Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
21/08/2024, 08:06
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-21_ecb37dc3f246ea3c8f0c76685dd2fbe5_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-08-21_ecb37dc3f246ea3c8f0c76685dd2fbe5_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-21_ecb37dc3f246ea3c8f0c76685dd2fbe5_mafia.exe
-
Size
486KB
-
MD5
ecb37dc3f246ea3c8f0c76685dd2fbe5
-
SHA1
44518e7b66432df640494a2c6459a2027ba1533c
-
SHA256
4739e76e3117c28ebcc7bc7232443ae1ed4cf2ae64445937b1bb9d58ec5d8a6e
-
SHA512
fcdcdba7f3f75ea81e82be161379c2ce1dc119d786e68aa4f3294a1331dda64d19540f1d01e937137ba19ffc964e656b773793a2f2560c384943f00bf24074e4
-
SSDEEP
12288:UU5rCOTeiDUaLbPZi96dfQ7e0ZCLdLT5qNZ:UUQOJDUafxsx7ekChpqN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2752 E3E9.tmp 2916 E456.tmp 2744 E4F2.tmp 2812 E540.tmp 2580 E58E.tmp 2716 E62A.tmp 2636 E688.tmp 1940 E6F5.tmp 2144 E772.tmp 2868 E80E.tmp 2952 E88B.tmp 2108 E917.tmp 2060 E984.tmp 1300 E9D2.tmp 1264 EA30.tmp 1524 EABC.tmp 2040 EB2A.tmp 2240 EB78.tmp 1560 EBF4.tmp 536 EC81.tmp 320 ECFE.tmp 668 ED7A.tmp 3036 EDF7.tmp 1472 EE45.tmp 2132 EE84.tmp 2312 EED2.tmp 3020 EF20.tmp 856 EF6E.tmp 292 EFAC.tmp 1076 EFFA.tmp 2336 F048.tmp 1960 F0A6.tmp 956 F0F4.tmp 1800 F142.tmp 1752 F180.tmp 904 F1CE.tmp 3044 F21C.tmp 1344 F26A.tmp 1088 F2A8.tmp 1720 F2F6.tmp 2008 F335.tmp 808 F383.tmp 1432 F3C1.tmp 776 F40F.tmp 2560 F44E.tmp 680 F48C.tmp 1028 F4CA.tmp 1828 F518.tmp 880 F557.tmp 2400 F595.tmp 2732 F5D4.tmp 1580 F622.tmp 2748 F660.tmp 2824 F6AE.tmp 2736 F70C.tmp 2916 F75A.tmp 2820 F7C7.tmp 2908 F805.tmp 2956 F844.tmp 2776 F882.tmp 2920 F8C0.tmp 2620 F90E.tmp 2660 F94D.tmp 2160 F98B.tmp -
Loads dropped DLL 64 IoCs
pid Process 1280 2024-08-21_ecb37dc3f246ea3c8f0c76685dd2fbe5_mafia.exe 2752 E3E9.tmp 2916 E456.tmp 2744 E4F2.tmp 2812 E540.tmp 2580 E58E.tmp 2716 E62A.tmp 2636 E688.tmp 1940 E6F5.tmp 2144 E772.tmp 2868 E80E.tmp 2952 E88B.tmp 2108 E917.tmp 2060 E984.tmp 1300 E9D2.tmp 1264 EA30.tmp 1524 EABC.tmp 2040 EB2A.tmp 2240 EB78.tmp 1560 EBF4.tmp 536 EC81.tmp 320 ECFE.tmp 668 ED7A.tmp 3036 EDF7.tmp 1472 EE45.tmp 2132 EE84.tmp 2312 EED2.tmp 3020 EF20.tmp 856 EF6E.tmp 292 EFAC.tmp 1076 EFFA.tmp 2336 F048.tmp 1960 F0A6.tmp 956 F0F4.tmp 1800 F142.tmp 1752 F180.tmp 904 F1CE.tmp 3044 F21C.tmp 1344 F26A.tmp 1088 F2A8.tmp 1720 F2F6.tmp 2008 F335.tmp 808 F383.tmp 1432 F3C1.tmp 776 F40F.tmp 2560 F44E.tmp 680 F48C.tmp 1028 F4CA.tmp 1828 F518.tmp 880 F557.tmp 2400 F595.tmp 2732 F5D4.tmp 1580 F622.tmp 2748 F660.tmp 2824 F6AE.tmp 2736 F70C.tmp 2916 F75A.tmp 2820 F7C7.tmp 2908 F805.tmp 2956 F844.tmp 2776 F882.tmp 2920 F8C0.tmp 2620 F90E.tmp 2660 F94D.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2CFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F26A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 963.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 935A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB0A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 893C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D61.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E6F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 560C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F518.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B117.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E6D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CCC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7DA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 232A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4338.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B606.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1280 wrote to memory of 2752 1280 2024-08-21_ecb37dc3f246ea3c8f0c76685dd2fbe5_mafia.exe 31 PID 1280 wrote to memory of 2752 1280 2024-08-21_ecb37dc3f246ea3c8f0c76685dd2fbe5_mafia.exe 31 PID 1280 wrote to memory of 2752 1280 2024-08-21_ecb37dc3f246ea3c8f0c76685dd2fbe5_mafia.exe 31 PID 1280 wrote to memory of 2752 1280 2024-08-21_ecb37dc3f246ea3c8f0c76685dd2fbe5_mafia.exe 31 PID 2752 wrote to memory of 2916 2752 E3E9.tmp 32 PID 2752 wrote to memory of 2916 2752 E3E9.tmp 32 PID 2752 wrote to memory of 2916 2752 E3E9.tmp 32 PID 2752 wrote to memory of 2916 2752 E3E9.tmp 32 PID 2916 wrote to memory of 2744 2916 E456.tmp 33 PID 2916 wrote to memory of 2744 2916 E456.tmp 33 PID 2916 wrote to memory of 2744 2916 E456.tmp 33 PID 2916 wrote to memory of 2744 2916 E456.tmp 33 PID 2744 wrote to memory of 2812 2744 E4F2.tmp 34 PID 2744 wrote to memory of 2812 2744 E4F2.tmp 34 PID 2744 wrote to memory of 2812 2744 E4F2.tmp 34 PID 2744 wrote to memory of 2812 2744 E4F2.tmp 34 PID 2812 wrote to memory of 2580 2812 E540.tmp 35 PID 2812 wrote to memory of 2580 2812 E540.tmp 35 PID 2812 wrote to memory of 2580 2812 E540.tmp 35 PID 2812 wrote to memory of 2580 2812 E540.tmp 35 PID 2580 wrote to memory of 2716 2580 E58E.tmp 36 PID 2580 wrote to memory of 2716 2580 E58E.tmp 36 PID 2580 wrote to memory of 2716 2580 E58E.tmp 36 PID 2580 wrote to memory of 2716 2580 E58E.tmp 36 PID 2716 wrote to memory of 2636 2716 E62A.tmp 37 PID 2716 wrote to memory of 2636 2716 E62A.tmp 37 PID 2716 wrote to memory of 2636 2716 E62A.tmp 37 PID 2716 wrote to memory of 2636 2716 E62A.tmp 37 PID 2636 wrote to memory of 1940 2636 E688.tmp 38 PID 2636 wrote to memory of 1940 2636 E688.tmp 38 PID 2636 wrote to memory of 1940 2636 E688.tmp 38 PID 2636 wrote to memory of 1940 2636 E688.tmp 38 PID 1940 wrote to memory of 2144 1940 E6F5.tmp 39 PID 1940 wrote to memory of 2144 1940 E6F5.tmp 39 PID 1940 wrote to memory of 2144 1940 E6F5.tmp 39 PID 1940 wrote to memory of 2144 1940 E6F5.tmp 39 PID 2144 wrote to memory of 2868 2144 E772.tmp 40 PID 2144 wrote to memory of 2868 2144 E772.tmp 40 PID 2144 wrote to memory of 2868 2144 E772.tmp 40 PID 2144 wrote to memory of 2868 2144 E772.tmp 40 PID 2868 wrote to memory of 2952 2868 E80E.tmp 41 PID 2868 wrote to memory of 2952 2868 E80E.tmp 41 PID 2868 wrote to memory of 2952 2868 E80E.tmp 41 PID 2868 wrote to memory of 2952 2868 E80E.tmp 41 PID 2952 wrote to memory of 2108 2952 E88B.tmp 42 PID 2952 wrote to memory of 2108 2952 E88B.tmp 42 PID 2952 wrote to memory of 2108 2952 E88B.tmp 42 PID 2952 wrote to memory of 2108 2952 E88B.tmp 42 PID 2108 wrote to memory of 2060 2108 E917.tmp 43 PID 2108 wrote to memory of 2060 2108 E917.tmp 43 PID 2108 wrote to memory of 2060 2108 E917.tmp 43 PID 2108 wrote to memory of 2060 2108 E917.tmp 43 PID 2060 wrote to memory of 1300 2060 E984.tmp 44 PID 2060 wrote to memory of 1300 2060 E984.tmp 44 PID 2060 wrote to memory of 1300 2060 E984.tmp 44 PID 2060 wrote to memory of 1300 2060 E984.tmp 44 PID 1300 wrote to memory of 1264 1300 E9D2.tmp 45 PID 1300 wrote to memory of 1264 1300 E9D2.tmp 45 PID 1300 wrote to memory of 1264 1300 E9D2.tmp 45 PID 1300 wrote to memory of 1264 1300 E9D2.tmp 45 PID 1264 wrote to memory of 1524 1264 EA30.tmp 46 PID 1264 wrote to memory of 1524 1264 EA30.tmp 46 PID 1264 wrote to memory of 1524 1264 EA30.tmp 46 PID 1264 wrote to memory of 1524 1264 EA30.tmp 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-21_ecb37dc3f246ea3c8f0c76685dd2fbe5_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-21_ecb37dc3f246ea3c8f0c76685dd2fbe5_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\E3E9.tmp"C:\Users\Admin\AppData\Local\Temp\E3E9.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\E456.tmp"C:\Users\Admin\AppData\Local\Temp\E456.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\E4F2.tmp"C:\Users\Admin\AppData\Local\Temp\E4F2.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\E540.tmp"C:\Users\Admin\AppData\Local\Temp\E540.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\E58E.tmp"C:\Users\Admin\AppData\Local\Temp\E58E.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\E62A.tmp"C:\Users\Admin\AppData\Local\Temp\E62A.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\E688.tmp"C:\Users\Admin\AppData\Local\Temp\E688.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\E772.tmp"C:\Users\Admin\AppData\Local\Temp\E772.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\E80E.tmp"C:\Users\Admin\AppData\Local\Temp\E80E.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\E88B.tmp"C:\Users\Admin\AppData\Local\Temp\E88B.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\E917.tmp"C:\Users\Admin\AppData\Local\Temp\E917.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\E984.tmp"C:\Users\Admin\AppData\Local\Temp\E984.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\E9D2.tmp"C:\Users\Admin\AppData\Local\Temp\E9D2.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\EA30.tmp"C:\Users\Admin\AppData\Local\Temp\EA30.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\EABC.tmp"C:\Users\Admin\AppData\Local\Temp\EABC.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\EB2A.tmp"C:\Users\Admin\AppData\Local\Temp\EB2A.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\EB78.tmp"C:\Users\Admin\AppData\Local\Temp\EB78.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\EBF4.tmp"C:\Users\Admin\AppData\Local\Temp\EBF4.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\EC81.tmp"C:\Users\Admin\AppData\Local\Temp\EC81.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:536 -
C:\Users\Admin\AppData\Local\Temp\ECFE.tmp"C:\Users\Admin\AppData\Local\Temp\ECFE.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:320 -
C:\Users\Admin\AppData\Local\Temp\ED7A.tmp"C:\Users\Admin\AppData\Local\Temp\ED7A.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:668 -
C:\Users\Admin\AppData\Local\Temp\EDF7.tmp"C:\Users\Admin\AppData\Local\Temp\EDF7.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\EE45.tmp"C:\Users\Admin\AppData\Local\Temp\EE45.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\EE84.tmp"C:\Users\Admin\AppData\Local\Temp\EE84.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\EED2.tmp"C:\Users\Admin\AppData\Local\Temp\EED2.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\EF20.tmp"C:\Users\Admin\AppData\Local\Temp\EF20.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\EF6E.tmp"C:\Users\Admin\AppData\Local\Temp\EF6E.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:856 -
C:\Users\Admin\AppData\Local\Temp\EFAC.tmp"C:\Users\Admin\AppData\Local\Temp\EFAC.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:292 -
C:\Users\Admin\AppData\Local\Temp\EFFA.tmp"C:\Users\Admin\AppData\Local\Temp\EFFA.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\F048.tmp"C:\Users\Admin\AppData\Local\Temp\F048.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\F0A6.tmp"C:\Users\Admin\AppData\Local\Temp\F0A6.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\F0F4.tmp"C:\Users\Admin\AppData\Local\Temp\F0F4.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:956 -
C:\Users\Admin\AppData\Local\Temp\F142.tmp"C:\Users\Admin\AppData\Local\Temp\F142.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\F180.tmp"C:\Users\Admin\AppData\Local\Temp\F180.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\F1CE.tmp"C:\Users\Admin\AppData\Local\Temp\F1CE.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:904 -
C:\Users\Admin\AppData\Local\Temp\F21C.tmp"C:\Users\Admin\AppData\Local\Temp\F21C.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\F26A.tmp"C:\Users\Admin\AppData\Local\Temp\F26A.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\F2A8.tmp"C:\Users\Admin\AppData\Local\Temp\F2A8.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\F2F6.tmp"C:\Users\Admin\AppData\Local\Temp\F2F6.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\F335.tmp"C:\Users\Admin\AppData\Local\Temp\F335.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\F383.tmp"C:\Users\Admin\AppData\Local\Temp\F383.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:808 -
C:\Users\Admin\AppData\Local\Temp\F3C1.tmp"C:\Users\Admin\AppData\Local\Temp\F3C1.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\F40F.tmp"C:\Users\Admin\AppData\Local\Temp\F40F.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:776 -
C:\Users\Admin\AppData\Local\Temp\F44E.tmp"C:\Users\Admin\AppData\Local\Temp\F44E.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\F48C.tmp"C:\Users\Admin\AppData\Local\Temp\F48C.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:680 -
C:\Users\Admin\AppData\Local\Temp\F4CA.tmp"C:\Users\Admin\AppData\Local\Temp\F4CA.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\F518.tmp"C:\Users\Admin\AppData\Local\Temp\F518.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\F557.tmp"C:\Users\Admin\AppData\Local\Temp\F557.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:880 -
C:\Users\Admin\AppData\Local\Temp\F595.tmp"C:\Users\Admin\AppData\Local\Temp\F595.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\F5D4.tmp"C:\Users\Admin\AppData\Local\Temp\F5D4.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\F622.tmp"C:\Users\Admin\AppData\Local\Temp\F622.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\F660.tmp"C:\Users\Admin\AppData\Local\Temp\F660.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\F6AE.tmp"C:\Users\Admin\AppData\Local\Temp\F6AE.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\F70C.tmp"C:\Users\Admin\AppData\Local\Temp\F70C.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\F75A.tmp"C:\Users\Admin\AppData\Local\Temp\F75A.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\F7C7.tmp"C:\Users\Admin\AppData\Local\Temp\F7C7.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\F805.tmp"C:\Users\Admin\AppData\Local\Temp\F805.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\F844.tmp"C:\Users\Admin\AppData\Local\Temp\F844.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\F882.tmp"C:\Users\Admin\AppData\Local\Temp\F882.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\F8C0.tmp"C:\Users\Admin\AppData\Local\Temp\F8C0.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\F90E.tmp"C:\Users\Admin\AppData\Local\Temp\F90E.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\F94D.tmp"C:\Users\Admin\AppData\Local\Temp\F94D.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\F98B.tmp"C:\Users\Admin\AppData\Local\Temp\F98B.tmp"65⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\F9CA.tmp"C:\Users\Admin\AppData\Local\Temp\F9CA.tmp"66⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\FA08.tmp"C:\Users\Admin\AppData\Local\Temp\FA08.tmp"67⤵
- System Location Discovery: System Language Discovery
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\FA46.tmp"C:\Users\Admin\AppData\Local\Temp\FA46.tmp"68⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\FA94.tmp"C:\Users\Admin\AppData\Local\Temp\FA94.tmp"69⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\FAD3.tmp"C:\Users\Admin\AppData\Local\Temp\FAD3.tmp"70⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\FB11.tmp"C:\Users\Admin\AppData\Local\Temp\FB11.tmp"71⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\FB50.tmp"C:\Users\Admin\AppData\Local\Temp\FB50.tmp"72⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\FB8E.tmp"C:\Users\Admin\AppData\Local\Temp\FB8E.tmp"73⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\FBCC.tmp"C:\Users\Admin\AppData\Local\Temp\FBCC.tmp"74⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\FC0B.tmp"C:\Users\Admin\AppData\Local\Temp\FC0B.tmp"75⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\FC49.tmp"C:\Users\Admin\AppData\Local\Temp\FC49.tmp"76⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\FCB6.tmp"C:\Users\Admin\AppData\Local\Temp\FCB6.tmp"77⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\FCF5.tmp"C:\Users\Admin\AppData\Local\Temp\FCF5.tmp"78⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\FD33.tmp"C:\Users\Admin\AppData\Local\Temp\FD33.tmp"79⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\FD72.tmp"C:\Users\Admin\AppData\Local\Temp\FD72.tmp"80⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\FDB0.tmp"C:\Users\Admin\AppData\Local\Temp\FDB0.tmp"81⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\FDEE.tmp"C:\Users\Admin\AppData\Local\Temp\FDEE.tmp"82⤵PID:484
-
C:\Users\Admin\AppData\Local\Temp\FE3C.tmp"C:\Users\Admin\AppData\Local\Temp\FE3C.tmp"83⤵PID:344
-
C:\Users\Admin\AppData\Local\Temp\FE7B.tmp"C:\Users\Admin\AppData\Local\Temp\FE7B.tmp"84⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\FEB9.tmp"C:\Users\Admin\AppData\Local\Temp\FEB9.tmp"85⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\FF07.tmp"C:\Users\Admin\AppData\Local\Temp\FF07.tmp"86⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\FF55.tmp"C:\Users\Admin\AppData\Local\Temp\FF55.tmp"87⤵
- System Location Discovery: System Language Discovery
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\FF94.tmp"C:\Users\Admin\AppData\Local\Temp\FF94.tmp"88⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\FFD2.tmp"C:\Users\Admin\AppData\Local\Temp\FFD2.tmp"89⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\10.tmp"C:\Users\Admin\AppData\Local\Temp\10.tmp"90⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\4F.tmp"C:\Users\Admin\AppData\Local\Temp\4F.tmp"91⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\9D.tmp"C:\Users\Admin\AppData\Local\Temp\9D.tmp"92⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\EB.tmp"C:\Users\Admin\AppData\Local\Temp\EB.tmp"93⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\129.tmp"C:\Users\Admin\AppData\Local\Temp\129.tmp"94⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\177.tmp"C:\Users\Admin\AppData\Local\Temp\177.tmp"95⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\1B6.tmp"C:\Users\Admin\AppData\Local\Temp\1B6.tmp"96⤵PID:280
-
C:\Users\Admin\AppData\Local\Temp\204.tmp"C:\Users\Admin\AppData\Local\Temp\204.tmp"97⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\242.tmp"C:\Users\Admin\AppData\Local\Temp\242.tmp"98⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\280.tmp"C:\Users\Admin\AppData\Local\Temp\280.tmp"99⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\2BF.tmp"C:\Users\Admin\AppData\Local\Temp\2BF.tmp"100⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\30D.tmp"C:\Users\Admin\AppData\Local\Temp\30D.tmp"101⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\34B.tmp"C:\Users\Admin\AppData\Local\Temp\34B.tmp"102⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\399.tmp"C:\Users\Admin\AppData\Local\Temp\399.tmp"103⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\3D8.tmp"C:\Users\Admin\AppData\Local\Temp\3D8.tmp"104⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\416.tmp"C:\Users\Admin\AppData\Local\Temp\416.tmp"105⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\464.tmp"C:\Users\Admin\AppData\Local\Temp\464.tmp"106⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\4A2.tmp"C:\Users\Admin\AppData\Local\Temp\4A2.tmp"107⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\4D1.tmp"C:\Users\Admin\AppData\Local\Temp\4D1.tmp"108⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\510.tmp"C:\Users\Admin\AppData\Local\Temp\510.tmp"109⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\54E.tmp"C:\Users\Admin\AppData\Local\Temp\54E.tmp"110⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\58C.tmp"C:\Users\Admin\AppData\Local\Temp\58C.tmp"111⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\5CB.tmp"C:\Users\Admin\AppData\Local\Temp\5CB.tmp"112⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\609.tmp"C:\Users\Admin\AppData\Local\Temp\609.tmp"113⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\648.tmp"C:\Users\Admin\AppData\Local\Temp\648.tmp"114⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\686.tmp"C:\Users\Admin\AppData\Local\Temp\686.tmp"115⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\6D4.tmp"C:\Users\Admin\AppData\Local\Temp\6D4.tmp"116⤵
- System Location Discovery: System Language Discovery
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\722.tmp"C:\Users\Admin\AppData\Local\Temp\722.tmp"117⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\770.tmp"C:\Users\Admin\AppData\Local\Temp\770.tmp"118⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\7AE.tmp"C:\Users\Admin\AppData\Local\Temp\7AE.tmp"119⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\7ED.tmp"C:\Users\Admin\AppData\Local\Temp\7ED.tmp"120⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\84A.tmp"C:\Users\Admin\AppData\Local\Temp\84A.tmp"121⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\889.tmp"C:\Users\Admin\AppData\Local\Temp\889.tmp"122⤵PID:2632
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-