Analysis
-
max time kernel
150s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
08/08/2024, 04:27
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-08_e69964d11b4226594ecaf446a574b84a_mafia.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-08-08_e69964d11b4226594ecaf446a574b84a_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-08_e69964d11b4226594ecaf446a574b84a_mafia.exe
-
Size
529KB
-
MD5
e69964d11b4226594ecaf446a574b84a
-
SHA1
f483260d567f8d945ade50e118616d84ef952a06
-
SHA256
5be9eb272ca814b7e28072aa5badd653373ec890505650fa7082a18322e2e323
-
SHA512
9390ea3fd3ba7b7de8a59229ea5d549e336dde80193d3f0c63d6dfe02bddf03641357b11fd3c59a71ba1ba5d858ba42deaa7de2e6c81d50df721905e5a663e5a
-
SSDEEP
12288:NU5rCOTeijwXBS1nClBrp7smsYTl3udQ3SKWTPdTZwlH4Hp:NUQOJjlnCl4mTT0diSvTPdTSlH4Hp
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1484 C5DE.tmp 2028 C64B.tmp 2124 C6C8.tmp 2920 C735.tmp 2912 C7A3.tmp 2660 C81F.tmp 2812 C87D.tmp 2856 C8EA.tmp 2816 C948.tmp 2656 C9B5.tmp 2728 CA13.tmp 2352 CA8F.tmp 2712 CAED.tmp 2172 CB5A.tmp 2420 CBC7.tmp 1824 CC44.tmp 2628 CCA2.tmp 1584 CD0F.tmp 944 CD7C.tmp 1560 CDF9.tmp 2264 CE76.tmp 1180 CEF3.tmp 808 CF50.tmp 2100 CF9E.tmp 1648 CFDD.tmp 2204 D01B.tmp 2156 D059.tmp 2136 D0A7.tmp 2184 D0E6.tmp 2608 D124.tmp 1060 D163.tmp 2404 D1A1.tmp 2216 D1E0.tmp 1044 D21E.tmp 552 D25C.tmp 1052 D29B.tmp 696 D2D9.tmp 1604 D318.tmp 1544 D356.tmp 2208 D394.tmp 1548 D3D3.tmp 2244 D411.tmp 1936 D450.tmp 1368 D49E.tmp 1976 D4DC.tmp 1036 D51A.tmp 2380 D559.tmp 352 D597.tmp 2256 D5D6.tmp 2460 D614.tmp 1100 D652.tmp 2308 D691.tmp 1612 D6CF.tmp 3036 D70E.tmp 2840 D74C.tmp 2744 D78A.tmp 2796 D7C9.tmp 2124 D807.tmp 2964 D846.tmp 2168 D884.tmp 2936 D8C2.tmp 2660 D901.tmp 2940 D93F.tmp 2812 D97E.tmp -
Loads dropped DLL 64 IoCs
pid Process 2300 2024-08-08_e69964d11b4226594ecaf446a574b84a_mafia.exe 1484 C5DE.tmp 2028 C64B.tmp 2124 C6C8.tmp 2920 C735.tmp 2912 C7A3.tmp 2660 C81F.tmp 2812 C87D.tmp 2856 C8EA.tmp 2816 C948.tmp 2656 C9B5.tmp 2728 CA13.tmp 2352 CA8F.tmp 2712 CAED.tmp 2172 CB5A.tmp 2420 CBC7.tmp 1824 CC44.tmp 2628 CCA2.tmp 1584 CD0F.tmp 944 CD7C.tmp 1560 CDF9.tmp 2264 CE76.tmp 1180 CEF3.tmp 808 CF50.tmp 2100 CF9E.tmp 1648 CFDD.tmp 2204 D01B.tmp 2156 D059.tmp 2136 D0A7.tmp 2184 D0E6.tmp 2608 D124.tmp 1060 D163.tmp 2404 D1A1.tmp 2216 D1E0.tmp 1044 D21E.tmp 552 D25C.tmp 1052 D29B.tmp 696 D2D9.tmp 1604 D318.tmp 1544 D356.tmp 2208 D394.tmp 1548 D3D3.tmp 2244 D411.tmp 1936 D450.tmp 1368 D49E.tmp 1976 D4DC.tmp 1036 D51A.tmp 2380 D559.tmp 352 D597.tmp 2256 D5D6.tmp 2460 D614.tmp 1100 D652.tmp 2308 D691.tmp 1612 D6CF.tmp 3036 D70E.tmp 2840 D74C.tmp 2744 D78A.tmp 2796 D7C9.tmp 2124 D807.tmp 2964 D846.tmp 2168 D884.tmp 2936 D8C2.tmp 2660 D901.tmp 2940 D93F.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E13B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 232A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6825.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8141.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4318.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5467.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2710.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 278D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2CFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA75.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 513C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 672C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6FB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3063.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B413.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C043.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDF9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2300 wrote to memory of 1484 2300 2024-08-08_e69964d11b4226594ecaf446a574b84a_mafia.exe 30 PID 2300 wrote to memory of 1484 2300 2024-08-08_e69964d11b4226594ecaf446a574b84a_mafia.exe 30 PID 2300 wrote to memory of 1484 2300 2024-08-08_e69964d11b4226594ecaf446a574b84a_mafia.exe 30 PID 2300 wrote to memory of 1484 2300 2024-08-08_e69964d11b4226594ecaf446a574b84a_mafia.exe 30 PID 1484 wrote to memory of 2028 1484 C5DE.tmp 31 PID 1484 wrote to memory of 2028 1484 C5DE.tmp 31 PID 1484 wrote to memory of 2028 1484 C5DE.tmp 31 PID 1484 wrote to memory of 2028 1484 C5DE.tmp 31 PID 2028 wrote to memory of 2124 2028 C64B.tmp 32 PID 2028 wrote to memory of 2124 2028 C64B.tmp 32 PID 2028 wrote to memory of 2124 2028 C64B.tmp 32 PID 2028 wrote to memory of 2124 2028 C64B.tmp 32 PID 2124 wrote to memory of 2920 2124 C6C8.tmp 33 PID 2124 wrote to memory of 2920 2124 C6C8.tmp 33 PID 2124 wrote to memory of 2920 2124 C6C8.tmp 33 PID 2124 wrote to memory of 2920 2124 C6C8.tmp 33 PID 2920 wrote to memory of 2912 2920 C735.tmp 34 PID 2920 wrote to memory of 2912 2920 C735.tmp 34 PID 2920 wrote to memory of 2912 2920 C735.tmp 34 PID 2920 wrote to memory of 2912 2920 C735.tmp 34 PID 2912 wrote to memory of 2660 2912 C7A3.tmp 35 PID 2912 wrote to memory of 2660 2912 C7A3.tmp 35 PID 2912 wrote to memory of 2660 2912 C7A3.tmp 35 PID 2912 wrote to memory of 2660 2912 C7A3.tmp 35 PID 2660 wrote to memory of 2812 2660 C81F.tmp 36 PID 2660 wrote to memory of 2812 2660 C81F.tmp 36 PID 2660 wrote to memory of 2812 2660 C81F.tmp 36 PID 2660 wrote to memory of 2812 2660 C81F.tmp 36 PID 2812 wrote to memory of 2856 2812 C87D.tmp 37 PID 2812 wrote to memory of 2856 2812 C87D.tmp 37 PID 2812 wrote to memory of 2856 2812 C87D.tmp 37 PID 2812 wrote to memory of 2856 2812 C87D.tmp 37 PID 2856 wrote to memory of 2816 2856 C8EA.tmp 38 PID 2856 wrote to memory of 2816 2856 C8EA.tmp 38 PID 2856 wrote to memory of 2816 2856 C8EA.tmp 38 PID 2856 wrote to memory of 2816 2856 C8EA.tmp 38 PID 2816 wrote to memory of 2656 2816 C948.tmp 39 PID 2816 wrote to memory of 2656 2816 C948.tmp 39 PID 2816 wrote to memory of 2656 2816 C948.tmp 39 PID 2816 wrote to memory of 2656 2816 C948.tmp 39 PID 2656 wrote to memory of 2728 2656 C9B5.tmp 40 PID 2656 wrote to memory of 2728 2656 C9B5.tmp 40 PID 2656 wrote to memory of 2728 2656 C9B5.tmp 40 PID 2656 wrote to memory of 2728 2656 C9B5.tmp 40 PID 2728 wrote to memory of 2352 2728 CA13.tmp 41 PID 2728 wrote to memory of 2352 2728 CA13.tmp 41 PID 2728 wrote to memory of 2352 2728 CA13.tmp 41 PID 2728 wrote to memory of 2352 2728 CA13.tmp 41 PID 2352 wrote to memory of 2712 2352 CA8F.tmp 42 PID 2352 wrote to memory of 2712 2352 CA8F.tmp 42 PID 2352 wrote to memory of 2712 2352 CA8F.tmp 42 PID 2352 wrote to memory of 2712 2352 CA8F.tmp 42 PID 2712 wrote to memory of 2172 2712 CAED.tmp 43 PID 2712 wrote to memory of 2172 2712 CAED.tmp 43 PID 2712 wrote to memory of 2172 2712 CAED.tmp 43 PID 2712 wrote to memory of 2172 2712 CAED.tmp 43 PID 2172 wrote to memory of 2420 2172 CB5A.tmp 44 PID 2172 wrote to memory of 2420 2172 CB5A.tmp 44 PID 2172 wrote to memory of 2420 2172 CB5A.tmp 44 PID 2172 wrote to memory of 2420 2172 CB5A.tmp 44 PID 2420 wrote to memory of 1824 2420 CBC7.tmp 45 PID 2420 wrote to memory of 1824 2420 CBC7.tmp 45 PID 2420 wrote to memory of 1824 2420 CBC7.tmp 45 PID 2420 wrote to memory of 1824 2420 CBC7.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-08_e69964d11b4226594ecaf446a574b84a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-08_e69964d11b4226594ecaf446a574b84a_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\C5DE.tmp"C:\Users\Admin\AppData\Local\Temp\C5DE.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\C64B.tmp"C:\Users\Admin\AppData\Local\Temp\C64B.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\C6C8.tmp"C:\Users\Admin\AppData\Local\Temp\C6C8.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\C735.tmp"C:\Users\Admin\AppData\Local\Temp\C735.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\C7A3.tmp"C:\Users\Admin\AppData\Local\Temp\C7A3.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\C81F.tmp"C:\Users\Admin\AppData\Local\Temp\C81F.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\C87D.tmp"C:\Users\Admin\AppData\Local\Temp\C87D.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\C8EA.tmp"C:\Users\Admin\AppData\Local\Temp\C8EA.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\C948.tmp"C:\Users\Admin\AppData\Local\Temp\C948.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\C9B5.tmp"C:\Users\Admin\AppData\Local\Temp\C9B5.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\CA13.tmp"C:\Users\Admin\AppData\Local\Temp\CA13.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\CA8F.tmp"C:\Users\Admin\AppData\Local\Temp\CA8F.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\CAED.tmp"C:\Users\Admin\AppData\Local\Temp\CAED.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\CB5A.tmp"C:\Users\Admin\AppData\Local\Temp\CB5A.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\CBC7.tmp"C:\Users\Admin\AppData\Local\Temp\CBC7.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\CC44.tmp"C:\Users\Admin\AppData\Local\Temp\CC44.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\CCA2.tmp"C:\Users\Admin\AppData\Local\Temp\CCA2.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\CD0F.tmp"C:\Users\Admin\AppData\Local\Temp\CD0F.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:944 -
C:\Users\Admin\AppData\Local\Temp\CDF9.tmp"C:\Users\Admin\AppData\Local\Temp\CDF9.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\CE76.tmp"C:\Users\Admin\AppData\Local\Temp\CE76.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\CEF3.tmp"C:\Users\Admin\AppData\Local\Temp\CEF3.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\CF50.tmp"C:\Users\Admin\AppData\Local\Temp\CF50.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:808 -
C:\Users\Admin\AppData\Local\Temp\CF9E.tmp"C:\Users\Admin\AppData\Local\Temp\CF9E.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\CFDD.tmp"C:\Users\Admin\AppData\Local\Temp\CFDD.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\D01B.tmp"C:\Users\Admin\AppData\Local\Temp\D01B.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\D059.tmp"C:\Users\Admin\AppData\Local\Temp\D059.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\D0A7.tmp"C:\Users\Admin\AppData\Local\Temp\D0A7.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\D0E6.tmp"C:\Users\Admin\AppData\Local\Temp\D0E6.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\D124.tmp"C:\Users\Admin\AppData\Local\Temp\D124.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\D163.tmp"C:\Users\Admin\AppData\Local\Temp\D163.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\D1A1.tmp"C:\Users\Admin\AppData\Local\Temp\D1A1.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\D1E0.tmp"C:\Users\Admin\AppData\Local\Temp\D1E0.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\D21E.tmp"C:\Users\Admin\AppData\Local\Temp\D21E.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\D25C.tmp"C:\Users\Admin\AppData\Local\Temp\D25C.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:552 -
C:\Users\Admin\AppData\Local\Temp\D29B.tmp"C:\Users\Admin\AppData\Local\Temp\D29B.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\D2D9.tmp"C:\Users\Admin\AppData\Local\Temp\D2D9.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:696 -
C:\Users\Admin\AppData\Local\Temp\D318.tmp"C:\Users\Admin\AppData\Local\Temp\D318.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\D356.tmp"C:\Users\Admin\AppData\Local\Temp\D356.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\D394.tmp"C:\Users\Admin\AppData\Local\Temp\D394.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\D3D3.tmp"C:\Users\Admin\AppData\Local\Temp\D3D3.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\D411.tmp"C:\Users\Admin\AppData\Local\Temp\D411.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\D450.tmp"C:\Users\Admin\AppData\Local\Temp\D450.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\D49E.tmp"C:\Users\Admin\AppData\Local\Temp\D49E.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\D4DC.tmp"C:\Users\Admin\AppData\Local\Temp\D4DC.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\D51A.tmp"C:\Users\Admin\AppData\Local\Temp\D51A.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\D559.tmp"C:\Users\Admin\AppData\Local\Temp\D559.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\D597.tmp"C:\Users\Admin\AppData\Local\Temp\D597.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:352 -
C:\Users\Admin\AppData\Local\Temp\D5D6.tmp"C:\Users\Admin\AppData\Local\Temp\D5D6.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\D614.tmp"C:\Users\Admin\AppData\Local\Temp\D614.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\D652.tmp"C:\Users\Admin\AppData\Local\Temp\D652.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\D691.tmp"C:\Users\Admin\AppData\Local\Temp\D691.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\D6CF.tmp"C:\Users\Admin\AppData\Local\Temp\D6CF.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\D70E.tmp"C:\Users\Admin\AppData\Local\Temp\D70E.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\D74C.tmp"C:\Users\Admin\AppData\Local\Temp\D74C.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\D78A.tmp"C:\Users\Admin\AppData\Local\Temp\D78A.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\D7C9.tmp"C:\Users\Admin\AppData\Local\Temp\D7C9.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\D807.tmp"C:\Users\Admin\AppData\Local\Temp\D807.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\D846.tmp"C:\Users\Admin\AppData\Local\Temp\D846.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\D884.tmp"C:\Users\Admin\AppData\Local\Temp\D884.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\D8C2.tmp"C:\Users\Admin\AppData\Local\Temp\D8C2.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\D901.tmp"C:\Users\Admin\AppData\Local\Temp\D901.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\D93F.tmp"C:\Users\Admin\AppData\Local\Temp\D93F.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\D97E.tmp"C:\Users\Admin\AppData\Local\Temp\D97E.tmp"65⤵
- Executes dropped EXE
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\D9BC.tmp"C:\Users\Admin\AppData\Local\Temp\D9BC.tmp"66⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\D9FA.tmp"C:\Users\Admin\AppData\Local\Temp\D9FA.tmp"67⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\DA39.tmp"C:\Users\Admin\AppData\Local\Temp\DA39.tmp"68⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\DA77.tmp"C:\Users\Admin\AppData\Local\Temp\DA77.tmp"69⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\DAB6.tmp"C:\Users\Admin\AppData\Local\Temp\DAB6.tmp"70⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\DAF4.tmp"C:\Users\Admin\AppData\Local\Temp\DAF4.tmp"71⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\DB32.tmp"C:\Users\Admin\AppData\Local\Temp\DB32.tmp"72⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\DB71.tmp"C:\Users\Admin\AppData\Local\Temp\DB71.tmp"73⤵
- System Location Discovery: System Language Discovery
PID:940 -
C:\Users\Admin\AppData\Local\Temp\DBAF.tmp"C:\Users\Admin\AppData\Local\Temp\DBAF.tmp"74⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\DBEE.tmp"C:\Users\Admin\AppData\Local\Temp\DBEE.tmp"75⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\DC2C.tmp"C:\Users\Admin\AppData\Local\Temp\DC2C.tmp"76⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\DC6A.tmp"C:\Users\Admin\AppData\Local\Temp\DC6A.tmp"77⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\DCA9.tmp"C:\Users\Admin\AppData\Local\Temp\DCA9.tmp"78⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\DCE7.tmp"C:\Users\Admin\AppData\Local\Temp\DCE7.tmp"79⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\DD26.tmp"C:\Users\Admin\AppData\Local\Temp\DD26.tmp"80⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\DD64.tmp"C:\Users\Admin\AppData\Local\Temp\DD64.tmp"81⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\DD93.tmp"C:\Users\Admin\AppData\Local\Temp\DD93.tmp"82⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\DDD1.tmp"C:\Users\Admin\AppData\Local\Temp\DDD1.tmp"83⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\DE10.tmp"C:\Users\Admin\AppData\Local\Temp\DE10.tmp"84⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\DE4E.tmp"C:\Users\Admin\AppData\Local\Temp\DE4E.tmp"85⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\DE8C.tmp"C:\Users\Admin\AppData\Local\Temp\DE8C.tmp"86⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\DECB.tmp"C:\Users\Admin\AppData\Local\Temp\DECB.tmp"87⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\DF09.tmp"C:\Users\Admin\AppData\Local\Temp\DF09.tmp"88⤵PID:276
-
C:\Users\Admin\AppData\Local\Temp\DF48.tmp"C:\Users\Admin\AppData\Local\Temp\DF48.tmp"89⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\DF86.tmp"C:\Users\Admin\AppData\Local\Temp\DF86.tmp"90⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\DFC4.tmp"C:\Users\Admin\AppData\Local\Temp\DFC4.tmp"91⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\E003.tmp"C:\Users\Admin\AppData\Local\Temp\E003.tmp"92⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\E041.tmp"C:\Users\Admin\AppData\Local\Temp\E041.tmp"93⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\E080.tmp"C:\Users\Admin\AppData\Local\Temp\E080.tmp"94⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\E0BE.tmp"C:\Users\Admin\AppData\Local\Temp\E0BE.tmp"95⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\E0FC.tmp"C:\Users\Admin\AppData\Local\Temp\E0FC.tmp"96⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\E13B.tmp"C:\Users\Admin\AppData\Local\Temp\E13B.tmp"97⤵
- System Location Discovery: System Language Discovery
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\E179.tmp"C:\Users\Admin\AppData\Local\Temp\E179.tmp"98⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\E1B8.tmp"C:\Users\Admin\AppData\Local\Temp\E1B8.tmp"99⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\E1F6.tmp"C:\Users\Admin\AppData\Local\Temp\E1F6.tmp"100⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\E244.tmp"C:\Users\Admin\AppData\Local\Temp\E244.tmp"101⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\E282.tmp"C:\Users\Admin\AppData\Local\Temp\E282.tmp"102⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\E2C1.tmp"C:\Users\Admin\AppData\Local\Temp\E2C1.tmp"103⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\E2FF.tmp"C:\Users\Admin\AppData\Local\Temp\E2FF.tmp"104⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\E33E.tmp"C:\Users\Admin\AppData\Local\Temp\E33E.tmp"105⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\E37C.tmp"C:\Users\Admin\AppData\Local\Temp\E37C.tmp"106⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\E3BA.tmp"C:\Users\Admin\AppData\Local\Temp\E3BA.tmp"107⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\E3F9.tmp"C:\Users\Admin\AppData\Local\Temp\E3F9.tmp"108⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\E437.tmp"C:\Users\Admin\AppData\Local\Temp\E437.tmp"109⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\E466.tmp"C:\Users\Admin\AppData\Local\Temp\E466.tmp"110⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\E4A4.tmp"C:\Users\Admin\AppData\Local\Temp\E4A4.tmp"111⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\E4E3.tmp"C:\Users\Admin\AppData\Local\Temp\E4E3.tmp"112⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\E521.tmp"C:\Users\Admin\AppData\Local\Temp\E521.tmp"113⤵PID:352
-
C:\Users\Admin\AppData\Local\Temp\E560.tmp"C:\Users\Admin\AppData\Local\Temp\E560.tmp"114⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\E59E.tmp"C:\Users\Admin\AppData\Local\Temp\E59E.tmp"115⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\E5DC.tmp"C:\Users\Admin\AppData\Local\Temp\E5DC.tmp"116⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\E61B.tmp"C:\Users\Admin\AppData\Local\Temp\E61B.tmp"117⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\E659.tmp"C:\Users\Admin\AppData\Local\Temp\E659.tmp"118⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\E698.tmp"C:\Users\Admin\AppData\Local\Temp\E698.tmp"119⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\E6D6.tmp"C:\Users\Admin\AppData\Local\Temp\E6D6.tmp"120⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\E714.tmp"C:\Users\Admin\AppData\Local\Temp\E714.tmp"121⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\E753.tmp"C:\Users\Admin\AppData\Local\Temp\E753.tmp"122⤵PID:2796
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-