Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
02/09/2024, 06:44
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-02_039ef107588843f5530107bbccc03fc9_mafia.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2024-09-02_039ef107588843f5530107bbccc03fc9_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-02_039ef107588843f5530107bbccc03fc9_mafia.exe
-
Size
488KB
-
MD5
039ef107588843f5530107bbccc03fc9
-
SHA1
77e93644c87078f0ef5ca19e01111976b0ce03c8
-
SHA256
6685369ed09a6dfc03ba125663a04bce1ba8605afa8abf1249b42dcd8aa51b2d
-
SHA512
b9e9a90bec39e6abc5739a3b6b7863fd71cea7ec6d425e90916f5df97fa5cfde14e04d77a40d0e34403a1ebb29af5396748d875b9c688691f9d0aef52dad7d62
-
SSDEEP
12288:/U5rCOTeiD28ZPHuIVLblfQnvBk+LjNiNZ:/UQOJDpHuI9lcliN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2524 A5E0.tmp 2340 A61F.tmp 1764 A69B.tmp 3060 A709.tmp 2300 A766.tmp 2856 A7D3.tmp 2120 A841.tmp 2304 A89E.tmp 2892 A90B.tmp 2608 A969.tmp 2700 A9C7.tmp 2604 AA24.tmp 3048 AA91.tmp 3056 AAFF.tmp 1560 AB6C.tmp 2572 ABC9.tmp 1244 AC27.tmp 596 AC85.tmp 2020 ACE2.tmp 1416 AD4F.tmp 1216 ADAD.tmp 1788 AE1A.tmp 1420 AE78.tmp 2848 AEB6.tmp 2836 AEF5.tmp 2236 AF33.tmp 2452 AF71.tmp 2060 AFB0.tmp 2316 AFEE.tmp 2924 B02D.tmp 2208 B06B.tmp 2492 B0B9.tmp 2984 B0F7.tmp 1092 B136.tmp 960 B174.tmp 788 B1B3.tmp 1348 B1F1.tmp 556 B22F.tmp 1700 B26E.tmp 1552 B2AC.tmp 1756 B2EB.tmp 1044 B329.tmp 708 B367.tmp 2396 B3C5.tmp 2380 B403.tmp 1500 B442.tmp 600 B480.tmp 1648 B4BF.tmp 3064 B4FD.tmp 2384 B53B.tmp 1668 B57A.tmp 2964 B5B8.tmp 1972 B5F7.tmp 1980 B635.tmp 1996 B683.tmp 2140 B6C1.tmp 2956 B700.tmp 2908 B73E.tmp 2112 B77D.tmp 2716 B7BB.tmp 2780 B7F9.tmp 2860 B838.tmp 2712 B876.tmp 2720 B8B5.tmp -
Loads dropped DLL 64 IoCs
pid Process 1972 2024-09-02_039ef107588843f5530107bbccc03fc9_mafia.exe 2524 A5E0.tmp 2340 A61F.tmp 1764 A69B.tmp 3060 A709.tmp 2300 A766.tmp 2856 A7D3.tmp 2120 A841.tmp 2304 A89E.tmp 2892 A90B.tmp 2608 A969.tmp 2700 A9C7.tmp 2604 AA24.tmp 3048 AA91.tmp 3056 AAFF.tmp 1560 AB6C.tmp 2572 ABC9.tmp 1244 AC27.tmp 596 AC85.tmp 2020 ACE2.tmp 1416 AD4F.tmp 1216 ADAD.tmp 1788 AE1A.tmp 1420 AE78.tmp 2848 AEB6.tmp 2836 AEF5.tmp 2236 AF33.tmp 2452 AF71.tmp 2060 AFB0.tmp 2316 AFEE.tmp 2924 B02D.tmp 2208 B06B.tmp 2492 B0B9.tmp 2984 B0F7.tmp 1092 B136.tmp 960 B174.tmp 788 B1B3.tmp 1348 B1F1.tmp 556 B22F.tmp 1700 B26E.tmp 1552 B2AC.tmp 1756 B2EB.tmp 1044 B329.tmp 708 B367.tmp 2396 B3C5.tmp 2380 B403.tmp 1500 B442.tmp 600 B480.tmp 1648 B4BF.tmp 3064 B4FD.tmp 2384 B53B.tmp 1668 B57A.tmp 2964 B5B8.tmp 1972 B5F7.tmp 1980 B635.tmp 1996 B683.tmp 2140 B6C1.tmp 2956 B700.tmp 2908 B73E.tmp 2112 B77D.tmp 2716 B7BB.tmp 2780 B7F9.tmp 2860 B838.tmp 2712 B876.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4588.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8279.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A209.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D76B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B838.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C091.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 788A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 671C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE5C.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1972 wrote to memory of 2524 1972 2024-09-02_039ef107588843f5530107bbccc03fc9_mafia.exe 30 PID 1972 wrote to memory of 2524 1972 2024-09-02_039ef107588843f5530107bbccc03fc9_mafia.exe 30 PID 1972 wrote to memory of 2524 1972 2024-09-02_039ef107588843f5530107bbccc03fc9_mafia.exe 30 PID 1972 wrote to memory of 2524 1972 2024-09-02_039ef107588843f5530107bbccc03fc9_mafia.exe 30 PID 2524 wrote to memory of 2340 2524 A5E0.tmp 31 PID 2524 wrote to memory of 2340 2524 A5E0.tmp 31 PID 2524 wrote to memory of 2340 2524 A5E0.tmp 31 PID 2524 wrote to memory of 2340 2524 A5E0.tmp 31 PID 2340 wrote to memory of 1764 2340 A61F.tmp 32 PID 2340 wrote to memory of 1764 2340 A61F.tmp 32 PID 2340 wrote to memory of 1764 2340 A61F.tmp 32 PID 2340 wrote to memory of 1764 2340 A61F.tmp 32 PID 1764 wrote to memory of 3060 1764 A69B.tmp 33 PID 1764 wrote to memory of 3060 1764 A69B.tmp 33 PID 1764 wrote to memory of 3060 1764 A69B.tmp 33 PID 1764 wrote to memory of 3060 1764 A69B.tmp 33 PID 3060 wrote to memory of 2300 3060 A709.tmp 34 PID 3060 wrote to memory of 2300 3060 A709.tmp 34 PID 3060 wrote to memory of 2300 3060 A709.tmp 34 PID 3060 wrote to memory of 2300 3060 A709.tmp 34 PID 2300 wrote to memory of 2856 2300 A766.tmp 35 PID 2300 wrote to memory of 2856 2300 A766.tmp 35 PID 2300 wrote to memory of 2856 2300 A766.tmp 35 PID 2300 wrote to memory of 2856 2300 A766.tmp 35 PID 2856 wrote to memory of 2120 2856 A7D3.tmp 36 PID 2856 wrote to memory of 2120 2856 A7D3.tmp 36 PID 2856 wrote to memory of 2120 2856 A7D3.tmp 36 PID 2856 wrote to memory of 2120 2856 A7D3.tmp 36 PID 2120 wrote to memory of 2304 2120 A841.tmp 37 PID 2120 wrote to memory of 2304 2120 A841.tmp 37 PID 2120 wrote to memory of 2304 2120 A841.tmp 37 PID 2120 wrote to memory of 2304 2120 A841.tmp 37 PID 2304 wrote to memory of 2892 2304 A89E.tmp 38 PID 2304 wrote to memory of 2892 2304 A89E.tmp 38 PID 2304 wrote to memory of 2892 2304 A89E.tmp 38 PID 2304 wrote to memory of 2892 2304 A89E.tmp 38 PID 2892 wrote to memory of 2608 2892 A90B.tmp 39 PID 2892 wrote to memory of 2608 2892 A90B.tmp 39 PID 2892 wrote to memory of 2608 2892 A90B.tmp 39 PID 2892 wrote to memory of 2608 2892 A90B.tmp 39 PID 2608 wrote to memory of 2700 2608 A969.tmp 40 PID 2608 wrote to memory of 2700 2608 A969.tmp 40 PID 2608 wrote to memory of 2700 2608 A969.tmp 40 PID 2608 wrote to memory of 2700 2608 A969.tmp 40 PID 2700 wrote to memory of 2604 2700 A9C7.tmp 41 PID 2700 wrote to memory of 2604 2700 A9C7.tmp 41 PID 2700 wrote to memory of 2604 2700 A9C7.tmp 41 PID 2700 wrote to memory of 2604 2700 A9C7.tmp 41 PID 2604 wrote to memory of 3048 2604 AA24.tmp 42 PID 2604 wrote to memory of 3048 2604 AA24.tmp 42 PID 2604 wrote to memory of 3048 2604 AA24.tmp 42 PID 2604 wrote to memory of 3048 2604 AA24.tmp 42 PID 3048 wrote to memory of 3056 3048 AA91.tmp 43 PID 3048 wrote to memory of 3056 3048 AA91.tmp 43 PID 3048 wrote to memory of 3056 3048 AA91.tmp 43 PID 3048 wrote to memory of 3056 3048 AA91.tmp 43 PID 3056 wrote to memory of 1560 3056 AAFF.tmp 44 PID 3056 wrote to memory of 1560 3056 AAFF.tmp 44 PID 3056 wrote to memory of 1560 3056 AAFF.tmp 44 PID 3056 wrote to memory of 1560 3056 AAFF.tmp 44 PID 1560 wrote to memory of 2572 1560 AB6C.tmp 45 PID 1560 wrote to memory of 2572 1560 AB6C.tmp 45 PID 1560 wrote to memory of 2572 1560 AB6C.tmp 45 PID 1560 wrote to memory of 2572 1560 AB6C.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-02_039ef107588843f5530107bbccc03fc9_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-02_039ef107588843f5530107bbccc03fc9_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\A5E0.tmp"C:\Users\Admin\AppData\Local\Temp\A5E0.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\A61F.tmp"C:\Users\Admin\AppData\Local\Temp\A61F.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\A69B.tmp"C:\Users\Admin\AppData\Local\Temp\A69B.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\A709.tmp"C:\Users\Admin\AppData\Local\Temp\A709.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\A766.tmp"C:\Users\Admin\AppData\Local\Temp\A766.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\A7D3.tmp"C:\Users\Admin\AppData\Local\Temp\A7D3.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\A841.tmp"C:\Users\Admin\AppData\Local\Temp\A841.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\A89E.tmp"C:\Users\Admin\AppData\Local\Temp\A89E.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\A90B.tmp"C:\Users\Admin\AppData\Local\Temp\A90B.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\A969.tmp"C:\Users\Admin\AppData\Local\Temp\A969.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\A9C7.tmp"C:\Users\Admin\AppData\Local\Temp\A9C7.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\AA24.tmp"C:\Users\Admin\AppData\Local\Temp\AA24.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\AA91.tmp"C:\Users\Admin\AppData\Local\Temp\AA91.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\AAFF.tmp"C:\Users\Admin\AppData\Local\Temp\AAFF.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\AB6C.tmp"C:\Users\Admin\AppData\Local\Temp\AB6C.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\ABC9.tmp"C:\Users\Admin\AppData\Local\Temp\ABC9.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\AC27.tmp"C:\Users\Admin\AppData\Local\Temp\AC27.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\AC85.tmp"C:\Users\Admin\AppData\Local\Temp\AC85.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:596 -
C:\Users\Admin\AppData\Local\Temp\ACE2.tmp"C:\Users\Admin\AppData\Local\Temp\ACE2.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\AD4F.tmp"C:\Users\Admin\AppData\Local\Temp\AD4F.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\ADAD.tmp"C:\Users\Admin\AppData\Local\Temp\ADAD.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\AE1A.tmp"C:\Users\Admin\AppData\Local\Temp\AE1A.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\AE78.tmp"C:\Users\Admin\AppData\Local\Temp\AE78.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\AEB6.tmp"C:\Users\Admin\AppData\Local\Temp\AEB6.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\AEF5.tmp"C:\Users\Admin\AppData\Local\Temp\AEF5.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\AF33.tmp"C:\Users\Admin\AppData\Local\Temp\AF33.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\AF71.tmp"C:\Users\Admin\AppData\Local\Temp\AF71.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\AFB0.tmp"C:\Users\Admin\AppData\Local\Temp\AFB0.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\AFEE.tmp"C:\Users\Admin\AppData\Local\Temp\AFEE.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\B02D.tmp"C:\Users\Admin\AppData\Local\Temp\B02D.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\B06B.tmp"C:\Users\Admin\AppData\Local\Temp\B06B.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\B0B9.tmp"C:\Users\Admin\AppData\Local\Temp\B0B9.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\B136.tmp"C:\Users\Admin\AppData\Local\Temp\B136.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\B174.tmp"C:\Users\Admin\AppData\Local\Temp\B174.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:960 -
C:\Users\Admin\AppData\Local\Temp\B1B3.tmp"C:\Users\Admin\AppData\Local\Temp\B1B3.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:788 -
C:\Users\Admin\AppData\Local\Temp\B1F1.tmp"C:\Users\Admin\AppData\Local\Temp\B1F1.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\B22F.tmp"C:\Users\Admin\AppData\Local\Temp\B22F.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:556 -
C:\Users\Admin\AppData\Local\Temp\B26E.tmp"C:\Users\Admin\AppData\Local\Temp\B26E.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\B2AC.tmp"C:\Users\Admin\AppData\Local\Temp\B2AC.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\B2EB.tmp"C:\Users\Admin\AppData\Local\Temp\B2EB.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\B329.tmp"C:\Users\Admin\AppData\Local\Temp\B329.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\B367.tmp"C:\Users\Admin\AppData\Local\Temp\B367.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:708 -
C:\Users\Admin\AppData\Local\Temp\B3C5.tmp"C:\Users\Admin\AppData\Local\Temp\B3C5.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\B403.tmp"C:\Users\Admin\AppData\Local\Temp\B403.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\B442.tmp"C:\Users\Admin\AppData\Local\Temp\B442.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\B480.tmp"C:\Users\Admin\AppData\Local\Temp\B480.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:600 -
C:\Users\Admin\AppData\Local\Temp\B4BF.tmp"C:\Users\Admin\AppData\Local\Temp\B4BF.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\B4FD.tmp"C:\Users\Admin\AppData\Local\Temp\B4FD.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\B53B.tmp"C:\Users\Admin\AppData\Local\Temp\B53B.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\B57A.tmp"C:\Users\Admin\AppData\Local\Temp\B57A.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\B5B8.tmp"C:\Users\Admin\AppData\Local\Temp\B5B8.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\B5F7.tmp"C:\Users\Admin\AppData\Local\Temp\B5F7.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\B635.tmp"C:\Users\Admin\AppData\Local\Temp\B635.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\B683.tmp"C:\Users\Admin\AppData\Local\Temp\B683.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\B6C1.tmp"C:\Users\Admin\AppData\Local\Temp\B6C1.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\B700.tmp"C:\Users\Admin\AppData\Local\Temp\B700.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\B73E.tmp"C:\Users\Admin\AppData\Local\Temp\B73E.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\B77D.tmp"C:\Users\Admin\AppData\Local\Temp\B77D.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\B7BB.tmp"C:\Users\Admin\AppData\Local\Temp\B7BB.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\B7F9.tmp"C:\Users\Admin\AppData\Local\Temp\B7F9.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\B838.tmp"C:\Users\Admin\AppData\Local\Temp\B838.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\B876.tmp"C:\Users\Admin\AppData\Local\Temp\B876.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\B8B5.tmp"C:\Users\Admin\AppData\Local\Temp\B8B5.tmp"65⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\B903.tmp"C:\Users\Admin\AppData\Local\Temp\B903.tmp"66⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\B941.tmp"C:\Users\Admin\AppData\Local\Temp\B941.tmp"67⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\B97F.tmp"C:\Users\Admin\AppData\Local\Temp\B97F.tmp"68⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\B9BE.tmp"C:\Users\Admin\AppData\Local\Temp\B9BE.tmp"69⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\B9FC.tmp"C:\Users\Admin\AppData\Local\Temp\B9FC.tmp"70⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\BA3B.tmp"C:\Users\Admin\AppData\Local\Temp\BA3B.tmp"71⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\BA79.tmp"C:\Users\Admin\AppData\Local\Temp\BA79.tmp"72⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\BAB7.tmp"C:\Users\Admin\AppData\Local\Temp\BAB7.tmp"73⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\BAF6.tmp"C:\Users\Admin\AppData\Local\Temp\BAF6.tmp"74⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\BB34.tmp"C:\Users\Admin\AppData\Local\Temp\BB34.tmp"75⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\BB73.tmp"C:\Users\Admin\AppData\Local\Temp\BB73.tmp"76⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\BBB1.tmp"C:\Users\Admin\AppData\Local\Temp\BBB1.tmp"77⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\BBEF.tmp"C:\Users\Admin\AppData\Local\Temp\BBEF.tmp"78⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\BC3D.tmp"C:\Users\Admin\AppData\Local\Temp\BC3D.tmp"79⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\BC7C.tmp"C:\Users\Admin\AppData\Local\Temp\BC7C.tmp"80⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\BCBA.tmp"C:\Users\Admin\AppData\Local\Temp\BCBA.tmp"81⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\BD08.tmp"C:\Users\Admin\AppData\Local\Temp\BD08.tmp"82⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\BD47.tmp"C:\Users\Admin\AppData\Local\Temp\BD47.tmp"83⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\BD95.tmp"C:\Users\Admin\AppData\Local\Temp\BD95.tmp"84⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\BDD3.tmp"C:\Users\Admin\AppData\Local\Temp\BDD3.tmp"85⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\BE11.tmp"C:\Users\Admin\AppData\Local\Temp\BE11.tmp"86⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\BE50.tmp"C:\Users\Admin\AppData\Local\Temp\BE50.tmp"87⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\BE8E.tmp"C:\Users\Admin\AppData\Local\Temp\BE8E.tmp"88⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\BEDC.tmp"C:\Users\Admin\AppData\Local\Temp\BEDC.tmp"89⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\BF1B.tmp"C:\Users\Admin\AppData\Local\Temp\BF1B.tmp"90⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\BF59.tmp"C:\Users\Admin\AppData\Local\Temp\BF59.tmp"91⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\BF97.tmp"C:\Users\Admin\AppData\Local\Temp\BF97.tmp"92⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\BFD6.tmp"C:\Users\Admin\AppData\Local\Temp\BFD6.tmp"93⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\C014.tmp"C:\Users\Admin\AppData\Local\Temp\C014.tmp"94⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\C053.tmp"C:\Users\Admin\AppData\Local\Temp\C053.tmp"95⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\C091.tmp"C:\Users\Admin\AppData\Local\Temp\C091.tmp"96⤵
- System Location Discovery: System Language Discovery
PID:448 -
C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"97⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\C10E.tmp"C:\Users\Admin\AppData\Local\Temp\C10E.tmp"98⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\C14C.tmp"C:\Users\Admin\AppData\Local\Temp\C14C.tmp"99⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\C18B.tmp"C:\Users\Admin\AppData\Local\Temp\C18B.tmp"100⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"101⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\C207.tmp"C:\Users\Admin\AppData\Local\Temp\C207.tmp"102⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\C246.tmp"C:\Users\Admin\AppData\Local\Temp\C246.tmp"103⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\C284.tmp"C:\Users\Admin\AppData\Local\Temp\C284.tmp"104⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"105⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\C301.tmp"C:\Users\Admin\AppData\Local\Temp\C301.tmp"106⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\C33F.tmp"C:\Users\Admin\AppData\Local\Temp\C33F.tmp"107⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\C38D.tmp"C:\Users\Admin\AppData\Local\Temp\C38D.tmp"108⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\C3CC.tmp"C:\Users\Admin\AppData\Local\Temp\C3CC.tmp"109⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\C40A.tmp"C:\Users\Admin\AppData\Local\Temp\C40A.tmp"110⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\C449.tmp"C:\Users\Admin\AppData\Local\Temp\C449.tmp"111⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\C487.tmp"C:\Users\Admin\AppData\Local\Temp\C487.tmp"112⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\C4C5.tmp"C:\Users\Admin\AppData\Local\Temp\C4C5.tmp"113⤵PID:600
-
C:\Users\Admin\AppData\Local\Temp\C513.tmp"C:\Users\Admin\AppData\Local\Temp\C513.tmp"114⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\C561.tmp"C:\Users\Admin\AppData\Local\Temp\C561.tmp"115⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\C5A0.tmp"C:\Users\Admin\AppData\Local\Temp\C5A0.tmp"116⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\C5DE.tmp"C:\Users\Admin\AppData\Local\Temp\C5DE.tmp"117⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\C62C.tmp"C:\Users\Admin\AppData\Local\Temp\C62C.tmp"118⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\C66B.tmp"C:\Users\Admin\AppData\Local\Temp\C66B.tmp"119⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\C6A9.tmp"C:\Users\Admin\AppData\Local\Temp\C6A9.tmp"120⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\C6E7.tmp"C:\Users\Admin\AppData\Local\Temp\C6E7.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\C735.tmp"C:\Users\Admin\AppData\Local\Temp\C735.tmp"122⤵PID:1748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-