Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-09-2024 05:51
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-19_6998c5368f764ccff5614309e4da1929_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-19_6998c5368f764ccff5614309e4da1929_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-19_6998c5368f764ccff5614309e4da1929_mafia.exe
-
Size
487KB
-
MD5
6998c5368f764ccff5614309e4da1929
-
SHA1
ba2b4bda08d547ab5667b570056d1e85a789fa96
-
SHA256
4eccb188c6564bc072b89d9e8582aed630c2d85da9fc10295bd841997649b99e
-
SHA512
14b95af18de9a25736b30a89004984477de6cc446b50e4dc2393282b5f798b0dbd75c7d77923b86d2bb922dcfdbc50ac09f353a27f165e07f0fa6a19ce10e05a
-
SSDEEP
6144:qorf3lPvovsgZnqG2C7mOTeiL9DUzQJ8BoTK/CKhof5Jh49HO40F5IQpjZkYnY36:HU5rCOTeiJcnCKhvtl0F3jZk8Y3MNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2580 AF91.tmp 2544 AFFE.tmp 2348 B07B.tmp 2528 B0F7.tmp 2480 B165.tmp 2756 B1D2.tmp 2892 B22F.tmp 2312 B29D.tmp 2924 B2FA.tmp 2700 B367.tmp 2660 B3D5.tmp 2624 B442.tmp 2444 B49F.tmp 2396 B50D.tmp 1492 B56A.tmp 580 B5E7.tmp 2804 B645.tmp 1648 B6B2.tmp 2836 B71F.tmp 300 B78C.tmp 2364 B7F9.tmp 1264 B867.tmp 1368 B8C4.tmp 2476 B903.tmp 2976 B941.tmp 2068 B97F.tmp 2172 B9BE.tmp 2392 B9FC.tmp 2272 BA4A.tmp 1316 BA89.tmp 984 BAC7.tmp 2448 BB05.tmp 840 BB44.tmp 828 BB82.tmp 628 BBC1.tmp 940 BBFF.tmp 2344 BC3D.tmp 1900 BC7C.tmp 1700 BCBA.tmp 2056 BCF9.tmp 896 BD37.tmp 888 BD85.tmp 2300 BDC3.tmp 2496 BE02.tmp 2460 BE40.tmp 2372 BE7F.tmp 1232 BEBD.tmp 1892 BEFB.tmp 2232 BF3A.tmp 760 BF78.tmp 1516 BFB7.tmp 2328 BFF5.tmp 1724 C033.tmp 1308 C072.tmp 3044 C0B0.tmp 3048 C0EF.tmp 2212 C12D.tmp 2340 C16B.tmp 2992 C1AA.tmp 1468 C1E8.tmp 2752 C227.tmp 2264 C265.tmp 2876 C2A3.tmp 2736 C2E2.tmp -
Loads dropped DLL 64 IoCs
pid Process 1800 2024-09-19_6998c5368f764ccff5614309e4da1929_mafia.exe 2580 AF91.tmp 2544 AFFE.tmp 2348 B07B.tmp 2528 B0F7.tmp 2480 B165.tmp 2756 B1D2.tmp 2892 B22F.tmp 2312 B29D.tmp 2924 B2FA.tmp 2700 B367.tmp 2660 B3D5.tmp 2624 B442.tmp 2444 B49F.tmp 2396 B50D.tmp 1492 B56A.tmp 580 B5E7.tmp 2804 B645.tmp 1648 B6B2.tmp 2836 B71F.tmp 300 B78C.tmp 2364 B7F9.tmp 1264 B867.tmp 1368 B8C4.tmp 2476 B903.tmp 2976 B941.tmp 2068 B97F.tmp 2172 B9BE.tmp 2392 B9FC.tmp 2272 BA4A.tmp 1316 BA89.tmp 984 BAC7.tmp 2448 BB05.tmp 840 BB44.tmp 828 BB82.tmp 628 BBC1.tmp 940 BBFF.tmp 2344 BC3D.tmp 1900 BC7C.tmp 1700 BCBA.tmp 2056 BCF9.tmp 896 BD37.tmp 888 BD85.tmp 2300 BDC3.tmp 2496 BE02.tmp 2460 BE40.tmp 2372 BE7F.tmp 1232 BEBD.tmp 1892 BEFB.tmp 2232 BF3A.tmp 760 BF78.tmp 1516 BFB7.tmp 2328 BFF5.tmp 1724 C033.tmp 1308 C072.tmp 3044 C0B0.tmp 3048 C0EF.tmp 2212 C12D.tmp 2340 C16B.tmp 2992 C1AA.tmp 1468 C1E8.tmp 2752 C227.tmp 2264 C265.tmp 2876 C2A3.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B29D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C5CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E936.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1880.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 449E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 843D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E83D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4FA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D42.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CA5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A4B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-09-19_6998c5368f764ccff5614309e4da1929_mafia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D10.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1800 wrote to memory of 2580 1800 2024-09-19_6998c5368f764ccff5614309e4da1929_mafia.exe 30 PID 1800 wrote to memory of 2580 1800 2024-09-19_6998c5368f764ccff5614309e4da1929_mafia.exe 30 PID 1800 wrote to memory of 2580 1800 2024-09-19_6998c5368f764ccff5614309e4da1929_mafia.exe 30 PID 1800 wrote to memory of 2580 1800 2024-09-19_6998c5368f764ccff5614309e4da1929_mafia.exe 30 PID 2580 wrote to memory of 2544 2580 AF91.tmp 31 PID 2580 wrote to memory of 2544 2580 AF91.tmp 31 PID 2580 wrote to memory of 2544 2580 AF91.tmp 31 PID 2580 wrote to memory of 2544 2580 AF91.tmp 31 PID 2544 wrote to memory of 2348 2544 AFFE.tmp 32 PID 2544 wrote to memory of 2348 2544 AFFE.tmp 32 PID 2544 wrote to memory of 2348 2544 AFFE.tmp 32 PID 2544 wrote to memory of 2348 2544 AFFE.tmp 32 PID 2348 wrote to memory of 2528 2348 B07B.tmp 33 PID 2348 wrote to memory of 2528 2348 B07B.tmp 33 PID 2348 wrote to memory of 2528 2348 B07B.tmp 33 PID 2348 wrote to memory of 2528 2348 B07B.tmp 33 PID 2528 wrote to memory of 2480 2528 B0F7.tmp 34 PID 2528 wrote to memory of 2480 2528 B0F7.tmp 34 PID 2528 wrote to memory of 2480 2528 B0F7.tmp 34 PID 2528 wrote to memory of 2480 2528 B0F7.tmp 34 PID 2480 wrote to memory of 2756 2480 B165.tmp 35 PID 2480 wrote to memory of 2756 2480 B165.tmp 35 PID 2480 wrote to memory of 2756 2480 B165.tmp 35 PID 2480 wrote to memory of 2756 2480 B165.tmp 35 PID 2756 wrote to memory of 2892 2756 B1D2.tmp 36 PID 2756 wrote to memory of 2892 2756 B1D2.tmp 36 PID 2756 wrote to memory of 2892 2756 B1D2.tmp 36 PID 2756 wrote to memory of 2892 2756 B1D2.tmp 36 PID 2892 wrote to memory of 2312 2892 B22F.tmp 37 PID 2892 wrote to memory of 2312 2892 B22F.tmp 37 PID 2892 wrote to memory of 2312 2892 B22F.tmp 37 PID 2892 wrote to memory of 2312 2892 B22F.tmp 37 PID 2312 wrote to memory of 2924 2312 B29D.tmp 38 PID 2312 wrote to memory of 2924 2312 B29D.tmp 38 PID 2312 wrote to memory of 2924 2312 B29D.tmp 38 PID 2312 wrote to memory of 2924 2312 B29D.tmp 38 PID 2924 wrote to memory of 2700 2924 B2FA.tmp 39 PID 2924 wrote to memory of 2700 2924 B2FA.tmp 39 PID 2924 wrote to memory of 2700 2924 B2FA.tmp 39 PID 2924 wrote to memory of 2700 2924 B2FA.tmp 39 PID 2700 wrote to memory of 2660 2700 B367.tmp 40 PID 2700 wrote to memory of 2660 2700 B367.tmp 40 PID 2700 wrote to memory of 2660 2700 B367.tmp 40 PID 2700 wrote to memory of 2660 2700 B367.tmp 40 PID 2660 wrote to memory of 2624 2660 B3D5.tmp 41 PID 2660 wrote to memory of 2624 2660 B3D5.tmp 41 PID 2660 wrote to memory of 2624 2660 B3D5.tmp 41 PID 2660 wrote to memory of 2624 2660 B3D5.tmp 41 PID 2624 wrote to memory of 2444 2624 B442.tmp 42 PID 2624 wrote to memory of 2444 2624 B442.tmp 42 PID 2624 wrote to memory of 2444 2624 B442.tmp 42 PID 2624 wrote to memory of 2444 2624 B442.tmp 42 PID 2444 wrote to memory of 2396 2444 B49F.tmp 43 PID 2444 wrote to memory of 2396 2444 B49F.tmp 43 PID 2444 wrote to memory of 2396 2444 B49F.tmp 43 PID 2444 wrote to memory of 2396 2444 B49F.tmp 43 PID 2396 wrote to memory of 1492 2396 B50D.tmp 44 PID 2396 wrote to memory of 1492 2396 B50D.tmp 44 PID 2396 wrote to memory of 1492 2396 B50D.tmp 44 PID 2396 wrote to memory of 1492 2396 B50D.tmp 44 PID 1492 wrote to memory of 580 1492 B56A.tmp 45 PID 1492 wrote to memory of 580 1492 B56A.tmp 45 PID 1492 wrote to memory of 580 1492 B56A.tmp 45 PID 1492 wrote to memory of 580 1492 B56A.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_6998c5368f764ccff5614309e4da1929_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_6998c5368f764ccff5614309e4da1929_mafia.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\AF91.tmp"C:\Users\Admin\AppData\Local\Temp\AF91.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\AFFE.tmp"C:\Users\Admin\AppData\Local\Temp\AFFE.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\B07B.tmp"C:\Users\Admin\AppData\Local\Temp\B07B.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\B165.tmp"C:\Users\Admin\AppData\Local\Temp\B165.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\B1D2.tmp"C:\Users\Admin\AppData\Local\Temp\B1D2.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\B22F.tmp"C:\Users\Admin\AppData\Local\Temp\B22F.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\B29D.tmp"C:\Users\Admin\AppData\Local\Temp\B29D.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\B2FA.tmp"C:\Users\Admin\AppData\Local\Temp\B2FA.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\B367.tmp"C:\Users\Admin\AppData\Local\Temp\B367.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\B3D5.tmp"C:\Users\Admin\AppData\Local\Temp\B3D5.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\B442.tmp"C:\Users\Admin\AppData\Local\Temp\B442.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\B49F.tmp"C:\Users\Admin\AppData\Local\Temp\B49F.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\B50D.tmp"C:\Users\Admin\AppData\Local\Temp\B50D.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\B56A.tmp"C:\Users\Admin\AppData\Local\Temp\B56A.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\B5E7.tmp"C:\Users\Admin\AppData\Local\Temp\B5E7.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:580 -
C:\Users\Admin\AppData\Local\Temp\B645.tmp"C:\Users\Admin\AppData\Local\Temp\B645.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\B6B2.tmp"C:\Users\Admin\AppData\Local\Temp\B6B2.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\B71F.tmp"C:\Users\Admin\AppData\Local\Temp\B71F.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\B78C.tmp"C:\Users\Admin\AppData\Local\Temp\B78C.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:300 -
C:\Users\Admin\AppData\Local\Temp\B7F9.tmp"C:\Users\Admin\AppData\Local\Temp\B7F9.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\B867.tmp"C:\Users\Admin\AppData\Local\Temp\B867.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\B8C4.tmp"C:\Users\Admin\AppData\Local\Temp\B8C4.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\B903.tmp"C:\Users\Admin\AppData\Local\Temp\B903.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\B941.tmp"C:\Users\Admin\AppData\Local\Temp\B941.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\B97F.tmp"C:\Users\Admin\AppData\Local\Temp\B97F.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\B9BE.tmp"C:\Users\Admin\AppData\Local\Temp\B9BE.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\B9FC.tmp"C:\Users\Admin\AppData\Local\Temp\B9FC.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\BA4A.tmp"C:\Users\Admin\AppData\Local\Temp\BA4A.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\BA89.tmp"C:\Users\Admin\AppData\Local\Temp\BA89.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\BAC7.tmp"C:\Users\Admin\AppData\Local\Temp\BAC7.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:984 -
C:\Users\Admin\AppData\Local\Temp\BB05.tmp"C:\Users\Admin\AppData\Local\Temp\BB05.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\BB44.tmp"C:\Users\Admin\AppData\Local\Temp\BB44.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:840 -
C:\Users\Admin\AppData\Local\Temp\BB82.tmp"C:\Users\Admin\AppData\Local\Temp\BB82.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:828 -
C:\Users\Admin\AppData\Local\Temp\BBC1.tmp"C:\Users\Admin\AppData\Local\Temp\BBC1.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:628 -
C:\Users\Admin\AppData\Local\Temp\BBFF.tmp"C:\Users\Admin\AppData\Local\Temp\BBFF.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:940 -
C:\Users\Admin\AppData\Local\Temp\BC3D.tmp"C:\Users\Admin\AppData\Local\Temp\BC3D.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\BC7C.tmp"C:\Users\Admin\AppData\Local\Temp\BC7C.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\BCBA.tmp"C:\Users\Admin\AppData\Local\Temp\BCBA.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\BCF9.tmp"C:\Users\Admin\AppData\Local\Temp\BCF9.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\BD37.tmp"C:\Users\Admin\AppData\Local\Temp\BD37.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:896 -
C:\Users\Admin\AppData\Local\Temp\BD85.tmp"C:\Users\Admin\AppData\Local\Temp\BD85.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:888 -
C:\Users\Admin\AppData\Local\Temp\BDC3.tmp"C:\Users\Admin\AppData\Local\Temp\BDC3.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\BE02.tmp"C:\Users\Admin\AppData\Local\Temp\BE02.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\BE40.tmp"C:\Users\Admin\AppData\Local\Temp\BE40.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\BE7F.tmp"C:\Users\Admin\AppData\Local\Temp\BE7F.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\BEBD.tmp"C:\Users\Admin\AppData\Local\Temp\BEBD.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\BEFB.tmp"C:\Users\Admin\AppData\Local\Temp\BEFB.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\BF3A.tmp"C:\Users\Admin\AppData\Local\Temp\BF3A.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\BF78.tmp"C:\Users\Admin\AppData\Local\Temp\BF78.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:760 -
C:\Users\Admin\AppData\Local\Temp\BFB7.tmp"C:\Users\Admin\AppData\Local\Temp\BFB7.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\BFF5.tmp"C:\Users\Admin\AppData\Local\Temp\BFF5.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\C033.tmp"C:\Users\Admin\AppData\Local\Temp\C033.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\C072.tmp"C:\Users\Admin\AppData\Local\Temp\C072.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\C0EF.tmp"C:\Users\Admin\AppData\Local\Temp\C0EF.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\C12D.tmp"C:\Users\Admin\AppData\Local\Temp\C12D.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\C16B.tmp"C:\Users\Admin\AppData\Local\Temp\C16B.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\C227.tmp"C:\Users\Admin\AppData\Local\Temp\C227.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\C265.tmp"C:\Users\Admin\AppData\Local\Temp\C265.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\C2A3.tmp"C:\Users\Admin\AppData\Local\Temp\C2A3.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"65⤵
- Executes dropped EXE
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\C320.tmp"C:\Users\Admin\AppData\Local\Temp\C320.tmp"66⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\C35F.tmp"C:\Users\Admin\AppData\Local\Temp\C35F.tmp"67⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\C39D.tmp"C:\Users\Admin\AppData\Local\Temp\C39D.tmp"68⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\C3DB.tmp"C:\Users\Admin\AppData\Local\Temp\C3DB.tmp"69⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\C41A.tmp"C:\Users\Admin\AppData\Local\Temp\C41A.tmp"70⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\C458.tmp"C:\Users\Admin\AppData\Local\Temp\C458.tmp"71⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\C497.tmp"C:\Users\Admin\AppData\Local\Temp\C497.tmp"72⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\C4D5.tmp"C:\Users\Admin\AppData\Local\Temp\C4D5.tmp"73⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\C513.tmp"C:\Users\Admin\AppData\Local\Temp\C513.tmp"74⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\C552.tmp"C:\Users\Admin\AppData\Local\Temp\C552.tmp"75⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\C590.tmp"C:\Users\Admin\AppData\Local\Temp\C590.tmp"76⤵PID:524
-
C:\Users\Admin\AppData\Local\Temp\C5CF.tmp"C:\Users\Admin\AppData\Local\Temp\C5CF.tmp"77⤵
- System Location Discovery: System Language Discovery
PID:664 -
C:\Users\Admin\AppData\Local\Temp\C60D.tmp"C:\Users\Admin\AppData\Local\Temp\C60D.tmp"78⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\C64B.tmp"C:\Users\Admin\AppData\Local\Temp\C64B.tmp"79⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\C68A.tmp"C:\Users\Admin\AppData\Local\Temp\C68A.tmp"80⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\C6C8.tmp"C:\Users\Admin\AppData\Local\Temp\C6C8.tmp"81⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\C707.tmp"C:\Users\Admin\AppData\Local\Temp\C707.tmp"82⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\C745.tmp"C:\Users\Admin\AppData\Local\Temp\C745.tmp"83⤵PID:340
-
C:\Users\Admin\AppData\Local\Temp\C783.tmp"C:\Users\Admin\AppData\Local\Temp\C783.tmp"84⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\C7C2.tmp"C:\Users\Admin\AppData\Local\Temp\C7C2.tmp"85⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\C800.tmp"C:\Users\Admin\AppData\Local\Temp\C800.tmp"86⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\C83F.tmp"C:\Users\Admin\AppData\Local\Temp\C83F.tmp"87⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\C87D.tmp"C:\Users\Admin\AppData\Local\Temp\C87D.tmp"88⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\C8BB.tmp"C:\Users\Admin\AppData\Local\Temp\C8BB.tmp"89⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\C8FA.tmp"C:\Users\Admin\AppData\Local\Temp\C8FA.tmp"90⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\C938.tmp"C:\Users\Admin\AppData\Local\Temp\C938.tmp"91⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\C977.tmp"C:\Users\Admin\AppData\Local\Temp\C977.tmp"92⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\C9A5.tmp"C:\Users\Admin\AppData\Local\Temp\C9A5.tmp"93⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\C9E4.tmp"C:\Users\Admin\AppData\Local\Temp\C9E4.tmp"94⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\CA22.tmp"C:\Users\Admin\AppData\Local\Temp\CA22.tmp"95⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\CA61.tmp"C:\Users\Admin\AppData\Local\Temp\CA61.tmp"96⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\CA9F.tmp"C:\Users\Admin\AppData\Local\Temp\CA9F.tmp"97⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\CADD.tmp"C:\Users\Admin\AppData\Local\Temp\CADD.tmp"98⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\CB1C.tmp"C:\Users\Admin\AppData\Local\Temp\CB1C.tmp"99⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\CB5A.tmp"C:\Users\Admin\AppData\Local\Temp\CB5A.tmp"100⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\CB99.tmp"C:\Users\Admin\AppData\Local\Temp\CB99.tmp"101⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\CBD7.tmp"C:\Users\Admin\AppData\Local\Temp\CBD7.tmp"102⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\CC15.tmp"C:\Users\Admin\AppData\Local\Temp\CC15.tmp"103⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\CC54.tmp"C:\Users\Admin\AppData\Local\Temp\CC54.tmp"104⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\CC92.tmp"C:\Users\Admin\AppData\Local\Temp\CC92.tmp"105⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\CCD1.tmp"C:\Users\Admin\AppData\Local\Temp\CCD1.tmp"106⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\CD0F.tmp"C:\Users\Admin\AppData\Local\Temp\CD0F.tmp"107⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\CD4D.tmp"C:\Users\Admin\AppData\Local\Temp\CD4D.tmp"108⤵PID:344
-
C:\Users\Admin\AppData\Local\Temp\CD8C.tmp"C:\Users\Admin\AppData\Local\Temp\CD8C.tmp"109⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\CDCA.tmp"C:\Users\Admin\AppData\Local\Temp\CDCA.tmp"110⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\CE09.tmp"C:\Users\Admin\AppData\Local\Temp\CE09.tmp"111⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\CE47.tmp"C:\Users\Admin\AppData\Local\Temp\CE47.tmp"112⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\CE85.tmp"C:\Users\Admin\AppData\Local\Temp\CE85.tmp"113⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\CEC4.tmp"C:\Users\Admin\AppData\Local\Temp\CEC4.tmp"114⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\CF02.tmp"C:\Users\Admin\AppData\Local\Temp\CF02.tmp"115⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\CF41.tmp"C:\Users\Admin\AppData\Local\Temp\CF41.tmp"116⤵
- System Location Discovery: System Language Discovery
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\CF7F.tmp"C:\Users\Admin\AppData\Local\Temp\CF7F.tmp"117⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\CFBD.tmp"C:\Users\Admin\AppData\Local\Temp\CFBD.tmp"118⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\CFFC.tmp"C:\Users\Admin\AppData\Local\Temp\CFFC.tmp"119⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\D03A.tmp"C:\Users\Admin\AppData\Local\Temp\D03A.tmp"120⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\D079.tmp"C:\Users\Admin\AppData\Local\Temp\D079.tmp"121⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\D0B7.tmp"C:\Users\Admin\AppData\Local\Temp\D0B7.tmp"122⤵PID:2108
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-