Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01/10/2024, 04:36
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-01_babce277aaf633d14b6790c512c7fedd_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-01_babce277aaf633d14b6790c512c7fedd_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-10-01_babce277aaf633d14b6790c512c7fedd_mafia.exe
-
Size
765KB
-
MD5
babce277aaf633d14b6790c512c7fedd
-
SHA1
549765473ebcb698e2a202c936340e2670f4797c
-
SHA256
a2be8f9ec075f5b6bdb383b5a8dfded0b0fab0904003b225e5818c5c778a1bac
-
SHA512
2eae090bd5857637482b8ac231a8ae403278f938beba2df694da217cde0f57b5fc9b9bae766a59f148144f35aacc569cb91d143a8a756f578ac1f3ea411cc3b4
-
SSDEEP
12288:ZU5rCOTeiDn3dPcKynNB98Qkf6L3ZF5rn5rLOa54U5w5A:ZUQOJDn3dEKyX98s3vh5Oa+UOS
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1984 DB32.tmp 1760 DB71.tmp 2108 DBCE.tmp 2168 DC0D.tmp 2680 DC5B.tmp 2800 DD35.tmp 2664 DDB2.tmp 2820 DE2F.tmp 2852 DEBB.tmp 2696 DF48.tmp 2544 DFB5.tmp 2584 E032.tmp 2996 E070.tmp 1848 E12B.tmp 1752 E1A8.tmp 2620 E215.tmp 492 E263.tmp 2520 E2D0.tmp 2336 E33E.tmp 1632 E3AB.tmp 1980 E437.tmp 1160 E4D3.tmp 1996 E540.tmp 2384 E57F.tmp 2360 E5BD.tmp 2100 E5FC.tmp 2340 E63A.tmp 2088 E678.tmp 2940 E6B7.tmp 1640 E6F5.tmp 2772 E734.tmp 1236 E772.tmp 1344 E7B0.tmp 936 E7FE.tmp 2512 E83D.tmp 2148 E87B.tmp 952 E8BA.tmp 612 E8F8.tmp 572 E936.tmp 1380 E975.tmp 2292 E9B3.tmp 2960 E9F2.tmp 2956 EA30.tmp 568 EA6E.tmp 1504 EAAD.tmp 3068 EAEB.tmp 876 EB2A.tmp 1692 EB68.tmp 1928 EBA6.tmp 2944 EBE5.tmp 2612 EC23.tmp 1588 EC62.tmp 1548 ECA0.tmp 2040 ECDE.tmp 2836 ED1D.tmp 2012 ED5B.tmp 2660 ED9A.tmp 2316 EDD8.tmp 2672 EE16.tmp 2796 EE64.tmp 2912 EEA3.tmp 3060 EEE1.tmp 2816 EF20.tmp 2860 EF5E.tmp -
Loads dropped DLL 64 IoCs
pid Process 548 2024-10-01_babce277aaf633d14b6790c512c7fedd_mafia.exe 1984 DB32.tmp 1760 DB71.tmp 2108 DBCE.tmp 2168 DC0D.tmp 2680 DC5B.tmp 2800 DD35.tmp 2664 DDB2.tmp 2820 DE2F.tmp 2852 DEBB.tmp 2696 DF48.tmp 2544 DFB5.tmp 2584 E032.tmp 2996 E070.tmp 1848 E12B.tmp 1752 E1A8.tmp 2620 E215.tmp 492 E263.tmp 2520 E2D0.tmp 2336 E33E.tmp 1632 E3AB.tmp 1980 E437.tmp 1160 E4D3.tmp 1996 E540.tmp 2384 E57F.tmp 2360 E5BD.tmp 2100 E5FC.tmp 2340 E63A.tmp 2088 E678.tmp 2940 E6B7.tmp 1640 E6F5.tmp 2772 E734.tmp 1236 E772.tmp 1344 E7B0.tmp 936 E7FE.tmp 2512 E83D.tmp 2148 E87B.tmp 952 E8BA.tmp 612 E8F8.tmp 572 E936.tmp 1380 E975.tmp 2292 E9B3.tmp 2960 E9F2.tmp 2956 EA30.tmp 568 EA6E.tmp 1504 EAAD.tmp 3068 EAEB.tmp 876 EB2A.tmp 1692 EB68.tmp 1928 EBA6.tmp 2944 EBE5.tmp 2612 EC23.tmp 1588 EC62.tmp 1548 ECA0.tmp 2040 ECDE.tmp 2836 ED1D.tmp 2012 ED5B.tmp 2660 ED9A.tmp 2316 EDD8.tmp 2672 EE16.tmp 2796 EE64.tmp 2912 EEA3.tmp 3060 EEE1.tmp 2816 EF20.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6596.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D9DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 538C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD75.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4431.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B23F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FED8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3939.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D088.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D99D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2684.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6326.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F383.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D920.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6854.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C22.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 891D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 548 wrote to memory of 1984 548 2024-10-01_babce277aaf633d14b6790c512c7fedd_mafia.exe 31 PID 548 wrote to memory of 1984 548 2024-10-01_babce277aaf633d14b6790c512c7fedd_mafia.exe 31 PID 548 wrote to memory of 1984 548 2024-10-01_babce277aaf633d14b6790c512c7fedd_mafia.exe 31 PID 548 wrote to memory of 1984 548 2024-10-01_babce277aaf633d14b6790c512c7fedd_mafia.exe 31 PID 1984 wrote to memory of 1760 1984 DB32.tmp 32 PID 1984 wrote to memory of 1760 1984 DB32.tmp 32 PID 1984 wrote to memory of 1760 1984 DB32.tmp 32 PID 1984 wrote to memory of 1760 1984 DB32.tmp 32 PID 1760 wrote to memory of 2108 1760 DB71.tmp 33 PID 1760 wrote to memory of 2108 1760 DB71.tmp 33 PID 1760 wrote to memory of 2108 1760 DB71.tmp 33 PID 1760 wrote to memory of 2108 1760 DB71.tmp 33 PID 2108 wrote to memory of 2168 2108 DBCE.tmp 34 PID 2108 wrote to memory of 2168 2108 DBCE.tmp 34 PID 2108 wrote to memory of 2168 2108 DBCE.tmp 34 PID 2108 wrote to memory of 2168 2108 DBCE.tmp 34 PID 2168 wrote to memory of 2680 2168 DC0D.tmp 35 PID 2168 wrote to memory of 2680 2168 DC0D.tmp 35 PID 2168 wrote to memory of 2680 2168 DC0D.tmp 35 PID 2168 wrote to memory of 2680 2168 DC0D.tmp 35 PID 2680 wrote to memory of 2800 2680 DC5B.tmp 36 PID 2680 wrote to memory of 2800 2680 DC5B.tmp 36 PID 2680 wrote to memory of 2800 2680 DC5B.tmp 36 PID 2680 wrote to memory of 2800 2680 DC5B.tmp 36 PID 2800 wrote to memory of 2664 2800 DD35.tmp 37 PID 2800 wrote to memory of 2664 2800 DD35.tmp 37 PID 2800 wrote to memory of 2664 2800 DD35.tmp 37 PID 2800 wrote to memory of 2664 2800 DD35.tmp 37 PID 2664 wrote to memory of 2820 2664 DDB2.tmp 38 PID 2664 wrote to memory of 2820 2664 DDB2.tmp 38 PID 2664 wrote to memory of 2820 2664 DDB2.tmp 38 PID 2664 wrote to memory of 2820 2664 DDB2.tmp 38 PID 2820 wrote to memory of 2852 2820 DE2F.tmp 39 PID 2820 wrote to memory of 2852 2820 DE2F.tmp 39 PID 2820 wrote to memory of 2852 2820 DE2F.tmp 39 PID 2820 wrote to memory of 2852 2820 DE2F.tmp 39 PID 2852 wrote to memory of 2696 2852 DEBB.tmp 40 PID 2852 wrote to memory of 2696 2852 DEBB.tmp 40 PID 2852 wrote to memory of 2696 2852 DEBB.tmp 40 PID 2852 wrote to memory of 2696 2852 DEBB.tmp 40 PID 2696 wrote to memory of 2544 2696 DF48.tmp 41 PID 2696 wrote to memory of 2544 2696 DF48.tmp 41 PID 2696 wrote to memory of 2544 2696 DF48.tmp 41 PID 2696 wrote to memory of 2544 2696 DF48.tmp 41 PID 2544 wrote to memory of 2584 2544 DFB5.tmp 42 PID 2544 wrote to memory of 2584 2544 DFB5.tmp 42 PID 2544 wrote to memory of 2584 2544 DFB5.tmp 42 PID 2544 wrote to memory of 2584 2544 DFB5.tmp 42 PID 2584 wrote to memory of 2996 2584 E032.tmp 43 PID 2584 wrote to memory of 2996 2584 E032.tmp 43 PID 2584 wrote to memory of 2996 2584 E032.tmp 43 PID 2584 wrote to memory of 2996 2584 E032.tmp 43 PID 2996 wrote to memory of 1848 2996 E070.tmp 44 PID 2996 wrote to memory of 1848 2996 E070.tmp 44 PID 2996 wrote to memory of 1848 2996 E070.tmp 44 PID 2996 wrote to memory of 1848 2996 E070.tmp 44 PID 1848 wrote to memory of 1752 1848 E12B.tmp 45 PID 1848 wrote to memory of 1752 1848 E12B.tmp 45 PID 1848 wrote to memory of 1752 1848 E12B.tmp 45 PID 1848 wrote to memory of 1752 1848 E12B.tmp 45 PID 1752 wrote to memory of 2620 1752 E1A8.tmp 46 PID 1752 wrote to memory of 2620 1752 E1A8.tmp 46 PID 1752 wrote to memory of 2620 1752 E1A8.tmp 46 PID 1752 wrote to memory of 2620 1752 E1A8.tmp 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-01_babce277aaf633d14b6790c512c7fedd_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-01_babce277aaf633d14b6790c512c7fedd_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\DB32.tmp"C:\Users\Admin\AppData\Local\Temp\DB32.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\DB71.tmp"C:\Users\Admin\AppData\Local\Temp\DB71.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\DBCE.tmp"C:\Users\Admin\AppData\Local\Temp\DBCE.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\DC0D.tmp"C:\Users\Admin\AppData\Local\Temp\DC0D.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\DC5B.tmp"C:\Users\Admin\AppData\Local\Temp\DC5B.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\DD35.tmp"C:\Users\Admin\AppData\Local\Temp\DD35.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\DDB2.tmp"C:\Users\Admin\AppData\Local\Temp\DDB2.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\DE2F.tmp"C:\Users\Admin\AppData\Local\Temp\DE2F.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\DEBB.tmp"C:\Users\Admin\AppData\Local\Temp\DEBB.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\DF48.tmp"C:\Users\Admin\AppData\Local\Temp\DF48.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\DFB5.tmp"C:\Users\Admin\AppData\Local\Temp\DFB5.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\E032.tmp"C:\Users\Admin\AppData\Local\Temp\E032.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\E070.tmp"C:\Users\Admin\AppData\Local\Temp\E070.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\E12B.tmp"C:\Users\Admin\AppData\Local\Temp\E12B.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\E1A8.tmp"C:\Users\Admin\AppData\Local\Temp\E1A8.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\E215.tmp"C:\Users\Admin\AppData\Local\Temp\E215.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\E263.tmp"C:\Users\Admin\AppData\Local\Temp\E263.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:492 -
C:\Users\Admin\AppData\Local\Temp\E2D0.tmp"C:\Users\Admin\AppData\Local\Temp\E2D0.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\E33E.tmp"C:\Users\Admin\AppData\Local\Temp\E33E.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\E3AB.tmp"C:\Users\Admin\AppData\Local\Temp\E3AB.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\E437.tmp"C:\Users\Admin\AppData\Local\Temp\E437.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\E4D3.tmp"C:\Users\Admin\AppData\Local\Temp\E4D3.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\E540.tmp"C:\Users\Admin\AppData\Local\Temp\E540.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\E57F.tmp"C:\Users\Admin\AppData\Local\Temp\E57F.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\E5BD.tmp"C:\Users\Admin\AppData\Local\Temp\E5BD.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\E5FC.tmp"C:\Users\Admin\AppData\Local\Temp\E5FC.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\E63A.tmp"C:\Users\Admin\AppData\Local\Temp\E63A.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\E678.tmp"C:\Users\Admin\AppData\Local\Temp\E678.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\E6B7.tmp"C:\Users\Admin\AppData\Local\Temp\E6B7.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\E734.tmp"C:\Users\Admin\AppData\Local\Temp\E734.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\E772.tmp"C:\Users\Admin\AppData\Local\Temp\E772.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\E7FE.tmp"C:\Users\Admin\AppData\Local\Temp\E7FE.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:936 -
C:\Users\Admin\AppData\Local\Temp\E83D.tmp"C:\Users\Admin\AppData\Local\Temp\E83D.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\E87B.tmp"C:\Users\Admin\AppData\Local\Temp\E87B.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:952 -
C:\Users\Admin\AppData\Local\Temp\E8F8.tmp"C:\Users\Admin\AppData\Local\Temp\E8F8.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:612 -
C:\Users\Admin\AppData\Local\Temp\E936.tmp"C:\Users\Admin\AppData\Local\Temp\E936.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:572 -
C:\Users\Admin\AppData\Local\Temp\E975.tmp"C:\Users\Admin\AppData\Local\Temp\E975.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\E9B3.tmp"C:\Users\Admin\AppData\Local\Temp\E9B3.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\E9F2.tmp"C:\Users\Admin\AppData\Local\Temp\E9F2.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\EA30.tmp"C:\Users\Admin\AppData\Local\Temp\EA30.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\EA6E.tmp"C:\Users\Admin\AppData\Local\Temp\EA6E.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:568 -
C:\Users\Admin\AppData\Local\Temp\EAAD.tmp"C:\Users\Admin\AppData\Local\Temp\EAAD.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\EAEB.tmp"C:\Users\Admin\AppData\Local\Temp\EAEB.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\EB2A.tmp"C:\Users\Admin\AppData\Local\Temp\EB2A.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:876 -
C:\Users\Admin\AppData\Local\Temp\EB68.tmp"C:\Users\Admin\AppData\Local\Temp\EB68.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\EBA6.tmp"C:\Users\Admin\AppData\Local\Temp\EBA6.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\EBE5.tmp"C:\Users\Admin\AppData\Local\Temp\EBE5.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\EC23.tmp"C:\Users\Admin\AppData\Local\Temp\EC23.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\EC62.tmp"C:\Users\Admin\AppData\Local\Temp\EC62.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\ECA0.tmp"C:\Users\Admin\AppData\Local\Temp\ECA0.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\ECDE.tmp"C:\Users\Admin\AppData\Local\Temp\ECDE.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\ED1D.tmp"C:\Users\Admin\AppData\Local\Temp\ED1D.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\ED5B.tmp"C:\Users\Admin\AppData\Local\Temp\ED5B.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\ED9A.tmp"C:\Users\Admin\AppData\Local\Temp\ED9A.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\EDD8.tmp"C:\Users\Admin\AppData\Local\Temp\EDD8.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\EE16.tmp"C:\Users\Admin\AppData\Local\Temp\EE16.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\EE64.tmp"C:\Users\Admin\AppData\Local\Temp\EE64.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\EEA3.tmp"C:\Users\Admin\AppData\Local\Temp\EEA3.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\EEE1.tmp"C:\Users\Admin\AppData\Local\Temp\EEE1.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\EF20.tmp"C:\Users\Admin\AppData\Local\Temp\EF20.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\EF5E.tmp"C:\Users\Admin\AppData\Local\Temp\EF5E.tmp"65⤵
- Executes dropped EXE
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\EF9C.tmp"C:\Users\Admin\AppData\Local\Temp\EF9C.tmp"66⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\EFDB.tmp"C:\Users\Admin\AppData\Local\Temp\EFDB.tmp"67⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\F019.tmp"C:\Users\Admin\AppData\Local\Temp\F019.tmp"68⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\F058.tmp"C:\Users\Admin\AppData\Local\Temp\F058.tmp"69⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\F096.tmp"C:\Users\Admin\AppData\Local\Temp\F096.tmp"70⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\F0D4.tmp"C:\Users\Admin\AppData\Local\Temp\F0D4.tmp"71⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\F113.tmp"C:\Users\Admin\AppData\Local\Temp\F113.tmp"72⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\F151.tmp"C:\Users\Admin\AppData\Local\Temp\F151.tmp"73⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\F190.tmp"C:\Users\Admin\AppData\Local\Temp\F190.tmp"74⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\F1CE.tmp"C:\Users\Admin\AppData\Local\Temp\F1CE.tmp"75⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\F20C.tmp"C:\Users\Admin\AppData\Local\Temp\F20C.tmp"76⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\F24B.tmp"C:\Users\Admin\AppData\Local\Temp\F24B.tmp"77⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\F289.tmp"C:\Users\Admin\AppData\Local\Temp\F289.tmp"78⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\F2C8.tmp"C:\Users\Admin\AppData\Local\Temp\F2C8.tmp"79⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\F306.tmp"C:\Users\Admin\AppData\Local\Temp\F306.tmp"80⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\F344.tmp"C:\Users\Admin\AppData\Local\Temp\F344.tmp"81⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\F383.tmp"C:\Users\Admin\AppData\Local\Temp\F383.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\F3C1.tmp"C:\Users\Admin\AppData\Local\Temp\F3C1.tmp"83⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\F400.tmp"C:\Users\Admin\AppData\Local\Temp\F400.tmp"84⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\F43E.tmp"C:\Users\Admin\AppData\Local\Temp\F43E.tmp"85⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\F47C.tmp"C:\Users\Admin\AppData\Local\Temp\F47C.tmp"86⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\F4BB.tmp"C:\Users\Admin\AppData\Local\Temp\F4BB.tmp"87⤵
- System Location Discovery: System Language Discovery
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\F4F9.tmp"C:\Users\Admin\AppData\Local\Temp\F4F9.tmp"88⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\F538.tmp"C:\Users\Admin\AppData\Local\Temp\F538.tmp"89⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\F576.tmp"C:\Users\Admin\AppData\Local\Temp\F576.tmp"90⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\F5C4.tmp"C:\Users\Admin\AppData\Local\Temp\F5C4.tmp"91⤵PID:288
-
C:\Users\Admin\AppData\Local\Temp\F602.tmp"C:\Users\Admin\AppData\Local\Temp\F602.tmp"92⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\F641.tmp"C:\Users\Admin\AppData\Local\Temp\F641.tmp"93⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\F67F.tmp"C:\Users\Admin\AppData\Local\Temp\F67F.tmp"94⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\F6BE.tmp"C:\Users\Admin\AppData\Local\Temp\F6BE.tmp"95⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\F6FC.tmp"C:\Users\Admin\AppData\Local\Temp\F6FC.tmp"96⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\F73A.tmp"C:\Users\Admin\AppData\Local\Temp\F73A.tmp"97⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\F779.tmp"C:\Users\Admin\AppData\Local\Temp\F779.tmp"98⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\F7B7.tmp"C:\Users\Admin\AppData\Local\Temp\F7B7.tmp"99⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\F7F6.tmp"C:\Users\Admin\AppData\Local\Temp\F7F6.tmp"100⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\F834.tmp"C:\Users\Admin\AppData\Local\Temp\F834.tmp"101⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\F872.tmp"C:\Users\Admin\AppData\Local\Temp\F872.tmp"102⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\F8B1.tmp"C:\Users\Admin\AppData\Local\Temp\F8B1.tmp"103⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\F8EF.tmp"C:\Users\Admin\AppData\Local\Temp\F8EF.tmp"104⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\F92E.tmp"C:\Users\Admin\AppData\Local\Temp\F92E.tmp"105⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\F96C.tmp"C:\Users\Admin\AppData\Local\Temp\F96C.tmp"106⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\F9AA.tmp"C:\Users\Admin\AppData\Local\Temp\F9AA.tmp"107⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\F9E9.tmp"C:\Users\Admin\AppData\Local\Temp\F9E9.tmp"108⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\FA27.tmp"C:\Users\Admin\AppData\Local\Temp\FA27.tmp"109⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\FA66.tmp"C:\Users\Admin\AppData\Local\Temp\FA66.tmp"110⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\FAA4.tmp"C:\Users\Admin\AppData\Local\Temp\FAA4.tmp"111⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\FAE2.tmp"C:\Users\Admin\AppData\Local\Temp\FAE2.tmp"112⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\FB21.tmp"C:\Users\Admin\AppData\Local\Temp\FB21.tmp"113⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\FB5F.tmp"C:\Users\Admin\AppData\Local\Temp\FB5F.tmp"114⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\FB9E.tmp"C:\Users\Admin\AppData\Local\Temp\FB9E.tmp"115⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\FBDC.tmp"C:\Users\Admin\AppData\Local\Temp\FBDC.tmp"116⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\FC1A.tmp"C:\Users\Admin\AppData\Local\Temp\FC1A.tmp"117⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\FC59.tmp"C:\Users\Admin\AppData\Local\Temp\FC59.tmp"118⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\FC97.tmp"C:\Users\Admin\AppData\Local\Temp\FC97.tmp"119⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\FCD6.tmp"C:\Users\Admin\AppData\Local\Temp\FCD6.tmp"120⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\FD14.tmp"C:\Users\Admin\AppData\Local\Temp\FD14.tmp"121⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\FD52.tmp"C:\Users\Admin\AppData\Local\Temp\FD52.tmp"122⤵PID:2316
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-