Analysis
-
max time kernel
150s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
02-08-2024 12:45
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-02_e3d4ac7035ec4642277dc36a152a9c3a_mafia.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2024-08-02_e3d4ac7035ec4642277dc36a152a9c3a_mafia.exe
Resource
win10v2004-20240730-en
General
-
Target
2024-08-02_e3d4ac7035ec4642277dc36a152a9c3a_mafia.exe
-
Size
520KB
-
MD5
e3d4ac7035ec4642277dc36a152a9c3a
-
SHA1
ba08e3913e3783bc018adc799ffc74d3b1db887a
-
SHA256
0a6c3713728b350b7109090e08db77efe4965f884c45ce6b283959894ab163d4
-
SHA512
7bb4f6ed8de0ebfe5d1f7c62257156c8a6c57e2b0799ebd81f9cbd4e5133879ce423b9fbd4f6e0c55cfe99571490045d4a517ed73a59425105f4308112fded5e
-
SSDEEP
12288:gj8fuxR21t5i8fp3op4v3Go0JNgO12ILyTS5AqklNZ:gj8fuK1GYpYuvW5gO1HyTOAq4N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2056 C36E.tmp 2280 C3BC.tmp 1244 C429.tmp 2908 C497.tmp 1180 C504.tmp 2484 C571.tmp 2952 C60D.tmp 2344 C66B.tmp 2980 C6C8.tmp 2716 C735.tmp 320 C7A3.tmp 1496 C810.tmp 2556 C86D.tmp 2568 C8DB.tmp 2368 C929.tmp 1248 C986.tmp 2852 C9F3.tmp 3052 CA51.tmp 2868 CABE.tmp 2764 CB1C.tmp 2268 CB79.tmp 2724 CBD7.tmp 828 CC25.tmp 1688 CC63.tmp 2284 CCA2.tmp 2084 CCF0.tmp 2520 CD3E.tmp 2608 CD7C.tmp 2216 CDBB.tmp 2464 CE09.tmp 380 CE47.tmp 908 CE85.tmp 924 CEC4.tmp 2004 CF12.tmp 2616 CF50.tmp 1828 CF8F.tmp 2228 CFCD.tmp 2188 D00B.tmp 2132 D059.tmp 1816 D098.tmp 768 D0D6.tmp 756 D124.tmp 1700 D163.tmp 684 D1A1.tmp 1756 D1E0.tmp 2548 D21E.tmp 2308 D25C.tmp 568 D2AA.tmp 2384 D2E9.tmp 884 D327.tmp 2296 D375.tmp 2052 D3B4.tmp 2064 D3F2.tmp 1076 D430.tmp 2164 D46F.tmp 2496 D4BD.tmp 2448 D50B.tmp 2812 D549.tmp 1244 D597.tmp 2940 D5D6.tmp 2672 D624.tmp 2912 D672.tmp 2700 D6C0.tmp 2692 D6FE.tmp -
Loads dropped DLL 64 IoCs
pid Process 1432 2024-08-02_e3d4ac7035ec4642277dc36a152a9c3a_mafia.exe 2056 C36E.tmp 2280 C3BC.tmp 1244 C429.tmp 2908 C497.tmp 1180 C504.tmp 2484 C571.tmp 2952 C60D.tmp 2344 C66B.tmp 2980 C6C8.tmp 2716 C735.tmp 320 C7A3.tmp 1496 C810.tmp 2556 C86D.tmp 2568 C8DB.tmp 2368 C929.tmp 1248 C986.tmp 2852 C9F3.tmp 3052 CA51.tmp 2868 CABE.tmp 2764 CB1C.tmp 2268 CB79.tmp 2724 CBD7.tmp 828 CC25.tmp 1688 CC63.tmp 2284 CCA2.tmp 2084 CCF0.tmp 2520 CD3E.tmp 2608 CD7C.tmp 2216 CDBB.tmp 2464 CE09.tmp 380 CE47.tmp 908 CE85.tmp 924 CEC4.tmp 2004 CF12.tmp 2616 CF50.tmp 1828 CF8F.tmp 2228 CFCD.tmp 2188 D00B.tmp 2132 D059.tmp 1816 D098.tmp 768 D0D6.tmp 756 D124.tmp 1700 D163.tmp 684 D1A1.tmp 1756 D1E0.tmp 2548 D21E.tmp 2308 D25C.tmp 568 D2AA.tmp 2384 D2E9.tmp 884 D327.tmp 2296 D375.tmp 2052 D3B4.tmp 2064 D3F2.tmp 1076 D430.tmp 2164 D46F.tmp 2496 D4BD.tmp 2448 D50B.tmp 2812 D549.tmp 1244 D597.tmp 2940 D5D6.tmp 2672 D624.tmp 2912 D672.tmp 2700 D6C0.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5033.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 751.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DC1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9444.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 252.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7FAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E42.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE8A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FCE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D430.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB92.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C70.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9000.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1432 wrote to memory of 2056 1432 2024-08-02_e3d4ac7035ec4642277dc36a152a9c3a_mafia.exe 30 PID 1432 wrote to memory of 2056 1432 2024-08-02_e3d4ac7035ec4642277dc36a152a9c3a_mafia.exe 30 PID 1432 wrote to memory of 2056 1432 2024-08-02_e3d4ac7035ec4642277dc36a152a9c3a_mafia.exe 30 PID 1432 wrote to memory of 2056 1432 2024-08-02_e3d4ac7035ec4642277dc36a152a9c3a_mafia.exe 30 PID 2056 wrote to memory of 2280 2056 C36E.tmp 31 PID 2056 wrote to memory of 2280 2056 C36E.tmp 31 PID 2056 wrote to memory of 2280 2056 C36E.tmp 31 PID 2056 wrote to memory of 2280 2056 C36E.tmp 31 PID 2280 wrote to memory of 1244 2280 C3BC.tmp 32 PID 2280 wrote to memory of 1244 2280 C3BC.tmp 32 PID 2280 wrote to memory of 1244 2280 C3BC.tmp 32 PID 2280 wrote to memory of 1244 2280 C3BC.tmp 32 PID 1244 wrote to memory of 2908 1244 C429.tmp 33 PID 1244 wrote to memory of 2908 1244 C429.tmp 33 PID 1244 wrote to memory of 2908 1244 C429.tmp 33 PID 1244 wrote to memory of 2908 1244 C429.tmp 33 PID 2908 wrote to memory of 1180 2908 C497.tmp 34 PID 2908 wrote to memory of 1180 2908 C497.tmp 34 PID 2908 wrote to memory of 1180 2908 C497.tmp 34 PID 2908 wrote to memory of 1180 2908 C497.tmp 34 PID 1180 wrote to memory of 2484 1180 C504.tmp 35 PID 1180 wrote to memory of 2484 1180 C504.tmp 35 PID 1180 wrote to memory of 2484 1180 C504.tmp 35 PID 1180 wrote to memory of 2484 1180 C504.tmp 35 PID 2484 wrote to memory of 2952 2484 C571.tmp 36 PID 2484 wrote to memory of 2952 2484 C571.tmp 36 PID 2484 wrote to memory of 2952 2484 C571.tmp 36 PID 2484 wrote to memory of 2952 2484 C571.tmp 36 PID 2952 wrote to memory of 2344 2952 C60D.tmp 37 PID 2952 wrote to memory of 2344 2952 C60D.tmp 37 PID 2952 wrote to memory of 2344 2952 C60D.tmp 37 PID 2952 wrote to memory of 2344 2952 C60D.tmp 37 PID 2344 wrote to memory of 2980 2344 C66B.tmp 38 PID 2344 wrote to memory of 2980 2344 C66B.tmp 38 PID 2344 wrote to memory of 2980 2344 C66B.tmp 38 PID 2344 wrote to memory of 2980 2344 C66B.tmp 38 PID 2980 wrote to memory of 2716 2980 C6C8.tmp 39 PID 2980 wrote to memory of 2716 2980 C6C8.tmp 39 PID 2980 wrote to memory of 2716 2980 C6C8.tmp 39 PID 2980 wrote to memory of 2716 2980 C6C8.tmp 39 PID 2716 wrote to memory of 320 2716 C735.tmp 40 PID 2716 wrote to memory of 320 2716 C735.tmp 40 PID 2716 wrote to memory of 320 2716 C735.tmp 40 PID 2716 wrote to memory of 320 2716 C735.tmp 40 PID 320 wrote to memory of 1496 320 C7A3.tmp 41 PID 320 wrote to memory of 1496 320 C7A3.tmp 41 PID 320 wrote to memory of 1496 320 C7A3.tmp 41 PID 320 wrote to memory of 1496 320 C7A3.tmp 41 PID 1496 wrote to memory of 2556 1496 C810.tmp 42 PID 1496 wrote to memory of 2556 1496 C810.tmp 42 PID 1496 wrote to memory of 2556 1496 C810.tmp 42 PID 1496 wrote to memory of 2556 1496 C810.tmp 42 PID 2556 wrote to memory of 2568 2556 C86D.tmp 43 PID 2556 wrote to memory of 2568 2556 C86D.tmp 43 PID 2556 wrote to memory of 2568 2556 C86D.tmp 43 PID 2556 wrote to memory of 2568 2556 C86D.tmp 43 PID 2568 wrote to memory of 2368 2568 C8DB.tmp 44 PID 2568 wrote to memory of 2368 2568 C8DB.tmp 44 PID 2568 wrote to memory of 2368 2568 C8DB.tmp 44 PID 2568 wrote to memory of 2368 2568 C8DB.tmp 44 PID 2368 wrote to memory of 1248 2368 C929.tmp 45 PID 2368 wrote to memory of 1248 2368 C929.tmp 45 PID 2368 wrote to memory of 1248 2368 C929.tmp 45 PID 2368 wrote to memory of 1248 2368 C929.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-02_e3d4ac7035ec4642277dc36a152a9c3a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-02_e3d4ac7035ec4642277dc36a152a9c3a_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\C36E.tmp"C:\Users\Admin\AppData\Local\Temp\C36E.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\C3BC.tmp"C:\Users\Admin\AppData\Local\Temp\C3BC.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\C429.tmp"C:\Users\Admin\AppData\Local\Temp\C429.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\C497.tmp"C:\Users\Admin\AppData\Local\Temp\C497.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\C504.tmp"C:\Users\Admin\AppData\Local\Temp\C504.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\C571.tmp"C:\Users\Admin\AppData\Local\Temp\C571.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\C60D.tmp"C:\Users\Admin\AppData\Local\Temp\C60D.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\C66B.tmp"C:\Users\Admin\AppData\Local\Temp\C66B.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\C6C8.tmp"C:\Users\Admin\AppData\Local\Temp\C6C8.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\C735.tmp"C:\Users\Admin\AppData\Local\Temp\C735.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\C7A3.tmp"C:\Users\Admin\AppData\Local\Temp\C7A3.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Users\Admin\AppData\Local\Temp\C810.tmp"C:\Users\Admin\AppData\Local\Temp\C810.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\C86D.tmp"C:\Users\Admin\AppData\Local\Temp\C86D.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\C8DB.tmp"C:\Users\Admin\AppData\Local\Temp\C8DB.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\C929.tmp"C:\Users\Admin\AppData\Local\Temp\C929.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\C986.tmp"C:\Users\Admin\AppData\Local\Temp\C986.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\C9F3.tmp"C:\Users\Admin\AppData\Local\Temp\C9F3.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\CA51.tmp"C:\Users\Admin\AppData\Local\Temp\CA51.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\CABE.tmp"C:\Users\Admin\AppData\Local\Temp\CABE.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\CB1C.tmp"C:\Users\Admin\AppData\Local\Temp\CB1C.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\CB79.tmp"C:\Users\Admin\AppData\Local\Temp\CB79.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\CBD7.tmp"C:\Users\Admin\AppData\Local\Temp\CBD7.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\CC25.tmp"C:\Users\Admin\AppData\Local\Temp\CC25.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:828 -
C:\Users\Admin\AppData\Local\Temp\CC63.tmp"C:\Users\Admin\AppData\Local\Temp\CC63.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\CCA2.tmp"C:\Users\Admin\AppData\Local\Temp\CCA2.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\CCF0.tmp"C:\Users\Admin\AppData\Local\Temp\CCF0.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\CD3E.tmp"C:\Users\Admin\AppData\Local\Temp\CD3E.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\CDBB.tmp"C:\Users\Admin\AppData\Local\Temp\CDBB.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\CE09.tmp"C:\Users\Admin\AppData\Local\Temp\CE09.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\CE47.tmp"C:\Users\Admin\AppData\Local\Temp\CE47.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:380 -
C:\Users\Admin\AppData\Local\Temp\CE85.tmp"C:\Users\Admin\AppData\Local\Temp\CE85.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:908 -
C:\Users\Admin\AppData\Local\Temp\CEC4.tmp"C:\Users\Admin\AppData\Local\Temp\CEC4.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:924 -
C:\Users\Admin\AppData\Local\Temp\CF12.tmp"C:\Users\Admin\AppData\Local\Temp\CF12.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\CF50.tmp"C:\Users\Admin\AppData\Local\Temp\CF50.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\CF8F.tmp"C:\Users\Admin\AppData\Local\Temp\CF8F.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\CFCD.tmp"C:\Users\Admin\AppData\Local\Temp\CFCD.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\D00B.tmp"C:\Users\Admin\AppData\Local\Temp\D00B.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\D059.tmp"C:\Users\Admin\AppData\Local\Temp\D059.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\D098.tmp"C:\Users\Admin\AppData\Local\Temp\D098.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\D0D6.tmp"C:\Users\Admin\AppData\Local\Temp\D0D6.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:768 -
C:\Users\Admin\AppData\Local\Temp\D124.tmp"C:\Users\Admin\AppData\Local\Temp\D124.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:756 -
C:\Users\Admin\AppData\Local\Temp\D163.tmp"C:\Users\Admin\AppData\Local\Temp\D163.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\D1A1.tmp"C:\Users\Admin\AppData\Local\Temp\D1A1.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:684 -
C:\Users\Admin\AppData\Local\Temp\D1E0.tmp"C:\Users\Admin\AppData\Local\Temp\D1E0.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\D21E.tmp"C:\Users\Admin\AppData\Local\Temp\D21E.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\D25C.tmp"C:\Users\Admin\AppData\Local\Temp\D25C.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\D2AA.tmp"C:\Users\Admin\AppData\Local\Temp\D2AA.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:568 -
C:\Users\Admin\AppData\Local\Temp\D2E9.tmp"C:\Users\Admin\AppData\Local\Temp\D2E9.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\D327.tmp"C:\Users\Admin\AppData\Local\Temp\D327.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:884 -
C:\Users\Admin\AppData\Local\Temp\D375.tmp"C:\Users\Admin\AppData\Local\Temp\D375.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\D3B4.tmp"C:\Users\Admin\AppData\Local\Temp\D3B4.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\D3F2.tmp"C:\Users\Admin\AppData\Local\Temp\D3F2.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\D430.tmp"C:\Users\Admin\AppData\Local\Temp\D430.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\D46F.tmp"C:\Users\Admin\AppData\Local\Temp\D46F.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\D4BD.tmp"C:\Users\Admin\AppData\Local\Temp\D4BD.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\D50B.tmp"C:\Users\Admin\AppData\Local\Temp\D50B.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\D549.tmp"C:\Users\Admin\AppData\Local\Temp\D549.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\D597.tmp"C:\Users\Admin\AppData\Local\Temp\D597.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\D5D6.tmp"C:\Users\Admin\AppData\Local\Temp\D5D6.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\D624.tmp"C:\Users\Admin\AppData\Local\Temp\D624.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\D672.tmp"C:\Users\Admin\AppData\Local\Temp\D672.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\D6C0.tmp"C:\Users\Admin\AppData\Local\Temp\D6C0.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\D6FE.tmp"C:\Users\Admin\AppData\Local\Temp\D6FE.tmp"65⤵
- Executes dropped EXE
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\D74C.tmp"C:\Users\Admin\AppData\Local\Temp\D74C.tmp"66⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\D78A.tmp"C:\Users\Admin\AppData\Local\Temp\D78A.tmp"67⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\D7C9.tmp"C:\Users\Admin\AppData\Local\Temp\D7C9.tmp"68⤵PID:600
-
C:\Users\Admin\AppData\Local\Temp\D807.tmp"C:\Users\Admin\AppData\Local\Temp\D807.tmp"69⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\D846.tmp"C:\Users\Admin\AppData\Local\Temp\D846.tmp"70⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\D884.tmp"C:\Users\Admin\AppData\Local\Temp\D884.tmp"71⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\D8C2.tmp"C:\Users\Admin\AppData\Local\Temp\D8C2.tmp"72⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\D901.tmp"C:\Users\Admin\AppData\Local\Temp\D901.tmp"73⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\D93F.tmp"C:\Users\Admin\AppData\Local\Temp\D93F.tmp"74⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\D97E.tmp"C:\Users\Admin\AppData\Local\Temp\D97E.tmp"75⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\D9BC.tmp"C:\Users\Admin\AppData\Local\Temp\D9BC.tmp"76⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\DA0A.tmp"C:\Users\Admin\AppData\Local\Temp\DA0A.tmp"77⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\DA48.tmp"C:\Users\Admin\AppData\Local\Temp\DA48.tmp"78⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\DA96.tmp"C:\Users\Admin\AppData\Local\Temp\DA96.tmp"79⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\DAD5.tmp"C:\Users\Admin\AppData\Local\Temp\DAD5.tmp"80⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\DB23.tmp"C:\Users\Admin\AppData\Local\Temp\DB23.tmp"81⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\DB61.tmp"C:\Users\Admin\AppData\Local\Temp\DB61.tmp"82⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\DBA0.tmp"C:\Users\Admin\AppData\Local\Temp\DBA0.tmp"83⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\DBDE.tmp"C:\Users\Admin\AppData\Local\Temp\DBDE.tmp"84⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\DC2C.tmp"C:\Users\Admin\AppData\Local\Temp\DC2C.tmp"85⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\DC6A.tmp"C:\Users\Admin\AppData\Local\Temp\DC6A.tmp"86⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\DCA9.tmp"C:\Users\Admin\AppData\Local\Temp\DCA9.tmp"87⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\DCE7.tmp"C:\Users\Admin\AppData\Local\Temp\DCE7.tmp"88⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\DD35.tmp"C:\Users\Admin\AppData\Local\Temp\DD35.tmp"89⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\DD74.tmp"C:\Users\Admin\AppData\Local\Temp\DD74.tmp"90⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\DDB2.tmp"C:\Users\Admin\AppData\Local\Temp\DDB2.tmp"91⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\DDF0.tmp"C:\Users\Admin\AppData\Local\Temp\DDF0.tmp"92⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\DE2F.tmp"C:\Users\Admin\AppData\Local\Temp\DE2F.tmp"93⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\DE6D.tmp"C:\Users\Admin\AppData\Local\Temp\DE6D.tmp"94⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\DEAC.tmp"C:\Users\Admin\AppData\Local\Temp\DEAC.tmp"95⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\DEEA.tmp"C:\Users\Admin\AppData\Local\Temp\DEEA.tmp"96⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\DF28.tmp"C:\Users\Admin\AppData\Local\Temp\DF28.tmp"97⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\DF76.tmp"C:\Users\Admin\AppData\Local\Temp\DF76.tmp"98⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\DFB5.tmp"C:\Users\Admin\AppData\Local\Temp\DFB5.tmp"99⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\DFF3.tmp"C:\Users\Admin\AppData\Local\Temp\DFF3.tmp"100⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\E032.tmp"C:\Users\Admin\AppData\Local\Temp\E032.tmp"101⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\E070.tmp"C:\Users\Admin\AppData\Local\Temp\E070.tmp"102⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\E0BE.tmp"C:\Users\Admin\AppData\Local\Temp\E0BE.tmp"103⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\E0FC.tmp"C:\Users\Admin\AppData\Local\Temp\E0FC.tmp"104⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\E13B.tmp"C:\Users\Admin\AppData\Local\Temp\E13B.tmp"105⤵PID:340
-
C:\Users\Admin\AppData\Local\Temp\E179.tmp"C:\Users\Admin\AppData\Local\Temp\E179.tmp"106⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\E1B8.tmp"C:\Users\Admin\AppData\Local\Temp\E1B8.tmp"107⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\E1F6.tmp"C:\Users\Admin\AppData\Local\Temp\E1F6.tmp"108⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\E234.tmp"C:\Users\Admin\AppData\Local\Temp\E234.tmp"109⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\E273.tmp"C:\Users\Admin\AppData\Local\Temp\E273.tmp"110⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\E2B1.tmp"C:\Users\Admin\AppData\Local\Temp\E2B1.tmp"111⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\E2FF.tmp"C:\Users\Admin\AppData\Local\Temp\E2FF.tmp"112⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\E33E.tmp"C:\Users\Admin\AppData\Local\Temp\E33E.tmp"113⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\E37C.tmp"C:\Users\Admin\AppData\Local\Temp\E37C.tmp"114⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\E3BA.tmp"C:\Users\Admin\AppData\Local\Temp\E3BA.tmp"115⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\E3F9.tmp"C:\Users\Admin\AppData\Local\Temp\E3F9.tmp"116⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\E447.tmp"C:\Users\Admin\AppData\Local\Temp\E447.tmp"117⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\E485.tmp"C:\Users\Admin\AppData\Local\Temp\E485.tmp"118⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\E4D3.tmp"C:\Users\Admin\AppData\Local\Temp\E4D3.tmp"119⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\E512.tmp"C:\Users\Admin\AppData\Local\Temp\E512.tmp"120⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\E550.tmp"C:\Users\Admin\AppData\Local\Temp\E550.tmp"121⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\E58E.tmp"C:\Users\Admin\AppData\Local\Temp\E58E.tmp"122⤵PID:2280
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-