Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
08-08-2024 14:07
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-08_eea921d5fdc12bc368055fa90613130a_mafia.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-08-08_eea921d5fdc12bc368055fa90613130a_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-08_eea921d5fdc12bc368055fa90613130a_mafia.exe
-
Size
536KB
-
MD5
eea921d5fdc12bc368055fa90613130a
-
SHA1
51863e68bdeb19ed994af9a9b19aa160a0c3b4b9
-
SHA256
b385b29495844f1e65eef4279512054b2c016a747ee7ad0479ee00ac8bb34391
-
SHA512
70e2a5c016813e4f6393223ac49fb07b7ef98166ffd0333d426e45e67aea67e5ee1ee23c5ae898afd3d7a4909b28aa93efb9dc424bc28666c043023c376f3b9a
-
SSDEEP
12288:wU5rCOTeiU5B3Rk1VocicVk9hEIZxVJ0ZT9:wUQOJU5g1VopcVkLEIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2052 E447.tmp 2328 E4B4.tmp 3036 E59E.tmp 2148 E659.tmp 2668 E705.tmp 2784 E782.tmp 2384 E85C.tmp 2916 E8E8.tmp 2576 E9A4.tmp 2572 EA4F.tmp 1832 EAEB.tmp 1800 EB78.tmp 2752 EC23.tmp 1864 ECDE.tmp 2428 ED8A.tmp 2724 EE45.tmp 1528 EE93.tmp 1768 EF20.tmp 2920 EFEA.tmp 1972 F0A6.tmp 2896 F142.tmp 2008 F1CE.tmp 1216 F26A.tmp 1628 F2A8.tmp 896 F306.tmp 3004 F354.tmp 1140 F3C1.tmp 2164 F400.tmp 496 F46D.tmp 1560 F4AB.tmp 2080 F509.tmp 2372 F547.tmp 1432 F595.tmp 880 F5E3.tmp 1484 F641.tmp 272 F67F.tmp 2496 F6DD.tmp 1616 F71B.tmp 1460 F779.tmp 2836 F7D6.tmp 3048 F815.tmp 2224 F863.tmp 2648 F892.tmp 2808 F8D0.tmp 2668 F90E.tmp 2528 F94D.tmp 2636 F98B.tmp 2904 F9CA.tmp 2744 FA08.tmp 2520 FA46.tmp 2576 FA85.tmp 3056 FAC3.tmp 3028 FB02.tmp 1760 FB40.tmp 1748 FB7E.tmp 2708 FBBD.tmp 1976 FBFB.tmp 288 FC3A.tmp 1096 FC78.tmp 316 FCB6.tmp 2696 FCF5.tmp 1168 FD33.tmp 2868 FD72.tmp 2924 FDB0.tmp -
Loads dropped DLL 64 IoCs
pid Process 824 2024-08-08_eea921d5fdc12bc368055fa90613130a_mafia.exe 2052 E447.tmp 2328 E4B4.tmp 3036 E59E.tmp 2148 E659.tmp 2668 E705.tmp 2784 E782.tmp 2384 E85C.tmp 2916 E8E8.tmp 2576 E9A4.tmp 2572 EA4F.tmp 1832 EAEB.tmp 1800 EB78.tmp 2752 EC23.tmp 1864 ECDE.tmp 2428 ED8A.tmp 2724 EE45.tmp 1528 EE93.tmp 1768 EF20.tmp 2920 EFEA.tmp 1972 F0A6.tmp 2896 F142.tmp 2008 F1CE.tmp 1216 F26A.tmp 1628 F2A8.tmp 896 F306.tmp 3004 F354.tmp 1140 F3C1.tmp 2164 F400.tmp 496 F46D.tmp 1560 F4AB.tmp 2080 F509.tmp 2372 F547.tmp 1432 F595.tmp 880 F5E3.tmp 1484 F641.tmp 272 F67F.tmp 2496 F6DD.tmp 1616 F71B.tmp 1460 F779.tmp 2836 F7D6.tmp 3048 F815.tmp 2224 F863.tmp 2648 F892.tmp 2808 F8D0.tmp 2668 F90E.tmp 2528 F94D.tmp 2636 F98B.tmp 2904 F9CA.tmp 2744 FA08.tmp 2520 FA46.tmp 2576 FA85.tmp 3056 FAC3.tmp 3028 FB02.tmp 1760 FB40.tmp 1748 FB7E.tmp 2708 FBBD.tmp 1976 FBFB.tmp 288 FC3A.tmp 1096 FC78.tmp 316 FCB6.tmp 2696 FCF5.tmp 1168 FD33.tmp 2868 FD72.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E705.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E96.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6671.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7243.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1729.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BB3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A62E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 951E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 722.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6ED9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4183.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E669.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4FF4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D588.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D894.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 360E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1870.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C561.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7050.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 824 wrote to memory of 2052 824 2024-08-08_eea921d5fdc12bc368055fa90613130a_mafia.exe 31 PID 824 wrote to memory of 2052 824 2024-08-08_eea921d5fdc12bc368055fa90613130a_mafia.exe 31 PID 824 wrote to memory of 2052 824 2024-08-08_eea921d5fdc12bc368055fa90613130a_mafia.exe 31 PID 824 wrote to memory of 2052 824 2024-08-08_eea921d5fdc12bc368055fa90613130a_mafia.exe 31 PID 2052 wrote to memory of 2328 2052 E447.tmp 32 PID 2052 wrote to memory of 2328 2052 E447.tmp 32 PID 2052 wrote to memory of 2328 2052 E447.tmp 32 PID 2052 wrote to memory of 2328 2052 E447.tmp 32 PID 2328 wrote to memory of 3036 2328 E4B4.tmp 33 PID 2328 wrote to memory of 3036 2328 E4B4.tmp 33 PID 2328 wrote to memory of 3036 2328 E4B4.tmp 33 PID 2328 wrote to memory of 3036 2328 E4B4.tmp 33 PID 3036 wrote to memory of 2148 3036 E59E.tmp 34 PID 3036 wrote to memory of 2148 3036 E59E.tmp 34 PID 3036 wrote to memory of 2148 3036 E59E.tmp 34 PID 3036 wrote to memory of 2148 3036 E59E.tmp 34 PID 2148 wrote to memory of 2668 2148 E659.tmp 35 PID 2148 wrote to memory of 2668 2148 E659.tmp 35 PID 2148 wrote to memory of 2668 2148 E659.tmp 35 PID 2148 wrote to memory of 2668 2148 E659.tmp 35 PID 2668 wrote to memory of 2784 2668 E705.tmp 36 PID 2668 wrote to memory of 2784 2668 E705.tmp 36 PID 2668 wrote to memory of 2784 2668 E705.tmp 36 PID 2668 wrote to memory of 2784 2668 E705.tmp 36 PID 2784 wrote to memory of 2384 2784 E782.tmp 37 PID 2784 wrote to memory of 2384 2784 E782.tmp 37 PID 2784 wrote to memory of 2384 2784 E782.tmp 37 PID 2784 wrote to memory of 2384 2784 E782.tmp 37 PID 2384 wrote to memory of 2916 2384 E85C.tmp 38 PID 2384 wrote to memory of 2916 2384 E85C.tmp 38 PID 2384 wrote to memory of 2916 2384 E85C.tmp 38 PID 2384 wrote to memory of 2916 2384 E85C.tmp 38 PID 2916 wrote to memory of 2576 2916 E8E8.tmp 39 PID 2916 wrote to memory of 2576 2916 E8E8.tmp 39 PID 2916 wrote to memory of 2576 2916 E8E8.tmp 39 PID 2916 wrote to memory of 2576 2916 E8E8.tmp 39 PID 2576 wrote to memory of 2572 2576 E9A4.tmp 40 PID 2576 wrote to memory of 2572 2576 E9A4.tmp 40 PID 2576 wrote to memory of 2572 2576 E9A4.tmp 40 PID 2576 wrote to memory of 2572 2576 E9A4.tmp 40 PID 2572 wrote to memory of 1832 2572 EA4F.tmp 41 PID 2572 wrote to memory of 1832 2572 EA4F.tmp 41 PID 2572 wrote to memory of 1832 2572 EA4F.tmp 41 PID 2572 wrote to memory of 1832 2572 EA4F.tmp 41 PID 1832 wrote to memory of 1800 1832 EAEB.tmp 42 PID 1832 wrote to memory of 1800 1832 EAEB.tmp 42 PID 1832 wrote to memory of 1800 1832 EAEB.tmp 42 PID 1832 wrote to memory of 1800 1832 EAEB.tmp 42 PID 1800 wrote to memory of 2752 1800 EB78.tmp 43 PID 1800 wrote to memory of 2752 1800 EB78.tmp 43 PID 1800 wrote to memory of 2752 1800 EB78.tmp 43 PID 1800 wrote to memory of 2752 1800 EB78.tmp 43 PID 2752 wrote to memory of 1864 2752 EC23.tmp 44 PID 2752 wrote to memory of 1864 2752 EC23.tmp 44 PID 2752 wrote to memory of 1864 2752 EC23.tmp 44 PID 2752 wrote to memory of 1864 2752 EC23.tmp 44 PID 1864 wrote to memory of 2428 1864 ECDE.tmp 45 PID 1864 wrote to memory of 2428 1864 ECDE.tmp 45 PID 1864 wrote to memory of 2428 1864 ECDE.tmp 45 PID 1864 wrote to memory of 2428 1864 ECDE.tmp 45 PID 2428 wrote to memory of 2724 2428 ED8A.tmp 46 PID 2428 wrote to memory of 2724 2428 ED8A.tmp 46 PID 2428 wrote to memory of 2724 2428 ED8A.tmp 46 PID 2428 wrote to memory of 2724 2428 ED8A.tmp 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-08_eea921d5fdc12bc368055fa90613130a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-08_eea921d5fdc12bc368055fa90613130a_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\E447.tmp"C:\Users\Admin\AppData\Local\Temp\E447.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\E4B4.tmp"C:\Users\Admin\AppData\Local\Temp\E4B4.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\E59E.tmp"C:\Users\Admin\AppData\Local\Temp\E59E.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\E659.tmp"C:\Users\Admin\AppData\Local\Temp\E659.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\E705.tmp"C:\Users\Admin\AppData\Local\Temp\E705.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\E782.tmp"C:\Users\Admin\AppData\Local\Temp\E782.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\E85C.tmp"C:\Users\Admin\AppData\Local\Temp\E85C.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\E8E8.tmp"C:\Users\Admin\AppData\Local\Temp\E8E8.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\E9A4.tmp"C:\Users\Admin\AppData\Local\Temp\E9A4.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\EA4F.tmp"C:\Users\Admin\AppData\Local\Temp\EA4F.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\EAEB.tmp"C:\Users\Admin\AppData\Local\Temp\EAEB.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\EB78.tmp"C:\Users\Admin\AppData\Local\Temp\EB78.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\EC23.tmp"C:\Users\Admin\AppData\Local\Temp\EC23.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\ECDE.tmp"C:\Users\Admin\AppData\Local\Temp\ECDE.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\ED8A.tmp"C:\Users\Admin\AppData\Local\Temp\ED8A.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\EE45.tmp"C:\Users\Admin\AppData\Local\Temp\EE45.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\EE93.tmp"C:\Users\Admin\AppData\Local\Temp\EE93.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\EF20.tmp"C:\Users\Admin\AppData\Local\Temp\EF20.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\EFEA.tmp"C:\Users\Admin\AppData\Local\Temp\EFEA.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\F0A6.tmp"C:\Users\Admin\AppData\Local\Temp\F0A6.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\F142.tmp"C:\Users\Admin\AppData\Local\Temp\F142.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\F1CE.tmp"C:\Users\Admin\AppData\Local\Temp\F1CE.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\F26A.tmp"C:\Users\Admin\AppData\Local\Temp\F26A.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\F2A8.tmp"C:\Users\Admin\AppData\Local\Temp\F2A8.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\F306.tmp"C:\Users\Admin\AppData\Local\Temp\F306.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:896 -
C:\Users\Admin\AppData\Local\Temp\F354.tmp"C:\Users\Admin\AppData\Local\Temp\F354.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\F3C1.tmp"C:\Users\Admin\AppData\Local\Temp\F3C1.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\F400.tmp"C:\Users\Admin\AppData\Local\Temp\F400.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\F46D.tmp"C:\Users\Admin\AppData\Local\Temp\F46D.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:496 -
C:\Users\Admin\AppData\Local\Temp\F4AB.tmp"C:\Users\Admin\AppData\Local\Temp\F4AB.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\F509.tmp"C:\Users\Admin\AppData\Local\Temp\F509.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\F547.tmp"C:\Users\Admin\AppData\Local\Temp\F547.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\F595.tmp"C:\Users\Admin\AppData\Local\Temp\F595.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\F5E3.tmp"C:\Users\Admin\AppData\Local\Temp\F5E3.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:880 -
C:\Users\Admin\AppData\Local\Temp\F641.tmp"C:\Users\Admin\AppData\Local\Temp\F641.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\F67F.tmp"C:\Users\Admin\AppData\Local\Temp\F67F.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:272 -
C:\Users\Admin\AppData\Local\Temp\F6DD.tmp"C:\Users\Admin\AppData\Local\Temp\F6DD.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\F71B.tmp"C:\Users\Admin\AppData\Local\Temp\F71B.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\F779.tmp"C:\Users\Admin\AppData\Local\Temp\F779.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\F7D6.tmp"C:\Users\Admin\AppData\Local\Temp\F7D6.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\F815.tmp"C:\Users\Admin\AppData\Local\Temp\F815.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\F863.tmp"C:\Users\Admin\AppData\Local\Temp\F863.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\F892.tmp"C:\Users\Admin\AppData\Local\Temp\F892.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\F8D0.tmp"C:\Users\Admin\AppData\Local\Temp\F8D0.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\F90E.tmp"C:\Users\Admin\AppData\Local\Temp\F90E.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\F94D.tmp"C:\Users\Admin\AppData\Local\Temp\F94D.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\F98B.tmp"C:\Users\Admin\AppData\Local\Temp\F98B.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\F9CA.tmp"C:\Users\Admin\AppData\Local\Temp\F9CA.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\FA08.tmp"C:\Users\Admin\AppData\Local\Temp\FA08.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\FA46.tmp"C:\Users\Admin\AppData\Local\Temp\FA46.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\FA85.tmp"C:\Users\Admin\AppData\Local\Temp\FA85.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\FAC3.tmp"C:\Users\Admin\AppData\Local\Temp\FAC3.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\FB02.tmp"C:\Users\Admin\AppData\Local\Temp\FB02.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\FB40.tmp"C:\Users\Admin\AppData\Local\Temp\FB40.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\FB7E.tmp"C:\Users\Admin\AppData\Local\Temp\FB7E.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\FBBD.tmp"C:\Users\Admin\AppData\Local\Temp\FBBD.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\FBFB.tmp"C:\Users\Admin\AppData\Local\Temp\FBFB.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\FC3A.tmp"C:\Users\Admin\AppData\Local\Temp\FC3A.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:288 -
C:\Users\Admin\AppData\Local\Temp\FC78.tmp"C:\Users\Admin\AppData\Local\Temp\FC78.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\FCB6.tmp"C:\Users\Admin\AppData\Local\Temp\FCB6.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:316 -
C:\Users\Admin\AppData\Local\Temp\FCF5.tmp"C:\Users\Admin\AppData\Local\Temp\FCF5.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\FD33.tmp"C:\Users\Admin\AppData\Local\Temp\FD33.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\FD72.tmp"C:\Users\Admin\AppData\Local\Temp\FD72.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\FDB0.tmp"C:\Users\Admin\AppData\Local\Temp\FDB0.tmp"65⤵
- Executes dropped EXE
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\FDEE.tmp"C:\Users\Admin\AppData\Local\Temp\FDEE.tmp"66⤵
- System Location Discovery: System Language Discovery
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\FE2D.tmp"C:\Users\Admin\AppData\Local\Temp\FE2D.tmp"67⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\FE6B.tmp"C:\Users\Admin\AppData\Local\Temp\FE6B.tmp"68⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\FEAA.tmp"C:\Users\Admin\AppData\Local\Temp\FEAA.tmp"69⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\FEE8.tmp"C:\Users\Admin\AppData\Local\Temp\FEE8.tmp"70⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\FF26.tmp"C:\Users\Admin\AppData\Local\Temp\FF26.tmp"71⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\FF74.tmp"C:\Users\Admin\AppData\Local\Temp\FF74.tmp"72⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\FFB3.tmp"C:\Users\Admin\AppData\Local\Temp\FFB3.tmp"73⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\FFF1.tmp"C:\Users\Admin\AppData\Local\Temp\FFF1.tmp"74⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\30.tmp"C:\Users\Admin\AppData\Local\Temp\30.tmp"75⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\8D.tmp"C:\Users\Admin\AppData\Local\Temp\8D.tmp"76⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\CC.tmp"C:\Users\Admin\AppData\Local\Temp\CC.tmp"77⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\10A.tmp"C:\Users\Admin\AppData\Local\Temp\10A.tmp"78⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\148.tmp"C:\Users\Admin\AppData\Local\Temp\148.tmp"79⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\187.tmp"C:\Users\Admin\AppData\Local\Temp\187.tmp"80⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\1C5.tmp"C:\Users\Admin\AppData\Local\Temp\1C5.tmp"81⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\204.tmp"C:\Users\Admin\AppData\Local\Temp\204.tmp"82⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\242.tmp"C:\Users\Admin\AppData\Local\Temp\242.tmp"83⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\280.tmp"C:\Users\Admin\AppData\Local\Temp\280.tmp"84⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\2BF.tmp"C:\Users\Admin\AppData\Local\Temp\2BF.tmp"85⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\2FD.tmp"C:\Users\Admin\AppData\Local\Temp\2FD.tmp"86⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\33C.tmp"C:\Users\Admin\AppData\Local\Temp\33C.tmp"87⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\37A.tmp"C:\Users\Admin\AppData\Local\Temp\37A.tmp"88⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\3B8.tmp"C:\Users\Admin\AppData\Local\Temp\3B8.tmp"89⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\3F7.tmp"C:\Users\Admin\AppData\Local\Temp\3F7.tmp"90⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\435.tmp"C:\Users\Admin\AppData\Local\Temp\435.tmp"91⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\474.tmp"C:\Users\Admin\AppData\Local\Temp\474.tmp"92⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\4B2.tmp"C:\Users\Admin\AppData\Local\Temp\4B2.tmp"93⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\4F0.tmp"C:\Users\Admin\AppData\Local\Temp\4F0.tmp"94⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\52F.tmp"C:\Users\Admin\AppData\Local\Temp\52F.tmp"95⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\56D.tmp"C:\Users\Admin\AppData\Local\Temp\56D.tmp"96⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\5AC.tmp"C:\Users\Admin\AppData\Local\Temp\5AC.tmp"97⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\5EA.tmp"C:\Users\Admin\AppData\Local\Temp\5EA.tmp"98⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\628.tmp"C:\Users\Admin\AppData\Local\Temp\628.tmp"99⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\667.tmp"C:\Users\Admin\AppData\Local\Temp\667.tmp"100⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\6A5.tmp"C:\Users\Admin\AppData\Local\Temp\6A5.tmp"101⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\6E4.tmp"C:\Users\Admin\AppData\Local\Temp\6E4.tmp"102⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\722.tmp"C:\Users\Admin\AppData\Local\Temp\722.tmp"103⤵
- System Location Discovery: System Language Discovery
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\760.tmp"C:\Users\Admin\AppData\Local\Temp\760.tmp"104⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\79F.tmp"C:\Users\Admin\AppData\Local\Temp\79F.tmp"105⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\7DD.tmp"C:\Users\Admin\AppData\Local\Temp\7DD.tmp"106⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\81C.tmp"C:\Users\Admin\AppData\Local\Temp\81C.tmp"107⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\85A.tmp"C:\Users\Admin\AppData\Local\Temp\85A.tmp"108⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\898.tmp"C:\Users\Admin\AppData\Local\Temp\898.tmp"109⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\8D7.tmp"C:\Users\Admin\AppData\Local\Temp\8D7.tmp"110⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\915.tmp"C:\Users\Admin\AppData\Local\Temp\915.tmp"111⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\954.tmp"C:\Users\Admin\AppData\Local\Temp\954.tmp"112⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\992.tmp"C:\Users\Admin\AppData\Local\Temp\992.tmp"113⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\9E0.tmp"C:\Users\Admin\AppData\Local\Temp\9E0.tmp"114⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\A1E.tmp"C:\Users\Admin\AppData\Local\Temp\A1E.tmp"115⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\A5D.tmp"C:\Users\Admin\AppData\Local\Temp\A5D.tmp"116⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\A9B.tmp"C:\Users\Admin\AppData\Local\Temp\A9B.tmp"117⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\ADA.tmp"C:\Users\Admin\AppData\Local\Temp\ADA.tmp"118⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\B37.tmp"C:\Users\Admin\AppData\Local\Temp\B37.tmp"119⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\B76.tmp"C:\Users\Admin\AppData\Local\Temp\B76.tmp"120⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\BB4.tmp"C:\Users\Admin\AppData\Local\Temp\BB4.tmp"121⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\BF2.tmp"C:\Users\Admin\AppData\Local\Temp\BF2.tmp"122⤵PID:448
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-