Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
30/09/2024, 11:03
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-30_6ed2dc2cbd815fbed83a8066440c73b5_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-09-30_6ed2dc2cbd815fbed83a8066440c73b5_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-30_6ed2dc2cbd815fbed83a8066440c73b5_mafia.exe
-
Size
520KB
-
MD5
6ed2dc2cbd815fbed83a8066440c73b5
-
SHA1
f373ccb45762153e135e5081c1f5495e28c313f4
-
SHA256
08064e870542460b060fb6adad3d812d5866748cef7cb782f8f5eb0e6673bbd0
-
SHA512
122fb3052d3e158253fdc6ddb5044375514fd72a40a74c56882538c09d79f6cad226d79bb3f3dd7cee24afc0838d8513d3a9b7f2760ee05399b7580be46b1d47
-
SSDEEP
12288:roRXOQjmOyFH7abxLnWtFOHss0hrgxYZZmFH0mFlvHNZ:rogQ9yF+b5Wvs+rsYZZm5xlvHN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1772 9AB9.tmp 2352 9B17.tmp 1844 9B84.tmp 2780 9BE2.tmp 2472 9C4F.tmp 2808 9CBC.tmp 2804 9D29.tmp 2824 9D97.tmp 2752 9E04.tmp 2616 9EAF.tmp 2704 9F1D.tmp 2608 9F8A.tmp 2136 9FF7.tmp 2100 A083.tmp 2928 A100.tmp 2128 A16D.tmp 2872 A1DB.tmp 2856 A267.tmp 2868 A2D4.tmp 2948 A341.tmp 380 A3AF.tmp 1904 A40C.tmp 1824 A46A.tmp 2420 A4B8.tmp 2228 A506.tmp 1200 A554.tmp 572 A592.tmp 1652 A5E0.tmp 2540 A61F.tmp 1988 A66D.tmp 2124 A6BB.tmp 628 A6F9.tmp 2264 A737.tmp 1664 A785.tmp 952 A7D3.tmp 760 A812.tmp 912 A860.tmp 600 A8AE.tmp 1716 A8FC.tmp 1752 A94A.tmp 1544 A998.tmp 776 A9E6.tmp 1284 AA24.tmp 2036 AA63.tmp 1644 AAB1.tmp 308 AB0E.tmp 1252 AB4D.tmp 3020 AB8B.tmp 1712 ABD9.tmp 1504 AC27.tmp 2368 AC75.tmp 2040 ACC3.tmp 1328 AD01.tmp 1708 AD4F.tmp 1692 AD9D.tmp 1804 AE1A.tmp 2508 AEF5.tmp 1844 AF43.tmp 2184 AFA0.tmp 2696 AFEE.tmp 2720 B02D.tmp 3028 B07B.tmp 2828 B0B9.tmp 2308 B126.tmp -
Loads dropped DLL 64 IoCs
pid Process 1952 2024-09-30_6ed2dc2cbd815fbed83a8066440c73b5_mafia.exe 1772 9AB9.tmp 2352 9B17.tmp 1844 9B84.tmp 2780 9BE2.tmp 2472 9C4F.tmp 2808 9CBC.tmp 2804 9D29.tmp 2824 9D97.tmp 2752 9E04.tmp 2616 9EAF.tmp 2704 9F1D.tmp 2608 9F8A.tmp 2136 9FF7.tmp 2100 A083.tmp 2928 A100.tmp 2128 A16D.tmp 2872 A1DB.tmp 2856 A267.tmp 2868 A2D4.tmp 2948 A341.tmp 380 A3AF.tmp 1904 A40C.tmp 1824 A46A.tmp 2420 A4B8.tmp 2228 A506.tmp 1200 A554.tmp 572 A592.tmp 1652 A5E0.tmp 2540 A61F.tmp 1988 A66D.tmp 2124 A6BB.tmp 628 A6F9.tmp 2264 A737.tmp 1664 A785.tmp 952 A7D3.tmp 760 A812.tmp 912 A860.tmp 600 A8AE.tmp 1716 A8FC.tmp 1752 A94A.tmp 1544 A998.tmp 776 A9E6.tmp 1284 AA24.tmp 2036 AA63.tmp 1644 AAB1.tmp 308 AB0E.tmp 1252 AB4D.tmp 3020 AB8B.tmp 1712 ABD9.tmp 1504 AC27.tmp 2368 AC75.tmp 2040 ACC3.tmp 1328 AD01.tmp 1708 AD4F.tmp 1692 AD9D.tmp 1804 AE1A.tmp 2508 AEF5.tmp 1844 AF43.tmp 2184 AFA0.tmp 2696 AFEE.tmp 2720 B02D.tmp 3028 B07B.tmp 2828 B0B9.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F47C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2472.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F73A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F805.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CACE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 647D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7DB8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C053.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1600.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E01.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8FD.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1952 wrote to memory of 1772 1952 2024-09-30_6ed2dc2cbd815fbed83a8066440c73b5_mafia.exe 30 PID 1952 wrote to memory of 1772 1952 2024-09-30_6ed2dc2cbd815fbed83a8066440c73b5_mafia.exe 30 PID 1952 wrote to memory of 1772 1952 2024-09-30_6ed2dc2cbd815fbed83a8066440c73b5_mafia.exe 30 PID 1952 wrote to memory of 1772 1952 2024-09-30_6ed2dc2cbd815fbed83a8066440c73b5_mafia.exe 30 PID 1772 wrote to memory of 2352 1772 9AB9.tmp 31 PID 1772 wrote to memory of 2352 1772 9AB9.tmp 31 PID 1772 wrote to memory of 2352 1772 9AB9.tmp 31 PID 1772 wrote to memory of 2352 1772 9AB9.tmp 31 PID 2352 wrote to memory of 1844 2352 9B17.tmp 32 PID 2352 wrote to memory of 1844 2352 9B17.tmp 32 PID 2352 wrote to memory of 1844 2352 9B17.tmp 32 PID 2352 wrote to memory of 1844 2352 9B17.tmp 32 PID 1844 wrote to memory of 2780 1844 9B84.tmp 33 PID 1844 wrote to memory of 2780 1844 9B84.tmp 33 PID 1844 wrote to memory of 2780 1844 9B84.tmp 33 PID 1844 wrote to memory of 2780 1844 9B84.tmp 33 PID 2780 wrote to memory of 2472 2780 9BE2.tmp 34 PID 2780 wrote to memory of 2472 2780 9BE2.tmp 34 PID 2780 wrote to memory of 2472 2780 9BE2.tmp 34 PID 2780 wrote to memory of 2472 2780 9BE2.tmp 34 PID 2472 wrote to memory of 2808 2472 9C4F.tmp 35 PID 2472 wrote to memory of 2808 2472 9C4F.tmp 35 PID 2472 wrote to memory of 2808 2472 9C4F.tmp 35 PID 2472 wrote to memory of 2808 2472 9C4F.tmp 35 PID 2808 wrote to memory of 2804 2808 9CBC.tmp 36 PID 2808 wrote to memory of 2804 2808 9CBC.tmp 36 PID 2808 wrote to memory of 2804 2808 9CBC.tmp 36 PID 2808 wrote to memory of 2804 2808 9CBC.tmp 36 PID 2804 wrote to memory of 2824 2804 9D29.tmp 37 PID 2804 wrote to memory of 2824 2804 9D29.tmp 37 PID 2804 wrote to memory of 2824 2804 9D29.tmp 37 PID 2804 wrote to memory of 2824 2804 9D29.tmp 37 PID 2824 wrote to memory of 2752 2824 9D97.tmp 38 PID 2824 wrote to memory of 2752 2824 9D97.tmp 38 PID 2824 wrote to memory of 2752 2824 9D97.tmp 38 PID 2824 wrote to memory of 2752 2824 9D97.tmp 38 PID 2752 wrote to memory of 2616 2752 9E04.tmp 39 PID 2752 wrote to memory of 2616 2752 9E04.tmp 39 PID 2752 wrote to memory of 2616 2752 9E04.tmp 39 PID 2752 wrote to memory of 2616 2752 9E04.tmp 39 PID 2616 wrote to memory of 2704 2616 9EAF.tmp 40 PID 2616 wrote to memory of 2704 2616 9EAF.tmp 40 PID 2616 wrote to memory of 2704 2616 9EAF.tmp 40 PID 2616 wrote to memory of 2704 2616 9EAF.tmp 40 PID 2704 wrote to memory of 2608 2704 9F1D.tmp 41 PID 2704 wrote to memory of 2608 2704 9F1D.tmp 41 PID 2704 wrote to memory of 2608 2704 9F1D.tmp 41 PID 2704 wrote to memory of 2608 2704 9F1D.tmp 41 PID 2608 wrote to memory of 2136 2608 9F8A.tmp 42 PID 2608 wrote to memory of 2136 2608 9F8A.tmp 42 PID 2608 wrote to memory of 2136 2608 9F8A.tmp 42 PID 2608 wrote to memory of 2136 2608 9F8A.tmp 42 PID 2136 wrote to memory of 2100 2136 9FF7.tmp 43 PID 2136 wrote to memory of 2100 2136 9FF7.tmp 43 PID 2136 wrote to memory of 2100 2136 9FF7.tmp 43 PID 2136 wrote to memory of 2100 2136 9FF7.tmp 43 PID 2100 wrote to memory of 2928 2100 A083.tmp 44 PID 2100 wrote to memory of 2928 2100 A083.tmp 44 PID 2100 wrote to memory of 2928 2100 A083.tmp 44 PID 2100 wrote to memory of 2928 2100 A083.tmp 44 PID 2928 wrote to memory of 2128 2928 A100.tmp 45 PID 2928 wrote to memory of 2128 2928 A100.tmp 45 PID 2928 wrote to memory of 2128 2928 A100.tmp 45 PID 2928 wrote to memory of 2128 2928 A100.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-30_6ed2dc2cbd815fbed83a8066440c73b5_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-30_6ed2dc2cbd815fbed83a8066440c73b5_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\9B17.tmp"C:\Users\Admin\AppData\Local\Temp\9B17.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\9CBC.tmp"C:\Users\Admin\AppData\Local\Temp\9CBC.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\9D29.tmp"C:\Users\Admin\AppData\Local\Temp\9D29.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\9D97.tmp"C:\Users\Admin\AppData\Local\Temp\9D97.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\9E04.tmp"C:\Users\Admin\AppData\Local\Temp\9E04.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\9EAF.tmp"C:\Users\Admin\AppData\Local\Temp\9EAF.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\9F1D.tmp"C:\Users\Admin\AppData\Local\Temp\9F1D.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\9F8A.tmp"C:\Users\Admin\AppData\Local\Temp\9F8A.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\9FF7.tmp"C:\Users\Admin\AppData\Local\Temp\9FF7.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\A083.tmp"C:\Users\Admin\AppData\Local\Temp\A083.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\A100.tmp"C:\Users\Admin\AppData\Local\Temp\A100.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\A16D.tmp"C:\Users\Admin\AppData\Local\Temp\A16D.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\A1DB.tmp"C:\Users\Admin\AppData\Local\Temp\A1DB.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\A267.tmp"C:\Users\Admin\AppData\Local\Temp\A267.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\A2D4.tmp"C:\Users\Admin\AppData\Local\Temp\A2D4.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\A341.tmp"C:\Users\Admin\AppData\Local\Temp\A341.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\A3AF.tmp"C:\Users\Admin\AppData\Local\Temp\A3AF.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:380 -
C:\Users\Admin\AppData\Local\Temp\A40C.tmp"C:\Users\Admin\AppData\Local\Temp\A40C.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\A46A.tmp"C:\Users\Admin\AppData\Local\Temp\A46A.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\A4B8.tmp"C:\Users\Admin\AppData\Local\Temp\A4B8.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\A506.tmp"C:\Users\Admin\AppData\Local\Temp\A506.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\A554.tmp"C:\Users\Admin\AppData\Local\Temp\A554.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\A592.tmp"C:\Users\Admin\AppData\Local\Temp\A592.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:572 -
C:\Users\Admin\AppData\Local\Temp\A5E0.tmp"C:\Users\Admin\AppData\Local\Temp\A5E0.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\A61F.tmp"C:\Users\Admin\AppData\Local\Temp\A61F.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\A66D.tmp"C:\Users\Admin\AppData\Local\Temp\A66D.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\A6BB.tmp"C:\Users\Admin\AppData\Local\Temp\A6BB.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\A6F9.tmp"C:\Users\Admin\AppData\Local\Temp\A6F9.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:628 -
C:\Users\Admin\AppData\Local\Temp\A737.tmp"C:\Users\Admin\AppData\Local\Temp\A737.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\A785.tmp"C:\Users\Admin\AppData\Local\Temp\A785.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\A7D3.tmp"C:\Users\Admin\AppData\Local\Temp\A7D3.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:952 -
C:\Users\Admin\AppData\Local\Temp\A812.tmp"C:\Users\Admin\AppData\Local\Temp\A812.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:760 -
C:\Users\Admin\AppData\Local\Temp\A860.tmp"C:\Users\Admin\AppData\Local\Temp\A860.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:912 -
C:\Users\Admin\AppData\Local\Temp\A8AE.tmp"C:\Users\Admin\AppData\Local\Temp\A8AE.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:600 -
C:\Users\Admin\AppData\Local\Temp\A8FC.tmp"C:\Users\Admin\AppData\Local\Temp\A8FC.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\A94A.tmp"C:\Users\Admin\AppData\Local\Temp\A94A.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\A998.tmp"C:\Users\Admin\AppData\Local\Temp\A998.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\A9E6.tmp"C:\Users\Admin\AppData\Local\Temp\A9E6.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:776 -
C:\Users\Admin\AppData\Local\Temp\AA24.tmp"C:\Users\Admin\AppData\Local\Temp\AA24.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\AA63.tmp"C:\Users\Admin\AppData\Local\Temp\AA63.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\AAB1.tmp"C:\Users\Admin\AppData\Local\Temp\AAB1.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\AB0E.tmp"C:\Users\Admin\AppData\Local\Temp\AB0E.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:308 -
C:\Users\Admin\AppData\Local\Temp\AB4D.tmp"C:\Users\Admin\AppData\Local\Temp\AB4D.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\AB8B.tmp"C:\Users\Admin\AppData\Local\Temp\AB8B.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\ABD9.tmp"C:\Users\Admin\AppData\Local\Temp\ABD9.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\AC27.tmp"C:\Users\Admin\AppData\Local\Temp\AC27.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\AC75.tmp"C:\Users\Admin\AppData\Local\Temp\AC75.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\ACC3.tmp"C:\Users\Admin\AppData\Local\Temp\ACC3.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\AD01.tmp"C:\Users\Admin\AppData\Local\Temp\AD01.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\AD4F.tmp"C:\Users\Admin\AppData\Local\Temp\AD4F.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\AD9D.tmp"C:\Users\Admin\AppData\Local\Temp\AD9D.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\AE1A.tmp"C:\Users\Admin\AppData\Local\Temp\AE1A.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\AEF5.tmp"C:\Users\Admin\AppData\Local\Temp\AEF5.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\AF43.tmp"C:\Users\Admin\AppData\Local\Temp\AF43.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\AFA0.tmp"C:\Users\Admin\AppData\Local\Temp\AFA0.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\AFEE.tmp"C:\Users\Admin\AppData\Local\Temp\AFEE.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\B02D.tmp"C:\Users\Admin\AppData\Local\Temp\B02D.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\B07B.tmp"C:\Users\Admin\AppData\Local\Temp\B07B.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\B0B9.tmp"C:\Users\Admin\AppData\Local\Temp\B0B9.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\B126.tmp"C:\Users\Admin\AppData\Local\Temp\B126.tmp"65⤵
- Executes dropped EXE
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\B174.tmp"C:\Users\Admin\AppData\Local\Temp\B174.tmp"66⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\B1C2.tmp"C:\Users\Admin\AppData\Local\Temp\B1C2.tmp"67⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\B201.tmp"C:\Users\Admin\AppData\Local\Temp\B201.tmp"68⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\B24F.tmp"C:\Users\Admin\AppData\Local\Temp\B24F.tmp"69⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\B2AC.tmp"C:\Users\Admin\AppData\Local\Temp\B2AC.tmp"70⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\B2EB.tmp"C:\Users\Admin\AppData\Local\Temp\B2EB.tmp"71⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\B339.tmp"C:\Users\Admin\AppData\Local\Temp\B339.tmp"72⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\B387.tmp"C:\Users\Admin\AppData\Local\Temp\B387.tmp"73⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\B3D5.tmp"C:\Users\Admin\AppData\Local\Temp\B3D5.tmp"74⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\B423.tmp"C:\Users\Admin\AppData\Local\Temp\B423.tmp"75⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\B471.tmp"C:\Users\Admin\AppData\Local\Temp\B471.tmp"76⤵PID:484
-
C:\Users\Admin\AppData\Local\Temp\B4BF.tmp"C:\Users\Admin\AppData\Local\Temp\B4BF.tmp"77⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\B4FD.tmp"C:\Users\Admin\AppData\Local\Temp\B4FD.tmp"78⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\B53B.tmp"C:\Users\Admin\AppData\Local\Temp\B53B.tmp"79⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\B589.tmp"C:\Users\Admin\AppData\Local\Temp\B589.tmp"80⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\B5C8.tmp"C:\Users\Admin\AppData\Local\Temp\B5C8.tmp"81⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\B606.tmp"C:\Users\Admin\AppData\Local\Temp\B606.tmp"82⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\B654.tmp"C:\Users\Admin\AppData\Local\Temp\B654.tmp"83⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\B693.tmp"C:\Users\Admin\AppData\Local\Temp\B693.tmp"84⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\B6E1.tmp"C:\Users\Admin\AppData\Local\Temp\B6E1.tmp"85⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\B71F.tmp"C:\Users\Admin\AppData\Local\Temp\B71F.tmp"86⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\B77D.tmp"C:\Users\Admin\AppData\Local\Temp\B77D.tmp"87⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\B7BB.tmp"C:\Users\Admin\AppData\Local\Temp\B7BB.tmp"88⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\B809.tmp"C:\Users\Admin\AppData\Local\Temp\B809.tmp"89⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\B857.tmp"C:\Users\Admin\AppData\Local\Temp\B857.tmp"90⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\B8B5.tmp"C:\Users\Admin\AppData\Local\Temp\B8B5.tmp"91⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\B8F3.tmp"C:\Users\Admin\AppData\Local\Temp\B8F3.tmp"92⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\B931.tmp"C:\Users\Admin\AppData\Local\Temp\B931.tmp"93⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\B98F.tmp"C:\Users\Admin\AppData\Local\Temp\B98F.tmp"94⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\B9CD.tmp"C:\Users\Admin\AppData\Local\Temp\B9CD.tmp"95⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\BA1B.tmp"C:\Users\Admin\AppData\Local\Temp\BA1B.tmp"96⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\BA5A.tmp"C:\Users\Admin\AppData\Local\Temp\BA5A.tmp"97⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\BAA8.tmp"C:\Users\Admin\AppData\Local\Temp\BAA8.tmp"98⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\BAF6.tmp"C:\Users\Admin\AppData\Local\Temp\BAF6.tmp"99⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\BB44.tmp"C:\Users\Admin\AppData\Local\Temp\BB44.tmp"100⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\BB92.tmp"C:\Users\Admin\AppData\Local\Temp\BB92.tmp"101⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\BBEF.tmp"C:\Users\Admin\AppData\Local\Temp\BBEF.tmp"102⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\BC3D.tmp"C:\Users\Admin\AppData\Local\Temp\BC3D.tmp"103⤵PID:600
-
C:\Users\Admin\AppData\Local\Temp\BC8B.tmp"C:\Users\Admin\AppData\Local\Temp\BC8B.tmp"104⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\BCD9.tmp"C:\Users\Admin\AppData\Local\Temp\BCD9.tmp"105⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\BD27.tmp"C:\Users\Admin\AppData\Local\Temp\BD27.tmp"106⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\BD75.tmp"C:\Users\Admin\AppData\Local\Temp\BD75.tmp"107⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\BDB4.tmp"C:\Users\Admin\AppData\Local\Temp\BDB4.tmp"108⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\BE11.tmp"C:\Users\Admin\AppData\Local\Temp\BE11.tmp"109⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\BE5F.tmp"C:\Users\Admin\AppData\Local\Temp\BE5F.tmp"110⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\BEBD.tmp"C:\Users\Admin\AppData\Local\Temp\BEBD.tmp"111⤵PID:308
-
C:\Users\Admin\AppData\Local\Temp\BF0B.tmp"C:\Users\Admin\AppData\Local\Temp\BF0B.tmp"112⤵PID:344
-
C:\Users\Admin\AppData\Local\Temp\BF59.tmp"C:\Users\Admin\AppData\Local\Temp\BF59.tmp"113⤵
- System Location Discovery: System Language Discovery
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\BFB7.tmp"C:\Users\Admin\AppData\Local\Temp\BFB7.tmp"114⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\C005.tmp"C:\Users\Admin\AppData\Local\Temp\C005.tmp"115⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\C053.tmp"C:\Users\Admin\AppData\Local\Temp\C053.tmp"116⤵
- System Location Discovery: System Language Discovery
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\C091.tmp"C:\Users\Admin\AppData\Local\Temp\C091.tmp"117⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"118⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\C13D.tmp"C:\Users\Admin\AppData\Local\Temp\C13D.tmp"119⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\C17B.tmp"C:\Users\Admin\AppData\Local\Temp\C17B.tmp"120⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"121⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\C207.tmp"C:\Users\Admin\AppData\Local\Temp\C207.tmp"122⤵PID:2508
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-