Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13-09-2024 13:40
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-13_ef3a3b98a34d91838c8eb6252d49f2a5_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-13_ef3a3b98a34d91838c8eb6252d49f2a5_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-13_ef3a3b98a34d91838c8eb6252d49f2a5_mafia.exe
-
Size
486KB
-
MD5
ef3a3b98a34d91838c8eb6252d49f2a5
-
SHA1
93c6814d6a5940a09edd8ab79d342d4cde4fbcad
-
SHA256
0b91b1612d659c7b3a7269bd04e97fc1f004778dae9e884a5878ab1d419ed78b
-
SHA512
78fca8189aa13d2b5515c07dd5679fea40489f8ee861b14a79b4f35d30050e7fdbfc832e90e7906d032d147a6461b9d96bd6e5702fadf5c62599e19dd590ee3e
-
SSDEEP
12288:UU5rCOTeiD/KZClvtOKh54sgsoSIbNVwsNZ:UUQOJDSElvt7h54sgHjBCsN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2736 6E0F.tmp 2212 6E7C.tmp 2088 6EF9.tmp 2724 6F56.tmp 1948 6FD3.tmp 2608 7031.tmp 2356 708E.tmp 1944 70EC.tmp 600 7159.tmp 1572 71B7.tmp 2616 7224.tmp 2368 7281.tmp 1240 72DF.tmp 2976 733D.tmp 2940 73AA.tmp 2920 7407.tmp 2832 7475.tmp 2992 74C3.tmp 2320 7530.tmp 2864 758D.tmp 1504 75FB.tmp 1356 7658.tmp 2108 76B6.tmp 2768 76F4.tmp 2548 7733.tmp 2216 7781.tmp 2432 77BF.tmp 2420 77FD.tmp 2444 783C.tmp 2164 787A.tmp 1608 78C8.tmp 844 7907.tmp 1620 7945.tmp 2464 7983.tmp 700 79C2.tmp 968 7A00.tmp 1644 7A3F.tmp 3068 7A7D.tmp 1508 7ACB.tmp 2096 7B19.tmp 1656 7B67.tmp 620 7BA5.tmp 696 7BE4.tmp 2024 7C22.tmp 236 7C61.tmp 1964 7C9F.tmp 1888 7CDD.tmp 2180 7D1C.tmp 288 7D5A.tmp 2484 7D99.tmp 2684 7DD7.tmp 1624 7E25.tmp 1520 7E63.tmp 1636 7EA2.tmp 2824 7EE0.tmp 2892 7F2E.tmp 2612 7F6D.tmp 2212 7FAB.tmp 2956 7FE9.tmp 2620 8028.tmp 2724 8066.tmp 1948 80A5.tmp 1940 80F3.tmp 2608 8141.tmp -
Loads dropped DLL 64 IoCs
pid Process 2824 2024-09-13_ef3a3b98a34d91838c8eb6252d49f2a5_mafia.exe 2736 6E0F.tmp 2212 6E7C.tmp 2088 6EF9.tmp 2724 6F56.tmp 1948 6FD3.tmp 2608 7031.tmp 2356 708E.tmp 1944 70EC.tmp 600 7159.tmp 1572 71B7.tmp 2616 7224.tmp 2368 7281.tmp 1240 72DF.tmp 2976 733D.tmp 2940 73AA.tmp 2920 7407.tmp 2832 7475.tmp 2992 74C3.tmp 2320 7530.tmp 2864 758D.tmp 1504 75FB.tmp 1356 7658.tmp 2108 76B6.tmp 2768 76F4.tmp 2548 7733.tmp 2216 7781.tmp 2432 77BF.tmp 2420 77FD.tmp 2444 783C.tmp 2164 787A.tmp 1608 78C8.tmp 844 7907.tmp 1620 7945.tmp 2464 7983.tmp 700 79C2.tmp 968 7A00.tmp 1644 7A3F.tmp 3068 7A7D.tmp 1508 7ACB.tmp 2096 7B19.tmp 1656 7B67.tmp 620 7BA5.tmp 696 7BE4.tmp 2024 7C22.tmp 236 7C61.tmp 1964 7C9F.tmp 1888 7CDD.tmp 2180 7D1C.tmp 288 7D5A.tmp 2484 7D99.tmp 2684 7DD7.tmp 1624 7E25.tmp 1520 7E63.tmp 1636 7EA2.tmp 2824 7EE0.tmp 2892 7F2E.tmp 2612 7F6D.tmp 2212 7FAB.tmp 2956 7FE9.tmp 2620 8028.tmp 2724 8066.tmp 1948 80A5.tmp 1940 80F3.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C12D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FA2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7021.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 787A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B4E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FED8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1056.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1822.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A351.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E189.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 864F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2824 wrote to memory of 2736 2824 2024-09-13_ef3a3b98a34d91838c8eb6252d49f2a5_mafia.exe 30 PID 2824 wrote to memory of 2736 2824 2024-09-13_ef3a3b98a34d91838c8eb6252d49f2a5_mafia.exe 30 PID 2824 wrote to memory of 2736 2824 2024-09-13_ef3a3b98a34d91838c8eb6252d49f2a5_mafia.exe 30 PID 2824 wrote to memory of 2736 2824 2024-09-13_ef3a3b98a34d91838c8eb6252d49f2a5_mafia.exe 30 PID 2736 wrote to memory of 2212 2736 6E0F.tmp 31 PID 2736 wrote to memory of 2212 2736 6E0F.tmp 31 PID 2736 wrote to memory of 2212 2736 6E0F.tmp 31 PID 2736 wrote to memory of 2212 2736 6E0F.tmp 31 PID 2212 wrote to memory of 2088 2212 6E7C.tmp 32 PID 2212 wrote to memory of 2088 2212 6E7C.tmp 32 PID 2212 wrote to memory of 2088 2212 6E7C.tmp 32 PID 2212 wrote to memory of 2088 2212 6E7C.tmp 32 PID 2088 wrote to memory of 2724 2088 6EF9.tmp 33 PID 2088 wrote to memory of 2724 2088 6EF9.tmp 33 PID 2088 wrote to memory of 2724 2088 6EF9.tmp 33 PID 2088 wrote to memory of 2724 2088 6EF9.tmp 33 PID 2724 wrote to memory of 1948 2724 6F56.tmp 34 PID 2724 wrote to memory of 1948 2724 6F56.tmp 34 PID 2724 wrote to memory of 1948 2724 6F56.tmp 34 PID 2724 wrote to memory of 1948 2724 6F56.tmp 34 PID 1948 wrote to memory of 2608 1948 6FD3.tmp 35 PID 1948 wrote to memory of 2608 1948 6FD3.tmp 35 PID 1948 wrote to memory of 2608 1948 6FD3.tmp 35 PID 1948 wrote to memory of 2608 1948 6FD3.tmp 35 PID 2608 wrote to memory of 2356 2608 7031.tmp 36 PID 2608 wrote to memory of 2356 2608 7031.tmp 36 PID 2608 wrote to memory of 2356 2608 7031.tmp 36 PID 2608 wrote to memory of 2356 2608 7031.tmp 36 PID 2356 wrote to memory of 1944 2356 708E.tmp 37 PID 2356 wrote to memory of 1944 2356 708E.tmp 37 PID 2356 wrote to memory of 1944 2356 708E.tmp 37 PID 2356 wrote to memory of 1944 2356 708E.tmp 37 PID 1944 wrote to memory of 600 1944 70EC.tmp 38 PID 1944 wrote to memory of 600 1944 70EC.tmp 38 PID 1944 wrote to memory of 600 1944 70EC.tmp 38 PID 1944 wrote to memory of 600 1944 70EC.tmp 38 PID 600 wrote to memory of 1572 600 7159.tmp 39 PID 600 wrote to memory of 1572 600 7159.tmp 39 PID 600 wrote to memory of 1572 600 7159.tmp 39 PID 600 wrote to memory of 1572 600 7159.tmp 39 PID 1572 wrote to memory of 2616 1572 71B7.tmp 40 PID 1572 wrote to memory of 2616 1572 71B7.tmp 40 PID 1572 wrote to memory of 2616 1572 71B7.tmp 40 PID 1572 wrote to memory of 2616 1572 71B7.tmp 40 PID 2616 wrote to memory of 2368 2616 7224.tmp 41 PID 2616 wrote to memory of 2368 2616 7224.tmp 41 PID 2616 wrote to memory of 2368 2616 7224.tmp 41 PID 2616 wrote to memory of 2368 2616 7224.tmp 41 PID 2368 wrote to memory of 1240 2368 7281.tmp 42 PID 2368 wrote to memory of 1240 2368 7281.tmp 42 PID 2368 wrote to memory of 1240 2368 7281.tmp 42 PID 2368 wrote to memory of 1240 2368 7281.tmp 42 PID 1240 wrote to memory of 2976 1240 72DF.tmp 43 PID 1240 wrote to memory of 2976 1240 72DF.tmp 43 PID 1240 wrote to memory of 2976 1240 72DF.tmp 43 PID 1240 wrote to memory of 2976 1240 72DF.tmp 43 PID 2976 wrote to memory of 2940 2976 733D.tmp 44 PID 2976 wrote to memory of 2940 2976 733D.tmp 44 PID 2976 wrote to memory of 2940 2976 733D.tmp 44 PID 2976 wrote to memory of 2940 2976 733D.tmp 44 PID 2940 wrote to memory of 2920 2940 73AA.tmp 45 PID 2940 wrote to memory of 2920 2940 73AA.tmp 45 PID 2940 wrote to memory of 2920 2940 73AA.tmp 45 PID 2940 wrote to memory of 2920 2940 73AA.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_ef3a3b98a34d91838c8eb6252d49f2a5_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-13_ef3a3b98a34d91838c8eb6252d49f2a5_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\6E0F.tmp"C:\Users\Admin\AppData\Local\Temp\6E0F.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\6E7C.tmp"C:\Users\Admin\AppData\Local\Temp\6E7C.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\6EF9.tmp"C:\Users\Admin\AppData\Local\Temp\6EF9.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\6F56.tmp"C:\Users\Admin\AppData\Local\Temp\6F56.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\6FD3.tmp"C:\Users\Admin\AppData\Local\Temp\6FD3.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\7031.tmp"C:\Users\Admin\AppData\Local\Temp\7031.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\708E.tmp"C:\Users\Admin\AppData\Local\Temp\708E.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\70EC.tmp"C:\Users\Admin\AppData\Local\Temp\70EC.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\7159.tmp"C:\Users\Admin\AppData\Local\Temp\7159.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:600 -
C:\Users\Admin\AppData\Local\Temp\71B7.tmp"C:\Users\Admin\AppData\Local\Temp\71B7.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\7224.tmp"C:\Users\Admin\AppData\Local\Temp\7224.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\7281.tmp"C:\Users\Admin\AppData\Local\Temp\7281.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\72DF.tmp"C:\Users\Admin\AppData\Local\Temp\72DF.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\733D.tmp"C:\Users\Admin\AppData\Local\Temp\733D.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\73AA.tmp"C:\Users\Admin\AppData\Local\Temp\73AA.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\7475.tmp"C:\Users\Admin\AppData\Local\Temp\7475.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\74C3.tmp"C:\Users\Admin\AppData\Local\Temp\74C3.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\7530.tmp"C:\Users\Admin\AppData\Local\Temp\7530.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\758D.tmp"C:\Users\Admin\AppData\Local\Temp\758D.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\75FB.tmp"C:\Users\Admin\AppData\Local\Temp\75FB.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\7658.tmp"C:\Users\Admin\AppData\Local\Temp\7658.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\76B6.tmp"C:\Users\Admin\AppData\Local\Temp\76B6.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\76F4.tmp"C:\Users\Admin\AppData\Local\Temp\76F4.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\7781.tmp"C:\Users\Admin\AppData\Local\Temp\7781.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\77BF.tmp"C:\Users\Admin\AppData\Local\Temp\77BF.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\77FD.tmp"C:\Users\Admin\AppData\Local\Temp\77FD.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\783C.tmp"C:\Users\Admin\AppData\Local\Temp\783C.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\787A.tmp"C:\Users\Admin\AppData\Local\Temp\787A.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\78C8.tmp"C:\Users\Admin\AppData\Local\Temp\78C8.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\7907.tmp"C:\Users\Admin\AppData\Local\Temp\7907.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:844 -
C:\Users\Admin\AppData\Local\Temp\7945.tmp"C:\Users\Admin\AppData\Local\Temp\7945.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\7983.tmp"C:\Users\Admin\AppData\Local\Temp\7983.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\79C2.tmp"C:\Users\Admin\AppData\Local\Temp\79C2.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:700 -
C:\Users\Admin\AppData\Local\Temp\7A00.tmp"C:\Users\Admin\AppData\Local\Temp\7A00.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:968 -
C:\Users\Admin\AppData\Local\Temp\7A3F.tmp"C:\Users\Admin\AppData\Local\Temp\7A3F.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\7A7D.tmp"C:\Users\Admin\AppData\Local\Temp\7A7D.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\7ACB.tmp"C:\Users\Admin\AppData\Local\Temp\7ACB.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\7B19.tmp"C:\Users\Admin\AppData\Local\Temp\7B19.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\7B67.tmp"C:\Users\Admin\AppData\Local\Temp\7B67.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\7BA5.tmp"C:\Users\Admin\AppData\Local\Temp\7BA5.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:620 -
C:\Users\Admin\AppData\Local\Temp\7BE4.tmp"C:\Users\Admin\AppData\Local\Temp\7BE4.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:696 -
C:\Users\Admin\AppData\Local\Temp\7C22.tmp"C:\Users\Admin\AppData\Local\Temp\7C22.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\7C61.tmp"C:\Users\Admin\AppData\Local\Temp\7C61.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:236 -
C:\Users\Admin\AppData\Local\Temp\7C9F.tmp"C:\Users\Admin\AppData\Local\Temp\7C9F.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\7CDD.tmp"C:\Users\Admin\AppData\Local\Temp\7CDD.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\7D1C.tmp"C:\Users\Admin\AppData\Local\Temp\7D1C.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\7D5A.tmp"C:\Users\Admin\AppData\Local\Temp\7D5A.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:288 -
C:\Users\Admin\AppData\Local\Temp\7D99.tmp"C:\Users\Admin\AppData\Local\Temp\7D99.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\7DD7.tmp"C:\Users\Admin\AppData\Local\Temp\7DD7.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\7E25.tmp"C:\Users\Admin\AppData\Local\Temp\7E25.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\7E63.tmp"C:\Users\Admin\AppData\Local\Temp\7E63.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\7EA2.tmp"C:\Users\Admin\AppData\Local\Temp\7EA2.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\7EE0.tmp"C:\Users\Admin\AppData\Local\Temp\7EE0.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\7F2E.tmp"C:\Users\Admin\AppData\Local\Temp\7F2E.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\7F6D.tmp"C:\Users\Admin\AppData\Local\Temp\7F6D.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\7FAB.tmp"C:\Users\Admin\AppData\Local\Temp\7FAB.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\7FE9.tmp"C:\Users\Admin\AppData\Local\Temp\7FE9.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\8028.tmp"C:\Users\Admin\AppData\Local\Temp\8028.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\8066.tmp"C:\Users\Admin\AppData\Local\Temp\8066.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\80A5.tmp"C:\Users\Admin\AppData\Local\Temp\80A5.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\80F3.tmp"C:\Users\Admin\AppData\Local\Temp\80F3.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\8141.tmp"C:\Users\Admin\AppData\Local\Temp\8141.tmp"65⤵
- Executes dropped EXE
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\817F.tmp"C:\Users\Admin\AppData\Local\Temp\817F.tmp"66⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\81BD.tmp"C:\Users\Admin\AppData\Local\Temp\81BD.tmp"67⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\820B.tmp"C:\Users\Admin\AppData\Local\Temp\820B.tmp"68⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\824A.tmp"C:\Users\Admin\AppData\Local\Temp\824A.tmp"69⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\8288.tmp"C:\Users\Admin\AppData\Local\Temp\8288.tmp"70⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\82C7.tmp"C:\Users\Admin\AppData\Local\Temp\82C7.tmp"71⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\8305.tmp"C:\Users\Admin\AppData\Local\Temp\8305.tmp"72⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\8343.tmp"C:\Users\Admin\AppData\Local\Temp\8343.tmp"73⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\8382.tmp"C:\Users\Admin\AppData\Local\Temp\8382.tmp"74⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\83D0.tmp"C:\Users\Admin\AppData\Local\Temp\83D0.tmp"75⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\840E.tmp"C:\Users\Admin\AppData\Local\Temp\840E.tmp"76⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\844D.tmp"C:\Users\Admin\AppData\Local\Temp\844D.tmp"77⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\848B.tmp"C:\Users\Admin\AppData\Local\Temp\848B.tmp"78⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\84C9.tmp"C:\Users\Admin\AppData\Local\Temp\84C9.tmp"79⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\8508.tmp"C:\Users\Admin\AppData\Local\Temp\8508.tmp"80⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\8546.tmp"C:\Users\Admin\AppData\Local\Temp\8546.tmp"81⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\8585.tmp"C:\Users\Admin\AppData\Local\Temp\8585.tmp"82⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\85D3.tmp"C:\Users\Admin\AppData\Local\Temp\85D3.tmp"83⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\8611.tmp"C:\Users\Admin\AppData\Local\Temp\8611.tmp"84⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\864F.tmp"C:\Users\Admin\AppData\Local\Temp\864F.tmp"85⤵
- System Location Discovery: System Language Discovery
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\868E.tmp"C:\Users\Admin\AppData\Local\Temp\868E.tmp"86⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\86DC.tmp"C:\Users\Admin\AppData\Local\Temp\86DC.tmp"87⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\871A.tmp"C:\Users\Admin\AppData\Local\Temp\871A.tmp"88⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\8759.tmp"C:\Users\Admin\AppData\Local\Temp\8759.tmp"89⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\8797.tmp"C:\Users\Admin\AppData\Local\Temp\8797.tmp"90⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\87E5.tmp"C:\Users\Admin\AppData\Local\Temp\87E5.tmp"91⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\8823.tmp"C:\Users\Admin\AppData\Local\Temp\8823.tmp"92⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\8871.tmp"C:\Users\Admin\AppData\Local\Temp\8871.tmp"93⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\88B0.tmp"C:\Users\Admin\AppData\Local\Temp\88B0.tmp"94⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\88EE.tmp"C:\Users\Admin\AppData\Local\Temp\88EE.tmp"95⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\893C.tmp"C:\Users\Admin\AppData\Local\Temp\893C.tmp"96⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\897B.tmp"C:\Users\Admin\AppData\Local\Temp\897B.tmp"97⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\89B9.tmp"C:\Users\Admin\AppData\Local\Temp\89B9.tmp"98⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\8A07.tmp"C:\Users\Admin\AppData\Local\Temp\8A07.tmp"99⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\8A45.tmp"C:\Users\Admin\AppData\Local\Temp\8A45.tmp"100⤵
- System Location Discovery: System Language Discovery
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\8A93.tmp"C:\Users\Admin\AppData\Local\Temp\8A93.tmp"101⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\8AD2.tmp"C:\Users\Admin\AppData\Local\Temp\8AD2.tmp"102⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\8B10.tmp"C:\Users\Admin\AppData\Local\Temp\8B10.tmp"103⤵PID:296
-
C:\Users\Admin\AppData\Local\Temp\8B4F.tmp"C:\Users\Admin\AppData\Local\Temp\8B4F.tmp"104⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\8B8D.tmp"C:\Users\Admin\AppData\Local\Temp\8B8D.tmp"105⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\8BCB.tmp"C:\Users\Admin\AppData\Local\Temp\8BCB.tmp"106⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\8C19.tmp"C:\Users\Admin\AppData\Local\Temp\8C19.tmp"107⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\8C58.tmp"C:\Users\Admin\AppData\Local\Temp\8C58.tmp"108⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\8C96.tmp"C:\Users\Admin\AppData\Local\Temp\8C96.tmp"109⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\8CD5.tmp"C:\Users\Admin\AppData\Local\Temp\8CD5.tmp"110⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\8D13.tmp"C:\Users\Admin\AppData\Local\Temp\8D13.tmp"111⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\8D51.tmp"C:\Users\Admin\AppData\Local\Temp\8D51.tmp"112⤵
- System Location Discovery: System Language Discovery
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\8D90.tmp"C:\Users\Admin\AppData\Local\Temp\8D90.tmp"113⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\8DCE.tmp"C:\Users\Admin\AppData\Local\Temp\8DCE.tmp"114⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"115⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\8E4B.tmp"C:\Users\Admin\AppData\Local\Temp\8E4B.tmp"116⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\8E89.tmp"C:\Users\Admin\AppData\Local\Temp\8E89.tmp"117⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\8ED7.tmp"C:\Users\Admin\AppData\Local\Temp\8ED7.tmp"118⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\8F16.tmp"C:\Users\Admin\AppData\Local\Temp\8F16.tmp"119⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\8F64.tmp"C:\Users\Admin\AppData\Local\Temp\8F64.tmp"120⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\8FA2.tmp"C:\Users\Admin\AppData\Local\Temp\8FA2.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\8FE1.tmp"C:\Users\Admin\AppData\Local\Temp\8FE1.tmp"122⤵PID:2736
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-