Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
09-08-2024 21:23
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-09_bcaf2eb511a49994fae4f36efdd1fb4c_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-08-09_bcaf2eb511a49994fae4f36efdd1fb4c_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-09_bcaf2eb511a49994fae4f36efdd1fb4c_mafia.exe
-
Size
488KB
-
MD5
bcaf2eb511a49994fae4f36efdd1fb4c
-
SHA1
6448a24a606f7f257318c1fe0b514ad9a4718a3c
-
SHA256
b07c610bf652d1864f18763ba06c5b06af8fcdfb2e318b3566b3558fe27f484a
-
SHA512
c266b0fb4ca8dc9c309d4d593e2d09ecbe3e0f998e48899105675a8935971275a5196e2303993f12fb59c239380feb444aea450f957ed3a26cca7bf00f24f019
-
SSDEEP
12288:/U5rCOTeiD8rnVMSO+e/vJ1tQINK7EZ/dKc4m4NZ:/UQOJDOMSPe/vJ1YEuDm4N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1812 A747.tmp 2200 A7D3.tmp 804 A88F.tmp 2792 A90B.tmp 2804 A998.tmp 3032 AA34.tmp 2248 AAB1.tmp 2316 AB4D.tmp 2644 ABAA.tmp 2884 AC46.tmp 2664 AC85.tmp 2652 AD01.tmp 1680 AD7E.tmp 2044 AE1A.tmp 1364 AEA7.tmp 2984 AF43.tmp 1636 AF91.tmp 2920 B01D.tmp 540 B06B.tmp 2668 B0D8.tmp 340 B165.tmp 1052 B1D2.tmp 1152 B22F.tmp 2348 B27D.tmp 2340 B2CB.tmp 1456 B30A.tmp 2424 B358.tmp 1688 B396.tmp 2120 B3D5.tmp 700 B413.tmp 2180 B451.tmp 1912 B490.tmp 3044 B4CE.tmp 2924 B50D.tmp 1860 B55B.tmp 1620 B5A9.tmp 2328 B5F7.tmp 836 B635.tmp 1628 B673.tmp 2504 B6C1.tmp 1540 B700.tmp 1100 B73E.tmp 2252 B78C.tmp 2276 B7DA.tmp 864 B819.tmp 1712 B867.tmp 2056 B8A5.tmp 292 B8E3.tmp 376 B922.tmp 1036 B970.tmp 1280 B9AE.tmp 1668 BA0C.tmp 1604 BA5A.tmp 1292 BA98.tmp 3008 BAE6.tmp 2896 BB34.tmp 1708 BB73.tmp 1640 BBB1.tmp 2472 BBEF.tmp 2820 BC2E.tmp 2832 BC7C.tmp 2764 BCBA.tmp 2324 BD08.tmp 2712 BD47.tmp -
Loads dropped DLL 64 IoCs
pid Process 3068 2024-08-09_bcaf2eb511a49994fae4f36efdd1fb4c_mafia.exe 1812 A747.tmp 2200 A7D3.tmp 804 A88F.tmp 2792 A90B.tmp 2804 A998.tmp 3032 AA34.tmp 2248 AAB1.tmp 2316 AB4D.tmp 2644 ABAA.tmp 2884 AC46.tmp 2664 AC85.tmp 2652 AD01.tmp 1680 AD7E.tmp 2044 AE1A.tmp 1364 AEA7.tmp 2984 AF43.tmp 1636 AF91.tmp 2920 B01D.tmp 540 B06B.tmp 2668 B0D8.tmp 340 B165.tmp 1052 B1D2.tmp 1152 B22F.tmp 2348 B27D.tmp 2340 B2CB.tmp 1456 B30A.tmp 2424 B358.tmp 1688 B396.tmp 2120 B3D5.tmp 700 B413.tmp 2180 B451.tmp 1912 B490.tmp 3044 B4CE.tmp 2924 B50D.tmp 1860 B55B.tmp 1620 B5A9.tmp 2328 B5F7.tmp 836 B635.tmp 1628 B673.tmp 2504 B6C1.tmp 1540 B700.tmp 1100 B73E.tmp 2252 B78C.tmp 2276 B7DA.tmp 864 B819.tmp 1712 B867.tmp 2056 B8A5.tmp 292 B8E3.tmp 376 B922.tmp 1036 B970.tmp 1280 B9AE.tmp 1668 BA0C.tmp 1604 BA5A.tmp 1292 BA98.tmp 3008 BAE6.tmp 2896 BB34.tmp 1708 BB73.tmp 1640 BBB1.tmp 2472 BBEF.tmp 2820 BC2E.tmp 2832 BC7C.tmp 2764 BCBA.tmp 2324 BD08.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB68.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C5AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1120.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCCA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E57F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1258.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4682.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5FBD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A959.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C311.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C919.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 197A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 252.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E35D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBF4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F7C.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3068 wrote to memory of 1812 3068 2024-08-09_bcaf2eb511a49994fae4f36efdd1fb4c_mafia.exe 30 PID 3068 wrote to memory of 1812 3068 2024-08-09_bcaf2eb511a49994fae4f36efdd1fb4c_mafia.exe 30 PID 3068 wrote to memory of 1812 3068 2024-08-09_bcaf2eb511a49994fae4f36efdd1fb4c_mafia.exe 30 PID 3068 wrote to memory of 1812 3068 2024-08-09_bcaf2eb511a49994fae4f36efdd1fb4c_mafia.exe 30 PID 1812 wrote to memory of 2200 1812 A747.tmp 31 PID 1812 wrote to memory of 2200 1812 A747.tmp 31 PID 1812 wrote to memory of 2200 1812 A747.tmp 31 PID 1812 wrote to memory of 2200 1812 A747.tmp 31 PID 2200 wrote to memory of 804 2200 A7D3.tmp 32 PID 2200 wrote to memory of 804 2200 A7D3.tmp 32 PID 2200 wrote to memory of 804 2200 A7D3.tmp 32 PID 2200 wrote to memory of 804 2200 A7D3.tmp 32 PID 804 wrote to memory of 2792 804 A88F.tmp 33 PID 804 wrote to memory of 2792 804 A88F.tmp 33 PID 804 wrote to memory of 2792 804 A88F.tmp 33 PID 804 wrote to memory of 2792 804 A88F.tmp 33 PID 2792 wrote to memory of 2804 2792 A90B.tmp 34 PID 2792 wrote to memory of 2804 2792 A90B.tmp 34 PID 2792 wrote to memory of 2804 2792 A90B.tmp 34 PID 2792 wrote to memory of 2804 2792 A90B.tmp 34 PID 2804 wrote to memory of 3032 2804 A998.tmp 35 PID 2804 wrote to memory of 3032 2804 A998.tmp 35 PID 2804 wrote to memory of 3032 2804 A998.tmp 35 PID 2804 wrote to memory of 3032 2804 A998.tmp 35 PID 3032 wrote to memory of 2248 3032 AA34.tmp 36 PID 3032 wrote to memory of 2248 3032 AA34.tmp 36 PID 3032 wrote to memory of 2248 3032 AA34.tmp 36 PID 3032 wrote to memory of 2248 3032 AA34.tmp 36 PID 2248 wrote to memory of 2316 2248 AAB1.tmp 37 PID 2248 wrote to memory of 2316 2248 AAB1.tmp 37 PID 2248 wrote to memory of 2316 2248 AAB1.tmp 37 PID 2248 wrote to memory of 2316 2248 AAB1.tmp 37 PID 2316 wrote to memory of 2644 2316 AB4D.tmp 38 PID 2316 wrote to memory of 2644 2316 AB4D.tmp 38 PID 2316 wrote to memory of 2644 2316 AB4D.tmp 38 PID 2316 wrote to memory of 2644 2316 AB4D.tmp 38 PID 2644 wrote to memory of 2884 2644 ABAA.tmp 39 PID 2644 wrote to memory of 2884 2644 ABAA.tmp 39 PID 2644 wrote to memory of 2884 2644 ABAA.tmp 39 PID 2644 wrote to memory of 2884 2644 ABAA.tmp 39 PID 2884 wrote to memory of 2664 2884 AC46.tmp 40 PID 2884 wrote to memory of 2664 2884 AC46.tmp 40 PID 2884 wrote to memory of 2664 2884 AC46.tmp 40 PID 2884 wrote to memory of 2664 2884 AC46.tmp 40 PID 2664 wrote to memory of 2652 2664 AC85.tmp 41 PID 2664 wrote to memory of 2652 2664 AC85.tmp 41 PID 2664 wrote to memory of 2652 2664 AC85.tmp 41 PID 2664 wrote to memory of 2652 2664 AC85.tmp 41 PID 2652 wrote to memory of 1680 2652 AD01.tmp 42 PID 2652 wrote to memory of 1680 2652 AD01.tmp 42 PID 2652 wrote to memory of 1680 2652 AD01.tmp 42 PID 2652 wrote to memory of 1680 2652 AD01.tmp 42 PID 1680 wrote to memory of 2044 1680 AD7E.tmp 43 PID 1680 wrote to memory of 2044 1680 AD7E.tmp 43 PID 1680 wrote to memory of 2044 1680 AD7E.tmp 43 PID 1680 wrote to memory of 2044 1680 AD7E.tmp 43 PID 2044 wrote to memory of 1364 2044 AE1A.tmp 44 PID 2044 wrote to memory of 1364 2044 AE1A.tmp 44 PID 2044 wrote to memory of 1364 2044 AE1A.tmp 44 PID 2044 wrote to memory of 1364 2044 AE1A.tmp 44 PID 1364 wrote to memory of 2984 1364 AEA7.tmp 45 PID 1364 wrote to memory of 2984 1364 AEA7.tmp 45 PID 1364 wrote to memory of 2984 1364 AEA7.tmp 45 PID 1364 wrote to memory of 2984 1364 AEA7.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-09_bcaf2eb511a49994fae4f36efdd1fb4c_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-09_bcaf2eb511a49994fae4f36efdd1fb4c_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\A747.tmp"C:\Users\Admin\AppData\Local\Temp\A747.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\A7D3.tmp"C:\Users\Admin\AppData\Local\Temp\A7D3.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\A88F.tmp"C:\Users\Admin\AppData\Local\Temp\A88F.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Users\Admin\AppData\Local\Temp\A90B.tmp"C:\Users\Admin\AppData\Local\Temp\A90B.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\A998.tmp"C:\Users\Admin\AppData\Local\Temp\A998.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\AA34.tmp"C:\Users\Admin\AppData\Local\Temp\AA34.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\AAB1.tmp"C:\Users\Admin\AppData\Local\Temp\AAB1.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\AB4D.tmp"C:\Users\Admin\AppData\Local\Temp\AB4D.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\ABAA.tmp"C:\Users\Admin\AppData\Local\Temp\ABAA.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\AC46.tmp"C:\Users\Admin\AppData\Local\Temp\AC46.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\AC85.tmp"C:\Users\Admin\AppData\Local\Temp\AC85.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\AD01.tmp"C:\Users\Admin\AppData\Local\Temp\AD01.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\AD7E.tmp"C:\Users\Admin\AppData\Local\Temp\AD7E.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\AE1A.tmp"C:\Users\Admin\AppData\Local\Temp\AE1A.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\AEA7.tmp"C:\Users\Admin\AppData\Local\Temp\AEA7.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\AF43.tmp"C:\Users\Admin\AppData\Local\Temp\AF43.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\AF91.tmp"C:\Users\Admin\AppData\Local\Temp\AF91.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\B01D.tmp"C:\Users\Admin\AppData\Local\Temp\B01D.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\B06B.tmp"C:\Users\Admin\AppData\Local\Temp\B06B.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:540 -
C:\Users\Admin\AppData\Local\Temp\B0D8.tmp"C:\Users\Admin\AppData\Local\Temp\B0D8.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\B165.tmp"C:\Users\Admin\AppData\Local\Temp\B165.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:340 -
C:\Users\Admin\AppData\Local\Temp\B1D2.tmp"C:\Users\Admin\AppData\Local\Temp\B1D2.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\B22F.tmp"C:\Users\Admin\AppData\Local\Temp\B22F.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\B27D.tmp"C:\Users\Admin\AppData\Local\Temp\B27D.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\B2CB.tmp"C:\Users\Admin\AppData\Local\Temp\B2CB.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\B30A.tmp"C:\Users\Admin\AppData\Local\Temp\B30A.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\B358.tmp"C:\Users\Admin\AppData\Local\Temp\B358.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\B396.tmp"C:\Users\Admin\AppData\Local\Temp\B396.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\B3D5.tmp"C:\Users\Admin\AppData\Local\Temp\B3D5.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\B413.tmp"C:\Users\Admin\AppData\Local\Temp\B413.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:700 -
C:\Users\Admin\AppData\Local\Temp\B451.tmp"C:\Users\Admin\AppData\Local\Temp\B451.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\B490.tmp"C:\Users\Admin\AppData\Local\Temp\B490.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\B4CE.tmp"C:\Users\Admin\AppData\Local\Temp\B4CE.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\B50D.tmp"C:\Users\Admin\AppData\Local\Temp\B50D.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\B55B.tmp"C:\Users\Admin\AppData\Local\Temp\B55B.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\B5A9.tmp"C:\Users\Admin\AppData\Local\Temp\B5A9.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\B5F7.tmp"C:\Users\Admin\AppData\Local\Temp\B5F7.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\B635.tmp"C:\Users\Admin\AppData\Local\Temp\B635.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:836 -
C:\Users\Admin\AppData\Local\Temp\B673.tmp"C:\Users\Admin\AppData\Local\Temp\B673.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\B6C1.tmp"C:\Users\Admin\AppData\Local\Temp\B6C1.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\B700.tmp"C:\Users\Admin\AppData\Local\Temp\B700.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\B73E.tmp"C:\Users\Admin\AppData\Local\Temp\B73E.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\B78C.tmp"C:\Users\Admin\AppData\Local\Temp\B78C.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\B7DA.tmp"C:\Users\Admin\AppData\Local\Temp\B7DA.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\B819.tmp"C:\Users\Admin\AppData\Local\Temp\B819.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:864 -
C:\Users\Admin\AppData\Local\Temp\B867.tmp"C:\Users\Admin\AppData\Local\Temp\B867.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\B8A5.tmp"C:\Users\Admin\AppData\Local\Temp\B8A5.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\B8E3.tmp"C:\Users\Admin\AppData\Local\Temp\B8E3.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:292 -
C:\Users\Admin\AppData\Local\Temp\B922.tmp"C:\Users\Admin\AppData\Local\Temp\B922.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:376 -
C:\Users\Admin\AppData\Local\Temp\B970.tmp"C:\Users\Admin\AppData\Local\Temp\B970.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\B9AE.tmp"C:\Users\Admin\AppData\Local\Temp\B9AE.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\BA0C.tmp"C:\Users\Admin\AppData\Local\Temp\BA0C.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\BA5A.tmp"C:\Users\Admin\AppData\Local\Temp\BA5A.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\BA98.tmp"C:\Users\Admin\AppData\Local\Temp\BA98.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\BAE6.tmp"C:\Users\Admin\AppData\Local\Temp\BAE6.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\BB34.tmp"C:\Users\Admin\AppData\Local\Temp\BB34.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\BB73.tmp"C:\Users\Admin\AppData\Local\Temp\BB73.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\BBB1.tmp"C:\Users\Admin\AppData\Local\Temp\BBB1.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\BBEF.tmp"C:\Users\Admin\AppData\Local\Temp\BBEF.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\BC2E.tmp"C:\Users\Admin\AppData\Local\Temp\BC2E.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\BC7C.tmp"C:\Users\Admin\AppData\Local\Temp\BC7C.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\BCBA.tmp"C:\Users\Admin\AppData\Local\Temp\BCBA.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\BD08.tmp"C:\Users\Admin\AppData\Local\Temp\BD08.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\BD47.tmp"C:\Users\Admin\AppData\Local\Temp\BD47.tmp"65⤵
- Executes dropped EXE
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\BD95.tmp"C:\Users\Admin\AppData\Local\Temp\BD95.tmp"66⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\BDE3.tmp"C:\Users\Admin\AppData\Local\Temp\BDE3.tmp"67⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\BE31.tmp"C:\Users\Admin\AppData\Local\Temp\BE31.tmp"68⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\BE7F.tmp"C:\Users\Admin\AppData\Local\Temp\BE7F.tmp"69⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\BEBD.tmp"C:\Users\Admin\AppData\Local\Temp\BEBD.tmp"70⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\BF0B.tmp"C:\Users\Admin\AppData\Local\Temp\BF0B.tmp"71⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\BF49.tmp"C:\Users\Admin\AppData\Local\Temp\BF49.tmp"72⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\BF88.tmp"C:\Users\Admin\AppData\Local\Temp\BF88.tmp"73⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"74⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\C005.tmp"C:\Users\Admin\AppData\Local\Temp\C005.tmp"75⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\C053.tmp"C:\Users\Admin\AppData\Local\Temp\C053.tmp"76⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\C091.tmp"C:\Users\Admin\AppData\Local\Temp\C091.tmp"77⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"78⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\C10E.tmp"C:\Users\Admin\AppData\Local\Temp\C10E.tmp"79⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\C15C.tmp"C:\Users\Admin\AppData\Local\Temp\C15C.tmp"80⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\C19A.tmp"C:\Users\Admin\AppData\Local\Temp\C19A.tmp"81⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"82⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\C217.tmp"C:\Users\Admin\AppData\Local\Temp\C217.tmp"83⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\C255.tmp"C:\Users\Admin\AppData\Local\Temp\C255.tmp"84⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\C294.tmp"C:\Users\Admin\AppData\Local\Temp\C294.tmp"85⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\C2D2.tmp"C:\Users\Admin\AppData\Local\Temp\C2D2.tmp"86⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\C311.tmp"C:\Users\Admin\AppData\Local\Temp\C311.tmp"87⤵
- System Location Discovery: System Language Discovery
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\C34F.tmp"C:\Users\Admin\AppData\Local\Temp\C34F.tmp"88⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\C39D.tmp"C:\Users\Admin\AppData\Local\Temp\C39D.tmp"89⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\C3DB.tmp"C:\Users\Admin\AppData\Local\Temp\C3DB.tmp"90⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\C429.tmp"C:\Users\Admin\AppData\Local\Temp\C429.tmp"91⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\C487.tmp"C:\Users\Admin\AppData\Local\Temp\C487.tmp"92⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\C4C5.tmp"C:\Users\Admin\AppData\Local\Temp\C4C5.tmp"93⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\C513.tmp"C:\Users\Admin\AppData\Local\Temp\C513.tmp"94⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\C561.tmp"C:\Users\Admin\AppData\Local\Temp\C561.tmp"95⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\C5AF.tmp"C:\Users\Admin\AppData\Local\Temp\C5AF.tmp"96⤵
- System Location Discovery: System Language Discovery
PID:700 -
C:\Users\Admin\AppData\Local\Temp\C5EE.tmp"C:\Users\Admin\AppData\Local\Temp\C5EE.tmp"97⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\C62C.tmp"C:\Users\Admin\AppData\Local\Temp\C62C.tmp"98⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\C66B.tmp"C:\Users\Admin\AppData\Local\Temp\C66B.tmp"99⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\C6B9.tmp"C:\Users\Admin\AppData\Local\Temp\C6B9.tmp"100⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\C6F7.tmp"C:\Users\Admin\AppData\Local\Temp\C6F7.tmp"101⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\C745.tmp"C:\Users\Admin\AppData\Local\Temp\C745.tmp"102⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\C793.tmp"C:\Users\Admin\AppData\Local\Temp\C793.tmp"103⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\C7D1.tmp"C:\Users\Admin\AppData\Local\Temp\C7D1.tmp"104⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\C81F.tmp"C:\Users\Admin\AppData\Local\Temp\C81F.tmp"105⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\C86D.tmp"C:\Users\Admin\AppData\Local\Temp\C86D.tmp"106⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\C8CB.tmp"C:\Users\Admin\AppData\Local\Temp\C8CB.tmp"107⤵
- System Location Discovery: System Language Discovery
PID:564 -
C:\Users\Admin\AppData\Local\Temp\C919.tmp"C:\Users\Admin\AppData\Local\Temp\C919.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\C957.tmp"C:\Users\Admin\AppData\Local\Temp\C957.tmp"109⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\C9A5.tmp"C:\Users\Admin\AppData\Local\Temp\C9A5.tmp"110⤵PID:344
-
C:\Users\Admin\AppData\Local\Temp\C9F3.tmp"C:\Users\Admin\AppData\Local\Temp\C9F3.tmp"111⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\CA41.tmp"C:\Users\Admin\AppData\Local\Temp\CA41.tmp"112⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\CA80.tmp"C:\Users\Admin\AppData\Local\Temp\CA80.tmp"113⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\CABE.tmp"C:\Users\Admin\AppData\Local\Temp\CABE.tmp"114⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\CAFD.tmp"C:\Users\Admin\AppData\Local\Temp\CAFD.tmp"115⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\CB3B.tmp"C:\Users\Admin\AppData\Local\Temp\CB3B.tmp"116⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\CB79.tmp"C:\Users\Admin\AppData\Local\Temp\CB79.tmp"117⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\CBC7.tmp"C:\Users\Admin\AppData\Local\Temp\CBC7.tmp"118⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\CC06.tmp"C:\Users\Admin\AppData\Local\Temp\CC06.tmp"119⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\CC44.tmp"C:\Users\Admin\AppData\Local\Temp\CC44.tmp"120⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\CC83.tmp"C:\Users\Admin\AppData\Local\Temp\CC83.tmp"121⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\CCC1.tmp"C:\Users\Admin\AppData\Local\Temp\CCC1.tmp"122⤵PID:1976
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-