Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/09/2024, 10:19
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-08_ae305bb2c606269e2ba7a6dbd8e83852_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-08_ae305bb2c606269e2ba7a6dbd8e83852_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-08_ae305bb2c606269e2ba7a6dbd8e83852_mafia.exe
-
Size
529KB
-
MD5
ae305bb2c606269e2ba7a6dbd8e83852
-
SHA1
7dad2778aabbb09bd667460e40225ea3209a92a2
-
SHA256
fc378ceed0cc63a01b0773227753d990b67585ecfabaf22ed079fe24f0295d2f
-
SHA512
94d333b6d30c4ba2a6781c1344dd3ce7734e2dfb71860e9c0904304cf67607ff7a531d334e26fc60ac1d8853efdc2e4bcbf0ecf0a974af429eed1dbd487c2df9
-
SSDEEP
12288:NU5rCOTeij/9zhO38ohL2KaBQQctkVYzk0UdaKzTZwlH4Hp:NUQOJjlZc2vQ2kkxddzTSlH4Hp
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2376 9C5F.tmp 2164 9CBC.tmp 1732 9D29.tmp 1300 9DA6.tmp 2332 9E13.tmp 2820 9E81.tmp 2752 9EEE.tmp 284 9F6B.tmp 2408 9FD8.tmp 2760 A055.tmp 2596 A0C2.tmp 2668 A12F.tmp 2224 A19C.tmp 1932 A219.tmp 1616 A296.tmp 1980 A303.tmp 1584 A370.tmp 1488 A3DD.tmp 1268 A45A.tmp 492 A4D7.tmp 1976 A554.tmp 1992 A5C1.tmp 1756 A62E.tmp 2684 A66D.tmp 2916 A6AB.tmp 2076 A6E9.tmp 2540 A728.tmp 1180 A766.tmp 2984 A7A5.tmp 1988 A7F3.tmp 600 A831.tmp 1740 A86F.tmp 3044 A8AE.tmp 1916 A8EC.tmp 1072 A92B.tmp 2120 A969.tmp 1812 A9A7.tmp 1776 A9E6.tmp 1656 AA24.tmp 1548 AA63.tmp 656 AAB1.tmp 2268 AAFF.tmp 2476 AB4D.tmp 2288 AB8B.tmp 2524 ABC9.tmp 1236 AC08.tmp 2204 AC46.tmp 1748 AC85.tmp 1996 ACC3.tmp 2108 AD01.tmp 2472 AD40.tmp 1608 AD7E.tmp 1596 ADBD.tmp 1708 ADFB.tmp 2376 AE39.tmp 1868 AE78.tmp 3016 AEB6.tmp 2780 AEF5.tmp 280 AF33.tmp 3028 AF81.tmp 2332 AFBF.tmp 3032 B00D.tmp 2816 B04C.tmp 2752 B08A.tmp -
Loads dropped DLL 64 IoCs
pid Process 3068 2024-09-08_ae305bb2c606269e2ba7a6dbd8e83852_mafia.exe 2376 9C5F.tmp 2164 9CBC.tmp 1732 9D29.tmp 1300 9DA6.tmp 2332 9E13.tmp 2820 9E81.tmp 2752 9EEE.tmp 284 9F6B.tmp 2408 9FD8.tmp 2760 A055.tmp 2596 A0C2.tmp 2668 A12F.tmp 2224 A19C.tmp 1932 A219.tmp 1616 A296.tmp 1980 A303.tmp 1584 A370.tmp 1488 A3DD.tmp 1268 A45A.tmp 492 A4D7.tmp 1976 A554.tmp 1992 A5C1.tmp 1756 A62E.tmp 2684 A66D.tmp 2916 A6AB.tmp 2076 A6E9.tmp 2540 A728.tmp 1180 A766.tmp 2984 A7A5.tmp 1988 A7F3.tmp 600 A831.tmp 1740 A86F.tmp 3044 A8AE.tmp 1916 A8EC.tmp 1072 A92B.tmp 2120 A969.tmp 1812 A9A7.tmp 1776 A9E6.tmp 1656 AA24.tmp 1548 AA63.tmp 656 AAB1.tmp 2268 AAFF.tmp 2476 AB4D.tmp 2288 AB8B.tmp 2524 ABC9.tmp 1236 AC08.tmp 2204 AC46.tmp 1748 AC85.tmp 1996 ACC3.tmp 2108 AD01.tmp 2472 AD40.tmp 1608 AD7E.tmp 1596 ADBD.tmp 1708 ADFB.tmp 2376 AE39.tmp 1868 AE78.tmp 3016 AEB6.tmp 2780 AEF5.tmp 280 AF33.tmp 3028 AF81.tmp 2332 AFBF.tmp 3032 B00D.tmp 2816 B04C.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB99.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E041.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA30.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A554.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C38D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A92B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F103.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6ECA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3068 wrote to memory of 2376 3068 2024-09-08_ae305bb2c606269e2ba7a6dbd8e83852_mafia.exe 30 PID 3068 wrote to memory of 2376 3068 2024-09-08_ae305bb2c606269e2ba7a6dbd8e83852_mafia.exe 30 PID 3068 wrote to memory of 2376 3068 2024-09-08_ae305bb2c606269e2ba7a6dbd8e83852_mafia.exe 30 PID 3068 wrote to memory of 2376 3068 2024-09-08_ae305bb2c606269e2ba7a6dbd8e83852_mafia.exe 30 PID 2376 wrote to memory of 2164 2376 9C5F.tmp 31 PID 2376 wrote to memory of 2164 2376 9C5F.tmp 31 PID 2376 wrote to memory of 2164 2376 9C5F.tmp 31 PID 2376 wrote to memory of 2164 2376 9C5F.tmp 31 PID 2164 wrote to memory of 1732 2164 9CBC.tmp 32 PID 2164 wrote to memory of 1732 2164 9CBC.tmp 32 PID 2164 wrote to memory of 1732 2164 9CBC.tmp 32 PID 2164 wrote to memory of 1732 2164 9CBC.tmp 32 PID 1732 wrote to memory of 1300 1732 9D29.tmp 33 PID 1732 wrote to memory of 1300 1732 9D29.tmp 33 PID 1732 wrote to memory of 1300 1732 9D29.tmp 33 PID 1732 wrote to memory of 1300 1732 9D29.tmp 33 PID 1300 wrote to memory of 2332 1300 9DA6.tmp 34 PID 1300 wrote to memory of 2332 1300 9DA6.tmp 34 PID 1300 wrote to memory of 2332 1300 9DA6.tmp 34 PID 1300 wrote to memory of 2332 1300 9DA6.tmp 34 PID 2332 wrote to memory of 2820 2332 9E13.tmp 35 PID 2332 wrote to memory of 2820 2332 9E13.tmp 35 PID 2332 wrote to memory of 2820 2332 9E13.tmp 35 PID 2332 wrote to memory of 2820 2332 9E13.tmp 35 PID 2820 wrote to memory of 2752 2820 9E81.tmp 36 PID 2820 wrote to memory of 2752 2820 9E81.tmp 36 PID 2820 wrote to memory of 2752 2820 9E81.tmp 36 PID 2820 wrote to memory of 2752 2820 9E81.tmp 36 PID 2752 wrote to memory of 284 2752 9EEE.tmp 37 PID 2752 wrote to memory of 284 2752 9EEE.tmp 37 PID 2752 wrote to memory of 284 2752 9EEE.tmp 37 PID 2752 wrote to memory of 284 2752 9EEE.tmp 37 PID 284 wrote to memory of 2408 284 9F6B.tmp 38 PID 284 wrote to memory of 2408 284 9F6B.tmp 38 PID 284 wrote to memory of 2408 284 9F6B.tmp 38 PID 284 wrote to memory of 2408 284 9F6B.tmp 38 PID 2408 wrote to memory of 2760 2408 9FD8.tmp 39 PID 2408 wrote to memory of 2760 2408 9FD8.tmp 39 PID 2408 wrote to memory of 2760 2408 9FD8.tmp 39 PID 2408 wrote to memory of 2760 2408 9FD8.tmp 39 PID 2760 wrote to memory of 2596 2760 A055.tmp 40 PID 2760 wrote to memory of 2596 2760 A055.tmp 40 PID 2760 wrote to memory of 2596 2760 A055.tmp 40 PID 2760 wrote to memory of 2596 2760 A055.tmp 40 PID 2596 wrote to memory of 2668 2596 A0C2.tmp 41 PID 2596 wrote to memory of 2668 2596 A0C2.tmp 41 PID 2596 wrote to memory of 2668 2596 A0C2.tmp 41 PID 2596 wrote to memory of 2668 2596 A0C2.tmp 41 PID 2668 wrote to memory of 2224 2668 A12F.tmp 42 PID 2668 wrote to memory of 2224 2668 A12F.tmp 42 PID 2668 wrote to memory of 2224 2668 A12F.tmp 42 PID 2668 wrote to memory of 2224 2668 A12F.tmp 42 PID 2224 wrote to memory of 1932 2224 A19C.tmp 43 PID 2224 wrote to memory of 1932 2224 A19C.tmp 43 PID 2224 wrote to memory of 1932 2224 A19C.tmp 43 PID 2224 wrote to memory of 1932 2224 A19C.tmp 43 PID 1932 wrote to memory of 1616 1932 A219.tmp 44 PID 1932 wrote to memory of 1616 1932 A219.tmp 44 PID 1932 wrote to memory of 1616 1932 A219.tmp 44 PID 1932 wrote to memory of 1616 1932 A219.tmp 44 PID 1616 wrote to memory of 1980 1616 A296.tmp 45 PID 1616 wrote to memory of 1980 1616 A296.tmp 45 PID 1616 wrote to memory of 1980 1616 A296.tmp 45 PID 1616 wrote to memory of 1980 1616 A296.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-08_ae305bb2c606269e2ba7a6dbd8e83852_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-08_ae305bb2c606269e2ba7a6dbd8e83852_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\9CBC.tmp"C:\Users\Admin\AppData\Local\Temp\9CBC.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\9D29.tmp"C:\Users\Admin\AppData\Local\Temp\9D29.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\9DA6.tmp"C:\Users\Admin\AppData\Local\Temp\9DA6.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\9E13.tmp"C:\Users\Admin\AppData\Local\Temp\9E13.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\9E81.tmp"C:\Users\Admin\AppData\Local\Temp\9E81.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\9EEE.tmp"C:\Users\Admin\AppData\Local\Temp\9EEE.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\9F6B.tmp"C:\Users\Admin\AppData\Local\Temp\9F6B.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:284 -
C:\Users\Admin\AppData\Local\Temp\9FD8.tmp"C:\Users\Admin\AppData\Local\Temp\9FD8.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\A055.tmp"C:\Users\Admin\AppData\Local\Temp\A055.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\A0C2.tmp"C:\Users\Admin\AppData\Local\Temp\A0C2.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\A12F.tmp"C:\Users\Admin\AppData\Local\Temp\A12F.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\A19C.tmp"C:\Users\Admin\AppData\Local\Temp\A19C.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\A219.tmp"C:\Users\Admin\AppData\Local\Temp\A219.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\A296.tmp"C:\Users\Admin\AppData\Local\Temp\A296.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\A303.tmp"C:\Users\Admin\AppData\Local\Temp\A303.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\A370.tmp"C:\Users\Admin\AppData\Local\Temp\A370.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\A3DD.tmp"C:\Users\Admin\AppData\Local\Temp\A3DD.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\A45A.tmp"C:\Users\Admin\AppData\Local\Temp\A45A.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\A4D7.tmp"C:\Users\Admin\AppData\Local\Temp\A4D7.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:492 -
C:\Users\Admin\AppData\Local\Temp\A554.tmp"C:\Users\Admin\AppData\Local\Temp\A554.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\A5C1.tmp"C:\Users\Admin\AppData\Local\Temp\A5C1.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\A62E.tmp"C:\Users\Admin\AppData\Local\Temp\A62E.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\A66D.tmp"C:\Users\Admin\AppData\Local\Temp\A66D.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\A6AB.tmp"C:\Users\Admin\AppData\Local\Temp\A6AB.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\A6E9.tmp"C:\Users\Admin\AppData\Local\Temp\A6E9.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\A728.tmp"C:\Users\Admin\AppData\Local\Temp\A728.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\A766.tmp"C:\Users\Admin\AppData\Local\Temp\A766.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\A7F3.tmp"C:\Users\Admin\AppData\Local\Temp\A7F3.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\A831.tmp"C:\Users\Admin\AppData\Local\Temp\A831.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:600 -
C:\Users\Admin\AppData\Local\Temp\A86F.tmp"C:\Users\Admin\AppData\Local\Temp\A86F.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\A8AE.tmp"C:\Users\Admin\AppData\Local\Temp\A8AE.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\A8EC.tmp"C:\Users\Admin\AppData\Local\Temp\A8EC.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\A92B.tmp"C:\Users\Admin\AppData\Local\Temp\A92B.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\A969.tmp"C:\Users\Admin\AppData\Local\Temp\A969.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\A9A7.tmp"C:\Users\Admin\AppData\Local\Temp\A9A7.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\A9E6.tmp"C:\Users\Admin\AppData\Local\Temp\A9E6.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\AA24.tmp"C:\Users\Admin\AppData\Local\Temp\AA24.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\AA63.tmp"C:\Users\Admin\AppData\Local\Temp\AA63.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\AAB1.tmp"C:\Users\Admin\AppData\Local\Temp\AAB1.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:656 -
C:\Users\Admin\AppData\Local\Temp\AAFF.tmp"C:\Users\Admin\AppData\Local\Temp\AAFF.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\AB4D.tmp"C:\Users\Admin\AppData\Local\Temp\AB4D.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\AB8B.tmp"C:\Users\Admin\AppData\Local\Temp\AB8B.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\ABC9.tmp"C:\Users\Admin\AppData\Local\Temp\ABC9.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\AC08.tmp"C:\Users\Admin\AppData\Local\Temp\AC08.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\AC46.tmp"C:\Users\Admin\AppData\Local\Temp\AC46.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\AC85.tmp"C:\Users\Admin\AppData\Local\Temp\AC85.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\ACC3.tmp"C:\Users\Admin\AppData\Local\Temp\ACC3.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\AD01.tmp"C:\Users\Admin\AppData\Local\Temp\AD01.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\AD40.tmp"C:\Users\Admin\AppData\Local\Temp\AD40.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\AD7E.tmp"C:\Users\Admin\AppData\Local\Temp\AD7E.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\ADBD.tmp"C:\Users\Admin\AppData\Local\Temp\ADBD.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\ADFB.tmp"C:\Users\Admin\AppData\Local\Temp\ADFB.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\AE39.tmp"C:\Users\Admin\AppData\Local\Temp\AE39.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\AE78.tmp"C:\Users\Admin\AppData\Local\Temp\AE78.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\AEB6.tmp"C:\Users\Admin\AppData\Local\Temp\AEB6.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\AEF5.tmp"C:\Users\Admin\AppData\Local\Temp\AEF5.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\AF33.tmp"C:\Users\Admin\AppData\Local\Temp\AF33.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:280 -
C:\Users\Admin\AppData\Local\Temp\AF81.tmp"C:\Users\Admin\AppData\Local\Temp\AF81.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\AFBF.tmp"C:\Users\Admin\AppData\Local\Temp\AFBF.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\B00D.tmp"C:\Users\Admin\AppData\Local\Temp\B00D.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\B04C.tmp"C:\Users\Admin\AppData\Local\Temp\B04C.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\B08A.tmp"C:\Users\Admin\AppData\Local\Temp\B08A.tmp"65⤵
- Executes dropped EXE
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\B0C9.tmp"C:\Users\Admin\AppData\Local\Temp\B0C9.tmp"66⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\B107.tmp"C:\Users\Admin\AppData\Local\Temp\B107.tmp"67⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\B145.tmp"C:\Users\Admin\AppData\Local\Temp\B145.tmp"68⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\B184.tmp"C:\Users\Admin\AppData\Local\Temp\B184.tmp"69⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\B1C2.tmp"C:\Users\Admin\AppData\Local\Temp\B1C2.tmp"70⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\B201.tmp"C:\Users\Admin\AppData\Local\Temp\B201.tmp"71⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\B23F.tmp"C:\Users\Admin\AppData\Local\Temp\B23F.tmp"72⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\B27D.tmp"C:\Users\Admin\AppData\Local\Temp\B27D.tmp"73⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\B2BC.tmp"C:\Users\Admin\AppData\Local\Temp\B2BC.tmp"74⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\B2FA.tmp"C:\Users\Admin\AppData\Local\Temp\B2FA.tmp"75⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\B339.tmp"C:\Users\Admin\AppData\Local\Temp\B339.tmp"76⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\B377.tmp"C:\Users\Admin\AppData\Local\Temp\B377.tmp"77⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\B3B5.tmp"C:\Users\Admin\AppData\Local\Temp\B3B5.tmp"78⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\B3F4.tmp"C:\Users\Admin\AppData\Local\Temp\B3F4.tmp"79⤵PID:476
-
C:\Users\Admin\AppData\Local\Temp\B432.tmp"C:\Users\Admin\AppData\Local\Temp\B432.tmp"80⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\B471.tmp"C:\Users\Admin\AppData\Local\Temp\B471.tmp"81⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\B4AF.tmp"C:\Users\Admin\AppData\Local\Temp\B4AF.tmp"82⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\B4ED.tmp"C:\Users\Admin\AppData\Local\Temp\B4ED.tmp"83⤵
- System Location Discovery: System Language Discovery
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\B52C.tmp"C:\Users\Admin\AppData\Local\Temp\B52C.tmp"84⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\B56A.tmp"C:\Users\Admin\AppData\Local\Temp\B56A.tmp"85⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\B5A9.tmp"C:\Users\Admin\AppData\Local\Temp\B5A9.tmp"86⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\B5E7.tmp"C:\Users\Admin\AppData\Local\Temp\B5E7.tmp"87⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\B625.tmp"C:\Users\Admin\AppData\Local\Temp\B625.tmp"88⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\B664.tmp"C:\Users\Admin\AppData\Local\Temp\B664.tmp"89⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\B6A2.tmp"C:\Users\Admin\AppData\Local\Temp\B6A2.tmp"90⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\B6E1.tmp"C:\Users\Admin\AppData\Local\Temp\B6E1.tmp"91⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\B71F.tmp"C:\Users\Admin\AppData\Local\Temp\B71F.tmp"92⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\B75D.tmp"C:\Users\Admin\AppData\Local\Temp\B75D.tmp"93⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\B79C.tmp"C:\Users\Admin\AppData\Local\Temp\B79C.tmp"94⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\B7DA.tmp"C:\Users\Admin\AppData\Local\Temp\B7DA.tmp"95⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\B819.tmp"C:\Users\Admin\AppData\Local\Temp\B819.tmp"96⤵PID:600
-
C:\Users\Admin\AppData\Local\Temp\B857.tmp"C:\Users\Admin\AppData\Local\Temp\B857.tmp"97⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\B895.tmp"C:\Users\Admin\AppData\Local\Temp\B895.tmp"98⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\B8D4.tmp"C:\Users\Admin\AppData\Local\Temp\B8D4.tmp"99⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\B912.tmp"C:\Users\Admin\AppData\Local\Temp\B912.tmp"100⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\B951.tmp"C:\Users\Admin\AppData\Local\Temp\B951.tmp"101⤵PID:272
-
C:\Users\Admin\AppData\Local\Temp\B98F.tmp"C:\Users\Admin\AppData\Local\Temp\B98F.tmp"102⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\B9CD.tmp"C:\Users\Admin\AppData\Local\Temp\B9CD.tmp"103⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\BA0C.tmp"C:\Users\Admin\AppData\Local\Temp\BA0C.tmp"104⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\BA4A.tmp"C:\Users\Admin\AppData\Local\Temp\BA4A.tmp"105⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\BA89.tmp"C:\Users\Admin\AppData\Local\Temp\BA89.tmp"106⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\BAC7.tmp"C:\Users\Admin\AppData\Local\Temp\BAC7.tmp"107⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\BB05.tmp"C:\Users\Admin\AppData\Local\Temp\BB05.tmp"108⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\BB44.tmp"C:\Users\Admin\AppData\Local\Temp\BB44.tmp"109⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\BB82.tmp"C:\Users\Admin\AppData\Local\Temp\BB82.tmp"110⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\BBC1.tmp"C:\Users\Admin\AppData\Local\Temp\BBC1.tmp"111⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\BBFF.tmp"C:\Users\Admin\AppData\Local\Temp\BBFF.tmp"112⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\BC4D.tmp"C:\Users\Admin\AppData\Local\Temp\BC4D.tmp"113⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\BC8B.tmp"C:\Users\Admin\AppData\Local\Temp\BC8B.tmp"114⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\BCCA.tmp"C:\Users\Admin\AppData\Local\Temp\BCCA.tmp"115⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\BD08.tmp"C:\Users\Admin\AppData\Local\Temp\BD08.tmp"116⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\BD66.tmp"C:\Users\Admin\AppData\Local\Temp\BD66.tmp"117⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\BDA4.tmp"C:\Users\Admin\AppData\Local\Temp\BDA4.tmp"118⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\BDE3.tmp"C:\Users\Admin\AppData\Local\Temp\BDE3.tmp"119⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\BE21.tmp"C:\Users\Admin\AppData\Local\Temp\BE21.tmp"120⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\BE5F.tmp"C:\Users\Admin\AppData\Local\Temp\BE5F.tmp"121⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\BE9E.tmp"C:\Users\Admin\AppData\Local\Temp\BE9E.tmp"122⤵PID:3016
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-