Analysis
-
max time kernel
150s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
23-08-2024 11:42
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-23_ccbe25de55dce61c724934f2adf24f5b_mafia.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-08-23_ccbe25de55dce61c724934f2adf24f5b_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-23_ccbe25de55dce61c724934f2adf24f5b_mafia.exe
-
Size
488KB
-
MD5
ccbe25de55dce61c724934f2adf24f5b
-
SHA1
1da32e1b170a22c121ee9890a0e090419a284919
-
SHA256
b941da56c4f4b244cb6046d81c98feeaafec4150a88d551b6eb36325b27fda81
-
SHA512
d9b65b7f8a54c747181a7f4eea70bd6d6e5e29e46cb83388d72682ff6aeb8f26b4484ad9ca03ea0aec832248cb848ba69322369b1022dc671ce5faaa66653bcf
-
SSDEEP
12288:/U5rCOTeiDPJ2JvQbUdBtC9NuT4IHrEdNZ:/UQOJDYTs9AEdN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2364 EF8D.tmp 2264 F00A.tmp 2784 F096.tmp 2900 F0E4.tmp 2768 F151.tmp 2916 F1AF.tmp 2680 F21C.tmp 2496 F299.tmp 2016 F306.tmp 2716 F344.tmp 2696 F3E0.tmp 1504 F43E.tmp 2580 F47C.tmp 2604 F4CA.tmp 1020 F518.tmp 2464 F557.tmp 1760 F595.tmp 2440 F5E3.tmp 2996 F641.tmp 2332 F68F.tmp 2572 F71B.tmp 452 F769.tmp 1972 F7A8.tmp 1464 F7F6.tmp 2480 F834.tmp 3064 F872.tmp 1280 F8B1.tmp 2308 F8EF.tmp 3068 F92E.tmp 624 F96C.tmp 900 F9AA.tmp 2184 F9E9.tmp 1448 FA27.tmp 2456 FA66.tmp 2556 FAA4.tmp 2540 FAE2.tmp 352 FB30.tmp 1452 FB9E.tmp 3024 FBFB.tmp 580 FC59.tmp 2368 FCA7.tmp 264 FD04.tmp 1512 FD72.tmp 2004 FDC0.tmp 932 FE0E.tmp 472 FE5C.tmp 1888 FEAA.tmp 872 FEE8.tmp 984 FF36.tmp 1632 FF74.tmp 2392 FFB3.tmp 1776 1.tmp 1508 3F.tmp 2608 7E.tmp 2360 BC.tmp 2256 FA.tmp 2264 139.tmp 2772 177.tmp 2856 1B6.tmp 2904 1F4.tmp 2652 242.tmp 2824 280.tmp 2804 2CE.tmp 2672 31C.tmp -
Loads dropped DLL 64 IoCs
pid Process 1400 2024-08-23_ccbe25de55dce61c724934f2adf24f5b_mafia.exe 2364 EF8D.tmp 2264 F00A.tmp 2784 F096.tmp 2900 F0E4.tmp 2768 F151.tmp 2916 F1AF.tmp 2680 F21C.tmp 2496 F299.tmp 2016 F306.tmp 2716 F344.tmp 2696 F3E0.tmp 1504 F43E.tmp 2580 F47C.tmp 2604 F4CA.tmp 1020 F518.tmp 2464 F557.tmp 1760 F595.tmp 2440 F5E3.tmp 2996 F641.tmp 2332 F68F.tmp 2572 F71B.tmp 452 F769.tmp 1972 F7A8.tmp 1464 F7F6.tmp 2480 F834.tmp 3064 F872.tmp 1280 F8B1.tmp 2308 F8EF.tmp 3068 F92E.tmp 624 F96C.tmp 900 F9AA.tmp 2184 F9E9.tmp 1448 FA27.tmp 2456 FA66.tmp 2556 FAA4.tmp 2540 FAE2.tmp 352 FB30.tmp 1452 FB9E.tmp 3024 FBFB.tmp 580 FC59.tmp 2368 FCA7.tmp 264 FD04.tmp 1512 FD72.tmp 2004 FDC0.tmp 932 FE0E.tmp 472 FE5C.tmp 1888 FEAA.tmp 872 FEE8.tmp 984 FF36.tmp 1632 FF74.tmp 2392 FFB3.tmp 1776 1.tmp 1508 3F.tmp 2608 7E.tmp 2360 BC.tmp 2256 FA.tmp 2264 139.tmp 2772 177.tmp 2856 1B6.tmp 2904 1F4.tmp 2652 242.tmp 2824 280.tmp 2804 2CE.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5773.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B00D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EBE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F99.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C246.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C88D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4950.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7188.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B4F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A68C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE2A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C16B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE36.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CD4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E59E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD04.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B165.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8881.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9740.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC99.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1400 wrote to memory of 2364 1400 2024-08-23_ccbe25de55dce61c724934f2adf24f5b_mafia.exe 29 PID 1400 wrote to memory of 2364 1400 2024-08-23_ccbe25de55dce61c724934f2adf24f5b_mafia.exe 29 PID 1400 wrote to memory of 2364 1400 2024-08-23_ccbe25de55dce61c724934f2adf24f5b_mafia.exe 29 PID 1400 wrote to memory of 2364 1400 2024-08-23_ccbe25de55dce61c724934f2adf24f5b_mafia.exe 29 PID 2364 wrote to memory of 2264 2364 EF8D.tmp 30 PID 2364 wrote to memory of 2264 2364 EF8D.tmp 30 PID 2364 wrote to memory of 2264 2364 EF8D.tmp 30 PID 2364 wrote to memory of 2264 2364 EF8D.tmp 30 PID 2264 wrote to memory of 2784 2264 F00A.tmp 31 PID 2264 wrote to memory of 2784 2264 F00A.tmp 31 PID 2264 wrote to memory of 2784 2264 F00A.tmp 31 PID 2264 wrote to memory of 2784 2264 F00A.tmp 31 PID 2784 wrote to memory of 2900 2784 F096.tmp 32 PID 2784 wrote to memory of 2900 2784 F096.tmp 32 PID 2784 wrote to memory of 2900 2784 F096.tmp 32 PID 2784 wrote to memory of 2900 2784 F096.tmp 32 PID 2900 wrote to memory of 2768 2900 F0E4.tmp 33 PID 2900 wrote to memory of 2768 2900 F0E4.tmp 33 PID 2900 wrote to memory of 2768 2900 F0E4.tmp 33 PID 2900 wrote to memory of 2768 2900 F0E4.tmp 33 PID 2768 wrote to memory of 2916 2768 F151.tmp 34 PID 2768 wrote to memory of 2916 2768 F151.tmp 34 PID 2768 wrote to memory of 2916 2768 F151.tmp 34 PID 2768 wrote to memory of 2916 2768 F151.tmp 34 PID 2916 wrote to memory of 2680 2916 F1AF.tmp 35 PID 2916 wrote to memory of 2680 2916 F1AF.tmp 35 PID 2916 wrote to memory of 2680 2916 F1AF.tmp 35 PID 2916 wrote to memory of 2680 2916 F1AF.tmp 35 PID 2680 wrote to memory of 2496 2680 F21C.tmp 36 PID 2680 wrote to memory of 2496 2680 F21C.tmp 36 PID 2680 wrote to memory of 2496 2680 F21C.tmp 36 PID 2680 wrote to memory of 2496 2680 F21C.tmp 36 PID 2496 wrote to memory of 2016 2496 F299.tmp 37 PID 2496 wrote to memory of 2016 2496 F299.tmp 37 PID 2496 wrote to memory of 2016 2496 F299.tmp 37 PID 2496 wrote to memory of 2016 2496 F299.tmp 37 PID 2016 wrote to memory of 2716 2016 F306.tmp 38 PID 2016 wrote to memory of 2716 2016 F306.tmp 38 PID 2016 wrote to memory of 2716 2016 F306.tmp 38 PID 2016 wrote to memory of 2716 2016 F306.tmp 38 PID 2716 wrote to memory of 2696 2716 F344.tmp 39 PID 2716 wrote to memory of 2696 2716 F344.tmp 39 PID 2716 wrote to memory of 2696 2716 F344.tmp 39 PID 2716 wrote to memory of 2696 2716 F344.tmp 39 PID 2696 wrote to memory of 1504 2696 F3E0.tmp 40 PID 2696 wrote to memory of 1504 2696 F3E0.tmp 40 PID 2696 wrote to memory of 1504 2696 F3E0.tmp 40 PID 2696 wrote to memory of 1504 2696 F3E0.tmp 40 PID 1504 wrote to memory of 2580 1504 F43E.tmp 41 PID 1504 wrote to memory of 2580 1504 F43E.tmp 41 PID 1504 wrote to memory of 2580 1504 F43E.tmp 41 PID 1504 wrote to memory of 2580 1504 F43E.tmp 41 PID 2580 wrote to memory of 2604 2580 F47C.tmp 42 PID 2580 wrote to memory of 2604 2580 F47C.tmp 42 PID 2580 wrote to memory of 2604 2580 F47C.tmp 42 PID 2580 wrote to memory of 2604 2580 F47C.tmp 42 PID 2604 wrote to memory of 1020 2604 F4CA.tmp 43 PID 2604 wrote to memory of 1020 2604 F4CA.tmp 43 PID 2604 wrote to memory of 1020 2604 F4CA.tmp 43 PID 2604 wrote to memory of 1020 2604 F4CA.tmp 43 PID 1020 wrote to memory of 2464 1020 F518.tmp 44 PID 1020 wrote to memory of 2464 1020 F518.tmp 44 PID 1020 wrote to memory of 2464 1020 F518.tmp 44 PID 1020 wrote to memory of 2464 1020 F518.tmp 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-23_ccbe25de55dce61c724934f2adf24f5b_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-23_ccbe25de55dce61c724934f2adf24f5b_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\EF8D.tmp"C:\Users\Admin\AppData\Local\Temp\EF8D.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\F00A.tmp"C:\Users\Admin\AppData\Local\Temp\F00A.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\F096.tmp"C:\Users\Admin\AppData\Local\Temp\F096.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\F0E4.tmp"C:\Users\Admin\AppData\Local\Temp\F0E4.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\F151.tmp"C:\Users\Admin\AppData\Local\Temp\F151.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\F1AF.tmp"C:\Users\Admin\AppData\Local\Temp\F1AF.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\F21C.tmp"C:\Users\Admin\AppData\Local\Temp\F21C.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\F299.tmp"C:\Users\Admin\AppData\Local\Temp\F299.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\F306.tmp"C:\Users\Admin\AppData\Local\Temp\F306.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\F344.tmp"C:\Users\Admin\AppData\Local\Temp\F344.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\F3E0.tmp"C:\Users\Admin\AppData\Local\Temp\F3E0.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\F43E.tmp"C:\Users\Admin\AppData\Local\Temp\F43E.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\F47C.tmp"C:\Users\Admin\AppData\Local\Temp\F47C.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\F4CA.tmp"C:\Users\Admin\AppData\Local\Temp\F4CA.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\F518.tmp"C:\Users\Admin\AppData\Local\Temp\F518.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\F557.tmp"C:\Users\Admin\AppData\Local\Temp\F557.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\F595.tmp"C:\Users\Admin\AppData\Local\Temp\F595.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\F5E3.tmp"C:\Users\Admin\AppData\Local\Temp\F5E3.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\F641.tmp"C:\Users\Admin\AppData\Local\Temp\F641.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\F68F.tmp"C:\Users\Admin\AppData\Local\Temp\F68F.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\F71B.tmp"C:\Users\Admin\AppData\Local\Temp\F71B.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\F769.tmp"C:\Users\Admin\AppData\Local\Temp\F769.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:452 -
C:\Users\Admin\AppData\Local\Temp\F7A8.tmp"C:\Users\Admin\AppData\Local\Temp\F7A8.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\F7F6.tmp"C:\Users\Admin\AppData\Local\Temp\F7F6.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\F834.tmp"C:\Users\Admin\AppData\Local\Temp\F834.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\F872.tmp"C:\Users\Admin\AppData\Local\Temp\F872.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\F8B1.tmp"C:\Users\Admin\AppData\Local\Temp\F8B1.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\F8EF.tmp"C:\Users\Admin\AppData\Local\Temp\F8EF.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\F92E.tmp"C:\Users\Admin\AppData\Local\Temp\F92E.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\F96C.tmp"C:\Users\Admin\AppData\Local\Temp\F96C.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:624 -
C:\Users\Admin\AppData\Local\Temp\F9AA.tmp"C:\Users\Admin\AppData\Local\Temp\F9AA.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:900 -
C:\Users\Admin\AppData\Local\Temp\F9E9.tmp"C:\Users\Admin\AppData\Local\Temp\F9E9.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\FA27.tmp"C:\Users\Admin\AppData\Local\Temp\FA27.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\FA66.tmp"C:\Users\Admin\AppData\Local\Temp\FA66.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\FAA4.tmp"C:\Users\Admin\AppData\Local\Temp\FAA4.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\FAE2.tmp"C:\Users\Admin\AppData\Local\Temp\FAE2.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\FB30.tmp"C:\Users\Admin\AppData\Local\Temp\FB30.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:352 -
C:\Users\Admin\AppData\Local\Temp\FB9E.tmp"C:\Users\Admin\AppData\Local\Temp\FB9E.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\FBFB.tmp"C:\Users\Admin\AppData\Local\Temp\FBFB.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\FC59.tmp"C:\Users\Admin\AppData\Local\Temp\FC59.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:580 -
C:\Users\Admin\AppData\Local\Temp\FCA7.tmp"C:\Users\Admin\AppData\Local\Temp\FCA7.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\FD04.tmp"C:\Users\Admin\AppData\Local\Temp\FD04.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:264 -
C:\Users\Admin\AppData\Local\Temp\FD72.tmp"C:\Users\Admin\AppData\Local\Temp\FD72.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\FDC0.tmp"C:\Users\Admin\AppData\Local\Temp\FDC0.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\FE0E.tmp"C:\Users\Admin\AppData\Local\Temp\FE0E.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:932 -
C:\Users\Admin\AppData\Local\Temp\FE5C.tmp"C:\Users\Admin\AppData\Local\Temp\FE5C.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:472 -
C:\Users\Admin\AppData\Local\Temp\FEAA.tmp"C:\Users\Admin\AppData\Local\Temp\FEAA.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\FEE8.tmp"C:\Users\Admin\AppData\Local\Temp\FEE8.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:872 -
C:\Users\Admin\AppData\Local\Temp\FF36.tmp"C:\Users\Admin\AppData\Local\Temp\FF36.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:984 -
C:\Users\Admin\AppData\Local\Temp\FF74.tmp"C:\Users\Admin\AppData\Local\Temp\FF74.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\FFB3.tmp"C:\Users\Admin\AppData\Local\Temp\FFB3.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\1.tmp"C:\Users\Admin\AppData\Local\Temp\1.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\3F.tmp"C:\Users\Admin\AppData\Local\Temp\3F.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\7E.tmp"C:\Users\Admin\AppData\Local\Temp\7E.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\BC.tmp"C:\Users\Admin\AppData\Local\Temp\BC.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\FA.tmp"C:\Users\Admin\AppData\Local\Temp\FA.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\139.tmp"C:\Users\Admin\AppData\Local\Temp\139.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\177.tmp"C:\Users\Admin\AppData\Local\Temp\177.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\1B6.tmp"C:\Users\Admin\AppData\Local\Temp\1B6.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\1F4.tmp"C:\Users\Admin\AppData\Local\Temp\1F4.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\242.tmp"C:\Users\Admin\AppData\Local\Temp\242.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\280.tmp"C:\Users\Admin\AppData\Local\Temp\280.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\2CE.tmp"C:\Users\Admin\AppData\Local\Temp\2CE.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\31C.tmp"C:\Users\Admin\AppData\Local\Temp\31C.tmp"65⤵
- Executes dropped EXE
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\35B.tmp"C:\Users\Admin\AppData\Local\Temp\35B.tmp"66⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\399.tmp"C:\Users\Admin\AppData\Local\Temp\399.tmp"67⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\3D8.tmp"C:\Users\Admin\AppData\Local\Temp\3D8.tmp"68⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\426.tmp"C:\Users\Admin\AppData\Local\Temp\426.tmp"69⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\474.tmp"C:\Users\Admin\AppData\Local\Temp\474.tmp"70⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\4B2.tmp"C:\Users\Admin\AppData\Local\Temp\4B2.tmp"71⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\4F0.tmp"C:\Users\Admin\AppData\Local\Temp\4F0.tmp"72⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\52F.tmp"C:\Users\Admin\AppData\Local\Temp\52F.tmp"73⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\57D.tmp"C:\Users\Admin\AppData\Local\Temp\57D.tmp"74⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\5BB.tmp"C:\Users\Admin\AppData\Local\Temp\5BB.tmp"75⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\5FA.tmp"C:\Users\Admin\AppData\Local\Temp\5FA.tmp"76⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\638.tmp"C:\Users\Admin\AppData\Local\Temp\638.tmp"77⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\676.tmp"C:\Users\Admin\AppData\Local\Temp\676.tmp"78⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\6C4.tmp"C:\Users\Admin\AppData\Local\Temp\6C4.tmp"79⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\703.tmp"C:\Users\Admin\AppData\Local\Temp\703.tmp"80⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\751.tmp"C:\Users\Admin\AppData\Local\Temp\751.tmp"81⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\78F.tmp"C:\Users\Admin\AppData\Local\Temp\78F.tmp"82⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\7CE.tmp"C:\Users\Admin\AppData\Local\Temp\7CE.tmp"83⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\80C.tmp"C:\Users\Admin\AppData\Local\Temp\80C.tmp"84⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\84A.tmp"C:\Users\Admin\AppData\Local\Temp\84A.tmp"85⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\889.tmp"C:\Users\Admin\AppData\Local\Temp\889.tmp"86⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\8D7.tmp"C:\Users\Admin\AppData\Local\Temp\8D7.tmp"87⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\915.tmp"C:\Users\Admin\AppData\Local\Temp\915.tmp"88⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\963.tmp"C:\Users\Admin\AppData\Local\Temp\963.tmp"89⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\9A2.tmp"C:\Users\Admin\AppData\Local\Temp\9A2.tmp"90⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\9F0.tmp"C:\Users\Admin\AppData\Local\Temp\9F0.tmp"91⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\A3E.tmp"C:\Users\Admin\AppData\Local\Temp\A3E.tmp"92⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\A7C.tmp"C:\Users\Admin\AppData\Local\Temp\A7C.tmp"93⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\ACA.tmp"C:\Users\Admin\AppData\Local\Temp\ACA.tmp"94⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\B08.tmp"C:\Users\Admin\AppData\Local\Temp\B08.tmp"95⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\B47.tmp"C:\Users\Admin\AppData\Local\Temp\B47.tmp"96⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\B95.tmp"C:\Users\Admin\AppData\Local\Temp\B95.tmp"97⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\BD3.tmp"C:\Users\Admin\AppData\Local\Temp\BD3.tmp"98⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\C21.tmp"C:\Users\Admin\AppData\Local\Temp\C21.tmp"99⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\C60.tmp"C:\Users\Admin\AppData\Local\Temp\C60.tmp"100⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\C9E.tmp"C:\Users\Admin\AppData\Local\Temp\C9E.tmp"101⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\CDC.tmp"C:\Users\Admin\AppData\Local\Temp\CDC.tmp"102⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\D2A.tmp"C:\Users\Admin\AppData\Local\Temp\D2A.tmp"103⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\D69.tmp"C:\Users\Admin\AppData\Local\Temp\D69.tmp"104⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\DA7.tmp"C:\Users\Admin\AppData\Local\Temp\DA7.tmp"105⤵
- System Location Discovery: System Language Discovery
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\DE6.tmp"C:\Users\Admin\AppData\Local\Temp\DE6.tmp"106⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\E24.tmp"C:\Users\Admin\AppData\Local\Temp\E24.tmp"107⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\E62.tmp"C:\Users\Admin\AppData\Local\Temp\E62.tmp"108⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\EA1.tmp"C:\Users\Admin\AppData\Local\Temp\EA1.tmp"109⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\EEF.tmp"C:\Users\Admin\AppData\Local\Temp\EEF.tmp"110⤵
- System Location Discovery: System Language Discovery
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\F2D.tmp"C:\Users\Admin\AppData\Local\Temp\F2D.tmp"111⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\F6C.tmp"C:\Users\Admin\AppData\Local\Temp\F6C.tmp"112⤵PID:472
-
C:\Users\Admin\AppData\Local\Temp\FBA.tmp"C:\Users\Admin\AppData\Local\Temp\FBA.tmp"113⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\FF8.tmp"C:\Users\Admin\AppData\Local\Temp\FF8.tmp"114⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\1036.tmp"C:\Users\Admin\AppData\Local\Temp\1036.tmp"115⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\1084.tmp"C:\Users\Admin\AppData\Local\Temp\1084.tmp"116⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\10C3.tmp"C:\Users\Admin\AppData\Local\Temp\10C3.tmp"117⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\1101.tmp"C:\Users\Admin\AppData\Local\Temp\1101.tmp"118⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\1140.tmp"C:\Users\Admin\AppData\Local\Temp\1140.tmp"119⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\117E.tmp"C:\Users\Admin\AppData\Local\Temp\117E.tmp"120⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\11BC.tmp"C:\Users\Admin\AppData\Local\Temp\11BC.tmp"121⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\11FB.tmp"C:\Users\Admin\AppData\Local\Temp\11FB.tmp"122⤵PID:2876
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-