Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
29/09/2024, 09:37
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-29_54274720d2089a8b502c9e7589df8051_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-09-29_54274720d2089a8b502c9e7589df8051_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-29_54274720d2089a8b502c9e7589df8051_mafia.exe
-
Size
487KB
-
MD5
54274720d2089a8b502c9e7589df8051
-
SHA1
b79a8a33516817165bc2f76e06e42fe77067d727
-
SHA256
43a66b615f974adbcc31f5ca034fb52b28249dce09cdb82db55075d2475f4c6c
-
SHA512
05d074a29573121efb001d41e1a21c7ca411cb766f8f3e593b7396dc6cd65c8eef3e4601cfc507c06d03f77f3f43fc148e95327225b7ffc1aef5833d9ea415d9
-
SSDEEP
6144:qorf3lPvovsgZnqG2C7mOTeiL9DUrfi6eeIFXPFiKqV7JnwnTY3F/UKHNgE1ZY5W:HU5rCOTeiJDeIVMVlwnspyEvYJQNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2348 8CE4.tmp 1912 8D23.tmp 1364 8D61.tmp 2360 8DBF.tmp 2172 8E1C.tmp 2816 8E7A.tmp 2820 8EE7.tmp 2752 8F54.tmp 2936 8FC1.tmp 2792 901F.tmp 2732 906D.tmp 2640 90CB.tmp 2380 9128.tmp 1884 9186.tmp 2900 91D4.tmp 2584 9231.tmp 2888 928F.tmp 2896 92FC.tmp 1680 935A.tmp 2972 93B7.tmp 1432 9425.tmp 2024 9482.tmp 1864 94E0.tmp 2716 951E.tmp 2352 956C.tmp 3012 95AB.tmp 536 95F9.tmp 1172 9647.tmp 1984 9695.tmp 1304 96D3.tmp 1732 9721.tmp 376 975F.tmp 2188 979E.tmp 860 97DC.tmp 1228 982A.tmp 968 9869.tmp 2708 98A7.tmp 2080 98E5.tmp 1244 9924.tmp 2564 9962.tmp 2952 99A1.tmp 796 99DF.tmp 2288 9A2D.tmp 2224 9A7B.tmp 2180 9AB9.tmp 792 9AF8.tmp 648 9B36.tmp 1796 9B75.tmp 1588 9BB3.tmp 2376 9BF1.tmp 2128 9C30.tmp 1524 9C6E.tmp 1552 9CBC.tmp 1508 9CFB.tmp 2104 9D39.tmp 1916 9D77.tmp 1936 9DB6.tmp 3060 9DF4.tmp 1640 9E33.tmp 2124 9E71.tmp 2836 9EAF.tmp 2932 9EEE.tmp 2724 9F3C.tmp 2884 9F8A.tmp -
Loads dropped DLL 64 IoCs
pid Process 2700 2024-09-29_54274720d2089a8b502c9e7589df8051_mafia.exe 2348 8CE4.tmp 1912 8D23.tmp 1364 8D61.tmp 2360 8DBF.tmp 2172 8E1C.tmp 2816 8E7A.tmp 2820 8EE7.tmp 2752 8F54.tmp 2936 8FC1.tmp 2792 901F.tmp 2732 906D.tmp 2640 90CB.tmp 2380 9128.tmp 1884 9186.tmp 2900 91D4.tmp 2584 9231.tmp 2888 928F.tmp 2896 92FC.tmp 1680 935A.tmp 2972 93B7.tmp 1432 9425.tmp 2024 9482.tmp 1864 94E0.tmp 2716 951E.tmp 2352 956C.tmp 3012 95AB.tmp 536 95F9.tmp 1172 9647.tmp 1984 9695.tmp 1304 96D3.tmp 1732 9721.tmp 376 975F.tmp 2188 979E.tmp 860 97DC.tmp 1228 982A.tmp 968 9869.tmp 2708 98A7.tmp 2080 98E5.tmp 1244 9924.tmp 2564 9962.tmp 2952 99A1.tmp 796 99DF.tmp 2288 9A2D.tmp 2224 9A7B.tmp 2180 9AB9.tmp 792 9AF8.tmp 648 9B36.tmp 1796 9B75.tmp 1588 9BB3.tmp 2376 9BF1.tmp 2128 9C30.tmp 1524 9C6E.tmp 1552 9CBC.tmp 1508 9CFB.tmp 2104 9D39.tmp 1916 9D77.tmp 1936 9DB6.tmp 3060 9DF4.tmp 1640 9E33.tmp 2124 9E71.tmp 2836 9EAF.tmp 2932 9EEE.tmp 2724 9F3C.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6FB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEFB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 169C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2952.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 281A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5754.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D308.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F103.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5947.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDBB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8076.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E6C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 842D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E58E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2700 wrote to memory of 2348 2700 2024-09-29_54274720d2089a8b502c9e7589df8051_mafia.exe 30 PID 2700 wrote to memory of 2348 2700 2024-09-29_54274720d2089a8b502c9e7589df8051_mafia.exe 30 PID 2700 wrote to memory of 2348 2700 2024-09-29_54274720d2089a8b502c9e7589df8051_mafia.exe 30 PID 2700 wrote to memory of 2348 2700 2024-09-29_54274720d2089a8b502c9e7589df8051_mafia.exe 30 PID 2348 wrote to memory of 1912 2348 8CE4.tmp 31 PID 2348 wrote to memory of 1912 2348 8CE4.tmp 31 PID 2348 wrote to memory of 1912 2348 8CE4.tmp 31 PID 2348 wrote to memory of 1912 2348 8CE4.tmp 31 PID 1912 wrote to memory of 1364 1912 8D23.tmp 32 PID 1912 wrote to memory of 1364 1912 8D23.tmp 32 PID 1912 wrote to memory of 1364 1912 8D23.tmp 32 PID 1912 wrote to memory of 1364 1912 8D23.tmp 32 PID 1364 wrote to memory of 2360 1364 8D61.tmp 33 PID 1364 wrote to memory of 2360 1364 8D61.tmp 33 PID 1364 wrote to memory of 2360 1364 8D61.tmp 33 PID 1364 wrote to memory of 2360 1364 8D61.tmp 33 PID 2360 wrote to memory of 2172 2360 8DBF.tmp 34 PID 2360 wrote to memory of 2172 2360 8DBF.tmp 34 PID 2360 wrote to memory of 2172 2360 8DBF.tmp 34 PID 2360 wrote to memory of 2172 2360 8DBF.tmp 34 PID 2172 wrote to memory of 2816 2172 8E1C.tmp 35 PID 2172 wrote to memory of 2816 2172 8E1C.tmp 35 PID 2172 wrote to memory of 2816 2172 8E1C.tmp 35 PID 2172 wrote to memory of 2816 2172 8E1C.tmp 35 PID 2816 wrote to memory of 2820 2816 8E7A.tmp 36 PID 2816 wrote to memory of 2820 2816 8E7A.tmp 36 PID 2816 wrote to memory of 2820 2816 8E7A.tmp 36 PID 2816 wrote to memory of 2820 2816 8E7A.tmp 36 PID 2820 wrote to memory of 2752 2820 8EE7.tmp 37 PID 2820 wrote to memory of 2752 2820 8EE7.tmp 37 PID 2820 wrote to memory of 2752 2820 8EE7.tmp 37 PID 2820 wrote to memory of 2752 2820 8EE7.tmp 37 PID 2752 wrote to memory of 2936 2752 8F54.tmp 38 PID 2752 wrote to memory of 2936 2752 8F54.tmp 38 PID 2752 wrote to memory of 2936 2752 8F54.tmp 38 PID 2752 wrote to memory of 2936 2752 8F54.tmp 38 PID 2936 wrote to memory of 2792 2936 8FC1.tmp 39 PID 2936 wrote to memory of 2792 2936 8FC1.tmp 39 PID 2936 wrote to memory of 2792 2936 8FC1.tmp 39 PID 2936 wrote to memory of 2792 2936 8FC1.tmp 39 PID 2792 wrote to memory of 2732 2792 901F.tmp 40 PID 2792 wrote to memory of 2732 2792 901F.tmp 40 PID 2792 wrote to memory of 2732 2792 901F.tmp 40 PID 2792 wrote to memory of 2732 2792 901F.tmp 40 PID 2732 wrote to memory of 2640 2732 906D.tmp 41 PID 2732 wrote to memory of 2640 2732 906D.tmp 41 PID 2732 wrote to memory of 2640 2732 906D.tmp 41 PID 2732 wrote to memory of 2640 2732 906D.tmp 41 PID 2640 wrote to memory of 2380 2640 90CB.tmp 42 PID 2640 wrote to memory of 2380 2640 90CB.tmp 42 PID 2640 wrote to memory of 2380 2640 90CB.tmp 42 PID 2640 wrote to memory of 2380 2640 90CB.tmp 42 PID 2380 wrote to memory of 1884 2380 9128.tmp 43 PID 2380 wrote to memory of 1884 2380 9128.tmp 43 PID 2380 wrote to memory of 1884 2380 9128.tmp 43 PID 2380 wrote to memory of 1884 2380 9128.tmp 43 PID 1884 wrote to memory of 2900 1884 9186.tmp 44 PID 1884 wrote to memory of 2900 1884 9186.tmp 44 PID 1884 wrote to memory of 2900 1884 9186.tmp 44 PID 1884 wrote to memory of 2900 1884 9186.tmp 44 PID 2900 wrote to memory of 2584 2900 91D4.tmp 45 PID 2900 wrote to memory of 2584 2900 91D4.tmp 45 PID 2900 wrote to memory of 2584 2900 91D4.tmp 45 PID 2900 wrote to memory of 2584 2900 91D4.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-29_54274720d2089a8b502c9e7589df8051_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-29_54274720d2089a8b502c9e7589df8051_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\8CE4.tmp"C:\Users\Admin\AppData\Local\Temp\8CE4.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\8D23.tmp"C:\Users\Admin\AppData\Local\Temp\8D23.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\8D61.tmp"C:\Users\Admin\AppData\Local\Temp\8D61.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\8DBF.tmp"C:\Users\Admin\AppData\Local\Temp\8DBF.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\8E1C.tmp"C:\Users\Admin\AppData\Local\Temp\8E1C.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\8E7A.tmp"C:\Users\Admin\AppData\Local\Temp\8E7A.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\8EE7.tmp"C:\Users\Admin\AppData\Local\Temp\8EE7.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\8F54.tmp"C:\Users\Admin\AppData\Local\Temp\8F54.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\8FC1.tmp"C:\Users\Admin\AppData\Local\Temp\8FC1.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\901F.tmp"C:\Users\Admin\AppData\Local\Temp\901F.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\906D.tmp"C:\Users\Admin\AppData\Local\Temp\906D.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\90CB.tmp"C:\Users\Admin\AppData\Local\Temp\90CB.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\9128.tmp"C:\Users\Admin\AppData\Local\Temp\9128.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\9186.tmp"C:\Users\Admin\AppData\Local\Temp\9186.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\91D4.tmp"C:\Users\Admin\AppData\Local\Temp\91D4.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\9231.tmp"C:\Users\Admin\AppData\Local\Temp\9231.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\928F.tmp"C:\Users\Admin\AppData\Local\Temp\928F.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\92FC.tmp"C:\Users\Admin\AppData\Local\Temp\92FC.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\935A.tmp"C:\Users\Admin\AppData\Local\Temp\935A.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\93B7.tmp"C:\Users\Admin\AppData\Local\Temp\93B7.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\9425.tmp"C:\Users\Admin\AppData\Local\Temp\9425.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\9482.tmp"C:\Users\Admin\AppData\Local\Temp\9482.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\94E0.tmp"C:\Users\Admin\AppData\Local\Temp\94E0.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\951E.tmp"C:\Users\Admin\AppData\Local\Temp\951E.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\956C.tmp"C:\Users\Admin\AppData\Local\Temp\956C.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\95AB.tmp"C:\Users\Admin\AppData\Local\Temp\95AB.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\95F9.tmp"C:\Users\Admin\AppData\Local\Temp\95F9.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:536 -
C:\Users\Admin\AppData\Local\Temp\9647.tmp"C:\Users\Admin\AppData\Local\Temp\9647.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\9695.tmp"C:\Users\Admin\AppData\Local\Temp\9695.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\96D3.tmp"C:\Users\Admin\AppData\Local\Temp\96D3.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\9721.tmp"C:\Users\Admin\AppData\Local\Temp\9721.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\975F.tmp"C:\Users\Admin\AppData\Local\Temp\975F.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:376 -
C:\Users\Admin\AppData\Local\Temp\979E.tmp"C:\Users\Admin\AppData\Local\Temp\979E.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\97DC.tmp"C:\Users\Admin\AppData\Local\Temp\97DC.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:860 -
C:\Users\Admin\AppData\Local\Temp\982A.tmp"C:\Users\Admin\AppData\Local\Temp\982A.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\9869.tmp"C:\Users\Admin\AppData\Local\Temp\9869.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:968 -
C:\Users\Admin\AppData\Local\Temp\98A7.tmp"C:\Users\Admin\AppData\Local\Temp\98A7.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\98E5.tmp"C:\Users\Admin\AppData\Local\Temp\98E5.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\9924.tmp"C:\Users\Admin\AppData\Local\Temp\9924.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\9962.tmp"C:\Users\Admin\AppData\Local\Temp\9962.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\99A1.tmp"C:\Users\Admin\AppData\Local\Temp\99A1.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\99DF.tmp"C:\Users\Admin\AppData\Local\Temp\99DF.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:796 -
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:792 -
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:648 -
C:\Users\Admin\AppData\Local\Temp\9B75.tmp"C:\Users\Admin\AppData\Local\Temp\9B75.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\9BF1.tmp"C:\Users\Admin\AppData\Local\Temp\9BF1.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\9C30.tmp"C:\Users\Admin\AppData\Local\Temp\9C30.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\9C6E.tmp"C:\Users\Admin\AppData\Local\Temp\9C6E.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\9CBC.tmp"C:\Users\Admin\AppData\Local\Temp\9CBC.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\9D39.tmp"C:\Users\Admin\AppData\Local\Temp\9D39.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\9D77.tmp"C:\Users\Admin\AppData\Local\Temp\9D77.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\9DB6.tmp"C:\Users\Admin\AppData\Local\Temp\9DB6.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\9DF4.tmp"C:\Users\Admin\AppData\Local\Temp\9DF4.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\9E33.tmp"C:\Users\Admin\AppData\Local\Temp\9E33.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\9E71.tmp"C:\Users\Admin\AppData\Local\Temp\9E71.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\9EAF.tmp"C:\Users\Admin\AppData\Local\Temp\9EAF.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\9EEE.tmp"C:\Users\Admin\AppData\Local\Temp\9EEE.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\9F3C.tmp"C:\Users\Admin\AppData\Local\Temp\9F3C.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\9F8A.tmp"C:\Users\Admin\AppData\Local\Temp\9F8A.tmp"65⤵
- Executes dropped EXE
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\9FC8.tmp"C:\Users\Admin\AppData\Local\Temp\9FC8.tmp"66⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\A026.tmp"C:\Users\Admin\AppData\Local\Temp\A026.tmp"67⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\A064.tmp"C:\Users\Admin\AppData\Local\Temp\A064.tmp"68⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\A0A3.tmp"C:\Users\Admin\AppData\Local\Temp\A0A3.tmp"69⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\A0E1.tmp"C:\Users\Admin\AppData\Local\Temp\A0E1.tmp"70⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\A11F.tmp"C:\Users\Admin\AppData\Local\Temp\A11F.tmp"71⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\A15E.tmp"C:\Users\Admin\AppData\Local\Temp\A15E.tmp"72⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\A1AC.tmp"C:\Users\Admin\AppData\Local\Temp\A1AC.tmp"73⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\A1EA.tmp"C:\Users\Admin\AppData\Local\Temp\A1EA.tmp"74⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\A229.tmp"C:\Users\Admin\AppData\Local\Temp\A229.tmp"75⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\A277.tmp"C:\Users\Admin\AppData\Local\Temp\A277.tmp"76⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\A2B5.tmp"C:\Users\Admin\AppData\Local\Temp\A2B5.tmp"77⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\A2F3.tmp"C:\Users\Admin\AppData\Local\Temp\A2F3.tmp"78⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\A341.tmp"C:\Users\Admin\AppData\Local\Temp\A341.tmp"79⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\A380.tmp"C:\Users\Admin\AppData\Local\Temp\A380.tmp"80⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\A3BE.tmp"C:\Users\Admin\AppData\Local\Temp\A3BE.tmp"81⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\A3FD.tmp"C:\Users\Admin\AppData\Local\Temp\A3FD.tmp"82⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\A43B.tmp"C:\Users\Admin\AppData\Local\Temp\A43B.tmp"83⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\A479.tmp"C:\Users\Admin\AppData\Local\Temp\A479.tmp"84⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\A4C7.tmp"C:\Users\Admin\AppData\Local\Temp\A4C7.tmp"85⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\A506.tmp"C:\Users\Admin\AppData\Local\Temp\A506.tmp"86⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\A544.tmp"C:\Users\Admin\AppData\Local\Temp\A544.tmp"87⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\A583.tmp"C:\Users\Admin\AppData\Local\Temp\A583.tmp"88⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\A5C1.tmp"C:\Users\Admin\AppData\Local\Temp\A5C1.tmp"89⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\A5FF.tmp"C:\Users\Admin\AppData\Local\Temp\A5FF.tmp"90⤵PID:600
-
C:\Users\Admin\AppData\Local\Temp\A63E.tmp"C:\Users\Admin\AppData\Local\Temp\A63E.tmp"91⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\A67C.tmp"C:\Users\Admin\AppData\Local\Temp\A67C.tmp"92⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\A6BB.tmp"C:\Users\Admin\AppData\Local\Temp\A6BB.tmp"93⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\A6F9.tmp"C:\Users\Admin\AppData\Local\Temp\A6F9.tmp"94⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\A737.tmp"C:\Users\Admin\AppData\Local\Temp\A737.tmp"95⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\A776.tmp"C:\Users\Admin\AppData\Local\Temp\A776.tmp"96⤵PID:284
-
C:\Users\Admin\AppData\Local\Temp\A7C4.tmp"C:\Users\Admin\AppData\Local\Temp\A7C4.tmp"97⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\A802.tmp"C:\Users\Admin\AppData\Local\Temp\A802.tmp"98⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\A841.tmp"C:\Users\Admin\AppData\Local\Temp\A841.tmp"99⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\A87F.tmp"C:\Users\Admin\AppData\Local\Temp\A87F.tmp"100⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\A8BD.tmp"C:\Users\Admin\AppData\Local\Temp\A8BD.tmp"101⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\A8FC.tmp"C:\Users\Admin\AppData\Local\Temp\A8FC.tmp"102⤵PID:596
-
C:\Users\Admin\AppData\Local\Temp\A93A.tmp"C:\Users\Admin\AppData\Local\Temp\A93A.tmp"103⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\A979.tmp"C:\Users\Admin\AppData\Local\Temp\A979.tmp"104⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\A9B7.tmp"C:\Users\Admin\AppData\Local\Temp\A9B7.tmp"105⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\A9F5.tmp"C:\Users\Admin\AppData\Local\Temp\A9F5.tmp"106⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\AA43.tmp"C:\Users\Admin\AppData\Local\Temp\AA43.tmp"107⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\AA82.tmp"C:\Users\Admin\AppData\Local\Temp\AA82.tmp"108⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\AAC0.tmp"C:\Users\Admin\AppData\Local\Temp\AAC0.tmp"109⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\AAFF.tmp"C:\Users\Admin\AppData\Local\Temp\AAFF.tmp"110⤵
- System Location Discovery: System Language Discovery
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\AB3D.tmp"C:\Users\Admin\AppData\Local\Temp\AB3D.tmp"111⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\AB7B.tmp"C:\Users\Admin\AppData\Local\Temp\AB7B.tmp"112⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\ABBA.tmp"C:\Users\Admin\AppData\Local\Temp\ABBA.tmp"113⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\ABF8.tmp"C:\Users\Admin\AppData\Local\Temp\ABF8.tmp"114⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\AC46.tmp"C:\Users\Admin\AppData\Local\Temp\AC46.tmp"115⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\AC94.tmp"C:\Users\Admin\AppData\Local\Temp\AC94.tmp"116⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\ACD3.tmp"C:\Users\Admin\AppData\Local\Temp\ACD3.tmp"117⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\AD11.tmp"C:\Users\Admin\AppData\Local\Temp\AD11.tmp"118⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\AD4F.tmp"C:\Users\Admin\AppData\Local\Temp\AD4F.tmp"119⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\AD8E.tmp"C:\Users\Admin\AppData\Local\Temp\AD8E.tmp"120⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\ADCC.tmp"C:\Users\Admin\AppData\Local\Temp\ADCC.tmp"121⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\AE0B.tmp"C:\Users\Admin\AppData\Local\Temp\AE0B.tmp"122⤵PID:2112
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-