Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
05/08/2024, 07:48
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-05_4cb9bcaac6fa3716cbc03cd6f9c9cbce_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-08-05_4cb9bcaac6fa3716cbc03cd6f9c9cbce_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-05_4cb9bcaac6fa3716cbc03cd6f9c9cbce_mafia.exe
-
Size
712KB
-
MD5
4cb9bcaac6fa3716cbc03cd6f9c9cbce
-
SHA1
5e09ee52ecbf350616f78b2da4e3e41e722a875b
-
SHA256
379ce5249961879409fb36d9a1ae300a095061370afee9d2c67c58ca23c0b984
-
SHA512
7edbb413517726f950f34100382014462c9107c91c06d98b1fa2c267bee6b1b968490b82a04257065dc256778f7fa4af6c38553939fed34f5fb4fc3219b16b87
-
SSDEEP
12288:FU5rCOTeiD363pnFp4+TE2zUrNZdCvq5TJLCvY90D8/LVBlVk736Y79GWzNbA:FUQOJDSpnFi+TxUrNnCvq5TJLCvY90DA
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3056 BBC1.tmp 2912 BC1E.tmp 2464 BCAB.tmp 1856 BD18.tmp 2360 BD95.tmp 2644 BDF2.tmp 2748 BE6F.tmp 2660 BEEC.tmp 2656 BF78.tmp 2712 BFE5.tmp 2840 C053.tmp 2716 C0C0.tmp 2724 C13D.tmp 2596 C1B9.tmp 3008 C236.tmp 1980 C294.tmp 1356 C301.tmp 2112 C36E.tmp 2308 C3DB.tmp 1204 C449.tmp 1648 C4B6.tmp 2620 C523.tmp 1392 C581.tmp 2856 C5CF.tmp 2800 C61D.tmp 2848 C65B.tmp 2276 C699.tmp 2436 C6D8.tmp 2448 C726.tmp 2728 C764.tmp 1592 C7A3.tmp 404 C7F1.tmp 2100 C82F.tmp 1832 C86D.tmp 1788 C8AC.tmp 1624 C8FA.tmp 2020 C938.tmp 1700 C977.tmp 300 C9C5.tmp 1560 CA03.tmp 2792 CA41.tmp 532 CA8F.tmp 2380 CACE.tmp 2188 CB0C.tmp 2268 CB5A.tmp 2384 CB99.tmp 2896 CBD7.tmp 2476 CC15.tmp 2932 CC54.tmp 2432 CC92.tmp 3040 CD0F.tmp 2352 CD5D.tmp 348 CD9B.tmp 2912 CDDA.tmp 2464 CE18.tmp 1976 CE57.tmp 2736 CEB4.tmp 2068 CEF3.tmp 1080 CF31.tmp 2644 CF7F.tmp 2780 CFBD.tmp 2164 CFFC.tmp 2696 D04A.tmp 2828 D088.tmp -
Loads dropped DLL 64 IoCs
pid Process 2992 2024-08-05_4cb9bcaac6fa3716cbc03cd6f9c9cbce_mafia.exe 3056 BBC1.tmp 2912 BC1E.tmp 2464 BCAB.tmp 1856 BD18.tmp 2360 BD95.tmp 2644 BDF2.tmp 2748 BE6F.tmp 2660 BEEC.tmp 2656 BF78.tmp 2712 BFE5.tmp 2840 C053.tmp 2716 C0C0.tmp 2724 C13D.tmp 2596 C1B9.tmp 3008 C236.tmp 1980 C294.tmp 1356 C301.tmp 2112 C36E.tmp 2308 C3DB.tmp 1204 C449.tmp 1648 C4B6.tmp 2620 C523.tmp 1392 C581.tmp 2856 C5CF.tmp 2800 C61D.tmp 2848 C65B.tmp 2276 C699.tmp 2436 C6D8.tmp 2448 C726.tmp 2728 C764.tmp 1592 C7A3.tmp 404 C7F1.tmp 2100 C82F.tmp 1832 C86D.tmp 1788 C8AC.tmp 1624 C8FA.tmp 2020 C938.tmp 1700 C977.tmp 300 C9C5.tmp 1560 CA03.tmp 2792 CA41.tmp 532 CA8F.tmp 2380 CACE.tmp 2188 CB0C.tmp 2268 CB5A.tmp 2384 CB99.tmp 2896 CBD7.tmp 2476 CC15.tmp 2932 CC54.tmp 1716 CCD1.tmp 3040 CD0F.tmp 2352 CD5D.tmp 348 CD9B.tmp 2912 CDDA.tmp 2464 CE18.tmp 1976 CE57.tmp 2736 CEB4.tmp 2068 CEF3.tmp 1080 CF31.tmp 2644 CF7F.tmp 2780 CFBD.tmp 2164 CFFC.tmp 2696 D04A.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1890.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 318C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 338E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 707F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7790.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A4E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3505.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B77D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6558.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2443.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6623.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 901F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 194B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2701.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 493.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 983A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2992 wrote to memory of 3056 2992 2024-08-05_4cb9bcaac6fa3716cbc03cd6f9c9cbce_mafia.exe 30 PID 2992 wrote to memory of 3056 2992 2024-08-05_4cb9bcaac6fa3716cbc03cd6f9c9cbce_mafia.exe 30 PID 2992 wrote to memory of 3056 2992 2024-08-05_4cb9bcaac6fa3716cbc03cd6f9c9cbce_mafia.exe 30 PID 2992 wrote to memory of 3056 2992 2024-08-05_4cb9bcaac6fa3716cbc03cd6f9c9cbce_mafia.exe 30 PID 3056 wrote to memory of 2912 3056 BBC1.tmp 31 PID 3056 wrote to memory of 2912 3056 BBC1.tmp 31 PID 3056 wrote to memory of 2912 3056 BBC1.tmp 31 PID 3056 wrote to memory of 2912 3056 BBC1.tmp 31 PID 2912 wrote to memory of 2464 2912 BC1E.tmp 32 PID 2912 wrote to memory of 2464 2912 BC1E.tmp 32 PID 2912 wrote to memory of 2464 2912 BC1E.tmp 32 PID 2912 wrote to memory of 2464 2912 BC1E.tmp 32 PID 2464 wrote to memory of 1856 2464 BCAB.tmp 33 PID 2464 wrote to memory of 1856 2464 BCAB.tmp 33 PID 2464 wrote to memory of 1856 2464 BCAB.tmp 33 PID 2464 wrote to memory of 1856 2464 BCAB.tmp 33 PID 1856 wrote to memory of 2360 1856 BD18.tmp 34 PID 1856 wrote to memory of 2360 1856 BD18.tmp 34 PID 1856 wrote to memory of 2360 1856 BD18.tmp 34 PID 1856 wrote to memory of 2360 1856 BD18.tmp 34 PID 2360 wrote to memory of 2644 2360 BD95.tmp 35 PID 2360 wrote to memory of 2644 2360 BD95.tmp 35 PID 2360 wrote to memory of 2644 2360 BD95.tmp 35 PID 2360 wrote to memory of 2644 2360 BD95.tmp 35 PID 2644 wrote to memory of 2748 2644 BDF2.tmp 36 PID 2644 wrote to memory of 2748 2644 BDF2.tmp 36 PID 2644 wrote to memory of 2748 2644 BDF2.tmp 36 PID 2644 wrote to memory of 2748 2644 BDF2.tmp 36 PID 2748 wrote to memory of 2660 2748 BE6F.tmp 37 PID 2748 wrote to memory of 2660 2748 BE6F.tmp 37 PID 2748 wrote to memory of 2660 2748 BE6F.tmp 37 PID 2748 wrote to memory of 2660 2748 BE6F.tmp 37 PID 2660 wrote to memory of 2656 2660 BEEC.tmp 38 PID 2660 wrote to memory of 2656 2660 BEEC.tmp 38 PID 2660 wrote to memory of 2656 2660 BEEC.tmp 38 PID 2660 wrote to memory of 2656 2660 BEEC.tmp 38 PID 2656 wrote to memory of 2712 2656 BF78.tmp 39 PID 2656 wrote to memory of 2712 2656 BF78.tmp 39 PID 2656 wrote to memory of 2712 2656 BF78.tmp 39 PID 2656 wrote to memory of 2712 2656 BF78.tmp 39 PID 2712 wrote to memory of 2840 2712 BFE5.tmp 40 PID 2712 wrote to memory of 2840 2712 BFE5.tmp 40 PID 2712 wrote to memory of 2840 2712 BFE5.tmp 40 PID 2712 wrote to memory of 2840 2712 BFE5.tmp 40 PID 2840 wrote to memory of 2716 2840 C053.tmp 41 PID 2840 wrote to memory of 2716 2840 C053.tmp 41 PID 2840 wrote to memory of 2716 2840 C053.tmp 41 PID 2840 wrote to memory of 2716 2840 C053.tmp 41 PID 2716 wrote to memory of 2724 2716 C0C0.tmp 42 PID 2716 wrote to memory of 2724 2716 C0C0.tmp 42 PID 2716 wrote to memory of 2724 2716 C0C0.tmp 42 PID 2716 wrote to memory of 2724 2716 C0C0.tmp 42 PID 2724 wrote to memory of 2596 2724 C13D.tmp 43 PID 2724 wrote to memory of 2596 2724 C13D.tmp 43 PID 2724 wrote to memory of 2596 2724 C13D.tmp 43 PID 2724 wrote to memory of 2596 2724 C13D.tmp 43 PID 2596 wrote to memory of 3008 2596 C1B9.tmp 44 PID 2596 wrote to memory of 3008 2596 C1B9.tmp 44 PID 2596 wrote to memory of 3008 2596 C1B9.tmp 44 PID 2596 wrote to memory of 3008 2596 C1B9.tmp 44 PID 3008 wrote to memory of 1980 3008 C236.tmp 45 PID 3008 wrote to memory of 1980 3008 C236.tmp 45 PID 3008 wrote to memory of 1980 3008 C236.tmp 45 PID 3008 wrote to memory of 1980 3008 C236.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-05_4cb9bcaac6fa3716cbc03cd6f9c9cbce_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-05_4cb9bcaac6fa3716cbc03cd6f9c9cbce_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\BBC1.tmp"C:\Users\Admin\AppData\Local\Temp\BBC1.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\BC1E.tmp"C:\Users\Admin\AppData\Local\Temp\BC1E.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\BCAB.tmp"C:\Users\Admin\AppData\Local\Temp\BCAB.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\BD18.tmp"C:\Users\Admin\AppData\Local\Temp\BD18.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\BD95.tmp"C:\Users\Admin\AppData\Local\Temp\BD95.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\BDF2.tmp"C:\Users\Admin\AppData\Local\Temp\BDF2.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\BE6F.tmp"C:\Users\Admin\AppData\Local\Temp\BE6F.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\BEEC.tmp"C:\Users\Admin\AppData\Local\Temp\BEEC.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\BF78.tmp"C:\Users\Admin\AppData\Local\Temp\BF78.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\C053.tmp"C:\Users\Admin\AppData\Local\Temp\C053.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\C13D.tmp"C:\Users\Admin\AppData\Local\Temp\C13D.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\C1B9.tmp"C:\Users\Admin\AppData\Local\Temp\C1B9.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\C236.tmp"C:\Users\Admin\AppData\Local\Temp\C236.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\C294.tmp"C:\Users\Admin\AppData\Local\Temp\C294.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\C301.tmp"C:\Users\Admin\AppData\Local\Temp\C301.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\C36E.tmp"C:\Users\Admin\AppData\Local\Temp\C36E.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\C3DB.tmp"C:\Users\Admin\AppData\Local\Temp\C3DB.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\C449.tmp"C:\Users\Admin\AppData\Local\Temp\C449.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\C4B6.tmp"C:\Users\Admin\AppData\Local\Temp\C4B6.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\C523.tmp"C:\Users\Admin\AppData\Local\Temp\C523.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\C581.tmp"C:\Users\Admin\AppData\Local\Temp\C581.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\C5CF.tmp"C:\Users\Admin\AppData\Local\Temp\C5CF.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\C61D.tmp"C:\Users\Admin\AppData\Local\Temp\C61D.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\C65B.tmp"C:\Users\Admin\AppData\Local\Temp\C65B.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\C699.tmp"C:\Users\Admin\AppData\Local\Temp\C699.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\C6D8.tmp"C:\Users\Admin\AppData\Local\Temp\C6D8.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\C726.tmp"C:\Users\Admin\AppData\Local\Temp\C726.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\C764.tmp"C:\Users\Admin\AppData\Local\Temp\C764.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\C7A3.tmp"C:\Users\Admin\AppData\Local\Temp\C7A3.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\C7F1.tmp"C:\Users\Admin\AppData\Local\Temp\C7F1.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:404 -
C:\Users\Admin\AppData\Local\Temp\C82F.tmp"C:\Users\Admin\AppData\Local\Temp\C82F.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\C86D.tmp"C:\Users\Admin\AppData\Local\Temp\C86D.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\C8AC.tmp"C:\Users\Admin\AppData\Local\Temp\C8AC.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\C8FA.tmp"C:\Users\Admin\AppData\Local\Temp\C8FA.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\C938.tmp"C:\Users\Admin\AppData\Local\Temp\C938.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\C977.tmp"C:\Users\Admin\AppData\Local\Temp\C977.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\C9C5.tmp"C:\Users\Admin\AppData\Local\Temp\C9C5.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:300 -
C:\Users\Admin\AppData\Local\Temp\CA03.tmp"C:\Users\Admin\AppData\Local\Temp\CA03.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\CA41.tmp"C:\Users\Admin\AppData\Local\Temp\CA41.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\CA8F.tmp"C:\Users\Admin\AppData\Local\Temp\CA8F.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:532 -
C:\Users\Admin\AppData\Local\Temp\CACE.tmp"C:\Users\Admin\AppData\Local\Temp\CACE.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\CB0C.tmp"C:\Users\Admin\AppData\Local\Temp\CB0C.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\CB5A.tmp"C:\Users\Admin\AppData\Local\Temp\CB5A.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\CB99.tmp"C:\Users\Admin\AppData\Local\Temp\CB99.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\CBD7.tmp"C:\Users\Admin\AppData\Local\Temp\CBD7.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\CC15.tmp"C:\Users\Admin\AppData\Local\Temp\CC15.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\CC54.tmp"C:\Users\Admin\AppData\Local\Temp\CC54.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\CC92.tmp"C:\Users\Admin\AppData\Local\Temp\CC92.tmp"51⤵
- Executes dropped EXE
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\CCD1.tmp"C:\Users\Admin\AppData\Local\Temp\CCD1.tmp"52⤵
- Loads dropped DLL
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\CD0F.tmp"C:\Users\Admin\AppData\Local\Temp\CD0F.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\CD5D.tmp"C:\Users\Admin\AppData\Local\Temp\CD5D.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\CD9B.tmp"C:\Users\Admin\AppData\Local\Temp\CD9B.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:348 -
C:\Users\Admin\AppData\Local\Temp\CDDA.tmp"C:\Users\Admin\AppData\Local\Temp\CDDA.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\CE18.tmp"C:\Users\Admin\AppData\Local\Temp\CE18.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\CE57.tmp"C:\Users\Admin\AppData\Local\Temp\CE57.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\CEB4.tmp"C:\Users\Admin\AppData\Local\Temp\CEB4.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\CEF3.tmp"C:\Users\Admin\AppData\Local\Temp\CEF3.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\CF31.tmp"C:\Users\Admin\AppData\Local\Temp\CF31.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\CF7F.tmp"C:\Users\Admin\AppData\Local\Temp\CF7F.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\CFBD.tmp"C:\Users\Admin\AppData\Local\Temp\CFBD.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\CFFC.tmp"C:\Users\Admin\AppData\Local\Temp\CFFC.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\D04A.tmp"C:\Users\Admin\AppData\Local\Temp\D04A.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\D088.tmp"C:\Users\Admin\AppData\Local\Temp\D088.tmp"66⤵
- Executes dropped EXE
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\D0C7.tmp"C:\Users\Admin\AppData\Local\Temp\D0C7.tmp"67⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\D115.tmp"C:\Users\Admin\AppData\Local\Temp\D115.tmp"68⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\D153.tmp"C:\Users\Admin\AppData\Local\Temp\D153.tmp"69⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\D191.tmp"C:\Users\Admin\AppData\Local\Temp\D191.tmp"70⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\D1D0.tmp"C:\Users\Admin\AppData\Local\Temp\D1D0.tmp"71⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\D20E.tmp"C:\Users\Admin\AppData\Local\Temp\D20E.tmp"72⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\D24D.tmp"C:\Users\Admin\AppData\Local\Temp\D24D.tmp"73⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\D29B.tmp"C:\Users\Admin\AppData\Local\Temp\D29B.tmp"74⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\D2E9.tmp"C:\Users\Admin\AppData\Local\Temp\D2E9.tmp"75⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\D327.tmp"C:\Users\Admin\AppData\Local\Temp\D327.tmp"76⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\D365.tmp"C:\Users\Admin\AppData\Local\Temp\D365.tmp"77⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\D3A4.tmp"C:\Users\Admin\AppData\Local\Temp\D3A4.tmp"78⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\D3F2.tmp"C:\Users\Admin\AppData\Local\Temp\D3F2.tmp"79⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\D430.tmp"C:\Users\Admin\AppData\Local\Temp\D430.tmp"80⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\D46F.tmp"C:\Users\Admin\AppData\Local\Temp\D46F.tmp"81⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\D4AD.tmp"C:\Users\Admin\AppData\Local\Temp\D4AD.tmp"82⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\D4EB.tmp"C:\Users\Admin\AppData\Local\Temp\D4EB.tmp"83⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\D52A.tmp"C:\Users\Admin\AppData\Local\Temp\D52A.tmp"84⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\D568.tmp"C:\Users\Admin\AppData\Local\Temp\D568.tmp"85⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\D5A7.tmp"C:\Users\Admin\AppData\Local\Temp\D5A7.tmp"86⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\D5E5.tmp"C:\Users\Admin\AppData\Local\Temp\D5E5.tmp"87⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\D623.tmp"C:\Users\Admin\AppData\Local\Temp\D623.tmp"88⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\D662.tmp"C:\Users\Admin\AppData\Local\Temp\D662.tmp"89⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\D6A0.tmp"C:\Users\Admin\AppData\Local\Temp\D6A0.tmp"90⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\D6EE.tmp"C:\Users\Admin\AppData\Local\Temp\D6EE.tmp"91⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\D72D.tmp"C:\Users\Admin\AppData\Local\Temp\D72D.tmp"92⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\D76B.tmp"C:\Users\Admin\AppData\Local\Temp\D76B.tmp"93⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\D7A9.tmp"C:\Users\Admin\AppData\Local\Temp\D7A9.tmp"94⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\D7F7.tmp"C:\Users\Admin\AppData\Local\Temp\D7F7.tmp"95⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\D836.tmp"C:\Users\Admin\AppData\Local\Temp\D836.tmp"96⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\D874.tmp"C:\Users\Admin\AppData\Local\Temp\D874.tmp"97⤵PID:296
-
C:\Users\Admin\AppData\Local\Temp\D8B3.tmp"C:\Users\Admin\AppData\Local\Temp\D8B3.tmp"98⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\D8F1.tmp"C:\Users\Admin\AppData\Local\Temp\D8F1.tmp"99⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\D92F.tmp"C:\Users\Admin\AppData\Local\Temp\D92F.tmp"100⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\D96E.tmp"C:\Users\Admin\AppData\Local\Temp\D96E.tmp"101⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\D9AC.tmp"C:\Users\Admin\AppData\Local\Temp\D9AC.tmp"102⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\D9EB.tmp"C:\Users\Admin\AppData\Local\Temp\D9EB.tmp"103⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\DA39.tmp"C:\Users\Admin\AppData\Local\Temp\DA39.tmp"104⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\DA77.tmp"C:\Users\Admin\AppData\Local\Temp\DA77.tmp"105⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\DAB5.tmp"C:\Users\Admin\AppData\Local\Temp\DAB5.tmp"106⤵PID:292
-
C:\Users\Admin\AppData\Local\Temp\DAF4.tmp"C:\Users\Admin\AppData\Local\Temp\DAF4.tmp"107⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\DB32.tmp"C:\Users\Admin\AppData\Local\Temp\DB32.tmp"108⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\DB71.tmp"C:\Users\Admin\AppData\Local\Temp\DB71.tmp"109⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\DBAF.tmp"C:\Users\Admin\AppData\Local\Temp\DBAF.tmp"110⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\DBED.tmp"C:\Users\Admin\AppData\Local\Temp\DBED.tmp"111⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\DC2C.tmp"C:\Users\Admin\AppData\Local\Temp\DC2C.tmp"112⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\DC6A.tmp"C:\Users\Admin\AppData\Local\Temp\DC6A.tmp"113⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\DCA9.tmp"C:\Users\Admin\AppData\Local\Temp\DCA9.tmp"114⤵
- System Location Discovery: System Language Discovery
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\DCE7.tmp"C:\Users\Admin\AppData\Local\Temp\DCE7.tmp"115⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\DD25.tmp"C:\Users\Admin\AppData\Local\Temp\DD25.tmp"116⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\DD64.tmp"C:\Users\Admin\AppData\Local\Temp\DD64.tmp"117⤵PID:284
-
C:\Users\Admin\AppData\Local\Temp\DDA2.tmp"C:\Users\Admin\AppData\Local\Temp\DDA2.tmp"118⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\DDE1.tmp"C:\Users\Admin\AppData\Local\Temp\DDE1.tmp"119⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\DE1F.tmp"C:\Users\Admin\AppData\Local\Temp\DE1F.tmp"120⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\DE5E.tmp"C:\Users\Admin\AppData\Local\Temp\DE5E.tmp"121⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\DE9C.tmp"C:\Users\Admin\AppData\Local\Temp\DE9C.tmp"122⤵PID:2708
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-