Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
12/08/2024, 00:50
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-12_46c48aa8d21d85ea975a0f68c5b5c3bc_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-08-12_46c48aa8d21d85ea975a0f68c5b5c3bc_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-12_46c48aa8d21d85ea975a0f68c5b5c3bc_mafia.exe
-
Size
536KB
-
MD5
46c48aa8d21d85ea975a0f68c5b5c3bc
-
SHA1
6ecb8f2f7bed1101a5b40754f4c2f090439b9f6c
-
SHA256
b7a2883dea65828e96337ede9ea58f33e7d417d973ab1eff96701932e45a6581
-
SHA512
d9505a412c29b1310f5d8f6d60251d0423ca110aacc6addc006d94ae7ecb3ce676da005edf879110cfa32673c7c06efdb0265d911ff8913e797bf8063635a647
-
SSDEEP
12288:wU5rCOTeiUwKVft2vMGK4a20KUlxNH0mIZxVJ0ZT9:wUQOJUwKBt2vTPLHUlnzIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2208 165E.tmp 2768 170A.tmp 2676 17B5.tmp 2572 1832.tmp 2672 18AF.tmp 2580 192C.tmp 1840 19B8.tmp 108 1A06.tmp 2420 1A73.tmp 2976 1AD1.tmp 748 1B1F.tmp 1324 1B5D.tmp 2832 1B9C.tmp 1732 1C28.tmp 2380 1CC4.tmp 1628 1D12.tmp 1652 1D60.tmp 1900 1D9E.tmp 2168 1DEC.tmp 2200 1E3A.tmp 2164 1EB7.tmp 2248 1FB1.tmp 288 1FEF.tmp 2288 202E.tmp 1080 206C.tmp 2896 20BA.tmp 1544 2108.tmp 2452 2146.tmp 1700 2194.tmp 1764 21D3.tmp 2956 2211.tmp 2032 2250.tmp 2800 228E.tmp 1148 22DC.tmp 2460 231A.tmp 284 2359.tmp 1932 2397.tmp 1568 23D6.tmp 2704 2414.tmp 2812 2452.tmp 2684 2491.tmp 2952 24CF.tmp 2844 250E.tmp 2792 254C.tmp 2624 258A.tmp 2484 25C9.tmp 2328 2607.tmp 1840 2646.tmp 1988 2684.tmp 2000 26F1.tmp 1224 2730.tmp 2340 276E.tmp 748 27AC.tmp 2620 27DB.tmp 2832 281A.tmp 2436 2858.tmp 2128 2896.tmp 536 28C5.tmp 1228 2904.tmp 1552 2952.tmp 1384 2990.tmp 2168 29BF.tmp 268 29EE.tmp 2120 2A2C.tmp -
Loads dropped DLL 64 IoCs
pid Process 2080 2024-08-12_46c48aa8d21d85ea975a0f68c5b5c3bc_mafia.exe 2208 165E.tmp 2768 170A.tmp 2676 17B5.tmp 2572 1832.tmp 2672 18AF.tmp 2580 192C.tmp 1840 19B8.tmp 108 1A06.tmp 2420 1A73.tmp 2976 1AD1.tmp 748 1B1F.tmp 1324 1B5D.tmp 2832 1B9C.tmp 1732 1C28.tmp 2380 1CC4.tmp 1628 1D12.tmp 1652 1D60.tmp 1900 1D9E.tmp 2168 1DEC.tmp 2200 1E3A.tmp 2164 1EB7.tmp 2248 1FB1.tmp 288 1FEF.tmp 2288 202E.tmp 1080 206C.tmp 2896 20BA.tmp 1544 2108.tmp 2452 2146.tmp 1700 2194.tmp 1764 21D3.tmp 2956 2211.tmp 2032 2250.tmp 2800 228E.tmp 1148 22DC.tmp 2460 231A.tmp 284 2359.tmp 1932 2397.tmp 1568 23D6.tmp 2704 2414.tmp 2812 2452.tmp 2684 2491.tmp 2952 24CF.tmp 2844 250E.tmp 2792 254C.tmp 2624 258A.tmp 2484 25C9.tmp 2328 2607.tmp 1840 2646.tmp 1988 2684.tmp 2000 26F1.tmp 1224 2730.tmp 2340 276E.tmp 748 27AC.tmp 2620 27DB.tmp 2832 281A.tmp 2436 2858.tmp 2128 2896.tmp 536 28C5.tmp 1228 2904.tmp 1552 2952.tmp 1384 2990.tmp 2168 29BF.tmp 268 29EE.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D04A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3321.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F660.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A277.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDD1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C19A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9924.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9492.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C005.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAC3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1120.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BC8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B136.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2080 wrote to memory of 2208 2080 2024-08-12_46c48aa8d21d85ea975a0f68c5b5c3bc_mafia.exe 30 PID 2080 wrote to memory of 2208 2080 2024-08-12_46c48aa8d21d85ea975a0f68c5b5c3bc_mafia.exe 30 PID 2080 wrote to memory of 2208 2080 2024-08-12_46c48aa8d21d85ea975a0f68c5b5c3bc_mafia.exe 30 PID 2080 wrote to memory of 2208 2080 2024-08-12_46c48aa8d21d85ea975a0f68c5b5c3bc_mafia.exe 30 PID 2208 wrote to memory of 2768 2208 165E.tmp 31 PID 2208 wrote to memory of 2768 2208 165E.tmp 31 PID 2208 wrote to memory of 2768 2208 165E.tmp 31 PID 2208 wrote to memory of 2768 2208 165E.tmp 31 PID 2768 wrote to memory of 2676 2768 170A.tmp 32 PID 2768 wrote to memory of 2676 2768 170A.tmp 32 PID 2768 wrote to memory of 2676 2768 170A.tmp 32 PID 2768 wrote to memory of 2676 2768 170A.tmp 32 PID 2676 wrote to memory of 2572 2676 17B5.tmp 33 PID 2676 wrote to memory of 2572 2676 17B5.tmp 33 PID 2676 wrote to memory of 2572 2676 17B5.tmp 33 PID 2676 wrote to memory of 2572 2676 17B5.tmp 33 PID 2572 wrote to memory of 2672 2572 1832.tmp 177 PID 2572 wrote to memory of 2672 2572 1832.tmp 177 PID 2572 wrote to memory of 2672 2572 1832.tmp 177 PID 2572 wrote to memory of 2672 2572 1832.tmp 177 PID 2672 wrote to memory of 2580 2672 18AF.tmp 35 PID 2672 wrote to memory of 2580 2672 18AF.tmp 35 PID 2672 wrote to memory of 2580 2672 18AF.tmp 35 PID 2672 wrote to memory of 2580 2672 18AF.tmp 35 PID 2580 wrote to memory of 1840 2580 192C.tmp 120 PID 2580 wrote to memory of 1840 2580 192C.tmp 120 PID 2580 wrote to memory of 1840 2580 192C.tmp 120 PID 2580 wrote to memory of 1840 2580 192C.tmp 120 PID 1840 wrote to memory of 108 1840 19B8.tmp 37 PID 1840 wrote to memory of 108 1840 19B8.tmp 37 PID 1840 wrote to memory of 108 1840 19B8.tmp 37 PID 1840 wrote to memory of 108 1840 19B8.tmp 37 PID 108 wrote to memory of 2420 108 1A06.tmp 38 PID 108 wrote to memory of 2420 108 1A06.tmp 38 PID 108 wrote to memory of 2420 108 1A06.tmp 38 PID 108 wrote to memory of 2420 108 1A06.tmp 38 PID 2420 wrote to memory of 2976 2420 1A73.tmp 123 PID 2420 wrote to memory of 2976 2420 1A73.tmp 123 PID 2420 wrote to memory of 2976 2420 1A73.tmp 123 PID 2420 wrote to memory of 2976 2420 1A73.tmp 123 PID 2976 wrote to memory of 748 2976 1AD1.tmp 40 PID 2976 wrote to memory of 748 2976 1AD1.tmp 40 PID 2976 wrote to memory of 748 2976 1AD1.tmp 40 PID 2976 wrote to memory of 748 2976 1AD1.tmp 40 PID 748 wrote to memory of 1324 748 1B1F.tmp 41 PID 748 wrote to memory of 1324 748 1B1F.tmp 41 PID 748 wrote to memory of 1324 748 1B1F.tmp 41 PID 748 wrote to memory of 1324 748 1B1F.tmp 41 PID 1324 wrote to memory of 2832 1324 1B5D.tmp 84 PID 1324 wrote to memory of 2832 1324 1B5D.tmp 84 PID 1324 wrote to memory of 2832 1324 1B5D.tmp 84 PID 1324 wrote to memory of 2832 1324 1B5D.tmp 84 PID 2832 wrote to memory of 1732 2832 1B9C.tmp 43 PID 2832 wrote to memory of 1732 2832 1B9C.tmp 43 PID 2832 wrote to memory of 1732 2832 1B9C.tmp 43 PID 2832 wrote to memory of 1732 2832 1B9C.tmp 43 PID 1732 wrote to memory of 2380 1732 1C28.tmp 44 PID 1732 wrote to memory of 2380 1732 1C28.tmp 44 PID 1732 wrote to memory of 2380 1732 1C28.tmp 44 PID 1732 wrote to memory of 2380 1732 1C28.tmp 44 PID 2380 wrote to memory of 1628 2380 1CC4.tmp 45 PID 2380 wrote to memory of 1628 2380 1CC4.tmp 45 PID 2380 wrote to memory of 1628 2380 1CC4.tmp 45 PID 2380 wrote to memory of 1628 2380 1CC4.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-12_46c48aa8d21d85ea975a0f68c5b5c3bc_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-12_46c48aa8d21d85ea975a0f68c5b5c3bc_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\165E.tmp"C:\Users\Admin\AppData\Local\Temp\165E.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\170A.tmp"C:\Users\Admin\AppData\Local\Temp\170A.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\17B5.tmp"C:\Users\Admin\AppData\Local\Temp\17B5.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\1832.tmp"C:\Users\Admin\AppData\Local\Temp\1832.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\18AF.tmp"C:\Users\Admin\AppData\Local\Temp\18AF.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\192C.tmp"C:\Users\Admin\AppData\Local\Temp\192C.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\19B8.tmp"C:\Users\Admin\AppData\Local\Temp\19B8.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\1A06.tmp"C:\Users\Admin\AppData\Local\Temp\1A06.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:108 -
C:\Users\Admin\AppData\Local\Temp\1A73.tmp"C:\Users\Admin\AppData\Local\Temp\1A73.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\1C28.tmp"C:\Users\Admin\AppData\Local\Temp\1C28.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\1D12.tmp"C:\Users\Admin\AppData\Local\Temp\1D12.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\1D60.tmp"C:\Users\Admin\AppData\Local\Temp\1D60.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:288 -
C:\Users\Admin\AppData\Local\Temp\202E.tmp"C:\Users\Admin\AppData\Local\Temp\202E.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\206C.tmp"C:\Users\Admin\AppData\Local\Temp\206C.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\20BA.tmp"C:\Users\Admin\AppData\Local\Temp\20BA.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\2108.tmp"C:\Users\Admin\AppData\Local\Temp\2108.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\2146.tmp"C:\Users\Admin\AppData\Local\Temp\2146.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\2194.tmp"C:\Users\Admin\AppData\Local\Temp\2194.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\21D3.tmp"C:\Users\Admin\AppData\Local\Temp\21D3.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\2211.tmp"C:\Users\Admin\AppData\Local\Temp\2211.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\2250.tmp"C:\Users\Admin\AppData\Local\Temp\2250.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\228E.tmp"C:\Users\Admin\AppData\Local\Temp\228E.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\22DC.tmp"C:\Users\Admin\AppData\Local\Temp\22DC.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\231A.tmp"C:\Users\Admin\AppData\Local\Temp\231A.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\2359.tmp"C:\Users\Admin\AppData\Local\Temp\2359.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:284 -
C:\Users\Admin\AppData\Local\Temp\2397.tmp"C:\Users\Admin\AppData\Local\Temp\2397.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\23D6.tmp"C:\Users\Admin\AppData\Local\Temp\23D6.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\2414.tmp"C:\Users\Admin\AppData\Local\Temp\2414.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\2452.tmp"C:\Users\Admin\AppData\Local\Temp\2452.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\2491.tmp"C:\Users\Admin\AppData\Local\Temp\2491.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\24CF.tmp"C:\Users\Admin\AppData\Local\Temp\24CF.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\250E.tmp"C:\Users\Admin\AppData\Local\Temp\250E.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\254C.tmp"C:\Users\Admin\AppData\Local\Temp\254C.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\258A.tmp"C:\Users\Admin\AppData\Local\Temp\258A.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\25C9.tmp"C:\Users\Admin\AppData\Local\Temp\25C9.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\2607.tmp"C:\Users\Admin\AppData\Local\Temp\2607.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\2646.tmp"C:\Users\Admin\AppData\Local\Temp\2646.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\2684.tmp"C:\Users\Admin\AppData\Local\Temp\2684.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\26F1.tmp"C:\Users\Admin\AppData\Local\Temp\26F1.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\2730.tmp"C:\Users\Admin\AppData\Local\Temp\2730.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\276E.tmp"C:\Users\Admin\AppData\Local\Temp\276E.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\27AC.tmp"C:\Users\Admin\AppData\Local\Temp\27AC.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:748 -
C:\Users\Admin\AppData\Local\Temp\27DB.tmp"C:\Users\Admin\AppData\Local\Temp\27DB.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\281A.tmp"C:\Users\Admin\AppData\Local\Temp\281A.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\2858.tmp"C:\Users\Admin\AppData\Local\Temp\2858.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\2896.tmp"C:\Users\Admin\AppData\Local\Temp\2896.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\28C5.tmp"C:\Users\Admin\AppData\Local\Temp\28C5.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:536 -
C:\Users\Admin\AppData\Local\Temp\2904.tmp"C:\Users\Admin\AppData\Local\Temp\2904.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\2952.tmp"C:\Users\Admin\AppData\Local\Temp\2952.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\2990.tmp"C:\Users\Admin\AppData\Local\Temp\2990.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\29BF.tmp"C:\Users\Admin\AppData\Local\Temp\29BF.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\29EE.tmp"C:\Users\Admin\AppData\Local\Temp\29EE.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:268 -
C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"65⤵
- Executes dropped EXE
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"66⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"67⤵PID:664
-
C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"68⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\2B26.tmp"C:\Users\Admin\AppData\Local\Temp\2B26.tmp"69⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\2B64.tmp"C:\Users\Admin\AppData\Local\Temp\2B64.tmp"70⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\2B93.tmp"C:\Users\Admin\AppData\Local\Temp\2B93.tmp"71⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"72⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\2C10.tmp"C:\Users\Admin\AppData\Local\Temp\2C10.tmp"73⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"74⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"75⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"76⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\2D09.tmp"C:\Users\Admin\AppData\Local\Temp\2D09.tmp"77⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\2D38.tmp"C:\Users\Admin\AppData\Local\Temp\2D38.tmp"78⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\2D67.tmp"C:\Users\Admin\AppData\Local\Temp\2D67.tmp"79⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"80⤵PID:284
-
C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"81⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\2E12.tmp"C:\Users\Admin\AppData\Local\Temp\2E12.tmp"82⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\2E41.tmp"C:\Users\Admin\AppData\Local\Temp\2E41.tmp"83⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\2E80.tmp"C:\Users\Admin\AppData\Local\Temp\2E80.tmp"84⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"85⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\2EED.tmp"C:\Users\Admin\AppData\Local\Temp\2EED.tmp"86⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"87⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\2F5A.tmp"C:\Users\Admin\AppData\Local\Temp\2F5A.tmp"88⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\2F98.tmp"C:\Users\Admin\AppData\Local\Temp\2F98.tmp"89⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"90⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\3006.tmp"C:\Users\Admin\AppData\Local\Temp\3006.tmp"91⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\3044.tmp"C:\Users\Admin\AppData\Local\Temp\3044.tmp"92⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\3082.tmp"C:\Users\Admin\AppData\Local\Temp\3082.tmp"93⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\30B1.tmp"C:\Users\Admin\AppData\Local\Temp\30B1.tmp"94⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\30F0.tmp"C:\Users\Admin\AppData\Local\Temp\30F0.tmp"95⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\311E.tmp"C:\Users\Admin\AppData\Local\Temp\311E.tmp"96⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\314D.tmp"C:\Users\Admin\AppData\Local\Temp\314D.tmp"97⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\318C.tmp"C:\Users\Admin\AppData\Local\Temp\318C.tmp"98⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\31BA.tmp"C:\Users\Admin\AppData\Local\Temp\31BA.tmp"99⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\31E9.tmp"C:\Users\Admin\AppData\Local\Temp\31E9.tmp"100⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\3228.tmp"C:\Users\Admin\AppData\Local\Temp\3228.tmp"101⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"102⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\3285.tmp"C:\Users\Admin\AppData\Local\Temp\3285.tmp"103⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\32C4.tmp"C:\Users\Admin\AppData\Local\Temp\32C4.tmp"104⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\32F2.tmp"C:\Users\Admin\AppData\Local\Temp\32F2.tmp"105⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\3321.tmp"C:\Users\Admin\AppData\Local\Temp\3321.tmp"106⤵
- System Location Discovery: System Language Discovery
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\3360.tmp"C:\Users\Admin\AppData\Local\Temp\3360.tmp"107⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\339E.tmp"C:\Users\Admin\AppData\Local\Temp\339E.tmp"108⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\33DC.tmp"C:\Users\Admin\AppData\Local\Temp\33DC.tmp"109⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\341B.tmp"C:\Users\Admin\AppData\Local\Temp\341B.tmp"110⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\3459.tmp"C:\Users\Admin\AppData\Local\Temp\3459.tmp"111⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\3498.tmp"C:\Users\Admin\AppData\Local\Temp\3498.tmp"112⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\34D6.tmp"C:\Users\Admin\AppData\Local\Temp\34D6.tmp"113⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\3514.tmp"C:\Users\Admin\AppData\Local\Temp\3514.tmp"114⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\3553.tmp"C:\Users\Admin\AppData\Local\Temp\3553.tmp"115⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\3591.tmp"C:\Users\Admin\AppData\Local\Temp\3591.tmp"116⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\35D0.tmp"C:\Users\Admin\AppData\Local\Temp\35D0.tmp"117⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\360E.tmp"C:\Users\Admin\AppData\Local\Temp\360E.tmp"118⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\364C.tmp"C:\Users\Admin\AppData\Local\Temp\364C.tmp"119⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\368B.tmp"C:\Users\Admin\AppData\Local\Temp\368B.tmp"120⤵PID:288
-
C:\Users\Admin\AppData\Local\Temp\36BA.tmp"C:\Users\Admin\AppData\Local\Temp\36BA.tmp"121⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\36E8.tmp"C:\Users\Admin\AppData\Local\Temp\36E8.tmp"122⤵PID:1080
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-