Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15/09/2024, 09:26
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-15_291d7063fd2799454424445722b99a4c_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-15_291d7063fd2799454424445722b99a4c_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-15_291d7063fd2799454424445722b99a4c_mafia.exe
-
Size
486KB
-
MD5
291d7063fd2799454424445722b99a4c
-
SHA1
127953e04a63c567c61ffdf6c38c1bb3a638bec9
-
SHA256
ae6e8d0e987721e6e5c2889652186437298370170cee210dd1ab7f386c91c433
-
SHA512
1ce6e3bec54ac85dbcf2c1c9545ba4d807689ed3be2954b7b25eac0cfa90201a934b2dd9dffa90a5af0090276289994a85fe7aa344b5f0d0c73d01151bf8c27f
-
SSDEEP
12288:UU5rCOTeiD3rAn7HGZHSIBfI88diHxNZ:UUQOJDcn7mRBfzN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2112 C37E.tmp 2184 C3CC.tmp 2548 C449.tmp 2056 C4B6.tmp 1912 C504.tmp 2736 C552.tmp 2824 C590.tmp 2408 C5FD.tmp 2700 C65B.tmp 2940 C6A9.tmp 2900 C707.tmp 2816 C774.tmp 2600 C7E1.tmp 2668 C83F.tmp 644 C8AC.tmp 1792 C919.tmp 2996 C986.tmp 868 C9F3.tmp 2320 CA51.tmp 1684 CAAF.tmp 2036 CAED.tmp 1168 CB3B.tmp 2692 CB99.tmp 2260 CBD7.tmp 2208 CC15.tmp 2192 CC54.tmp 2084 CC92.tmp 2280 CCD1.tmp 1520 CD0F.tmp 2124 CD4D.tmp 1144 CD8C.tmp 1032 CDCA.tmp 1480 CE09.tmp 1888 CE47.tmp 1040 CE95.tmp 1600 CED3.tmp 1748 CF12.tmp 1924 CF50.tmp 1680 CF9E.tmp 956 CFDD.tmp 1636 D01B.tmp 1780 D059.tmp 344 D098.tmp 2424 D0E6.tmp 532 D124.tmp 2512 D172.tmp 1292 D1B1.tmp 2016 D1EF.tmp 1716 D23D.tmp 2508 D27B.tmp 2484 D2BA.tmp 1668 D337.tmp 2224 D375.tmp 1984 D3B3.tmp 2088 D3F2.tmp 2380 D430.tmp 2276 D46F.tmp 2056 D4AD.tmp 2784 D4EB.tmp 2800 D52A.tmp 2724 D568.tmp 2824 D5A7.tmp 2296 D5E5.tmp 2408 D623.tmp -
Loads dropped DLL 64 IoCs
pid Process 2148 2024-09-15_291d7063fd2799454424445722b99a4c_mafia.exe 2112 C37E.tmp 2184 C3CC.tmp 2548 C449.tmp 2056 C4B6.tmp 1912 C504.tmp 2736 C552.tmp 2824 C590.tmp 2408 C5FD.tmp 2700 C65B.tmp 2940 C6A9.tmp 2900 C707.tmp 2816 C774.tmp 2600 C7E1.tmp 2668 C83F.tmp 644 C8AC.tmp 1792 C919.tmp 2996 C986.tmp 868 C9F3.tmp 2320 CA51.tmp 1684 CAAF.tmp 2036 CAED.tmp 1168 CB3B.tmp 2692 CB99.tmp 2260 CBD7.tmp 2208 CC15.tmp 2192 CC54.tmp 2084 CC92.tmp 2280 CCD1.tmp 1520 CD0F.tmp 2124 CD4D.tmp 1144 CD8C.tmp 1032 CDCA.tmp 1480 CE09.tmp 1888 CE47.tmp 1040 CE95.tmp 1600 CED3.tmp 1748 CF12.tmp 1924 CF50.tmp 1680 CF9E.tmp 956 CFDD.tmp 1636 D01B.tmp 1780 D059.tmp 344 D098.tmp 2424 D0E6.tmp 532 D124.tmp 2512 D172.tmp 1292 D1B1.tmp 2016 D1EF.tmp 1716 D23D.tmp 2508 D27B.tmp 996 D2F8.tmp 1668 D337.tmp 2224 D375.tmp 1984 D3B3.tmp 2088 D3F2.tmp 2380 D430.tmp 2276 D46F.tmp 2056 D4AD.tmp 2784 D4EB.tmp 2800 D52A.tmp 2724 D568.tmp 2824 D5A7.tmp 2296 D5E5.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7677.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE07.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3044.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C36E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 313E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9AC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D48.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4672.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D95E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD01.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 698C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C4E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4386.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A44.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2148 wrote to memory of 2112 2148 2024-09-15_291d7063fd2799454424445722b99a4c_mafia.exe 30 PID 2148 wrote to memory of 2112 2148 2024-09-15_291d7063fd2799454424445722b99a4c_mafia.exe 30 PID 2148 wrote to memory of 2112 2148 2024-09-15_291d7063fd2799454424445722b99a4c_mafia.exe 30 PID 2148 wrote to memory of 2112 2148 2024-09-15_291d7063fd2799454424445722b99a4c_mafia.exe 30 PID 2112 wrote to memory of 2184 2112 C37E.tmp 31 PID 2112 wrote to memory of 2184 2112 C37E.tmp 31 PID 2112 wrote to memory of 2184 2112 C37E.tmp 31 PID 2112 wrote to memory of 2184 2112 C37E.tmp 31 PID 2184 wrote to memory of 2548 2184 C3CC.tmp 32 PID 2184 wrote to memory of 2548 2184 C3CC.tmp 32 PID 2184 wrote to memory of 2548 2184 C3CC.tmp 32 PID 2184 wrote to memory of 2548 2184 C3CC.tmp 32 PID 2548 wrote to memory of 2056 2548 C449.tmp 33 PID 2548 wrote to memory of 2056 2548 C449.tmp 33 PID 2548 wrote to memory of 2056 2548 C449.tmp 33 PID 2548 wrote to memory of 2056 2548 C449.tmp 33 PID 2056 wrote to memory of 1912 2056 C4B6.tmp 34 PID 2056 wrote to memory of 1912 2056 C4B6.tmp 34 PID 2056 wrote to memory of 1912 2056 C4B6.tmp 34 PID 2056 wrote to memory of 1912 2056 C4B6.tmp 34 PID 1912 wrote to memory of 2736 1912 C504.tmp 35 PID 1912 wrote to memory of 2736 1912 C504.tmp 35 PID 1912 wrote to memory of 2736 1912 C504.tmp 35 PID 1912 wrote to memory of 2736 1912 C504.tmp 35 PID 2736 wrote to memory of 2824 2736 C552.tmp 36 PID 2736 wrote to memory of 2824 2736 C552.tmp 36 PID 2736 wrote to memory of 2824 2736 C552.tmp 36 PID 2736 wrote to memory of 2824 2736 C552.tmp 36 PID 2824 wrote to memory of 2408 2824 C590.tmp 37 PID 2824 wrote to memory of 2408 2824 C590.tmp 37 PID 2824 wrote to memory of 2408 2824 C590.tmp 37 PID 2824 wrote to memory of 2408 2824 C590.tmp 37 PID 2408 wrote to memory of 2700 2408 C5FD.tmp 38 PID 2408 wrote to memory of 2700 2408 C5FD.tmp 38 PID 2408 wrote to memory of 2700 2408 C5FD.tmp 38 PID 2408 wrote to memory of 2700 2408 C5FD.tmp 38 PID 2700 wrote to memory of 2940 2700 C65B.tmp 39 PID 2700 wrote to memory of 2940 2700 C65B.tmp 39 PID 2700 wrote to memory of 2940 2700 C65B.tmp 39 PID 2700 wrote to memory of 2940 2700 C65B.tmp 39 PID 2940 wrote to memory of 2900 2940 C6A9.tmp 40 PID 2940 wrote to memory of 2900 2940 C6A9.tmp 40 PID 2940 wrote to memory of 2900 2940 C6A9.tmp 40 PID 2940 wrote to memory of 2900 2940 C6A9.tmp 40 PID 2900 wrote to memory of 2816 2900 C707.tmp 41 PID 2900 wrote to memory of 2816 2900 C707.tmp 41 PID 2900 wrote to memory of 2816 2900 C707.tmp 41 PID 2900 wrote to memory of 2816 2900 C707.tmp 41 PID 2816 wrote to memory of 2600 2816 C774.tmp 42 PID 2816 wrote to memory of 2600 2816 C774.tmp 42 PID 2816 wrote to memory of 2600 2816 C774.tmp 42 PID 2816 wrote to memory of 2600 2816 C774.tmp 42 PID 2600 wrote to memory of 2668 2600 C7E1.tmp 43 PID 2600 wrote to memory of 2668 2600 C7E1.tmp 43 PID 2600 wrote to memory of 2668 2600 C7E1.tmp 43 PID 2600 wrote to memory of 2668 2600 C7E1.tmp 43 PID 2668 wrote to memory of 644 2668 C83F.tmp 44 PID 2668 wrote to memory of 644 2668 C83F.tmp 44 PID 2668 wrote to memory of 644 2668 C83F.tmp 44 PID 2668 wrote to memory of 644 2668 C83F.tmp 44 PID 644 wrote to memory of 1792 644 C8AC.tmp 45 PID 644 wrote to memory of 1792 644 C8AC.tmp 45 PID 644 wrote to memory of 1792 644 C8AC.tmp 45 PID 644 wrote to memory of 1792 644 C8AC.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-15_291d7063fd2799454424445722b99a4c_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-15_291d7063fd2799454424445722b99a4c_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\C37E.tmp"C:\Users\Admin\AppData\Local\Temp\C37E.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\C3CC.tmp"C:\Users\Admin\AppData\Local\Temp\C3CC.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\C449.tmp"C:\Users\Admin\AppData\Local\Temp\C449.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\C4B6.tmp"C:\Users\Admin\AppData\Local\Temp\C4B6.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\C504.tmp"C:\Users\Admin\AppData\Local\Temp\C504.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\C552.tmp"C:\Users\Admin\AppData\Local\Temp\C552.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\C590.tmp"C:\Users\Admin\AppData\Local\Temp\C590.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\C5FD.tmp"C:\Users\Admin\AppData\Local\Temp\C5FD.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\C65B.tmp"C:\Users\Admin\AppData\Local\Temp\C65B.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\C6A9.tmp"C:\Users\Admin\AppData\Local\Temp\C6A9.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\C707.tmp"C:\Users\Admin\AppData\Local\Temp\C707.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\C774.tmp"C:\Users\Admin\AppData\Local\Temp\C774.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\C7E1.tmp"C:\Users\Admin\AppData\Local\Temp\C7E1.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\C83F.tmp"C:\Users\Admin\AppData\Local\Temp\C83F.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\C8AC.tmp"C:\Users\Admin\AppData\Local\Temp\C8AC.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Users\Admin\AppData\Local\Temp\C919.tmp"C:\Users\Admin\AppData\Local\Temp\C919.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\C986.tmp"C:\Users\Admin\AppData\Local\Temp\C986.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\C9F3.tmp"C:\Users\Admin\AppData\Local\Temp\C9F3.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:868 -
C:\Users\Admin\AppData\Local\Temp\CA51.tmp"C:\Users\Admin\AppData\Local\Temp\CA51.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\CAAF.tmp"C:\Users\Admin\AppData\Local\Temp\CAAF.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\CAED.tmp"C:\Users\Admin\AppData\Local\Temp\CAED.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\CB3B.tmp"C:\Users\Admin\AppData\Local\Temp\CB3B.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\CB99.tmp"C:\Users\Admin\AppData\Local\Temp\CB99.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\CBD7.tmp"C:\Users\Admin\AppData\Local\Temp\CBD7.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\CC15.tmp"C:\Users\Admin\AppData\Local\Temp\CC15.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\CC54.tmp"C:\Users\Admin\AppData\Local\Temp\CC54.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\CC92.tmp"C:\Users\Admin\AppData\Local\Temp\CC92.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\CCD1.tmp"C:\Users\Admin\AppData\Local\Temp\CCD1.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\CD0F.tmp"C:\Users\Admin\AppData\Local\Temp\CD0F.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\CD4D.tmp"C:\Users\Admin\AppData\Local\Temp\CD4D.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\CD8C.tmp"C:\Users\Admin\AppData\Local\Temp\CD8C.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\CDCA.tmp"C:\Users\Admin\AppData\Local\Temp\CDCA.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\CE09.tmp"C:\Users\Admin\AppData\Local\Temp\CE09.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\CE47.tmp"C:\Users\Admin\AppData\Local\Temp\CE47.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\CE95.tmp"C:\Users\Admin\AppData\Local\Temp\CE95.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\CED3.tmp"C:\Users\Admin\AppData\Local\Temp\CED3.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\CF12.tmp"C:\Users\Admin\AppData\Local\Temp\CF12.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\CF50.tmp"C:\Users\Admin\AppData\Local\Temp\CF50.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\CF9E.tmp"C:\Users\Admin\AppData\Local\Temp\CF9E.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\CFDD.tmp"C:\Users\Admin\AppData\Local\Temp\CFDD.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:956 -
C:\Users\Admin\AppData\Local\Temp\D01B.tmp"C:\Users\Admin\AppData\Local\Temp\D01B.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\D059.tmp"C:\Users\Admin\AppData\Local\Temp\D059.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\D098.tmp"C:\Users\Admin\AppData\Local\Temp\D098.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:344 -
C:\Users\Admin\AppData\Local\Temp\D0E6.tmp"C:\Users\Admin\AppData\Local\Temp\D0E6.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\D124.tmp"C:\Users\Admin\AppData\Local\Temp\D124.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:532 -
C:\Users\Admin\AppData\Local\Temp\D172.tmp"C:\Users\Admin\AppData\Local\Temp\D172.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\D1B1.tmp"C:\Users\Admin\AppData\Local\Temp\D1B1.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\D1EF.tmp"C:\Users\Admin\AppData\Local\Temp\D1EF.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\D23D.tmp"C:\Users\Admin\AppData\Local\Temp\D23D.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\D27B.tmp"C:\Users\Admin\AppData\Local\Temp\D27B.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\D2BA.tmp"C:\Users\Admin\AppData\Local\Temp\D2BA.tmp"52⤵
- Executes dropped EXE
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\D2F8.tmp"C:\Users\Admin\AppData\Local\Temp\D2F8.tmp"53⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:996 -
C:\Users\Admin\AppData\Local\Temp\D337.tmp"C:\Users\Admin\AppData\Local\Temp\D337.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\D375.tmp"C:\Users\Admin\AppData\Local\Temp\D375.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\D3B3.tmp"C:\Users\Admin\AppData\Local\Temp\D3B3.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\D3F2.tmp"C:\Users\Admin\AppData\Local\Temp\D3F2.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\D430.tmp"C:\Users\Admin\AppData\Local\Temp\D430.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\D46F.tmp"C:\Users\Admin\AppData\Local\Temp\D46F.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\D4AD.tmp"C:\Users\Admin\AppData\Local\Temp\D4AD.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\D4EB.tmp"C:\Users\Admin\AppData\Local\Temp\D4EB.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\D52A.tmp"C:\Users\Admin\AppData\Local\Temp\D52A.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\D568.tmp"C:\Users\Admin\AppData\Local\Temp\D568.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\D5A7.tmp"C:\Users\Admin\AppData\Local\Temp\D5A7.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\D5E5.tmp"C:\Users\Admin\AppData\Local\Temp\D5E5.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\D623.tmp"C:\Users\Admin\AppData\Local\Temp\D623.tmp"66⤵
- Executes dropped EXE
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\D662.tmp"C:\Users\Admin\AppData\Local\Temp\D662.tmp"67⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\D6A0.tmp"C:\Users\Admin\AppData\Local\Temp\D6A0.tmp"68⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\D6DF.tmp"C:\Users\Admin\AppData\Local\Temp\D6DF.tmp"69⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\D72D.tmp"C:\Users\Admin\AppData\Local\Temp\D72D.tmp"70⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\D79A.tmp"C:\Users\Admin\AppData\Local\Temp\D79A.tmp"71⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\D7E8.tmp"C:\Users\Admin\AppData\Local\Temp\D7E8.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\D826.tmp"C:\Users\Admin\AppData\Local\Temp\D826.tmp"73⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\D865.tmp"C:\Users\Admin\AppData\Local\Temp\D865.tmp"74⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\D8A3.tmp"C:\Users\Admin\AppData\Local\Temp\D8A3.tmp"75⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\D8E1.tmp"C:\Users\Admin\AppData\Local\Temp\D8E1.tmp"76⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\D920.tmp"C:\Users\Admin\AppData\Local\Temp\D920.tmp"77⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\D95E.tmp"C:\Users\Admin\AppData\Local\Temp\D95E.tmp"78⤵
- System Location Discovery: System Language Discovery
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\D99D.tmp"C:\Users\Admin\AppData\Local\Temp\D99D.tmp"79⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\D9EB.tmp"C:\Users\Admin\AppData\Local\Temp\D9EB.tmp"80⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\DA29.tmp"C:\Users\Admin\AppData\Local\Temp\DA29.tmp"81⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\DA67.tmp"C:\Users\Admin\AppData\Local\Temp\DA67.tmp"82⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\DAA6.tmp"C:\Users\Admin\AppData\Local\Temp\DAA6.tmp"83⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\DAF4.tmp"C:\Users\Admin\AppData\Local\Temp\DAF4.tmp"84⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\DB32.tmp"C:\Users\Admin\AppData\Local\Temp\DB32.tmp"85⤵
- System Location Discovery: System Language Discovery
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\DB80.tmp"C:\Users\Admin\AppData\Local\Temp\DB80.tmp"86⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\DBBF.tmp"C:\Users\Admin\AppData\Local\Temp\DBBF.tmp"87⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\DBFD.tmp"C:\Users\Admin\AppData\Local\Temp\DBFD.tmp"88⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\DC3B.tmp"C:\Users\Admin\AppData\Local\Temp\DC3B.tmp"89⤵
- System Location Discovery: System Language Discovery
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\DC7A.tmp"C:\Users\Admin\AppData\Local\Temp\DC7A.tmp"90⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\DCB8.tmp"C:\Users\Admin\AppData\Local\Temp\DCB8.tmp"91⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\DCF7.tmp"C:\Users\Admin\AppData\Local\Temp\DCF7.tmp"92⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\DD35.tmp"C:\Users\Admin\AppData\Local\Temp\DD35.tmp"93⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\DD73.tmp"C:\Users\Admin\AppData\Local\Temp\DD73.tmp"94⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\DDB2.tmp"C:\Users\Admin\AppData\Local\Temp\DDB2.tmp"95⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\DDF0.tmp"C:\Users\Admin\AppData\Local\Temp\DDF0.tmp"96⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\DE3E.tmp"C:\Users\Admin\AppData\Local\Temp\DE3E.tmp"97⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\DE8C.tmp"C:\Users\Admin\AppData\Local\Temp\DE8C.tmp"98⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\DECB.tmp"C:\Users\Admin\AppData\Local\Temp\DECB.tmp"99⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\DF09.tmp"C:\Users\Admin\AppData\Local\Temp\DF09.tmp"100⤵PID:304
-
C:\Users\Admin\AppData\Local\Temp\DF48.tmp"C:\Users\Admin\AppData\Local\Temp\DF48.tmp"101⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\DF86.tmp"C:\Users\Admin\AppData\Local\Temp\DF86.tmp"102⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\DFC4.tmp"C:\Users\Admin\AppData\Local\Temp\DFC4.tmp"103⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\E003.tmp"C:\Users\Admin\AppData\Local\Temp\E003.tmp"104⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\E041.tmp"C:\Users\Admin\AppData\Local\Temp\E041.tmp"105⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\E080.tmp"C:\Users\Admin\AppData\Local\Temp\E080.tmp"106⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\E0BE.tmp"C:\Users\Admin\AppData\Local\Temp\E0BE.tmp"107⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\E0FC.tmp"C:\Users\Admin\AppData\Local\Temp\E0FC.tmp"108⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\E13B.tmp"C:\Users\Admin\AppData\Local\Temp\E13B.tmp"109⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\E179.tmp"C:\Users\Admin\AppData\Local\Temp\E179.tmp"110⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\E1B8.tmp"C:\Users\Admin\AppData\Local\Temp\E1B8.tmp"111⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\E1F6.tmp"C:\Users\Admin\AppData\Local\Temp\E1F6.tmp"112⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\E234.tmp"C:\Users\Admin\AppData\Local\Temp\E234.tmp"113⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\E273.tmp"C:\Users\Admin\AppData\Local\Temp\E273.tmp"114⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\E2B1.tmp"C:\Users\Admin\AppData\Local\Temp\E2B1.tmp"115⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\E2F0.tmp"C:\Users\Admin\AppData\Local\Temp\E2F0.tmp"116⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\E32E.tmp"C:\Users\Admin\AppData\Local\Temp\E32E.tmp"117⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\E36C.tmp"C:\Users\Admin\AppData\Local\Temp\E36C.tmp"118⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\E3AB.tmp"C:\Users\Admin\AppData\Local\Temp\E3AB.tmp"119⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\E3E9.tmp"C:\Users\Admin\AppData\Local\Temp\E3E9.tmp"120⤵
- System Location Discovery: System Language Discovery
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\E428.tmp"C:\Users\Admin\AppData\Local\Temp\E428.tmp"121⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\E476.tmp"C:\Users\Admin\AppData\Local\Temp\E476.tmp"122⤵PID:2276
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-