Analysis
-
max time kernel
150s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
26/08/2024, 00:39
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-26_aca9a7b3ad956092107bfa93a066241a_mafia.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-08-26_aca9a7b3ad956092107bfa93a066241a_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-26_aca9a7b3ad956092107bfa93a066241a_mafia.exe
-
Size
486KB
-
MD5
aca9a7b3ad956092107bfa93a066241a
-
SHA1
8023ba58030a88b016596ed3779f6c35a828626f
-
SHA256
32c0993347e4c83722236bc7e4c69ed7b95904f87a1225769a1e243b56bff1e0
-
SHA512
69de1f3525f8b0bff67b48719e519d913ba7b6d7388d63c23825eff8911151a13ffe61d8ef04b12c9be4e30d5c7ff19f66d74568354426617d7c9780d78fcdce
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7w73ivQuumX6amQnFB2Z/s8d5oRWoE9gMgW1Z:/U5rCOTeiDwb6uGmQc/s84RWoENVNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1816 982A.tmp 2704 98A7.tmp 2864 9924.tmp 2756 9981.tmp 952 99DF.tmp 2720 9A4C.tmp 2736 9AB9.tmp 2056 9B27.tmp 2832 9B84.tmp 2804 9BD2.tmp 2748 9C20.tmp 2644 9C7E.tmp 2120 9CBC.tmp 2108 9D0A.tmp 2956 9D58.tmp 2280 9DC5.tmp 2972 9E23.tmp 532 9E61.tmp 2888 9EBF.tmp 2912 9F2C.tmp 2568 9F8A.tmp 596 9FD8.tmp 2968 A026.tmp 1364 A064.tmp 1268 A0C2.tmp 1640 A100.tmp 1292 A14E.tmp 2556 A1AC.tmp 2176 A209.tmp 1508 A257.tmp 2392 A2A5.tmp 1808 A2E4.tmp 1552 A332.tmp 1728 A370.tmp 2088 A3AF.tmp 1832 A3ED.tmp 2256 A43B.tmp 2544 A479.tmp 1080 A4B8.tmp 276 A4F6.tmp 636 A535.tmp 2160 A573.tmp 1876 A5B1.tmp 928 A5F0.tmp 2084 A62E.tmp 2068 A66D.tmp 3068 A6AB.tmp 2132 A6E9.tmp 2260 A728.tmp 888 A766.tmp 828 A7A5.tmp 856 A7E3.tmp 1620 A821.tmp 2524 A860.tmp 2192 A89E.tmp 1532 A8DD.tmp 1504 A91B.tmp 2272 A959.tmp 2876 A998.tmp 2756 A9D6.tmp 2032 AA15.tmp 3024 AA53.tmp 1160 AA91.tmp 2196 AAD0.tmp -
Loads dropped DLL 64 IoCs
pid Process 1644 2024-08-26_aca9a7b3ad956092107bfa93a066241a_mafia.exe 1816 982A.tmp 2704 98A7.tmp 2864 9924.tmp 2756 9981.tmp 952 99DF.tmp 2720 9A4C.tmp 2736 9AB9.tmp 2056 9B27.tmp 2832 9B84.tmp 2804 9BD2.tmp 2748 9C20.tmp 2644 9C7E.tmp 2120 9CBC.tmp 2108 9D0A.tmp 2956 9D58.tmp 2280 9DC5.tmp 2972 9E23.tmp 532 9E61.tmp 2888 9EBF.tmp 2912 9F2C.tmp 2568 9F8A.tmp 596 9FD8.tmp 2968 A026.tmp 1364 A064.tmp 1268 A0C2.tmp 1640 A100.tmp 1292 A14E.tmp 2556 A1AC.tmp 2176 A209.tmp 1508 A257.tmp 2392 A2A5.tmp 1808 A2E4.tmp 1552 A332.tmp 1728 A370.tmp 2088 A3AF.tmp 1832 A3ED.tmp 2256 A43B.tmp 2544 A479.tmp 1080 A4B8.tmp 276 A4F6.tmp 636 A535.tmp 2160 A573.tmp 1876 A5B1.tmp 928 A5F0.tmp 2084 A62E.tmp 2068 A66D.tmp 3068 A6AB.tmp 2132 A6E9.tmp 2260 A728.tmp 888 A766.tmp 828 A7A5.tmp 856 A7E3.tmp 1620 A821.tmp 2524 A860.tmp 2192 A89E.tmp 1532 A8DD.tmp 1504 A91B.tmp 2272 A959.tmp 2876 A998.tmp 2756 A9D6.tmp 2032 AA15.tmp 3024 AA53.tmp 1160 AA91.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8CB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2397.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A209.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F132.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2971.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B76.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5532.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B210.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E060.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F72B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B673.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDD1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F24.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5052.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1120.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7169.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1644 wrote to memory of 1816 1644 2024-08-26_aca9a7b3ad956092107bfa93a066241a_mafia.exe 29 PID 1644 wrote to memory of 1816 1644 2024-08-26_aca9a7b3ad956092107bfa93a066241a_mafia.exe 29 PID 1644 wrote to memory of 1816 1644 2024-08-26_aca9a7b3ad956092107bfa93a066241a_mafia.exe 29 PID 1644 wrote to memory of 1816 1644 2024-08-26_aca9a7b3ad956092107bfa93a066241a_mafia.exe 29 PID 1816 wrote to memory of 2704 1816 982A.tmp 30 PID 1816 wrote to memory of 2704 1816 982A.tmp 30 PID 1816 wrote to memory of 2704 1816 982A.tmp 30 PID 1816 wrote to memory of 2704 1816 982A.tmp 30 PID 2704 wrote to memory of 2864 2704 98A7.tmp 31 PID 2704 wrote to memory of 2864 2704 98A7.tmp 31 PID 2704 wrote to memory of 2864 2704 98A7.tmp 31 PID 2704 wrote to memory of 2864 2704 98A7.tmp 31 PID 2864 wrote to memory of 2756 2864 9924.tmp 32 PID 2864 wrote to memory of 2756 2864 9924.tmp 32 PID 2864 wrote to memory of 2756 2864 9924.tmp 32 PID 2864 wrote to memory of 2756 2864 9924.tmp 32 PID 2756 wrote to memory of 952 2756 9981.tmp 33 PID 2756 wrote to memory of 952 2756 9981.tmp 33 PID 2756 wrote to memory of 952 2756 9981.tmp 33 PID 2756 wrote to memory of 952 2756 9981.tmp 33 PID 952 wrote to memory of 2720 952 99DF.tmp 34 PID 952 wrote to memory of 2720 952 99DF.tmp 34 PID 952 wrote to memory of 2720 952 99DF.tmp 34 PID 952 wrote to memory of 2720 952 99DF.tmp 34 PID 2720 wrote to memory of 2736 2720 9A4C.tmp 35 PID 2720 wrote to memory of 2736 2720 9A4C.tmp 35 PID 2720 wrote to memory of 2736 2720 9A4C.tmp 35 PID 2720 wrote to memory of 2736 2720 9A4C.tmp 35 PID 2736 wrote to memory of 2056 2736 9AB9.tmp 36 PID 2736 wrote to memory of 2056 2736 9AB9.tmp 36 PID 2736 wrote to memory of 2056 2736 9AB9.tmp 36 PID 2736 wrote to memory of 2056 2736 9AB9.tmp 36 PID 2056 wrote to memory of 2832 2056 9B27.tmp 37 PID 2056 wrote to memory of 2832 2056 9B27.tmp 37 PID 2056 wrote to memory of 2832 2056 9B27.tmp 37 PID 2056 wrote to memory of 2832 2056 9B27.tmp 37 PID 2832 wrote to memory of 2804 2832 9B84.tmp 38 PID 2832 wrote to memory of 2804 2832 9B84.tmp 38 PID 2832 wrote to memory of 2804 2832 9B84.tmp 38 PID 2832 wrote to memory of 2804 2832 9B84.tmp 38 PID 2804 wrote to memory of 2748 2804 9BD2.tmp 39 PID 2804 wrote to memory of 2748 2804 9BD2.tmp 39 PID 2804 wrote to memory of 2748 2804 9BD2.tmp 39 PID 2804 wrote to memory of 2748 2804 9BD2.tmp 39 PID 2748 wrote to memory of 2644 2748 9C20.tmp 40 PID 2748 wrote to memory of 2644 2748 9C20.tmp 40 PID 2748 wrote to memory of 2644 2748 9C20.tmp 40 PID 2748 wrote to memory of 2644 2748 9C20.tmp 40 PID 2644 wrote to memory of 2120 2644 9C7E.tmp 41 PID 2644 wrote to memory of 2120 2644 9C7E.tmp 41 PID 2644 wrote to memory of 2120 2644 9C7E.tmp 41 PID 2644 wrote to memory of 2120 2644 9C7E.tmp 41 PID 2120 wrote to memory of 2108 2120 9CBC.tmp 42 PID 2120 wrote to memory of 2108 2120 9CBC.tmp 42 PID 2120 wrote to memory of 2108 2120 9CBC.tmp 42 PID 2120 wrote to memory of 2108 2120 9CBC.tmp 42 PID 2108 wrote to memory of 2956 2108 9D0A.tmp 43 PID 2108 wrote to memory of 2956 2108 9D0A.tmp 43 PID 2108 wrote to memory of 2956 2108 9D0A.tmp 43 PID 2108 wrote to memory of 2956 2108 9D0A.tmp 43 PID 2956 wrote to memory of 2280 2956 9D58.tmp 44 PID 2956 wrote to memory of 2280 2956 9D58.tmp 44 PID 2956 wrote to memory of 2280 2956 9D58.tmp 44 PID 2956 wrote to memory of 2280 2956 9D58.tmp 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-26_aca9a7b3ad956092107bfa93a066241a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-26_aca9a7b3ad956092107bfa93a066241a_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\982A.tmp"C:\Users\Admin\AppData\Local\Temp\982A.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\98A7.tmp"C:\Users\Admin\AppData\Local\Temp\98A7.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\9924.tmp"C:\Users\Admin\AppData\Local\Temp\9924.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\9981.tmp"C:\Users\Admin\AppData\Local\Temp\9981.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\99DF.tmp"C:\Users\Admin\AppData\Local\Temp\99DF.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\9B27.tmp"C:\Users\Admin\AppData\Local\Temp\9B27.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\9C20.tmp"C:\Users\Admin\AppData\Local\Temp\9C20.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\9CBC.tmp"C:\Users\Admin\AppData\Local\Temp\9CBC.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\9D0A.tmp"C:\Users\Admin\AppData\Local\Temp\9D0A.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\9D58.tmp"C:\Users\Admin\AppData\Local\Temp\9D58.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\9DC5.tmp"C:\Users\Admin\AppData\Local\Temp\9DC5.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\9E23.tmp"C:\Users\Admin\AppData\Local\Temp\9E23.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\9E61.tmp"C:\Users\Admin\AppData\Local\Temp\9E61.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:532 -
C:\Users\Admin\AppData\Local\Temp\9EBF.tmp"C:\Users\Admin\AppData\Local\Temp\9EBF.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\9F2C.tmp"C:\Users\Admin\AppData\Local\Temp\9F2C.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\9F8A.tmp"C:\Users\Admin\AppData\Local\Temp\9F8A.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\9FD8.tmp"C:\Users\Admin\AppData\Local\Temp\9FD8.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:596 -
C:\Users\Admin\AppData\Local\Temp\A026.tmp"C:\Users\Admin\AppData\Local\Temp\A026.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\A064.tmp"C:\Users\Admin\AppData\Local\Temp\A064.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\A0C2.tmp"C:\Users\Admin\AppData\Local\Temp\A0C2.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\A100.tmp"C:\Users\Admin\AppData\Local\Temp\A100.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\A14E.tmp"C:\Users\Admin\AppData\Local\Temp\A14E.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\A1AC.tmp"C:\Users\Admin\AppData\Local\Temp\A1AC.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\A209.tmp"C:\Users\Admin\AppData\Local\Temp\A209.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\A257.tmp"C:\Users\Admin\AppData\Local\Temp\A257.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\A2A5.tmp"C:\Users\Admin\AppData\Local\Temp\A2A5.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\A2E4.tmp"C:\Users\Admin\AppData\Local\Temp\A2E4.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\A332.tmp"C:\Users\Admin\AppData\Local\Temp\A332.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\A370.tmp"C:\Users\Admin\AppData\Local\Temp\A370.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\A3AF.tmp"C:\Users\Admin\AppData\Local\Temp\A3AF.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\A3ED.tmp"C:\Users\Admin\AppData\Local\Temp\A3ED.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\A43B.tmp"C:\Users\Admin\AppData\Local\Temp\A43B.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\A479.tmp"C:\Users\Admin\AppData\Local\Temp\A479.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\A4B8.tmp"C:\Users\Admin\AppData\Local\Temp\A4B8.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\A4F6.tmp"C:\Users\Admin\AppData\Local\Temp\A4F6.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:276 -
C:\Users\Admin\AppData\Local\Temp\A535.tmp"C:\Users\Admin\AppData\Local\Temp\A535.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:636 -
C:\Users\Admin\AppData\Local\Temp\A573.tmp"C:\Users\Admin\AppData\Local\Temp\A573.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\A5B1.tmp"C:\Users\Admin\AppData\Local\Temp\A5B1.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\A5F0.tmp"C:\Users\Admin\AppData\Local\Temp\A5F0.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:928 -
C:\Users\Admin\AppData\Local\Temp\A62E.tmp"C:\Users\Admin\AppData\Local\Temp\A62E.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\A66D.tmp"C:\Users\Admin\AppData\Local\Temp\A66D.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\A6AB.tmp"C:\Users\Admin\AppData\Local\Temp\A6AB.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\A6E9.tmp"C:\Users\Admin\AppData\Local\Temp\A6E9.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\A728.tmp"C:\Users\Admin\AppData\Local\Temp\A728.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\A766.tmp"C:\Users\Admin\AppData\Local\Temp\A766.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:888 -
C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:828 -
C:\Users\Admin\AppData\Local\Temp\A7E3.tmp"C:\Users\Admin\AppData\Local\Temp\A7E3.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:856 -
C:\Users\Admin\AppData\Local\Temp\A821.tmp"C:\Users\Admin\AppData\Local\Temp\A821.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\A860.tmp"C:\Users\Admin\AppData\Local\Temp\A860.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\A89E.tmp"C:\Users\Admin\AppData\Local\Temp\A89E.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\A8DD.tmp"C:\Users\Admin\AppData\Local\Temp\A8DD.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\A91B.tmp"C:\Users\Admin\AppData\Local\Temp\A91B.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\A959.tmp"C:\Users\Admin\AppData\Local\Temp\A959.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\A998.tmp"C:\Users\Admin\AppData\Local\Temp\A998.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\A9D6.tmp"C:\Users\Admin\AppData\Local\Temp\A9D6.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\AA15.tmp"C:\Users\Admin\AppData\Local\Temp\AA15.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\AA53.tmp"C:\Users\Admin\AppData\Local\Temp\AA53.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\AA91.tmp"C:\Users\Admin\AppData\Local\Temp\AA91.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\AAD0.tmp"C:\Users\Admin\AppData\Local\Temp\AAD0.tmp"65⤵
- Executes dropped EXE
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\AB1E.tmp"C:\Users\Admin\AppData\Local\Temp\AB1E.tmp"66⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\AB6C.tmp"C:\Users\Admin\AppData\Local\Temp\AB6C.tmp"67⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\ABBA.tmp"C:\Users\Admin\AppData\Local\Temp\ABBA.tmp"68⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\ABF8.tmp"C:\Users\Admin\AppData\Local\Temp\ABF8.tmp"69⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\AC46.tmp"C:\Users\Admin\AppData\Local\Temp\AC46.tmp"70⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\AC85.tmp"C:\Users\Admin\AppData\Local\Temp\AC85.tmp"71⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\ACC3.tmp"C:\Users\Admin\AppData\Local\Temp\ACC3.tmp"72⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\AD11.tmp"C:\Users\Admin\AppData\Local\Temp\AD11.tmp"73⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\AD4F.tmp"C:\Users\Admin\AppData\Local\Temp\AD4F.tmp"74⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\AD8E.tmp"C:\Users\Admin\AppData\Local\Temp\AD8E.tmp"75⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\ADCC.tmp"C:\Users\Admin\AppData\Local\Temp\ADCC.tmp"76⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\AE0B.tmp"C:\Users\Admin\AppData\Local\Temp\AE0B.tmp"77⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\AE59.tmp"C:\Users\Admin\AppData\Local\Temp\AE59.tmp"78⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\AE97.tmp"C:\Users\Admin\AppData\Local\Temp\AE97.tmp"79⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\AED5.tmp"C:\Users\Admin\AppData\Local\Temp\AED5.tmp"80⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\AF14.tmp"C:\Users\Admin\AppData\Local\Temp\AF14.tmp"81⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\AF52.tmp"C:\Users\Admin\AppData\Local\Temp\AF52.tmp"82⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\AF91.tmp"C:\Users\Admin\AppData\Local\Temp\AF91.tmp"83⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\AFCF.tmp"C:\Users\Admin\AppData\Local\Temp\AFCF.tmp"84⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\B00D.tmp"C:\Users\Admin\AppData\Local\Temp\B00D.tmp"85⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\B04C.tmp"C:\Users\Admin\AppData\Local\Temp\B04C.tmp"86⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\B08A.tmp"C:\Users\Admin\AppData\Local\Temp\B08A.tmp"87⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\B0C9.tmp"C:\Users\Admin\AppData\Local\Temp\B0C9.tmp"88⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\B107.tmp"C:\Users\Admin\AppData\Local\Temp\B107.tmp"89⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\B145.tmp"C:\Users\Admin\AppData\Local\Temp\B145.tmp"90⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\B193.tmp"C:\Users\Admin\AppData\Local\Temp\B193.tmp"91⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\B1D2.tmp"C:\Users\Admin\AppData\Local\Temp\B1D2.tmp"92⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\B210.tmp"C:\Users\Admin\AppData\Local\Temp\B210.tmp"93⤵
- System Location Discovery: System Language Discovery
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\B24F.tmp"C:\Users\Admin\AppData\Local\Temp\B24F.tmp"94⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\B28D.tmp"C:\Users\Admin\AppData\Local\Temp\B28D.tmp"95⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\B2CB.tmp"C:\Users\Admin\AppData\Local\Temp\B2CB.tmp"96⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\B30A.tmp"C:\Users\Admin\AppData\Local\Temp\B30A.tmp"97⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\B348.tmp"C:\Users\Admin\AppData\Local\Temp\B348.tmp"98⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\B387.tmp"C:\Users\Admin\AppData\Local\Temp\B387.tmp"99⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\B3C5.tmp"C:\Users\Admin\AppData\Local\Temp\B3C5.tmp"100⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\B403.tmp"C:\Users\Admin\AppData\Local\Temp\B403.tmp"101⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\B442.tmp"C:\Users\Admin\AppData\Local\Temp\B442.tmp"102⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\B480.tmp"C:\Users\Admin\AppData\Local\Temp\B480.tmp"103⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\B4BF.tmp"C:\Users\Admin\AppData\Local\Temp\B4BF.tmp"104⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\B4FD.tmp"C:\Users\Admin\AppData\Local\Temp\B4FD.tmp"105⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\B53B.tmp"C:\Users\Admin\AppData\Local\Temp\B53B.tmp"106⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\B57A.tmp"C:\Users\Admin\AppData\Local\Temp\B57A.tmp"107⤵PID:344
-
C:\Users\Admin\AppData\Local\Temp\B5B8.tmp"C:\Users\Admin\AppData\Local\Temp\B5B8.tmp"108⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\B5F7.tmp"C:\Users\Admin\AppData\Local\Temp\B5F7.tmp"109⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\B635.tmp"C:\Users\Admin\AppData\Local\Temp\B635.tmp"110⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\B673.tmp"C:\Users\Admin\AppData\Local\Temp\B673.tmp"111⤵
- System Location Discovery: System Language Discovery
PID:916 -
C:\Users\Admin\AppData\Local\Temp\B6B2.tmp"C:\Users\Admin\AppData\Local\Temp\B6B2.tmp"112⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\B6F0.tmp"C:\Users\Admin\AppData\Local\Temp\B6F0.tmp"113⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\B72F.tmp"C:\Users\Admin\AppData\Local\Temp\B72F.tmp"114⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\B76D.tmp"C:\Users\Admin\AppData\Local\Temp\B76D.tmp"115⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\B7AB.tmp"C:\Users\Admin\AppData\Local\Temp\B7AB.tmp"116⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\B7EA.tmp"C:\Users\Admin\AppData\Local\Temp\B7EA.tmp"117⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\B828.tmp"C:\Users\Admin\AppData\Local\Temp\B828.tmp"118⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\B867.tmp"C:\Users\Admin\AppData\Local\Temp\B867.tmp"119⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\B8A5.tmp"C:\Users\Admin\AppData\Local\Temp\B8A5.tmp"120⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\B8E3.tmp"C:\Users\Admin\AppData\Local\Temp\B8E3.tmp"121⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\B922.tmp"C:\Users\Admin\AppData\Local\Temp\B922.tmp"122⤵PID:2600
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-