Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
11/08/2024, 06:57
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-11_a490d889acfb26e8cffe9be8739677ec_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-08-11_a490d889acfb26e8cffe9be8739677ec_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-11_a490d889acfb26e8cffe9be8739677ec_mafia.exe
-
Size
765KB
-
MD5
a490d889acfb26e8cffe9be8739677ec
-
SHA1
142f295405f119718353987c0804d4a12f8f58ac
-
SHA256
588e09f81f82f26bc984b5604200b09731b3fdcc507dae609a0028de6acd9a64
-
SHA512
ab1191621a88c48ff3b5419a39a7a179550d46cfa9985aab5bae2ba69dc1da4f8338bbf938c9f1e46439b9584b408573e1cec5af1c31f09a70664214f12f93b6
-
SSDEEP
12288:ZU5rCOTeiDalcVd9ydxd+dImdfnOhw0dP3ZF5rn5rLOa54U5w5A:ZUQOJDIcpAd+dImd/OhZl3vh5Oa+UOS
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2276 D2BA.tmp 2472 D308.tmp 2492 D3A4.tmp 1736 D411.tmp 2628 D48E.tmp 2740 D4FB.tmp 2888 D568.tmp 2684 D5C6.tmp 2704 D643.tmp 2688 D691.tmp 2764 D6DF.tmp 2588 D75B.tmp 1328 D7D8.tmp 712 D836.tmp 1908 D8B3.tmp 2624 D92F.tmp 2424 D9AC.tmp 1916 DA19.tmp 324 DA96.tmp 2000 DB13.tmp 332 DB90.tmp 2824 DBED.tmp 1948 DC4B.tmp 2380 DC89.tmp 2944 DCD7.tmp 2056 DD16.tmp 2136 DD64.tmp 684 DDA2.tmp 2396 DDE1.tmp 1000 DE2F.tmp 2412 DE6D.tmp 1932 DEBB.tmp 1304 DEFA.tmp 1796 DF38.tmp 1668 DF76.tmp 1680 DFB5.tmp 916 DFF3.tmp 1564 E032.tmp 1720 E070.tmp 1232 E0AE.tmp 2420 E0ED.tmp 2180 E12B.tmp 1904 E16A.tmp 2044 E1A8.tmp 484 E1E6.tmp 1972 E225.tmp 3008 E263.tmp 1032 E2A2.tmp 924 E2E0.tmp 900 E32E.tmp 2924 E36C.tmp 2456 E3AB.tmp 1548 E3E9.tmp 860 E428.tmp 572 E466.tmp 2992 E4B4.tmp 2808 E4F2.tmp 2976 E531.tmp 2140 E56F.tmp 2672 E5AE.tmp 2756 E60B.tmp 2676 E64A.tmp 2532 E688.tmp 2668 E6C6.tmp -
Loads dropped DLL 64 IoCs
pid Process 2604 2024-08-11_a490d889acfb26e8cffe9be8739677ec_mafia.exe 2276 D2BA.tmp 2472 D308.tmp 2492 D3A4.tmp 1736 D411.tmp 2628 D48E.tmp 2740 D4FB.tmp 2888 D568.tmp 2684 D5C6.tmp 2704 D643.tmp 2688 D691.tmp 2764 D6DF.tmp 2588 D75B.tmp 1328 D7D8.tmp 712 D836.tmp 1908 D8B3.tmp 2624 D92F.tmp 2424 D9AC.tmp 1916 DA19.tmp 324 DA96.tmp 2000 DB13.tmp 332 DB90.tmp 2824 DBED.tmp 1948 DC4B.tmp 2380 DC89.tmp 2944 DCD7.tmp 2056 DD16.tmp 2136 DD64.tmp 684 DDA2.tmp 2396 DDE1.tmp 1000 DE2F.tmp 2412 DE6D.tmp 1932 DEBB.tmp 1304 DEFA.tmp 1796 DF38.tmp 1668 DF76.tmp 1680 DFB5.tmp 916 DFF3.tmp 1564 E032.tmp 1720 E070.tmp 1232 E0AE.tmp 2420 E0ED.tmp 2180 E12B.tmp 1904 E16A.tmp 2044 E1A8.tmp 484 E1E6.tmp 1972 E225.tmp 3008 E263.tmp 1032 E2A2.tmp 924 E2E0.tmp 900 E32E.tmp 2924 E36C.tmp 2456 E3AB.tmp 1548 E3E9.tmp 860 E428.tmp 572 E466.tmp 2992 E4B4.tmp 2808 E4F2.tmp 2976 E531.tmp 2140 E56F.tmp 2672 E5AE.tmp 2756 E60B.tmp 2676 E64A.tmp 2532 E688.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D75B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9647.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E531.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 166E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ECF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F373.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F72B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6087.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B903.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F00A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 722.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EADC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E4F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5918.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC4B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9943.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA32.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2604 wrote to memory of 2276 2604 2024-08-11_a490d889acfb26e8cffe9be8739677ec_mafia.exe 31 PID 2604 wrote to memory of 2276 2604 2024-08-11_a490d889acfb26e8cffe9be8739677ec_mafia.exe 31 PID 2604 wrote to memory of 2276 2604 2024-08-11_a490d889acfb26e8cffe9be8739677ec_mafia.exe 31 PID 2604 wrote to memory of 2276 2604 2024-08-11_a490d889acfb26e8cffe9be8739677ec_mafia.exe 31 PID 2276 wrote to memory of 2472 2276 D2BA.tmp 32 PID 2276 wrote to memory of 2472 2276 D2BA.tmp 32 PID 2276 wrote to memory of 2472 2276 D2BA.tmp 32 PID 2276 wrote to memory of 2472 2276 D2BA.tmp 32 PID 2472 wrote to memory of 2492 2472 D308.tmp 33 PID 2472 wrote to memory of 2492 2472 D308.tmp 33 PID 2472 wrote to memory of 2492 2472 D308.tmp 33 PID 2472 wrote to memory of 2492 2472 D308.tmp 33 PID 2492 wrote to memory of 1736 2492 D3A4.tmp 34 PID 2492 wrote to memory of 1736 2492 D3A4.tmp 34 PID 2492 wrote to memory of 1736 2492 D3A4.tmp 34 PID 2492 wrote to memory of 1736 2492 D3A4.tmp 34 PID 1736 wrote to memory of 2628 1736 D411.tmp 35 PID 1736 wrote to memory of 2628 1736 D411.tmp 35 PID 1736 wrote to memory of 2628 1736 D411.tmp 35 PID 1736 wrote to memory of 2628 1736 D411.tmp 35 PID 2628 wrote to memory of 2740 2628 D48E.tmp 36 PID 2628 wrote to memory of 2740 2628 D48E.tmp 36 PID 2628 wrote to memory of 2740 2628 D48E.tmp 36 PID 2628 wrote to memory of 2740 2628 D48E.tmp 36 PID 2740 wrote to memory of 2888 2740 D4FB.tmp 37 PID 2740 wrote to memory of 2888 2740 D4FB.tmp 37 PID 2740 wrote to memory of 2888 2740 D4FB.tmp 37 PID 2740 wrote to memory of 2888 2740 D4FB.tmp 37 PID 2888 wrote to memory of 2684 2888 D568.tmp 38 PID 2888 wrote to memory of 2684 2888 D568.tmp 38 PID 2888 wrote to memory of 2684 2888 D568.tmp 38 PID 2888 wrote to memory of 2684 2888 D568.tmp 38 PID 2684 wrote to memory of 2704 2684 D5C6.tmp 39 PID 2684 wrote to memory of 2704 2684 D5C6.tmp 39 PID 2684 wrote to memory of 2704 2684 D5C6.tmp 39 PID 2684 wrote to memory of 2704 2684 D5C6.tmp 39 PID 2704 wrote to memory of 2688 2704 D643.tmp 40 PID 2704 wrote to memory of 2688 2704 D643.tmp 40 PID 2704 wrote to memory of 2688 2704 D643.tmp 40 PID 2704 wrote to memory of 2688 2704 D643.tmp 40 PID 2688 wrote to memory of 2764 2688 D691.tmp 41 PID 2688 wrote to memory of 2764 2688 D691.tmp 41 PID 2688 wrote to memory of 2764 2688 D691.tmp 41 PID 2688 wrote to memory of 2764 2688 D691.tmp 41 PID 2764 wrote to memory of 2588 2764 D6DF.tmp 42 PID 2764 wrote to memory of 2588 2764 D6DF.tmp 42 PID 2764 wrote to memory of 2588 2764 D6DF.tmp 42 PID 2764 wrote to memory of 2588 2764 D6DF.tmp 42 PID 2588 wrote to memory of 1328 2588 D75B.tmp 43 PID 2588 wrote to memory of 1328 2588 D75B.tmp 43 PID 2588 wrote to memory of 1328 2588 D75B.tmp 43 PID 2588 wrote to memory of 1328 2588 D75B.tmp 43 PID 1328 wrote to memory of 712 1328 D7D8.tmp 44 PID 1328 wrote to memory of 712 1328 D7D8.tmp 44 PID 1328 wrote to memory of 712 1328 D7D8.tmp 44 PID 1328 wrote to memory of 712 1328 D7D8.tmp 44 PID 712 wrote to memory of 1908 712 D836.tmp 45 PID 712 wrote to memory of 1908 712 D836.tmp 45 PID 712 wrote to memory of 1908 712 D836.tmp 45 PID 712 wrote to memory of 1908 712 D836.tmp 45 PID 1908 wrote to memory of 2624 1908 D8B3.tmp 46 PID 1908 wrote to memory of 2624 1908 D8B3.tmp 46 PID 1908 wrote to memory of 2624 1908 D8B3.tmp 46 PID 1908 wrote to memory of 2624 1908 D8B3.tmp 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-11_a490d889acfb26e8cffe9be8739677ec_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-11_a490d889acfb26e8cffe9be8739677ec_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\D2BA.tmp"C:\Users\Admin\AppData\Local\Temp\D2BA.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\D308.tmp"C:\Users\Admin\AppData\Local\Temp\D308.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\D3A4.tmp"C:\Users\Admin\AppData\Local\Temp\D3A4.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\D411.tmp"C:\Users\Admin\AppData\Local\Temp\D411.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\D48E.tmp"C:\Users\Admin\AppData\Local\Temp\D48E.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\D4FB.tmp"C:\Users\Admin\AppData\Local\Temp\D4FB.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\D568.tmp"C:\Users\Admin\AppData\Local\Temp\D568.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\D5C6.tmp"C:\Users\Admin\AppData\Local\Temp\D5C6.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\D643.tmp"C:\Users\Admin\AppData\Local\Temp\D643.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\D691.tmp"C:\Users\Admin\AppData\Local\Temp\D691.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\D6DF.tmp"C:\Users\Admin\AppData\Local\Temp\D6DF.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\D75B.tmp"C:\Users\Admin\AppData\Local\Temp\D75B.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\D7D8.tmp"C:\Users\Admin\AppData\Local\Temp\D7D8.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\D836.tmp"C:\Users\Admin\AppData\Local\Temp\D836.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Users\Admin\AppData\Local\Temp\D8B3.tmp"C:\Users\Admin\AppData\Local\Temp\D8B3.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\D92F.tmp"C:\Users\Admin\AppData\Local\Temp\D92F.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\D9AC.tmp"C:\Users\Admin\AppData\Local\Temp\D9AC.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\DA19.tmp"C:\Users\Admin\AppData\Local\Temp\DA19.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\DA96.tmp"C:\Users\Admin\AppData\Local\Temp\DA96.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:324 -
C:\Users\Admin\AppData\Local\Temp\DB13.tmp"C:\Users\Admin\AppData\Local\Temp\DB13.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\DB90.tmp"C:\Users\Admin\AppData\Local\Temp\DB90.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:332 -
C:\Users\Admin\AppData\Local\Temp\DBED.tmp"C:\Users\Admin\AppData\Local\Temp\DBED.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\DC4B.tmp"C:\Users\Admin\AppData\Local\Temp\DC4B.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\DC89.tmp"C:\Users\Admin\AppData\Local\Temp\DC89.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\DCD7.tmp"C:\Users\Admin\AppData\Local\Temp\DCD7.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\DD16.tmp"C:\Users\Admin\AppData\Local\Temp\DD16.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\DD64.tmp"C:\Users\Admin\AppData\Local\Temp\DD64.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\DDA2.tmp"C:\Users\Admin\AppData\Local\Temp\DDA2.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:684 -
C:\Users\Admin\AppData\Local\Temp\DDE1.tmp"C:\Users\Admin\AppData\Local\Temp\DDE1.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\DE2F.tmp"C:\Users\Admin\AppData\Local\Temp\DE2F.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\DE6D.tmp"C:\Users\Admin\AppData\Local\Temp\DE6D.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\DEBB.tmp"C:\Users\Admin\AppData\Local\Temp\DEBB.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\DEFA.tmp"C:\Users\Admin\AppData\Local\Temp\DEFA.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\DF38.tmp"C:\Users\Admin\AppData\Local\Temp\DF38.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\DF76.tmp"C:\Users\Admin\AppData\Local\Temp\DF76.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\DFB5.tmp"C:\Users\Admin\AppData\Local\Temp\DFB5.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\DFF3.tmp"C:\Users\Admin\AppData\Local\Temp\DFF3.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:916 -
C:\Users\Admin\AppData\Local\Temp\E032.tmp"C:\Users\Admin\AppData\Local\Temp\E032.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\E070.tmp"C:\Users\Admin\AppData\Local\Temp\E070.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\E0AE.tmp"C:\Users\Admin\AppData\Local\Temp\E0AE.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\E0ED.tmp"C:\Users\Admin\AppData\Local\Temp\E0ED.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\E12B.tmp"C:\Users\Admin\AppData\Local\Temp\E12B.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\E16A.tmp"C:\Users\Admin\AppData\Local\Temp\E16A.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\E1A8.tmp"C:\Users\Admin\AppData\Local\Temp\E1A8.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\E1E6.tmp"C:\Users\Admin\AppData\Local\Temp\E1E6.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:484 -
C:\Users\Admin\AppData\Local\Temp\E225.tmp"C:\Users\Admin\AppData\Local\Temp\E225.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\E263.tmp"C:\Users\Admin\AppData\Local\Temp\E263.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\E2A2.tmp"C:\Users\Admin\AppData\Local\Temp\E2A2.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\E2E0.tmp"C:\Users\Admin\AppData\Local\Temp\E2E0.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:924 -
C:\Users\Admin\AppData\Local\Temp\E32E.tmp"C:\Users\Admin\AppData\Local\Temp\E32E.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:900 -
C:\Users\Admin\AppData\Local\Temp\E36C.tmp"C:\Users\Admin\AppData\Local\Temp\E36C.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\E3AB.tmp"C:\Users\Admin\AppData\Local\Temp\E3AB.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\E3E9.tmp"C:\Users\Admin\AppData\Local\Temp\E3E9.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\E428.tmp"C:\Users\Admin\AppData\Local\Temp\E428.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:860 -
C:\Users\Admin\AppData\Local\Temp\E466.tmp"C:\Users\Admin\AppData\Local\Temp\E466.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:572 -
C:\Users\Admin\AppData\Local\Temp\E4B4.tmp"C:\Users\Admin\AppData\Local\Temp\E4B4.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\E4F2.tmp"C:\Users\Admin\AppData\Local\Temp\E4F2.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\E531.tmp"C:\Users\Admin\AppData\Local\Temp\E531.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\E56F.tmp"C:\Users\Admin\AppData\Local\Temp\E56F.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\E5AE.tmp"C:\Users\Admin\AppData\Local\Temp\E5AE.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\E60B.tmp"C:\Users\Admin\AppData\Local\Temp\E60B.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\E64A.tmp"C:\Users\Admin\AppData\Local\Temp\E64A.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\E688.tmp"C:\Users\Admin\AppData\Local\Temp\E688.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\E6C6.tmp"C:\Users\Admin\AppData\Local\Temp\E6C6.tmp"65⤵
- Executes dropped EXE
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\E705.tmp"C:\Users\Admin\AppData\Local\Temp\E705.tmp"66⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\E743.tmp"C:\Users\Admin\AppData\Local\Temp\E743.tmp"67⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\E782.tmp"C:\Users\Admin\AppData\Local\Temp\E782.tmp"68⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\E7D0.tmp"C:\Users\Admin\AppData\Local\Temp\E7D0.tmp"69⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\E80E.tmp"C:\Users\Admin\AppData\Local\Temp\E80E.tmp"70⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\E84C.tmp"C:\Users\Admin\AppData\Local\Temp\E84C.tmp"71⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\E89A.tmp"C:\Users\Admin\AppData\Local\Temp\E89A.tmp"72⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"73⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\E917.tmp"C:\Users\Admin\AppData\Local\Temp\E917.tmp"74⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\E956.tmp"C:\Users\Admin\AppData\Local\Temp\E956.tmp"75⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\E994.tmp"C:\Users\Admin\AppData\Local\Temp\E994.tmp"76⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\E9D2.tmp"C:\Users\Admin\AppData\Local\Temp\E9D2.tmp"77⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\EA11.tmp"C:\Users\Admin\AppData\Local\Temp\EA11.tmp"78⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\EA4F.tmp"C:\Users\Admin\AppData\Local\Temp\EA4F.tmp"79⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\EA8E.tmp"C:\Users\Admin\AppData\Local\Temp\EA8E.tmp"80⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\EADC.tmp"C:\Users\Admin\AppData\Local\Temp\EADC.tmp"81⤵
- System Location Discovery: System Language Discovery
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\EB1A.tmp"C:\Users\Admin\AppData\Local\Temp\EB1A.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\EB58.tmp"C:\Users\Admin\AppData\Local\Temp\EB58.tmp"83⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\EBA6.tmp"C:\Users\Admin\AppData\Local\Temp\EBA6.tmp"84⤵PID:352
-
C:\Users\Admin\AppData\Local\Temp\EBE5.tmp"C:\Users\Admin\AppData\Local\Temp\EBE5.tmp"85⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\EC23.tmp"C:\Users\Admin\AppData\Local\Temp\EC23.tmp"86⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\EC71.tmp"C:\Users\Admin\AppData\Local\Temp\EC71.tmp"87⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\ECB0.tmp"C:\Users\Admin\AppData\Local\Temp\ECB0.tmp"88⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\ECEE.tmp"C:\Users\Admin\AppData\Local\Temp\ECEE.tmp"89⤵
- System Location Discovery: System Language Discovery
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\ED2C.tmp"C:\Users\Admin\AppData\Local\Temp\ED2C.tmp"90⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\ED6B.tmp"C:\Users\Admin\AppData\Local\Temp\ED6B.tmp"91⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\EDA9.tmp"C:\Users\Admin\AppData\Local\Temp\EDA9.tmp"92⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\EDE8.tmp"C:\Users\Admin\AppData\Local\Temp\EDE8.tmp"93⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\EE26.tmp"C:\Users\Admin\AppData\Local\Temp\EE26.tmp"94⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\EE74.tmp"C:\Users\Admin\AppData\Local\Temp\EE74.tmp"95⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\EEB2.tmp"C:\Users\Admin\AppData\Local\Temp\EEB2.tmp"96⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\EF00.tmp"C:\Users\Admin\AppData\Local\Temp\EF00.tmp"97⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\EF3F.tmp"C:\Users\Admin\AppData\Local\Temp\EF3F.tmp"98⤵
- System Location Discovery: System Language Discovery
PID:696 -
C:\Users\Admin\AppData\Local\Temp\EF8D.tmp"C:\Users\Admin\AppData\Local\Temp\EF8D.tmp"99⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\EFCB.tmp"C:\Users\Admin\AppData\Local\Temp\EFCB.tmp"100⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\F00A.tmp"C:\Users\Admin\AppData\Local\Temp\F00A.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:804 -
C:\Users\Admin\AppData\Local\Temp\F048.tmp"C:\Users\Admin\AppData\Local\Temp\F048.tmp"102⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\F086.tmp"C:\Users\Admin\AppData\Local\Temp\F086.tmp"103⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\F0C5.tmp"C:\Users\Admin\AppData\Local\Temp\F0C5.tmp"104⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\F103.tmp"C:\Users\Admin\AppData\Local\Temp\F103.tmp"105⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\F142.tmp"C:\Users\Admin\AppData\Local\Temp\F142.tmp"106⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\F180.tmp"C:\Users\Admin\AppData\Local\Temp\F180.tmp"107⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\F1BE.tmp"C:\Users\Admin\AppData\Local\Temp\F1BE.tmp"108⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\F1FD.tmp"C:\Users\Admin\AppData\Local\Temp\F1FD.tmp"109⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\F23B.tmp"C:\Users\Admin\AppData\Local\Temp\F23B.tmp"110⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\F27A.tmp"C:\Users\Admin\AppData\Local\Temp\F27A.tmp"111⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\F2B8.tmp"C:\Users\Admin\AppData\Local\Temp\F2B8.tmp"112⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\F2F6.tmp"C:\Users\Admin\AppData\Local\Temp\F2F6.tmp"113⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\F335.tmp"C:\Users\Admin\AppData\Local\Temp\F335.tmp"114⤵PID:108
-
C:\Users\Admin\AppData\Local\Temp\F373.tmp"C:\Users\Admin\AppData\Local\Temp\F373.tmp"115⤵
- System Location Discovery: System Language Discovery
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\F3B2.tmp"C:\Users\Admin\AppData\Local\Temp\F3B2.tmp"116⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\F3F0.tmp"C:\Users\Admin\AppData\Local\Temp\F3F0.tmp"117⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\F43E.tmp"C:\Users\Admin\AppData\Local\Temp\F43E.tmp"118⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\F47C.tmp"C:\Users\Admin\AppData\Local\Temp\F47C.tmp"119⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\F4BB.tmp"C:\Users\Admin\AppData\Local\Temp\F4BB.tmp"120⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\F4F9.tmp"C:\Users\Admin\AppData\Local\Temp\F4F9.tmp"121⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\F547.tmp"C:\Users\Admin\AppData\Local\Temp\F547.tmp"122⤵PID:2808
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-