Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-09-2024 05:54
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-19_a45c7df3d5aa3c1b1082fc58b143c9db_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-19_a45c7df3d5aa3c1b1082fc58b143c9db_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-19_a45c7df3d5aa3c1b1082fc58b143c9db_mafia.exe
-
Size
536KB
-
MD5
a45c7df3d5aa3c1b1082fc58b143c9db
-
SHA1
7d9335dd265695089678f8b4c10937cce161bb0c
-
SHA256
7f18396fb23107aceef2ff9efd3e123b52d57ee1bec2ed5ac07ecd9f6455fbcf
-
SHA512
f0cbc79a7bfe835dd8a4f4fe87ed6b423fa50c8de36ff78469b1f35704cc77e3abc1358fc5c7adc3fe3b5686d53860b708995a0dfc8c317972e747c714ee38e9
-
SSDEEP
12288:wU5rCOTeiUZPaLwCM3FjIVRHARIZxVJ0ZT9:wUQOJUdmOpIVRHARIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2404 C024.tmp 1332 C0B0.tmp 2116 C0EF.tmp 2700 C1E8.tmp 2756 C284.tmp 2140 C320.tmp 2732 C38D.tmp 2912 C449.tmp 2644 C487.tmp 2648 C4D5.tmp 2332 C523.tmp 2860 C561.tmp 1112 C5A0.tmp 2972 C5DE.tmp 2848 C62C.tmp 2708 C67A.tmp 2980 C6C8.tmp 3012 C707.tmp 1044 C745.tmp 3032 C783.tmp 2240 C7C2.tmp 2432 C800.tmp 1840 C83F.tmp 2320 C87D.tmp 1956 C8BB.tmp 868 C8FA.tmp 1744 C938.tmp 2208 C977.tmp 1664 C9B5.tmp 1540 C9F3.tmp 2088 CA32.tmp 3056 CA70.tmp 1232 CAAF.tmp 344 CAED.tmp 2220 CB2B.tmp 2564 CB6A.tmp 908 CBA8.tmp 1852 CBE7.tmp 1576 CC25.tmp 2344 CC63.tmp 2404 CCA2.tmp 2496 CCE0.tmp 1620 CD1F.tmp 1032 CD5D.tmp 2468 CD9B.tmp 2820 CDDA.tmp 2756 CE18.tmp 2752 CE57.tmp 2724 CE95.tmp 2656 CED3.tmp 2780 CF12.tmp 552 CF50.tmp 2964 CF8F.tmp 2676 CFCD.tmp 2604 D00B.tmp 844 D069.tmp 1964 D0C7.tmp 2360 D105.tmp 2032 D143.tmp 2336 D182.tmp 2940 D1C0.tmp 2352 D1FF.tmp 1860 D24D.tmp 1564 D28B.tmp -
Loads dropped DLL 64 IoCs
pid Process 1732 2024-09-19_a45c7df3d5aa3c1b1082fc58b143c9db_mafia.exe 2404 C024.tmp 1332 C0B0.tmp 2116 C0EF.tmp 2700 C1E8.tmp 2756 C284.tmp 2140 C320.tmp 2732 C38D.tmp 2912 C449.tmp 2644 C487.tmp 2648 C4D5.tmp 2332 C523.tmp 2860 C561.tmp 1112 C5A0.tmp 2972 C5DE.tmp 2848 C62C.tmp 2708 C67A.tmp 2980 C6C8.tmp 3012 C707.tmp 1044 C745.tmp 3032 C783.tmp 2240 C7C2.tmp 2432 C800.tmp 1840 C83F.tmp 2320 C87D.tmp 1956 C8BB.tmp 868 C8FA.tmp 1744 C938.tmp 2208 C977.tmp 1664 C9B5.tmp 1540 C9F3.tmp 2088 CA32.tmp 3056 CA70.tmp 1232 CAAF.tmp 344 CAED.tmp 2220 CB2B.tmp 2564 CB6A.tmp 908 CBA8.tmp 1852 CBE7.tmp 1576 CC25.tmp 2344 CC63.tmp 2404 CCA2.tmp 2496 CCE0.tmp 1620 CD1F.tmp 1032 CD5D.tmp 2468 CD9B.tmp 2820 CDDA.tmp 2756 CE18.tmp 2752 CE57.tmp 2724 CE95.tmp 2656 CED3.tmp 2780 CF12.tmp 552 CF50.tmp 2964 CF8F.tmp 2676 CFCD.tmp 2604 D00B.tmp 844 D069.tmp 1964 D0C7.tmp 2360 D105.tmp 2032 D143.tmp 2336 D182.tmp 2940 D1C0.tmp 2352 D1FF.tmp 1860 D24D.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1EE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7475.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D77B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B50D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1278.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E91.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D385.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 733D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F71B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A380.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 925.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5264.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9000.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B73E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B931.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D8B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3987.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8121.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8871.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C8C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 785B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D549.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6365.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1732 wrote to memory of 2404 1732 2024-09-19_a45c7df3d5aa3c1b1082fc58b143c9db_mafia.exe 30 PID 1732 wrote to memory of 2404 1732 2024-09-19_a45c7df3d5aa3c1b1082fc58b143c9db_mafia.exe 30 PID 1732 wrote to memory of 2404 1732 2024-09-19_a45c7df3d5aa3c1b1082fc58b143c9db_mafia.exe 30 PID 1732 wrote to memory of 2404 1732 2024-09-19_a45c7df3d5aa3c1b1082fc58b143c9db_mafia.exe 30 PID 2404 wrote to memory of 1332 2404 C024.tmp 31 PID 2404 wrote to memory of 1332 2404 C024.tmp 31 PID 2404 wrote to memory of 1332 2404 C024.tmp 31 PID 2404 wrote to memory of 1332 2404 C024.tmp 31 PID 1332 wrote to memory of 2116 1332 C0B0.tmp 32 PID 1332 wrote to memory of 2116 1332 C0B0.tmp 32 PID 1332 wrote to memory of 2116 1332 C0B0.tmp 32 PID 1332 wrote to memory of 2116 1332 C0B0.tmp 32 PID 2116 wrote to memory of 2700 2116 C0EF.tmp 33 PID 2116 wrote to memory of 2700 2116 C0EF.tmp 33 PID 2116 wrote to memory of 2700 2116 C0EF.tmp 33 PID 2116 wrote to memory of 2700 2116 C0EF.tmp 33 PID 2700 wrote to memory of 2756 2700 C1E8.tmp 34 PID 2700 wrote to memory of 2756 2700 C1E8.tmp 34 PID 2700 wrote to memory of 2756 2700 C1E8.tmp 34 PID 2700 wrote to memory of 2756 2700 C1E8.tmp 34 PID 2756 wrote to memory of 2140 2756 C284.tmp 35 PID 2756 wrote to memory of 2140 2756 C284.tmp 35 PID 2756 wrote to memory of 2140 2756 C284.tmp 35 PID 2756 wrote to memory of 2140 2756 C284.tmp 35 PID 2140 wrote to memory of 2732 2140 C320.tmp 36 PID 2140 wrote to memory of 2732 2140 C320.tmp 36 PID 2140 wrote to memory of 2732 2140 C320.tmp 36 PID 2140 wrote to memory of 2732 2140 C320.tmp 36 PID 2732 wrote to memory of 2912 2732 C38D.tmp 37 PID 2732 wrote to memory of 2912 2732 C38D.tmp 37 PID 2732 wrote to memory of 2912 2732 C38D.tmp 37 PID 2732 wrote to memory of 2912 2732 C38D.tmp 37 PID 2912 wrote to memory of 2644 2912 C449.tmp 38 PID 2912 wrote to memory of 2644 2912 C449.tmp 38 PID 2912 wrote to memory of 2644 2912 C449.tmp 38 PID 2912 wrote to memory of 2644 2912 C449.tmp 38 PID 2644 wrote to memory of 2648 2644 C487.tmp 39 PID 2644 wrote to memory of 2648 2644 C487.tmp 39 PID 2644 wrote to memory of 2648 2644 C487.tmp 39 PID 2644 wrote to memory of 2648 2644 C487.tmp 39 PID 2648 wrote to memory of 2332 2648 C4D5.tmp 40 PID 2648 wrote to memory of 2332 2648 C4D5.tmp 40 PID 2648 wrote to memory of 2332 2648 C4D5.tmp 40 PID 2648 wrote to memory of 2332 2648 C4D5.tmp 40 PID 2332 wrote to memory of 2860 2332 C523.tmp 41 PID 2332 wrote to memory of 2860 2332 C523.tmp 41 PID 2332 wrote to memory of 2860 2332 C523.tmp 41 PID 2332 wrote to memory of 2860 2332 C523.tmp 41 PID 2860 wrote to memory of 1112 2860 C561.tmp 42 PID 2860 wrote to memory of 1112 2860 C561.tmp 42 PID 2860 wrote to memory of 1112 2860 C561.tmp 42 PID 2860 wrote to memory of 1112 2860 C561.tmp 42 PID 1112 wrote to memory of 2972 1112 C5A0.tmp 43 PID 1112 wrote to memory of 2972 1112 C5A0.tmp 43 PID 1112 wrote to memory of 2972 1112 C5A0.tmp 43 PID 1112 wrote to memory of 2972 1112 C5A0.tmp 43 PID 2972 wrote to memory of 2848 2972 C5DE.tmp 44 PID 2972 wrote to memory of 2848 2972 C5DE.tmp 44 PID 2972 wrote to memory of 2848 2972 C5DE.tmp 44 PID 2972 wrote to memory of 2848 2972 C5DE.tmp 44 PID 2848 wrote to memory of 2708 2848 C62C.tmp 45 PID 2848 wrote to memory of 2708 2848 C62C.tmp 45 PID 2848 wrote to memory of 2708 2848 C62C.tmp 45 PID 2848 wrote to memory of 2708 2848 C62C.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_a45c7df3d5aa3c1b1082fc58b143c9db_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_a45c7df3d5aa3c1b1082fc58b143c9db_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\C024.tmp"C:\Users\Admin\AppData\Local\Temp\C024.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\C0EF.tmp"C:\Users\Admin\AppData\Local\Temp\C0EF.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\C284.tmp"C:\Users\Admin\AppData\Local\Temp\C284.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\C320.tmp"C:\Users\Admin\AppData\Local\Temp\C320.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\C38D.tmp"C:\Users\Admin\AppData\Local\Temp\C38D.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\C449.tmp"C:\Users\Admin\AppData\Local\Temp\C449.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\C487.tmp"C:\Users\Admin\AppData\Local\Temp\C487.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\C4D5.tmp"C:\Users\Admin\AppData\Local\Temp\C4D5.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\C523.tmp"C:\Users\Admin\AppData\Local\Temp\C523.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\C561.tmp"C:\Users\Admin\AppData\Local\Temp\C561.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\C5A0.tmp"C:\Users\Admin\AppData\Local\Temp\C5A0.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\C5DE.tmp"C:\Users\Admin\AppData\Local\Temp\C5DE.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\C62C.tmp"C:\Users\Admin\AppData\Local\Temp\C62C.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\C67A.tmp"C:\Users\Admin\AppData\Local\Temp\C67A.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\C6C8.tmp"C:\Users\Admin\AppData\Local\Temp\C6C8.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\C707.tmp"C:\Users\Admin\AppData\Local\Temp\C707.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\C745.tmp"C:\Users\Admin\AppData\Local\Temp\C745.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\C783.tmp"C:\Users\Admin\AppData\Local\Temp\C783.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\C7C2.tmp"C:\Users\Admin\AppData\Local\Temp\C7C2.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\C800.tmp"C:\Users\Admin\AppData\Local\Temp\C800.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\C83F.tmp"C:\Users\Admin\AppData\Local\Temp\C83F.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\C87D.tmp"C:\Users\Admin\AppData\Local\Temp\C87D.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\C8BB.tmp"C:\Users\Admin\AppData\Local\Temp\C8BB.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\C8FA.tmp"C:\Users\Admin\AppData\Local\Temp\C8FA.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:868 -
C:\Users\Admin\AppData\Local\Temp\C938.tmp"C:\Users\Admin\AppData\Local\Temp\C938.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\C977.tmp"C:\Users\Admin\AppData\Local\Temp\C977.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\C9B5.tmp"C:\Users\Admin\AppData\Local\Temp\C9B5.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\C9F3.tmp"C:\Users\Admin\AppData\Local\Temp\C9F3.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\CA32.tmp"C:\Users\Admin\AppData\Local\Temp\CA32.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\CA70.tmp"C:\Users\Admin\AppData\Local\Temp\CA70.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\CAAF.tmp"C:\Users\Admin\AppData\Local\Temp\CAAF.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\CAED.tmp"C:\Users\Admin\AppData\Local\Temp\CAED.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:344 -
C:\Users\Admin\AppData\Local\Temp\CB2B.tmp"C:\Users\Admin\AppData\Local\Temp\CB2B.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\CB6A.tmp"C:\Users\Admin\AppData\Local\Temp\CB6A.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\CBA8.tmp"C:\Users\Admin\AppData\Local\Temp\CBA8.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:908 -
C:\Users\Admin\AppData\Local\Temp\CBE7.tmp"C:\Users\Admin\AppData\Local\Temp\CBE7.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\CC25.tmp"C:\Users\Admin\AppData\Local\Temp\CC25.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\CC63.tmp"C:\Users\Admin\AppData\Local\Temp\CC63.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\CCA2.tmp"C:\Users\Admin\AppData\Local\Temp\CCA2.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\CCE0.tmp"C:\Users\Admin\AppData\Local\Temp\CCE0.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\CD1F.tmp"C:\Users\Admin\AppData\Local\Temp\CD1F.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\CD5D.tmp"C:\Users\Admin\AppData\Local\Temp\CD5D.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\CD9B.tmp"C:\Users\Admin\AppData\Local\Temp\CD9B.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\CDDA.tmp"C:\Users\Admin\AppData\Local\Temp\CDDA.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\CE18.tmp"C:\Users\Admin\AppData\Local\Temp\CE18.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\CE57.tmp"C:\Users\Admin\AppData\Local\Temp\CE57.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\CE95.tmp"C:\Users\Admin\AppData\Local\Temp\CE95.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\CED3.tmp"C:\Users\Admin\AppData\Local\Temp\CED3.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\CF12.tmp"C:\Users\Admin\AppData\Local\Temp\CF12.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\CF50.tmp"C:\Users\Admin\AppData\Local\Temp\CF50.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:552 -
C:\Users\Admin\AppData\Local\Temp\CF8F.tmp"C:\Users\Admin\AppData\Local\Temp\CF8F.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\CFCD.tmp"C:\Users\Admin\AppData\Local\Temp\CFCD.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\D00B.tmp"C:\Users\Admin\AppData\Local\Temp\D00B.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\D069.tmp"C:\Users\Admin\AppData\Local\Temp\D069.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:844 -
C:\Users\Admin\AppData\Local\Temp\D0C7.tmp"C:\Users\Admin\AppData\Local\Temp\D0C7.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\D105.tmp"C:\Users\Admin\AppData\Local\Temp\D105.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\D143.tmp"C:\Users\Admin\AppData\Local\Temp\D143.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\D182.tmp"C:\Users\Admin\AppData\Local\Temp\D182.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\D1C0.tmp"C:\Users\Admin\AppData\Local\Temp\D1C0.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\D1FF.tmp"C:\Users\Admin\AppData\Local\Temp\D1FF.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\D24D.tmp"C:\Users\Admin\AppData\Local\Temp\D24D.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\D28B.tmp"C:\Users\Admin\AppData\Local\Temp\D28B.tmp"65⤵
- Executes dropped EXE
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\D2D9.tmp"C:\Users\Admin\AppData\Local\Temp\D2D9.tmp"66⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\D346.tmp"C:\Users\Admin\AppData\Local\Temp\D346.tmp"67⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\D385.tmp"C:\Users\Admin\AppData\Local\Temp\D385.tmp"68⤵
- System Location Discovery: System Language Discovery
PID:372 -
C:\Users\Admin\AppData\Local\Temp\D3D3.tmp"C:\Users\Admin\AppData\Local\Temp\D3D3.tmp"69⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\D411.tmp"C:\Users\Admin\AppData\Local\Temp\D411.tmp"70⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\D45F.tmp"C:\Users\Admin\AppData\Local\Temp\D45F.tmp"71⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\D48E.tmp"C:\Users\Admin\AppData\Local\Temp\D48E.tmp"72⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\D4CC.tmp"C:\Users\Admin\AppData\Local\Temp\D4CC.tmp"73⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\D50B.tmp"C:\Users\Admin\AppData\Local\Temp\D50B.tmp"74⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\D549.tmp"C:\Users\Admin\AppData\Local\Temp\D549.tmp"75⤵
- System Location Discovery: System Language Discovery
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\D578.tmp"C:\Users\Admin\AppData\Local\Temp\D578.tmp"76⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\D5B6.tmp"C:\Users\Admin\AppData\Local\Temp\D5B6.tmp"77⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\D604.tmp"C:\Users\Admin\AppData\Local\Temp\D604.tmp"78⤵PID:600
-
C:\Users\Admin\AppData\Local\Temp\D643.tmp"C:\Users\Admin\AppData\Local\Temp\D643.tmp"79⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\D681.tmp"C:\Users\Admin\AppData\Local\Temp\D681.tmp"80⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\D6BF.tmp"C:\Users\Admin\AppData\Local\Temp\D6BF.tmp"81⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\D6FE.tmp"C:\Users\Admin\AppData\Local\Temp\D6FE.tmp"82⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\D73C.tmp"C:\Users\Admin\AppData\Local\Temp\D73C.tmp"83⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\D77B.tmp"C:\Users\Admin\AppData\Local\Temp\D77B.tmp"84⤵
- System Location Discovery: System Language Discovery
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\D7B9.tmp"C:\Users\Admin\AppData\Local\Temp\D7B9.tmp"85⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\D7F7.tmp"C:\Users\Admin\AppData\Local\Temp\D7F7.tmp"86⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\D836.tmp"C:\Users\Admin\AppData\Local\Temp\D836.tmp"87⤵PID:340
-
C:\Users\Admin\AppData\Local\Temp\D874.tmp"C:\Users\Admin\AppData\Local\Temp\D874.tmp"88⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\D8B3.tmp"C:\Users\Admin\AppData\Local\Temp\D8B3.tmp"89⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\D8F1.tmp"C:\Users\Admin\AppData\Local\Temp\D8F1.tmp"90⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\D92F.tmp"C:\Users\Admin\AppData\Local\Temp\D92F.tmp"91⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\D96E.tmp"C:\Users\Admin\AppData\Local\Temp\D96E.tmp"92⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\D9AC.tmp"C:\Users\Admin\AppData\Local\Temp\D9AC.tmp"93⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\D9EB.tmp"C:\Users\Admin\AppData\Local\Temp\D9EB.tmp"94⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\DA29.tmp"C:\Users\Admin\AppData\Local\Temp\DA29.tmp"95⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\DA67.tmp"C:\Users\Admin\AppData\Local\Temp\DA67.tmp"96⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\DAA6.tmp"C:\Users\Admin\AppData\Local\Temp\DAA6.tmp"97⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\DAE4.tmp"C:\Users\Admin\AppData\Local\Temp\DAE4.tmp"98⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\DB23.tmp"C:\Users\Admin\AppData\Local\Temp\DB23.tmp"99⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\DB61.tmp"C:\Users\Admin\AppData\Local\Temp\DB61.tmp"100⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\DB9F.tmp"C:\Users\Admin\AppData\Local\Temp\DB9F.tmp"101⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\DBDE.tmp"C:\Users\Admin\AppData\Local\Temp\DBDE.tmp"102⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\DC1C.tmp"C:\Users\Admin\AppData\Local\Temp\DC1C.tmp"103⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\DC5B.tmp"C:\Users\Admin\AppData\Local\Temp\DC5B.tmp"104⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\DC99.tmp"C:\Users\Admin\AppData\Local\Temp\DC99.tmp"105⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\DCD7.tmp"C:\Users\Admin\AppData\Local\Temp\DCD7.tmp"106⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\DD16.tmp"C:\Users\Admin\AppData\Local\Temp\DD16.tmp"107⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\DD54.tmp"C:\Users\Admin\AppData\Local\Temp\DD54.tmp"108⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\DD93.tmp"C:\Users\Admin\AppData\Local\Temp\DD93.tmp"109⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\DDD1.tmp"C:\Users\Admin\AppData\Local\Temp\DDD1.tmp"110⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\DE10.tmp"C:\Users\Admin\AppData\Local\Temp\DE10.tmp"111⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\DE4E.tmp"C:\Users\Admin\AppData\Local\Temp\DE4E.tmp"112⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\DE8C.tmp"C:\Users\Admin\AppData\Local\Temp\DE8C.tmp"113⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\DECB.tmp"C:\Users\Admin\AppData\Local\Temp\DECB.tmp"114⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\DF09.tmp"C:\Users\Admin\AppData\Local\Temp\DF09.tmp"115⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\DF48.tmp"C:\Users\Admin\AppData\Local\Temp\DF48.tmp"116⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\DF86.tmp"C:\Users\Admin\AppData\Local\Temp\DF86.tmp"117⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\DFC4.tmp"C:\Users\Admin\AppData\Local\Temp\DFC4.tmp"118⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\E003.tmp"C:\Users\Admin\AppData\Local\Temp\E003.tmp"119⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\E041.tmp"C:\Users\Admin\AppData\Local\Temp\E041.tmp"120⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\E080.tmp"C:\Users\Admin\AppData\Local\Temp\E080.tmp"121⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\E0BE.tmp"C:\Users\Admin\AppData\Local\Temp\E0BE.tmp"122⤵PID:2428
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-