Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 04:09
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-19_d8413ae67779d7bd05f651b98b2417a3_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-09-19_d8413ae67779d7bd05f651b98b2417a3_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-19_d8413ae67779d7bd05f651b98b2417a3_mafia.exe
-
Size
487KB
-
MD5
d8413ae67779d7bd05f651b98b2417a3
-
SHA1
8961283ffe6bb23cf2a8c85a1cc34592e2fb9d12
-
SHA256
773d700ecf9289e09f1c3682a6f7feb9d4a6e1d02a5d84146940c758b531c1f0
-
SHA512
ffe8edce407b07444eafe8aa2e044d3f35054a77ffed62d5787f5f2fb20a2e9bf086dda5d731dd5aca6c12475ef70266d4ffa1cf33cc4a3e8230309168fd2bfb
-
SSDEEP
12288:HU5rCOTeiJY7TOIVyICXDKU1Fm+8TCaW2ozHsm6NZ:HUQOJJ23OLFm+8+WozP6N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2540 C7C2.tmp 2392 C810.tmp 2096 C84E.tmp 2104 C88D.tmp 1892 C8FA.tmp 2820 C957.tmp 2768 C9C5.tmp 2484 CA32.tmp 2772 CA9F.tmp 2636 CAFD.tmp 1628 CB4B.tmp 2628 CBB8.tmp 2536 CC15.tmp 2492 CC73.tmp 1564 CCD1.tmp 2164 CD3E.tmp 632 CD8C.tmp 2152 CDE9.tmp 1716 CE47.tmp 316 CEA5.tmp 1016 CF02.tmp 2672 CF60.tmp 1012 CFBD.tmp 2856 CFFC.tmp 2920 D03A.tmp 2836 D079.tmp 2228 D0B7.tmp 2320 D0F5.tmp 2284 D134.tmp 2232 D172.tmp 672 D1B1.tmp 2984 D1EF.tmp 444 D22D.tmp 1660 D26C.tmp 1856 D2AA.tmp 1860 D2E9.tmp 2552 D327.tmp 1932 D365.tmp 1008 D3A4.tmp 868 D3E2.tmp 1264 D421.tmp 2236 D45F.tmp 664 D49D.tmp 2220 D4EB.tmp 2352 D52A.tmp 1392 D568.tmp 1556 D5A7.tmp 2340 D5E5.tmp 880 D623.tmp 3008 D662.tmp 2368 D6A0.tmp 1512 D6DF.tmp 2056 D72D.tmp 2372 D76B.tmp 2100 D7A9.tmp 2392 D7E8.tmp 2796 D826.tmp 584 D865.tmp 2104 D8A3.tmp 2860 D8E1.tmp 2812 D920.tmp 2820 D95E.tmp 2744 D99D.tmp 2728 D9DB.tmp -
Loads dropped DLL 64 IoCs
pid Process 2300 2024-09-19_d8413ae67779d7bd05f651b98b2417a3_mafia.exe 2540 C7C2.tmp 2392 C810.tmp 2096 C84E.tmp 2104 C88D.tmp 1892 C8FA.tmp 2820 C957.tmp 2768 C9C5.tmp 2484 CA32.tmp 2772 CA9F.tmp 2636 CAFD.tmp 1628 CB4B.tmp 2628 CBB8.tmp 2536 CC15.tmp 2492 CC73.tmp 1564 CCD1.tmp 2164 CD3E.tmp 632 CD8C.tmp 2152 CDE9.tmp 1716 CE47.tmp 316 CEA5.tmp 1016 CF02.tmp 2672 CF60.tmp 1012 CFBD.tmp 2856 CFFC.tmp 2920 D03A.tmp 2836 D079.tmp 2228 D0B7.tmp 2320 D0F5.tmp 2284 D134.tmp 2232 D172.tmp 672 D1B1.tmp 2984 D1EF.tmp 444 D22D.tmp 1660 D26C.tmp 1856 D2AA.tmp 1860 D2E9.tmp 2552 D327.tmp 1932 D365.tmp 1008 D3A4.tmp 868 D3E2.tmp 1264 D421.tmp 2236 D45F.tmp 664 D49D.tmp 2220 D4EB.tmp 2352 D52A.tmp 1392 D568.tmp 1556 D5A7.tmp 2340 D5E5.tmp 880 D623.tmp 3008 D662.tmp 2368 D6A0.tmp 1512 D6DF.tmp 2056 D72D.tmp 2372 D76B.tmp 2100 D7A9.tmp 2392 D7E8.tmp 2796 D826.tmp 584 D865.tmp 2104 D8A3.tmp 2860 D8E1.tmp 2812 D920.tmp 2820 D95E.tmp 2744 D99D.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9888.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D134.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F824.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6799.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E521.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1008.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 145B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E070.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 739A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C810.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8269.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D365.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2300 wrote to memory of 2540 2300 2024-09-19_d8413ae67779d7bd05f651b98b2417a3_mafia.exe 30 PID 2300 wrote to memory of 2540 2300 2024-09-19_d8413ae67779d7bd05f651b98b2417a3_mafia.exe 30 PID 2300 wrote to memory of 2540 2300 2024-09-19_d8413ae67779d7bd05f651b98b2417a3_mafia.exe 30 PID 2300 wrote to memory of 2540 2300 2024-09-19_d8413ae67779d7bd05f651b98b2417a3_mafia.exe 30 PID 2540 wrote to memory of 2392 2540 C7C2.tmp 31 PID 2540 wrote to memory of 2392 2540 C7C2.tmp 31 PID 2540 wrote to memory of 2392 2540 C7C2.tmp 31 PID 2540 wrote to memory of 2392 2540 C7C2.tmp 31 PID 2392 wrote to memory of 2096 2392 C810.tmp 32 PID 2392 wrote to memory of 2096 2392 C810.tmp 32 PID 2392 wrote to memory of 2096 2392 C810.tmp 32 PID 2392 wrote to memory of 2096 2392 C810.tmp 32 PID 2096 wrote to memory of 2104 2096 C84E.tmp 33 PID 2096 wrote to memory of 2104 2096 C84E.tmp 33 PID 2096 wrote to memory of 2104 2096 C84E.tmp 33 PID 2096 wrote to memory of 2104 2096 C84E.tmp 33 PID 2104 wrote to memory of 1892 2104 C88D.tmp 34 PID 2104 wrote to memory of 1892 2104 C88D.tmp 34 PID 2104 wrote to memory of 1892 2104 C88D.tmp 34 PID 2104 wrote to memory of 1892 2104 C88D.tmp 34 PID 1892 wrote to memory of 2820 1892 C8FA.tmp 35 PID 1892 wrote to memory of 2820 1892 C8FA.tmp 35 PID 1892 wrote to memory of 2820 1892 C8FA.tmp 35 PID 1892 wrote to memory of 2820 1892 C8FA.tmp 35 PID 2820 wrote to memory of 2768 2820 C957.tmp 36 PID 2820 wrote to memory of 2768 2820 C957.tmp 36 PID 2820 wrote to memory of 2768 2820 C957.tmp 36 PID 2820 wrote to memory of 2768 2820 C957.tmp 36 PID 2768 wrote to memory of 2484 2768 C9C5.tmp 37 PID 2768 wrote to memory of 2484 2768 C9C5.tmp 37 PID 2768 wrote to memory of 2484 2768 C9C5.tmp 37 PID 2768 wrote to memory of 2484 2768 C9C5.tmp 37 PID 2484 wrote to memory of 2772 2484 CA32.tmp 38 PID 2484 wrote to memory of 2772 2484 CA32.tmp 38 PID 2484 wrote to memory of 2772 2484 CA32.tmp 38 PID 2484 wrote to memory of 2772 2484 CA32.tmp 38 PID 2772 wrote to memory of 2636 2772 CA9F.tmp 39 PID 2772 wrote to memory of 2636 2772 CA9F.tmp 39 PID 2772 wrote to memory of 2636 2772 CA9F.tmp 39 PID 2772 wrote to memory of 2636 2772 CA9F.tmp 39 PID 2636 wrote to memory of 1628 2636 CAFD.tmp 40 PID 2636 wrote to memory of 1628 2636 CAFD.tmp 40 PID 2636 wrote to memory of 1628 2636 CAFD.tmp 40 PID 2636 wrote to memory of 1628 2636 CAFD.tmp 40 PID 1628 wrote to memory of 2628 1628 CB4B.tmp 41 PID 1628 wrote to memory of 2628 1628 CB4B.tmp 41 PID 1628 wrote to memory of 2628 1628 CB4B.tmp 41 PID 1628 wrote to memory of 2628 1628 CB4B.tmp 41 PID 2628 wrote to memory of 2536 2628 CBB8.tmp 42 PID 2628 wrote to memory of 2536 2628 CBB8.tmp 42 PID 2628 wrote to memory of 2536 2628 CBB8.tmp 42 PID 2628 wrote to memory of 2536 2628 CBB8.tmp 42 PID 2536 wrote to memory of 2492 2536 CC15.tmp 43 PID 2536 wrote to memory of 2492 2536 CC15.tmp 43 PID 2536 wrote to memory of 2492 2536 CC15.tmp 43 PID 2536 wrote to memory of 2492 2536 CC15.tmp 43 PID 2492 wrote to memory of 1564 2492 CC73.tmp 44 PID 2492 wrote to memory of 1564 2492 CC73.tmp 44 PID 2492 wrote to memory of 1564 2492 CC73.tmp 44 PID 2492 wrote to memory of 1564 2492 CC73.tmp 44 PID 1564 wrote to memory of 2164 1564 CCD1.tmp 45 PID 1564 wrote to memory of 2164 1564 CCD1.tmp 45 PID 1564 wrote to memory of 2164 1564 CCD1.tmp 45 PID 1564 wrote to memory of 2164 1564 CCD1.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_d8413ae67779d7bd05f651b98b2417a3_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_d8413ae67779d7bd05f651b98b2417a3_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\C7C2.tmp"C:\Users\Admin\AppData\Local\Temp\C7C2.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\C810.tmp"C:\Users\Admin\AppData\Local\Temp\C810.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\C84E.tmp"C:\Users\Admin\AppData\Local\Temp\C84E.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\C88D.tmp"C:\Users\Admin\AppData\Local\Temp\C88D.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\C8FA.tmp"C:\Users\Admin\AppData\Local\Temp\C8FA.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\C957.tmp"C:\Users\Admin\AppData\Local\Temp\C957.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\C9C5.tmp"C:\Users\Admin\AppData\Local\Temp\C9C5.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\CA32.tmp"C:\Users\Admin\AppData\Local\Temp\CA32.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\CA9F.tmp"C:\Users\Admin\AppData\Local\Temp\CA9F.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\CAFD.tmp"C:\Users\Admin\AppData\Local\Temp\CAFD.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\CB4B.tmp"C:\Users\Admin\AppData\Local\Temp\CB4B.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\CBB8.tmp"C:\Users\Admin\AppData\Local\Temp\CBB8.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\CC15.tmp"C:\Users\Admin\AppData\Local\Temp\CC15.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\CC73.tmp"C:\Users\Admin\AppData\Local\Temp\CC73.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\CCD1.tmp"C:\Users\Admin\AppData\Local\Temp\CCD1.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\CD3E.tmp"C:\Users\Admin\AppData\Local\Temp\CD3E.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\CD8C.tmp"C:\Users\Admin\AppData\Local\Temp\CD8C.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:632 -
C:\Users\Admin\AppData\Local\Temp\CDE9.tmp"C:\Users\Admin\AppData\Local\Temp\CDE9.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\CE47.tmp"C:\Users\Admin\AppData\Local\Temp\CE47.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\CEA5.tmp"C:\Users\Admin\AppData\Local\Temp\CEA5.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:316 -
C:\Users\Admin\AppData\Local\Temp\CF02.tmp"C:\Users\Admin\AppData\Local\Temp\CF02.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\CF60.tmp"C:\Users\Admin\AppData\Local\Temp\CF60.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\CFBD.tmp"C:\Users\Admin\AppData\Local\Temp\CFBD.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\CFFC.tmp"C:\Users\Admin\AppData\Local\Temp\CFFC.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\D03A.tmp"C:\Users\Admin\AppData\Local\Temp\D03A.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\D079.tmp"C:\Users\Admin\AppData\Local\Temp\D079.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\D0B7.tmp"C:\Users\Admin\AppData\Local\Temp\D0B7.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\D0F5.tmp"C:\Users\Admin\AppData\Local\Temp\D0F5.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\D134.tmp"C:\Users\Admin\AppData\Local\Temp\D134.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\D172.tmp"C:\Users\Admin\AppData\Local\Temp\D172.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\D1B1.tmp"C:\Users\Admin\AppData\Local\Temp\D1B1.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:672 -
C:\Users\Admin\AppData\Local\Temp\D1EF.tmp"C:\Users\Admin\AppData\Local\Temp\D1EF.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\D22D.tmp"C:\Users\Admin\AppData\Local\Temp\D22D.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:444 -
C:\Users\Admin\AppData\Local\Temp\D26C.tmp"C:\Users\Admin\AppData\Local\Temp\D26C.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\D2AA.tmp"C:\Users\Admin\AppData\Local\Temp\D2AA.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\D2E9.tmp"C:\Users\Admin\AppData\Local\Temp\D2E9.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\D327.tmp"C:\Users\Admin\AppData\Local\Temp\D327.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\D365.tmp"C:\Users\Admin\AppData\Local\Temp\D365.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\D3A4.tmp"C:\Users\Admin\AppData\Local\Temp\D3A4.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\D3E2.tmp"C:\Users\Admin\AppData\Local\Temp\D3E2.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:868 -
C:\Users\Admin\AppData\Local\Temp\D421.tmp"C:\Users\Admin\AppData\Local\Temp\D421.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\D45F.tmp"C:\Users\Admin\AppData\Local\Temp\D45F.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\D49D.tmp"C:\Users\Admin\AppData\Local\Temp\D49D.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:664 -
C:\Users\Admin\AppData\Local\Temp\D4EB.tmp"C:\Users\Admin\AppData\Local\Temp\D4EB.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\D52A.tmp"C:\Users\Admin\AppData\Local\Temp\D52A.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\D568.tmp"C:\Users\Admin\AppData\Local\Temp\D568.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\D5A7.tmp"C:\Users\Admin\AppData\Local\Temp\D5A7.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\D5E5.tmp"C:\Users\Admin\AppData\Local\Temp\D5E5.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\D623.tmp"C:\Users\Admin\AppData\Local\Temp\D623.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:880 -
C:\Users\Admin\AppData\Local\Temp\D662.tmp"C:\Users\Admin\AppData\Local\Temp\D662.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\D6A0.tmp"C:\Users\Admin\AppData\Local\Temp\D6A0.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\D6DF.tmp"C:\Users\Admin\AppData\Local\Temp\D6DF.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\D72D.tmp"C:\Users\Admin\AppData\Local\Temp\D72D.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\D76B.tmp"C:\Users\Admin\AppData\Local\Temp\D76B.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\D7A9.tmp"C:\Users\Admin\AppData\Local\Temp\D7A9.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\D7E8.tmp"C:\Users\Admin\AppData\Local\Temp\D7E8.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\D826.tmp"C:\Users\Admin\AppData\Local\Temp\D826.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\D865.tmp"C:\Users\Admin\AppData\Local\Temp\D865.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:584 -
C:\Users\Admin\AppData\Local\Temp\D8A3.tmp"C:\Users\Admin\AppData\Local\Temp\D8A3.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\D8E1.tmp"C:\Users\Admin\AppData\Local\Temp\D8E1.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\D920.tmp"C:\Users\Admin\AppData\Local\Temp\D920.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\D95E.tmp"C:\Users\Admin\AppData\Local\Temp\D95E.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\D99D.tmp"C:\Users\Admin\AppData\Local\Temp\D99D.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\D9DB.tmp"C:\Users\Admin\AppData\Local\Temp\D9DB.tmp"65⤵
- Executes dropped EXE
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\DA19.tmp"C:\Users\Admin\AppData\Local\Temp\DA19.tmp"66⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\DA58.tmp"C:\Users\Admin\AppData\Local\Temp\DA58.tmp"67⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\DA87.tmp"C:\Users\Admin\AppData\Local\Temp\DA87.tmp"68⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\DAC5.tmp"C:\Users\Admin\AppData\Local\Temp\DAC5.tmp"69⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\DB13.tmp"C:\Users\Admin\AppData\Local\Temp\DB13.tmp"70⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\DB51.tmp"C:\Users\Admin\AppData\Local\Temp\DB51.tmp"71⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\DB90.tmp"C:\Users\Admin\AppData\Local\Temp\DB90.tmp"72⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\DBCE.tmp"C:\Users\Admin\AppData\Local\Temp\DBCE.tmp"73⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\DC0D.tmp"C:\Users\Admin\AppData\Local\Temp\DC0D.tmp"74⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\DC4B.tmp"C:\Users\Admin\AppData\Local\Temp\DC4B.tmp"75⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\DC89.tmp"C:\Users\Admin\AppData\Local\Temp\DC89.tmp"76⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\DCC8.tmp"C:\Users\Admin\AppData\Local\Temp\DCC8.tmp"77⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\DD06.tmp"C:\Users\Admin\AppData\Local\Temp\DD06.tmp"78⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\DD45.tmp"C:\Users\Admin\AppData\Local\Temp\DD45.tmp"79⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\DD83.tmp"C:\Users\Admin\AppData\Local\Temp\DD83.tmp"80⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\DDC2.tmp"C:\Users\Admin\AppData\Local\Temp\DDC2.tmp"81⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\DE00.tmp"C:\Users\Admin\AppData\Local\Temp\DE00.tmp"82⤵PID:276
-
C:\Users\Admin\AppData\Local\Temp\DE3E.tmp"C:\Users\Admin\AppData\Local\Temp\DE3E.tmp"83⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\DE7D.tmp"C:\Users\Admin\AppData\Local\Temp\DE7D.tmp"84⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\DEBB.tmp"C:\Users\Admin\AppData\Local\Temp\DEBB.tmp"85⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\DEFA.tmp"C:\Users\Admin\AppData\Local\Temp\DEFA.tmp"86⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\DF38.tmp"C:\Users\Admin\AppData\Local\Temp\DF38.tmp"87⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\DF76.tmp"C:\Users\Admin\AppData\Local\Temp\DF76.tmp"88⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\DFB5.tmp"C:\Users\Admin\AppData\Local\Temp\DFB5.tmp"89⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\DFF3.tmp"C:\Users\Admin\AppData\Local\Temp\DFF3.tmp"90⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\E032.tmp"C:\Users\Admin\AppData\Local\Temp\E032.tmp"91⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\E070.tmp"C:\Users\Admin\AppData\Local\Temp\E070.tmp"92⤵
- System Location Discovery: System Language Discovery
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\E0AE.tmp"C:\Users\Admin\AppData\Local\Temp\E0AE.tmp"93⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\E0ED.tmp"C:\Users\Admin\AppData\Local\Temp\E0ED.tmp"94⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\E12B.tmp"C:\Users\Admin\AppData\Local\Temp\E12B.tmp"95⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\E16A.tmp"C:\Users\Admin\AppData\Local\Temp\E16A.tmp"96⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\E1A8.tmp"C:\Users\Admin\AppData\Local\Temp\E1A8.tmp"97⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\E1E6.tmp"C:\Users\Admin\AppData\Local\Temp\E1E6.tmp"98⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\E225.tmp"C:\Users\Admin\AppData\Local\Temp\E225.tmp"99⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\E263.tmp"C:\Users\Admin\AppData\Local\Temp\E263.tmp"100⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\E2A2.tmp"C:\Users\Admin\AppData\Local\Temp\E2A2.tmp"101⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\E2E0.tmp"C:\Users\Admin\AppData\Local\Temp\E2E0.tmp"102⤵PID:520
-
C:\Users\Admin\AppData\Local\Temp\E31E.tmp"C:\Users\Admin\AppData\Local\Temp\E31E.tmp"103⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\E36C.tmp"C:\Users\Admin\AppData\Local\Temp\E36C.tmp"104⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\E3AB.tmp"C:\Users\Admin\AppData\Local\Temp\E3AB.tmp"105⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\E3E9.tmp"C:\Users\Admin\AppData\Local\Temp\E3E9.tmp"106⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\E428.tmp"C:\Users\Admin\AppData\Local\Temp\E428.tmp"107⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\E466.tmp"C:\Users\Admin\AppData\Local\Temp\E466.tmp"108⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\E4A4.tmp"C:\Users\Admin\AppData\Local\Temp\E4A4.tmp"109⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\E4E3.tmp"C:\Users\Admin\AppData\Local\Temp\E4E3.tmp"110⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\E521.tmp"C:\Users\Admin\AppData\Local\Temp\E521.tmp"111⤵
- System Location Discovery: System Language Discovery
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\E560.tmp"C:\Users\Admin\AppData\Local\Temp\E560.tmp"112⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\E59E.tmp"C:\Users\Admin\AppData\Local\Temp\E59E.tmp"113⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\E5DC.tmp"C:\Users\Admin\AppData\Local\Temp\E5DC.tmp"114⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\E61B.tmp"C:\Users\Admin\AppData\Local\Temp\E61B.tmp"115⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\E669.tmp"C:\Users\Admin\AppData\Local\Temp\E669.tmp"116⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"117⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\E6E6.tmp"C:\Users\Admin\AppData\Local\Temp\E6E6.tmp"118⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\E724.tmp"C:\Users\Admin\AppData\Local\Temp\E724.tmp"119⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\E762.tmp"C:\Users\Admin\AppData\Local\Temp\E762.tmp"120⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"121⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\E7DF.tmp"C:\Users\Admin\AppData\Local\Temp\E7DF.tmp"122⤵PID:2704
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-