local\Temp\C18B.tmp"97⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"98⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\C207.tmp"C:\Users\Admin\AppData\Local\Temp\C207.tmp"99⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\C246.tmp"C:\Users\Admin\AppData\Local\Temp\C246.tmp"100⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\C284.tmp"C:\Users\Admin\AppData\Local\Temp\C284.tmp"101⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"102⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\C301.tmp"C:\Users\Admin\AppData\Local\Temp\C301.tmp"103⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\C33F.tmp"C:\Users\Admin\AppData\Local\Temp\C33F.tmp"104⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\C37E.tmp"C:\Users\Admin\AppData\Local\Temp\C37E.tmp"105⤵PID:328
-
C:\Users\Admin\AppData\Local\Temp\C3BC.tmp"C:\Users\Admin\AppData\Local\Temp\C3BC.tmp"106⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\C40A.tmp"C:\Users\Admin\AppData\Local\Temp\C40A.tmp"107⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\C449.tmp"C:\Users\Admin\AppData\Local\Temp\C449.tmp"108⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\C487.tmp"C:\Users\Admin\AppData\Local\Temp\C487.tmp"109⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\C4C5.tmp"C:\Users\Admin\AppData\Local\Temp\C4C5.tmp"110⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\C504.tmp"C:\Users\Admin\AppData\Local\Temp\C504.tmp"111⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\C542.tmp"C:\Users\Admin\AppData\Local\Temp\C542.tmp"112⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\C590.tmp"C:\Users\Admin\AppData\Local\Temp\C590.tmp"113⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\C5CF.tmp"C:\Users\Admin\AppData\Local\Temp\C5CF.tmp"114⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\C60D.tmp"C:\Users\Admin\AppData\Local\Temp\C60D.tmp"115⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\C65B.tmp"C:\Users\Admin\AppData\Local\Temp\C65B.tmp"116⤵
- System Location Discovery: System Language Discovery
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\C699.tmp"C:\Users\Admin\AppData\Local\Temp\C699.tmp"117⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\C6D8.tmp"C:\Users\Admin\AppData\Local\Temp\C6D8.tmp"118⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\C716.tmp"C:\Users\Admin\AppData\Local\Temp\C716.tmp"119⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\C764.tmp"C:\Users\Admin\AppData\Local\Temp\C764.tmp"120⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\C7A3.tmp"C:\Users\Admin\AppData\Local\Temp\C7A3.tmp"121⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\C7E1.tmp"C:\Users\Admin\AppData\Local\Temp\C7E1.tmp"122⤵PID:2356
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-