Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12/10/2024, 13:47
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-12_1a77d343f6b0c3b5f90d12a1227d9b41_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-12_1a77d343f6b0c3b5f90d12a1227d9b41_mafia.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-12_1a77d343f6b0c3b5f90d12a1227d9b41_mafia.exe
-
Size
520KB
-
MD5
1a77d343f6b0c3b5f90d12a1227d9b41
-
SHA1
60667528cb6695835af2983983659330556ff901
-
SHA256
0f9c17ad604e45cce1dc268b241b073ce7716a3ba92e0ef4a1b330d9681002d1
-
SHA512
0612adb673cfc7fc9507cc32b47994d7b6c7f37a6308683be45d2ef052f636f236e19aeae84733faf54d12b24026b98033d67d27633211d86af6b9c1eab4cef1
-
SSDEEP
12288:5iLF/W8nDsy5L7j6LQxlUQGiYp1lQPNiuNZ:5iL08n35Lf6MF6ZQ3N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1916 C3AD.tmp 2332 C3FB.tmp 3000 C477.tmp 2480 C4D5.tmp 1656 C533.tmp 2712 C5A0.tmp 2800 C5FD.tmp 2716 C65B.tmp 2764 C6B9.tmp 2132 C726.tmp 3056 C793.tmp 2684 C7F1.tmp 2620 C84E.tmp 3024 C8BB.tmp 2456 C919.tmp 1244 C986.tmp 1208 C9E4.tmp 756 CA51.tmp 2564 CAAF.tmp 1220 CB0C.tmp 1248 CB6A.tmp 3048 CBD7.tmp 2912 CC25.tmp 2408 CC73.tmp 2216 CCB1.tmp 2212 CCFF.tmp 2088 CD3E.tmp 2516 CD7C.tmp 1860 CDBB.tmp 448 CDF9.tmp 2976 CE37.tmp 680 CE76.tmp 988 CEB4.tmp 612 CEF3.tmp 940 CF31.tmp 1124 CF6F.tmp 2428 CFAE.tmp 1652 CFEC.tmp 1764 D02B.tmp 1516 D069.tmp 1548 D0A7.tmp 2416 D0E6.tmp 2312 D124.tmp 2192 D163.tmp 764 D1B1.tmp 2468 D1EF.tmp 320 D22D.tmp 2184 D26C.tmp 2280 D2AA.tmp 552 D2E9.tmp 1580 D375.tmp 2504 D3B3.tmp 1060 D3F2.tmp 2860 D430.tmp 2548 D47E.tmp 1928 D4BD.tmp 1056 D4FB.tmp 2768 D539.tmp 2720 D578.tmp 2700 D5B6.tmp 2680 D5F5.tmp 2820 D633.tmp 2856 D671.tmp 2748 D6B0.tmp -
Loads dropped DLL 64 IoCs
pid Process 2368 2024-10-12_1a77d343f6b0c3b5f90d12a1227d9b41_mafia.exe 1916 C3AD.tmp 2332 C3FB.tmp 3000 C477.tmp 2480 C4D5.tmp 1656 C533.tmp 2712 C5A0.tmp 2800 C5FD.tmp 2716 C65B.tmp 2764 C6B9.tmp 2132 C726.tmp 3056 C793.tmp 2684 C7F1.tmp 2620 C84E.tmp 3024 C8BB.tmp 2456 C919.tmp 1244 C986.tmp 1208 C9E4.tmp 756 CA51.tmp 2564 CAAF.tmp 1220 CB0C.tmp 1248 CB6A.tmp 3048 CBD7.tmp 2912 CC25.tmp 2408 CC73.tmp 2216 CCB1.tmp 2212 CCFF.tmp 2088 CD3E.tmp 2516 CD7C.tmp 1860 CDBB.tmp 448 CDF9.tmp 2976 CE37.tmp 680 CE76.tmp 988 CEB4.tmp 612 CEF3.tmp 940 CF31.tmp 1124 CF6F.tmp 2428 CFAE.tmp 1652 CFEC.tmp 1764 D02B.tmp 1516 D069.tmp 1548 D0A7.tmp 2416 D0E6.tmp 2312 D124.tmp 2192 D163.tmp 764 D1B1.tmp 2468 D1EF.tmp 320 D22D.tmp 2184 D26C.tmp 2280 D2AA.tmp 1604 D327.tmp 1580 D375.tmp 2504 D3B3.tmp 1060 D3F2.tmp 2860 D430.tmp 2548 D47E.tmp 1928 D4BD.tmp 1056 D4FB.tmp 2768 D539.tmp 2720 D578.tmp 2700 D5B6.tmp 2680 D5F5.tmp 2820 D633.tmp 2856 D671.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2230.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3266.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9157.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D3D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A66D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D92.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5467.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C033.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8160.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 897B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7149.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A016.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2368 wrote to memory of 1916 2368 2024-10-12_1a77d343f6b0c3b5f90d12a1227d9b41_mafia.exe 30 PID 2368 wrote to memory of 1916 2368 2024-10-12_1a77d343f6b0c3b5f90d12a1227d9b41_mafia.exe 30 PID 2368 wrote to memory of 1916 2368 2024-10-12_1a77d343f6b0c3b5f90d12a1227d9b41_mafia.exe 30 PID 2368 wrote to memory of 1916 2368 2024-10-12_1a77d343f6b0c3b5f90d12a1227d9b41_mafia.exe 30 PID 1916 wrote to memory of 2332 1916 C3AD.tmp 31 PID 1916 wrote to memory of 2332 1916 C3AD.tmp 31 PID 1916 wrote to memory of 2332 1916 C3AD.tmp 31 PID 1916 wrote to memory of 2332 1916 C3AD.tmp 31 PID 2332 wrote to memory of 3000 2332 C3FB.tmp 32 PID 2332 wrote to memory of 3000 2332 C3FB.tmp 32 PID 2332 wrote to memory of 3000 2332 C3FB.tmp 32 PID 2332 wrote to memory of 3000 2332 C3FB.tmp 32 PID 3000 wrote to memory of 2480 3000 C477.tmp 33 PID 3000 wrote to memory of 2480 3000 C477.tmp 33 PID 3000 wrote to memory of 2480 3000 C477.tmp 33 PID 3000 wrote to memory of 2480 3000 C477.tmp 33 PID 2480 wrote to memory of 1656 2480 C4D5.tmp 34 PID 2480 wrote to memory of 1656 2480 C4D5.tmp 34 PID 2480 wrote to memory of 1656 2480 C4D5.tmp 34 PID 2480 wrote to memory of 1656 2480 C4D5.tmp 34 PID 1656 wrote to memory of 2712 1656 C533.tmp 35 PID 1656 wrote to memory of 2712 1656 C533.tmp 35 PID 1656 wrote to memory of 2712 1656 C533.tmp 35 PID 1656 wrote to memory of 2712 1656 C533.tmp 35 PID 2712 wrote to memory of 2800 2712 C5A0.tmp 36 PID 2712 wrote to memory of 2800 2712 C5A0.tmp 36 PID 2712 wrote to memory of 2800 2712 C5A0.tmp 36 PID 2712 wrote to memory of 2800 2712 C5A0.tmp 36 PID 2800 wrote to memory of 2716 2800 C5FD.tmp 37 PID 2800 wrote to memory of 2716 2800 C5FD.tmp 37 PID 2800 wrote to memory of 2716 2800 C5FD.tmp 37 PID 2800 wrote to memory of 2716 2800 C5FD.tmp 37 PID 2716 wrote to memory of 2764 2716 C65B.tmp 38 PID 2716 wrote to memory of 2764 2716 C65B.tmp 38 PID 2716 wrote to memory of 2764 2716 C65B.tmp 38 PID 2716 wrote to memory of 2764 2716 C65B.tmp 38 PID 2764 wrote to memory of 2132 2764 C6B9.tmp 39 PID 2764 wrote to memory of 2132 2764 C6B9.tmp 39 PID 2764 wrote to memory of 2132 2764 C6B9.tmp 39 PID 2764 wrote to memory of 2132 2764 C6B9.tmp 39 PID 2132 wrote to memory of 3056 2132 C726.tmp 40 PID 2132 wrote to memory of 3056 2132 C726.tmp 40 PID 2132 wrote to memory of 3056 2132 C726.tmp 40 PID 2132 wrote to memory of 3056 2132 C726.tmp 40 PID 3056 wrote to memory of 2684 3056 C793.tmp 41 PID 3056 wrote to memory of 2684 3056 C793.tmp 41 PID 3056 wrote to memory of 2684 3056 C793.tmp 41 PID 3056 wrote to memory of 2684 3056 C793.tmp 41 PID 2684 wrote to memory of 2620 2684 C7F1.tmp 42 PID 2684 wrote to memory of 2620 2684 C7F1.tmp 42 PID 2684 wrote to memory of 2620 2684 C7F1.tmp 42 PID 2684 wrote to memory of 2620 2684 C7F1.tmp 42 PID 2620 wrote to memory of 3024 2620 C84E.tmp 43 PID 2620 wrote to memory of 3024 2620 C84E.tmp 43 PID 2620 wrote to memory of 3024 2620 C84E.tmp 43 PID 2620 wrote to memory of 3024 2620 C84E.tmp 43 PID 3024 wrote to memory of 2456 3024 C8BB.tmp 44 PID 3024 wrote to memory of 2456 3024 C8BB.tmp 44 PID 3024 wrote to memory of 2456 3024 C8BB.tmp 44 PID 3024 wrote to memory of 2456 3024 C8BB.tmp 44 PID 2456 wrote to memory of 1244 2456 C919.tmp 46 PID 2456 wrote to memory of 1244 2456 C919.tmp 46 PID 2456 wrote to memory of 1244 2456 C919.tmp 46 PID 2456 wrote to memory of 1244 2456 C919.tmp 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-12_1a77d343f6b0c3b5f90d12a1227d9b41_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-12_1a77d343f6b0c3b5f90d12a1227d9b41_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\C3AD.tmp"C:\Users\Admin\AppData\Local\Temp\C3AD.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\C3FB.tmp"C:\Users\Admin\AppData\Local\Temp\C3FB.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\C477.tmp"C:\Users\Admin\AppData\Local\Temp\C477.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\C4D5.tmp"C:\Users\Admin\AppData\Local\Temp\C4D5.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\C533.tmp"C:\Users\Admin\AppData\Local\Temp\C533.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\C5A0.tmp"C:\Users\Admin\AppData\Local\Temp\C5A0.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\C5FD.tmp"C:\Users\Admin\AppData\Local\Temp\C5FD.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\C65B.tmp"C:\Users\Admin\AppData\Local\Temp\C65B.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\C6B9.tmp"C:\Users\Admin\AppData\Local\Temp\C6B9.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\C726.tmp"C:\Users\Admin\AppData\Local\Temp\C726.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\C793.tmp"C:\Users\Admin\AppData\Local\Temp\C793.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\C7F1.tmp"C:\Users\Admin\AppData\Local\Temp\C7F1.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\C84E.tmp"C:\Users\Admin\AppData\Local\Temp\C84E.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\C8BB.tmp"C:\Users\Admin\AppData\Local\Temp\C8BB.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\C919.tmp"C:\Users\Admin\AppData\Local\Temp\C919.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\C986.tmp"C:\Users\Admin\AppData\Local\Temp\C986.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\C9E4.tmp"C:\Users\Admin\AppData\Local\Temp\C9E4.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\CA51.tmp"C:\Users\Admin\AppData\Local\Temp\CA51.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:756 -
C:\Users\Admin\AppData\Local\Temp\CAAF.tmp"C:\Users\Admin\AppData\Local\Temp\CAAF.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\CB0C.tmp"C:\Users\Admin\AppData\Local\Temp\CB0C.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\CB6A.tmp"C:\Users\Admin\AppData\Local\Temp\CB6A.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\CBD7.tmp"C:\Users\Admin\AppData\Local\Temp\CBD7.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\CC25.tmp"C:\Users\Admin\AppData\Local\Temp\CC25.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\CC73.tmp"C:\Users\Admin\AppData\Local\Temp\CC73.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\CCB1.tmp"C:\Users\Admin\AppData\Local\Temp\CCB1.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\CCFF.tmp"C:\Users\Admin\AppData\Local\Temp\CCFF.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\CD3E.tmp"C:\Users\Admin\AppData\Local\Temp\CD3E.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\CDBB.tmp"C:\Users\Admin\AppData\Local\Temp\CDBB.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\CDF9.tmp"C:\Users\Admin\AppData\Local\Temp\CDF9.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:448 -
C:\Users\Admin\AppData\Local\Temp\CE37.tmp"C:\Users\Admin\AppData\Local\Temp\CE37.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\CE76.tmp"C:\Users\Admin\AppData\Local\Temp\CE76.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:680 -
C:\Users\Admin\AppData\Local\Temp\CEB4.tmp"C:\Users\Admin\AppData\Local\Temp\CEB4.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:988 -
C:\Users\Admin\AppData\Local\Temp\CEF3.tmp"C:\Users\Admin\AppData\Local\Temp\CEF3.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:612 -
C:\Users\Admin\AppData\Local\Temp\CF31.tmp"C:\Users\Admin\AppData\Local\Temp\CF31.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:940 -
C:\Users\Admin\AppData\Local\Temp\CF6F.tmp"C:\Users\Admin\AppData\Local\Temp\CF6F.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\CFAE.tmp"C:\Users\Admin\AppData\Local\Temp\CFAE.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\CFEC.tmp"C:\Users\Admin\AppData\Local\Temp\CFEC.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\D02B.tmp"C:\Users\Admin\AppData\Local\Temp\D02B.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\D069.tmp"C:\Users\Admin\AppData\Local\Temp\D069.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\D0A7.tmp"C:\Users\Admin\AppData\Local\Temp\D0A7.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\D0E6.tmp"C:\Users\Admin\AppData\Local\Temp\D0E6.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\D124.tmp"C:\Users\Admin\AppData\Local\Temp\D124.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\D163.tmp"C:\Users\Admin\AppData\Local\Temp\D163.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\D1B1.tmp"C:\Users\Admin\AppData\Local\Temp\D1B1.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:764 -
C:\Users\Admin\AppData\Local\Temp\D1EF.tmp"C:\Users\Admin\AppData\Local\Temp\D1EF.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\D22D.tmp"C:\Users\Admin\AppData\Local\Temp\D22D.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:320 -
C:\Users\Admin\AppData\Local\Temp\D26C.tmp"C:\Users\Admin\AppData\Local\Temp\D26C.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\D2AA.tmp"C:\Users\Admin\AppData\Local\Temp\D2AA.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\D2E9.tmp"C:\Users\Admin\AppData\Local\Temp\D2E9.tmp"51⤵
- Executes dropped EXE
PID:552 -
C:\Users\Admin\AppData\Local\Temp\D327.tmp"C:\Users\Admin\AppData\Local\Temp\D327.tmp"52⤵
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\D375.tmp"C:\Users\Admin\AppData\Local\Temp\D375.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\D3B3.tmp"C:\Users\Admin\AppData\Local\Temp\D3B3.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\D3F2.tmp"C:\Users\Admin\AppData\Local\Temp\D3F2.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\D430.tmp"C:\Users\Admin\AppData\Local\Temp\D430.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\D47E.tmp"C:\Users\Admin\AppData\Local\Temp\D47E.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\D4BD.tmp"C:\Users\Admin\AppData\Local\Temp\D4BD.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\D4FB.tmp"C:\Users\Admin\AppData\Local\Temp\D4FB.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\D539.tmp"C:\Users\Admin\AppData\Local\Temp\D539.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\D578.tmp"C:\Users\Admin\AppData\Local\Temp\D578.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\D5B6.tmp"C:\Users\Admin\AppData\Local\Temp\D5B6.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\D5F5.tmp"C:\Users\Admin\AppData\Local\Temp\D5F5.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\D633.tmp"C:\Users\Admin\AppData\Local\Temp\D633.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\D671.tmp"C:\Users\Admin\AppData\Local\Temp\D671.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\D6B0.tmp"C:\Users\Admin\AppData\Local\Temp\D6B0.tmp"66⤵
- Executes dropped EXE
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\D6FE.tmp"C:\Users\Admin\AppData\Local\Temp\D6FE.tmp"67⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\D73C.tmp"C:\Users\Admin\AppData\Local\Temp\D73C.tmp"68⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\D77B.tmp"C:\Users\Admin\AppData\Local\Temp\D77B.tmp"69⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\D7C9.tmp"C:\Users\Admin\AppData\Local\Temp\D7C9.tmp"70⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\D807.tmp"C:\Users\Admin\AppData\Local\Temp\D807.tmp"71⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\D845.tmp"C:\Users\Admin\AppData\Local\Temp\D845.tmp"72⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\D884.tmp"C:\Users\Admin\AppData\Local\Temp\D884.tmp"73⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\D8C2.tmp"C:\Users\Admin\AppData\Local\Temp\D8C2.tmp"74⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\D910.tmp"C:\Users\Admin\AppData\Local\Temp\D910.tmp"75⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\D94F.tmp"C:\Users\Admin\AppData\Local\Temp\D94F.tmp"76⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\D99D.tmp"C:\Users\Admin\AppData\Local\Temp\D99D.tmp"77⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\D9DB.tmp"C:\Users\Admin\AppData\Local\Temp\D9DB.tmp"78⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\DA19.tmp"C:\Users\Admin\AppData\Local\Temp\DA19.tmp"79⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\DA58.tmp"C:\Users\Admin\AppData\Local\Temp\DA58.tmp"80⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\DA96.tmp"C:\Users\Admin\AppData\Local\Temp\DA96.tmp"81⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\DAD5.tmp"C:\Users\Admin\AppData\Local\Temp\DAD5.tmp"82⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\DB13.tmp"C:\Users\Admin\AppData\Local\Temp\DB13.tmp"83⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\DB61.tmp"C:\Users\Admin\AppData\Local\Temp\DB61.tmp"84⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\DB9F.tmp"C:\Users\Admin\AppData\Local\Temp\DB9F.tmp"85⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\DBDE.tmp"C:\Users\Admin\AppData\Local\Temp\DBDE.tmp"86⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\DC1C.tmp"C:\Users\Admin\AppData\Local\Temp\DC1C.tmp"87⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\DC5B.tmp"C:\Users\Admin\AppData\Local\Temp\DC5B.tmp"88⤵
- System Location Discovery: System Language Discovery
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\DC99.tmp"C:\Users\Admin\AppData\Local\Temp\DC99.tmp"89⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\DCD7.tmp"C:\Users\Admin\AppData\Local\Temp\DCD7.tmp"90⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\DD16.tmp"C:\Users\Admin\AppData\Local\Temp\DD16.tmp"91⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\DD54.tmp"C:\Users\Admin\AppData\Local\Temp\DD54.tmp"92⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\DD93.tmp"C:\Users\Admin\AppData\Local\Temp\DD93.tmp"93⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\DDD1.tmp"C:\Users\Admin\AppData\Local\Temp\DDD1.tmp"94⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\DE10.tmp"C:\Users\Admin\AppData\Local\Temp\DE10.tmp"95⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\DE4E.tmp"C:\Users\Admin\AppData\Local\Temp\DE4E.tmp"96⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\DE8C.tmp"C:\Users\Admin\AppData\Local\Temp\DE8C.tmp"97⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\DECB.tmp"C:\Users\Admin\AppData\Local\Temp\DECB.tmp"98⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\DF09.tmp"C:\Users\Admin\AppData\Local\Temp\DF09.tmp"99⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\DF48.tmp"C:\Users\Admin\AppData\Local\Temp\DF48.tmp"100⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\DF86.tmp"C:\Users\Admin\AppData\Local\Temp\DF86.tmp"101⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\DFC4.tmp"C:\Users\Admin\AppData\Local\Temp\DFC4.tmp"102⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\E003.tmp"C:\Users\Admin\AppData\Local\Temp\E003.tmp"103⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\E032.tmp"C:\Users\Admin\AppData\Local\Temp\E032.tmp"104⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\E070.tmp"C:\Users\Admin\AppData\Local\Temp\E070.tmp"105⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\E0AE.tmp"C:\Users\Admin\AppData\Local\Temp\E0AE.tmp"106⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\E0ED.tmp"C:\Users\Admin\AppData\Local\Temp\E0ED.tmp"107⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\E12B.tmp"C:\Users\Admin\AppData\Local\Temp\E12B.tmp"108⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\E16A.tmp"C:\Users\Admin\AppData\Local\Temp\E16A.tmp"109⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\E1A8.tmp"C:\Users\Admin\AppData\Local\Temp\E1A8.tmp"110⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\E1E6.tmp"C:\Users\Admin\AppData\Local\Temp\E1E6.tmp"111⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\E225.tmp"C:\Users\Admin\AppData\Local\Temp\E225.tmp"112⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\E282.tmp"C:\Users\Admin\AppData\Local\Temp\E282.tmp"113⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\E2C1.tmp"C:\Users\Admin\AppData\Local\Temp\E2C1.tmp"114⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\E2FF.tmp"C:\Users\Admin\AppData\Local\Temp\E2FF.tmp"115⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\E33E.tmp"C:\Users\Admin\AppData\Local\Temp\E33E.tmp"116⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\E37C.tmp"C:\Users\Admin\AppData\Local\Temp\E37C.tmp"117⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\E3AB.tmp"C:\Users\Admin\AppData\Local\Temp\E3AB.tmp"118⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\E3E9.tmp"C:\Users\Admin\AppData\Local\Temp\E3E9.tmp"119⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\E428.tmp"C:\Users\Admin\AppData\Local\Temp\E428.tmp"120⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\E466.tmp"C:\Users\Admin\AppData\Local\Temp\E466.tmp"121⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\E4A4.tmp"C:\Users\Admin\AppData\Local\Temp\E4A4.tmp"122⤵PID:2776
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-