Analysis
-
max time kernel
150s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
21-09-2024 06:51
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-21_64b49494b1a6e006f4706151cc724cfe_mafia.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-09-21_64b49494b1a6e006f4706151cc724cfe_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-21_64b49494b1a6e006f4706151cc724cfe_mafia.exe
-
Size
486KB
-
MD5
64b49494b1a6e006f4706151cc724cfe
-
SHA1
2e5c136aef1405d873c8a62f202748a506e0192b
-
SHA256
3745567a0c62b7936fe02cffa8bc64e0f9b83ee35b6ed88062495d1b27fa3d60
-
SHA512
3bc25582830747c0107c776d0cdc9d552d6f3d729e9c9fb8fd4a3adfd5f411317f15517f77aaf46f8e872baa38b73d8b7e0166712a60f116c113f2d8646901ad
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7RXypXw3A+e8BMbzODLOafIfkGjiAr5ow5Jsz:/U5rCOTeiDByNw3AQMbyPSWAew5uNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 704 E051.tmp 2696 E09F.tmp 2100 E12B.tmp 2868 E189.tmp 2948 E1F6.tmp 2764 E254.tmp 2800 E2A2.tmp 2740 E2FF.tmp 2604 E36C.tmp 2676 E3E9.tmp 3028 E456.tmp 2620 E4D3.tmp 2068 E540.tmp 2064 E5BD.tmp 1728 E62A.tmp 2252 E6A7.tmp 2044 E714.tmp 2792 E772.tmp 2388 E7DF.tmp 1516 E83D.tmp 2052 E8BA.tmp 1272 E927.tmp 1068 E984.tmp 1160 E9D2.tmp 1648 EA20.tmp 2956 EA5F.tmp 2556 EA9D.tmp 2384 EADC.tmp 2228 EB1A.tmp 2296 EB58.tmp 904 EB97.tmp 2572 EBD5.tmp 2280 EC23.tmp 1964 EC62.tmp 2504 ECA0.tmp 1200 ECEE.tmp 2080 ED3C.tmp 2404 ED8A.tmp 2160 EDC8.tmp 648 EE07.tmp 1400 EE45.tmp 1748 EE84.tmp 1004 EED2.tmp 1784 EF10.tmp 2508 EF4E.tmp 1736 EF9C.tmp 3008 EFDB.tmp 2324 F019.tmp 2996 F067.tmp 3064 F0A6.tmp 896 F0F4.tmp 2988 F132.tmp 1996 F170.tmp 1596 F1AF.tmp 2892 F1FD.tmp 572 F23B.tmp 2752 F27A.tmp 2852 F2B8.tmp 2100 F306.tmp 2708 F354.tmp 2612 F392.tmp 2640 F3D1.tmp 2896 F41F.tmp 3016 F45D.tmp -
Loads dropped DLL 64 IoCs
pid Process 2544 2024-09-21_64b49494b1a6e006f4706151cc724cfe_mafia.exe 704 E051.tmp 2696 E09F.tmp 2100 E12B.tmp 2868 E189.tmp 2948 E1F6.tmp 2764 E254.tmp 2800 E2A2.tmp 2740 E2FF.tmp 2604 E36C.tmp 2676 E3E9.tmp 3028 E456.tmp 2620 E4D3.tmp 2068 E540.tmp 2064 E5BD.tmp 1728 E62A.tmp 2252 E6A7.tmp 2044 E714.tmp 2792 E772.tmp 2388 E7DF.tmp 1516 E83D.tmp 2052 E8BA.tmp 1272 E927.tmp 1068 E984.tmp 1160 E9D2.tmp 1648 EA20.tmp 2956 EA5F.tmp 2556 EA9D.tmp 2384 EADC.tmp 2228 EB1A.tmp 2296 EB58.tmp 904 EB97.tmp 2572 EBD5.tmp 2280 EC23.tmp 1964 EC62.tmp 2504 ECA0.tmp 1200 ECEE.tmp 2080 ED3C.tmp 2404 ED8A.tmp 2160 EDC8.tmp 648 EE07.tmp 1400 EE45.tmp 1748 EE84.tmp 1004 EED2.tmp 1784 EF10.tmp 2508 EF4E.tmp 1736 EF9C.tmp 3008 EFDB.tmp 2324 F019.tmp 2996 F067.tmp 3064 F0A6.tmp 896 F0F4.tmp 2988 F132.tmp 1996 F170.tmp 1596 F1AF.tmp 2892 F1FD.tmp 572 F23B.tmp 2752 F27A.tmp 2852 F2B8.tmp 2100 F306.tmp 2708 F354.tmp 2612 F392.tmp 2640 F3D1.tmp 2896 F41F.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D23D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9EEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BC3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B73E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F798.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F132.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 731D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2829.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E772.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1536.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADFB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C774.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 562B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2544 wrote to memory of 704 2544 2024-09-21_64b49494b1a6e006f4706151cc724cfe_mafia.exe 29 PID 2544 wrote to memory of 704 2544 2024-09-21_64b49494b1a6e006f4706151cc724cfe_mafia.exe 29 PID 2544 wrote to memory of 704 2544 2024-09-21_64b49494b1a6e006f4706151cc724cfe_mafia.exe 29 PID 2544 wrote to memory of 704 2544 2024-09-21_64b49494b1a6e006f4706151cc724cfe_mafia.exe 29 PID 704 wrote to memory of 2696 704 E051.tmp 30 PID 704 wrote to memory of 2696 704 E051.tmp 30 PID 704 wrote to memory of 2696 704 E051.tmp 30 PID 704 wrote to memory of 2696 704 E051.tmp 30 PID 2696 wrote to memory of 2100 2696 E09F.tmp 31 PID 2696 wrote to memory of 2100 2696 E09F.tmp 31 PID 2696 wrote to memory of 2100 2696 E09F.tmp 31 PID 2696 wrote to memory of 2100 2696 E09F.tmp 31 PID 2100 wrote to memory of 2868 2100 E12B.tmp 32 PID 2100 wrote to memory of 2868 2100 E12B.tmp 32 PID 2100 wrote to memory of 2868 2100 E12B.tmp 32 PID 2100 wrote to memory of 2868 2100 E12B.tmp 32 PID 2868 wrote to memory of 2948 2868 E189.tmp 33 PID 2868 wrote to memory of 2948 2868 E189.tmp 33 PID 2868 wrote to memory of 2948 2868 E189.tmp 33 PID 2868 wrote to memory of 2948 2868 E189.tmp 33 PID 2948 wrote to memory of 2764 2948 E1F6.tmp 34 PID 2948 wrote to memory of 2764 2948 E1F6.tmp 34 PID 2948 wrote to memory of 2764 2948 E1F6.tmp 34 PID 2948 wrote to memory of 2764 2948 E1F6.tmp 34 PID 2764 wrote to memory of 2800 2764 E254.tmp 35 PID 2764 wrote to memory of 2800 2764 E254.tmp 35 PID 2764 wrote to memory of 2800 2764 E254.tmp 35 PID 2764 wrote to memory of 2800 2764 E254.tmp 35 PID 2800 wrote to memory of 2740 2800 E2A2.tmp 36 PID 2800 wrote to memory of 2740 2800 E2A2.tmp 36 PID 2800 wrote to memory of 2740 2800 E2A2.tmp 36 PID 2800 wrote to memory of 2740 2800 E2A2.tmp 36 PID 2740 wrote to memory of 2604 2740 E2FF.tmp 37 PID 2740 wrote to memory of 2604 2740 E2FF.tmp 37 PID 2740 wrote to memory of 2604 2740 E2FF.tmp 37 PID 2740 wrote to memory of 2604 2740 E2FF.tmp 37 PID 2604 wrote to memory of 2676 2604 E36C.tmp 38 PID 2604 wrote to memory of 2676 2604 E36C.tmp 38 PID 2604 wrote to memory of 2676 2604 E36C.tmp 38 PID 2604 wrote to memory of 2676 2604 E36C.tmp 38 PID 2676 wrote to memory of 3028 2676 E3E9.tmp 39 PID 2676 wrote to memory of 3028 2676 E3E9.tmp 39 PID 2676 wrote to memory of 3028 2676 E3E9.tmp 39 PID 2676 wrote to memory of 3028 2676 E3E9.tmp 39 PID 3028 wrote to memory of 2620 3028 E456.tmp 40 PID 3028 wrote to memory of 2620 3028 E456.tmp 40 PID 3028 wrote to memory of 2620 3028 E456.tmp 40 PID 3028 wrote to memory of 2620 3028 E456.tmp 40 PID 2620 wrote to memory of 2068 2620 E4D3.tmp 41 PID 2620 wrote to memory of 2068 2620 E4D3.tmp 41 PID 2620 wrote to memory of 2068 2620 E4D3.tmp 41 PID 2620 wrote to memory of 2068 2620 E4D3.tmp 41 PID 2068 wrote to memory of 2064 2068 E540.tmp 42 PID 2068 wrote to memory of 2064 2068 E540.tmp 42 PID 2068 wrote to memory of 2064 2068 E540.tmp 42 PID 2068 wrote to memory of 2064 2068 E540.tmp 42 PID 2064 wrote to memory of 1728 2064 E5BD.tmp 43 PID 2064 wrote to memory of 1728 2064 E5BD.tmp 43 PID 2064 wrote to memory of 1728 2064 E5BD.tmp 43 PID 2064 wrote to memory of 1728 2064 E5BD.tmp 43 PID 1728 wrote to memory of 2252 1728 E62A.tmp 44 PID 1728 wrote to memory of 2252 1728 E62A.tmp 44 PID 1728 wrote to memory of 2252 1728 E62A.tmp 44 PID 1728 wrote to memory of 2252 1728 E62A.tmp 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-21_64b49494b1a6e006f4706151cc724cfe_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-21_64b49494b1a6e006f4706151cc724cfe_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\E051.tmp"C:\Users\Admin\AppData\Local\Temp\E051.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Users\Admin\AppData\Local\Temp\E09F.tmp"C:\Users\Admin\AppData\Local\Temp\E09F.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\E12B.tmp"C:\Users\Admin\AppData\Local\Temp\E12B.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\E189.tmp"C:\Users\Admin\AppData\Local\Temp\E189.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\E1F6.tmp"C:\Users\Admin\AppData\Local\Temp\E1F6.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\E254.tmp"C:\Users\Admin\AppData\Local\Temp\E254.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\E2A2.tmp"C:\Users\Admin\AppData\Local\Temp\E2A2.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\E2FF.tmp"C:\Users\Admin\AppData\Local\Temp\E2FF.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\E36C.tmp"C:\Users\Admin\AppData\Local\Temp\E36C.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\E3E9.tmp"C:\Users\Admin\AppData\Local\Temp\E3E9.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\E456.tmp"C:\Users\Admin\AppData\Local\Temp\E456.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\E4D3.tmp"C:\Users\Admin\AppData\Local\Temp\E4D3.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\E540.tmp"C:\Users\Admin\AppData\Local\Temp\E540.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\E5BD.tmp"C:\Users\Admin\AppData\Local\Temp\E5BD.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\E62A.tmp"C:\Users\Admin\AppData\Local\Temp\E62A.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\E714.tmp"C:\Users\Admin\AppData\Local\Temp\E714.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\E772.tmp"C:\Users\Admin\AppData\Local\Temp\E772.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\E7DF.tmp"C:\Users\Admin\AppData\Local\Temp\E7DF.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\E83D.tmp"C:\Users\Admin\AppData\Local\Temp\E83D.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\E927.tmp"C:\Users\Admin\AppData\Local\Temp\E927.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\E984.tmp"C:\Users\Admin\AppData\Local\Temp\E984.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\E9D2.tmp"C:\Users\Admin\AppData\Local\Temp\E9D2.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\EA20.tmp"C:\Users\Admin\AppData\Local\Temp\EA20.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\EA5F.tmp"C:\Users\Admin\AppData\Local\Temp\EA5F.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\EA9D.tmp"C:\Users\Admin\AppData\Local\Temp\EA9D.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\EADC.tmp"C:\Users\Admin\AppData\Local\Temp\EADC.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\EB1A.tmp"C:\Users\Admin\AppData\Local\Temp\EB1A.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\EB58.tmp"C:\Users\Admin\AppData\Local\Temp\EB58.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\EB97.tmp"C:\Users\Admin\AppData\Local\Temp\EB97.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:904 -
C:\Users\Admin\AppData\Local\Temp\EBD5.tmp"C:\Users\Admin\AppData\Local\Temp\EBD5.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\EC23.tmp"C:\Users\Admin\AppData\Local\Temp\EC23.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\EC62.tmp"C:\Users\Admin\AppData\Local\Temp\EC62.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\ECA0.tmp"C:\Users\Admin\AppData\Local\Temp\ECA0.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\ECEE.tmp"C:\Users\Admin\AppData\Local\Temp\ECEE.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\ED3C.tmp"C:\Users\Admin\AppData\Local\Temp\ED3C.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\ED8A.tmp"C:\Users\Admin\AppData\Local\Temp\ED8A.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\EDC8.tmp"C:\Users\Admin\AppData\Local\Temp\EDC8.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\EE07.tmp"C:\Users\Admin\AppData\Local\Temp\EE07.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:648 -
C:\Users\Admin\AppData\Local\Temp\EE45.tmp"C:\Users\Admin\AppData\Local\Temp\EE45.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\EE84.tmp"C:\Users\Admin\AppData\Local\Temp\EE84.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\EED2.tmp"C:\Users\Admin\AppData\Local\Temp\EED2.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\EF10.tmp"C:\Users\Admin\AppData\Local\Temp\EF10.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\EF4E.tmp"C:\Users\Admin\AppData\Local\Temp\EF4E.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\EF9C.tmp"C:\Users\Admin\AppData\Local\Temp\EF9C.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\EFDB.tmp"C:\Users\Admin\AppData\Local\Temp\EFDB.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\F019.tmp"C:\Users\Admin\AppData\Local\Temp\F019.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\F067.tmp"C:\Users\Admin\AppData\Local\Temp\F067.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\F0A6.tmp"C:\Users\Admin\AppData\Local\Temp\F0A6.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\F0F4.tmp"C:\Users\Admin\AppData\Local\Temp\F0F4.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:896 -
C:\Users\Admin\AppData\Local\Temp\F132.tmp"C:\Users\Admin\AppData\Local\Temp\F132.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\F170.tmp"C:\Users\Admin\AppData\Local\Temp\F170.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\F1AF.tmp"C:\Users\Admin\AppData\Local\Temp\F1AF.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\F1FD.tmp"C:\Users\Admin\AppData\Local\Temp\F1FD.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\F23B.tmp"C:\Users\Admin\AppData\Local\Temp\F23B.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:572 -
C:\Users\Admin\AppData\Local\Temp\F27A.tmp"C:\Users\Admin\AppData\Local\Temp\F27A.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\F2B8.tmp"C:\Users\Admin\AppData\Local\Temp\F2B8.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\F306.tmp"C:\Users\Admin\AppData\Local\Temp\F306.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\F354.tmp"C:\Users\Admin\AppData\Local\Temp\F354.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\F392.tmp"C:\Users\Admin\AppData\Local\Temp\F392.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\F3D1.tmp"C:\Users\Admin\AppData\Local\Temp\F3D1.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\F41F.tmp"C:\Users\Admin\AppData\Local\Temp\F41F.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\F45D.tmp"C:\Users\Admin\AppData\Local\Temp\F45D.tmp"65⤵
- Executes dropped EXE
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\F4AB.tmp"C:\Users\Admin\AppData\Local\Temp\F4AB.tmp"66⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\F4F9.tmp"C:\Users\Admin\AppData\Local\Temp\F4F9.tmp"67⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\F547.tmp"C:\Users\Admin\AppData\Local\Temp\F547.tmp"68⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\F586.tmp"C:\Users\Admin\AppData\Local\Temp\F586.tmp"69⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\F5C4.tmp"C:\Users\Admin\AppData\Local\Temp\F5C4.tmp"70⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\F602.tmp"C:\Users\Admin\AppData\Local\Temp\F602.tmp"71⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\F641.tmp"C:\Users\Admin\AppData\Local\Temp\F641.tmp"72⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\F67F.tmp"C:\Users\Admin\AppData\Local\Temp\F67F.tmp"73⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\F6CD.tmp"C:\Users\Admin\AppData\Local\Temp\F6CD.tmp"74⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\F71B.tmp"C:\Users\Admin\AppData\Local\Temp\F71B.tmp"75⤵PID:268
-
C:\Users\Admin\AppData\Local\Temp\F75A.tmp"C:\Users\Admin\AppData\Local\Temp\F75A.tmp"76⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\F798.tmp"C:\Users\Admin\AppData\Local\Temp\F798.tmp"77⤵
- System Location Discovery: System Language Discovery
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\F7D6.tmp"C:\Users\Admin\AppData\Local\Temp\F7D6.tmp"78⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\F815.tmp"C:\Users\Admin\AppData\Local\Temp\F815.tmp"79⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\F853.tmp"C:\Users\Admin\AppData\Local\Temp\F853.tmp"80⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\F892.tmp"C:\Users\Admin\AppData\Local\Temp\F892.tmp"81⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\F8D0.tmp"C:\Users\Admin\AppData\Local\Temp\F8D0.tmp"82⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\F90E.tmp"C:\Users\Admin\AppData\Local\Temp\F90E.tmp"83⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\F94D.tmp"C:\Users\Admin\AppData\Local\Temp\F94D.tmp"84⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\F98B.tmp"C:\Users\Admin\AppData\Local\Temp\F98B.tmp"85⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\F9D9.tmp"C:\Users\Admin\AppData\Local\Temp\F9D9.tmp"86⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\FA18.tmp"C:\Users\Admin\AppData\Local\Temp\FA18.tmp"87⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\FA66.tmp"C:\Users\Admin\AppData\Local\Temp\FA66.tmp"88⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\FAA4.tmp"C:\Users\Admin\AppData\Local\Temp\FAA4.tmp"89⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\FAF2.tmp"C:\Users\Admin\AppData\Local\Temp\FAF2.tmp"90⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\FB30.tmp"C:\Users\Admin\AppData\Local\Temp\FB30.tmp"91⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\FB6F.tmp"C:\Users\Admin\AppData\Local\Temp\FB6F.tmp"92⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\FBBD.tmp"C:\Users\Admin\AppData\Local\Temp\FBBD.tmp"93⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\FBFB.tmp"C:\Users\Admin\AppData\Local\Temp\FBFB.tmp"94⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\FC3A.tmp"C:\Users\Admin\AppData\Local\Temp\FC3A.tmp"95⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\FC88.tmp"C:\Users\Admin\AppData\Local\Temp\FC88.tmp"96⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\FCC6.tmp"C:\Users\Admin\AppData\Local\Temp\FCC6.tmp"97⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\FD04.tmp"C:\Users\Admin\AppData\Local\Temp\FD04.tmp"98⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\FD43.tmp"C:\Users\Admin\AppData\Local\Temp\FD43.tmp"99⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\FD81.tmp"C:\Users\Admin\AppData\Local\Temp\FD81.tmp"100⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\FDC0.tmp"C:\Users\Admin\AppData\Local\Temp\FDC0.tmp"101⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\FDFE.tmp"C:\Users\Admin\AppData\Local\Temp\FDFE.tmp"102⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\FE3C.tmp"C:\Users\Admin\AppData\Local\Temp\FE3C.tmp"103⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\FE7B.tmp"C:\Users\Admin\AppData\Local\Temp\FE7B.tmp"104⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\FEB9.tmp"C:\Users\Admin\AppData\Local\Temp\FEB9.tmp"105⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\FEF8.tmp"C:\Users\Admin\AppData\Local\Temp\FEF8.tmp"106⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\FF36.tmp"C:\Users\Admin\AppData\Local\Temp\FF36.tmp"107⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\FF74.tmp"C:\Users\Admin\AppData\Local\Temp\FF74.tmp"108⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\FFB3.tmp"C:\Users\Admin\AppData\Local\Temp\FFB3.tmp"109⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\FFF1.tmp"C:\Users\Admin\AppData\Local\Temp\FFF1.tmp"110⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\30.tmp"C:\Users\Admin\AppData\Local\Temp\30.tmp"111⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\6E.tmp"C:\Users\Admin\AppData\Local\Temp\6E.tmp"112⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\AC.tmp"C:\Users\Admin\AppData\Local\Temp\AC.tmp"113⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\EB.tmp"C:\Users\Admin\AppData\Local\Temp\EB.tmp"114⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\129.tmp"C:\Users\Admin\AppData\Local\Temp\129.tmp"115⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\168.tmp"C:\Users\Admin\AppData\Local\Temp\168.tmp"116⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\1A6.tmp"C:\Users\Admin\AppData\Local\Temp\1A6.tmp"117⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\1F4.tmp"C:\Users\Admin\AppData\Local\Temp\1F4.tmp"118⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\232.tmp"C:\Users\Admin\AppData\Local\Temp\232.tmp"119⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\271.tmp"C:\Users\Admin\AppData\Local\Temp\271.tmp"120⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\2AF.tmp"C:\Users\Admin\AppData\Local\Temp\2AF.tmp"121⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\2FD.tmp"C:\Users\Admin\AppData\Local\Temp\2FD.tmp"122⤵PID:1388
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-