Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15-10-2024 05:55
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-15_ceefc8c1d43bcfb27e7fa599cff16e02_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-15_ceefc8c1d43bcfb27e7fa599cff16e02_mafia.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-15_ceefc8c1d43bcfb27e7fa599cff16e02_mafia.exe
-
Size
488KB
-
MD5
ceefc8c1d43bcfb27e7fa599cff16e02
-
SHA1
9a8c70c9a67c0633e124a4043112291b9a130ef1
-
SHA256
1c96a1950d3a7671a244cb87b2d4769fe77de1813e58be1764d7782e8f2e570e
-
SHA512
1695644d028bcea8cb2c2378beae4764ace432daf68695d19a5adba96bf3564ab25925b2e827435d9f636a3758dea116c014c57ef5e2db31433149a67361cb38
-
SSDEEP
12288:/U5rCOTeiDLEhvG/InM0I7oK/7uGsWMNZ:/UQOJDL6MIM97oKCjWMN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2296 EBA6.tmp 2808 EC14.tmp 2732 EC90.tmp 2696 ECFE.tmp 2828 ED6B.tmp 2716 EDD8.tmp 2576 EE55.tmp 2652 EEC2.tmp 2068 EF20.tmp 1876 EF8D.tmp 2680 EFFA.tmp 2964 F067.tmp 2116 F0C5.tmp 1272 F142.tmp 596 F1AF.tmp 352 F22C.tmp 376 F289.tmp 2564 F2C8.tmp 2916 F344.tmp 592 F3B2.tmp 1956 F40F.tmp 3012 F47C.tmp 2536 F4DA.tmp 2444 F518.tmp 2232 F557.tmp 2184 F595.tmp 2456 F5D4.tmp 2308 F622.tmp 1320 F660.tmp 1580 F69E.tmp 848 F6DD.tmp 1396 F71B.tmp 2528 F75A.tmp 960 F798.tmp 1796 F7D6.tmp 1812 F824.tmp 1576 F872.tmp 1752 F8B1.tmp 1764 F8FF.tmp 1664 F94D.tmp 624 F98B.tmp 2104 F9CA.tmp 2000 FA08.tmp 2396 FA46.tmp 1516 FA85.tmp 2664 FAC3.tmp 2508 FB02.tmp 1984 FB40.tmp 2268 FB7E.tmp 1872 FBBD.tmp 1616 FBFB.tmp 2324 FC49.tmp 2688 FC88.tmp 2296 FCD6.tmp 2804 FD14.tmp 3000 FD62.tmp 2312 FDA0.tmp 2740 FDEE.tmp 2600 FE2D.tmp 2028 FE6B.tmp 2792 FEB9.tmp 1648 FEF8.tmp 2580 FF46.tmp 2400 FFA3.tmp -
Loads dropped DLL 64 IoCs
pid Process 2672 2024-10-15_ceefc8c1d43bcfb27e7fa599cff16e02_mafia.exe 2296 EBA6.tmp 2808 EC14.tmp 2732 EC90.tmp 2696 ECFE.tmp 2828 ED6B.tmp 2716 EDD8.tmp 2576 EE55.tmp 2652 EEC2.tmp 2068 EF20.tmp 1876 EF8D.tmp 2680 EFFA.tmp 2964 F067.tmp 2116 F0C5.tmp 1272 F142.tmp 596 F1AF.tmp 352 F22C.tmp 376 F289.tmp 2564 F2C8.tmp 2916 F344.tmp 592 F3B2.tmp 1956 F40F.tmp 3012 F47C.tmp 2536 F4DA.tmp 2444 F518.tmp 2232 F557.tmp 2184 F595.tmp 2456 F5D4.tmp 2308 F622.tmp 1320 F660.tmp 1580 F69E.tmp 848 F6DD.tmp 1396 F71B.tmp 2528 F75A.tmp 960 F798.tmp 1796 F7D6.tmp 1812 F824.tmp 1576 F872.tmp 1752 F8B1.tmp 1764 F8FF.tmp 1664 F94D.tmp 624 F98B.tmp 2104 F9CA.tmp 2000 FA08.tmp 2396 FA46.tmp 1516 FA85.tmp 2664 FAC3.tmp 2508 FB02.tmp 1984 FB40.tmp 2268 FB7E.tmp 1872 FBBD.tmp 1616 FBFB.tmp 2324 FC49.tmp 2688 FC88.tmp 2296 FCD6.tmp 2804 FD14.tmp 3000 FD62.tmp 2312 FDA0.tmp 2740 FDEE.tmp 2600 FE2D.tmp 2028 FE6B.tmp 2792 FEB9.tmp 1648 FEF8.tmp 2580 FF46.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F557.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8028.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A17D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D549.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2CEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E7B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 589B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6FD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DD5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E051.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3015.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8353.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 318C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5438.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D930.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCD8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2672 wrote to memory of 2296 2672 2024-10-15_ceefc8c1d43bcfb27e7fa599cff16e02_mafia.exe 31 PID 2672 wrote to memory of 2296 2672 2024-10-15_ceefc8c1d43bcfb27e7fa599cff16e02_mafia.exe 31 PID 2672 wrote to memory of 2296 2672 2024-10-15_ceefc8c1d43bcfb27e7fa599cff16e02_mafia.exe 31 PID 2672 wrote to memory of 2296 2672 2024-10-15_ceefc8c1d43bcfb27e7fa599cff16e02_mafia.exe 31 PID 2296 wrote to memory of 2808 2296 EBA6.tmp 32 PID 2296 wrote to memory of 2808 2296 EBA6.tmp 32 PID 2296 wrote to memory of 2808 2296 EBA6.tmp 32 PID 2296 wrote to memory of 2808 2296 EBA6.tmp 32 PID 2808 wrote to memory of 2732 2808 EC14.tmp 33 PID 2808 wrote to memory of 2732 2808 EC14.tmp 33 PID 2808 wrote to memory of 2732 2808 EC14.tmp 33 PID 2808 wrote to memory of 2732 2808 EC14.tmp 33 PID 2732 wrote to memory of 2696 2732 EC90.tmp 34 PID 2732 wrote to memory of 2696 2732 EC90.tmp 34 PID 2732 wrote to memory of 2696 2732 EC90.tmp 34 PID 2732 wrote to memory of 2696 2732 EC90.tmp 34 PID 2696 wrote to memory of 2828 2696 ECFE.tmp 35 PID 2696 wrote to memory of 2828 2696 ECFE.tmp 35 PID 2696 wrote to memory of 2828 2696 ECFE.tmp 35 PID 2696 wrote to memory of 2828 2696 ECFE.tmp 35 PID 2828 wrote to memory of 2716 2828 ED6B.tmp 36 PID 2828 wrote to memory of 2716 2828 ED6B.tmp 36 PID 2828 wrote to memory of 2716 2828 ED6B.tmp 36 PID 2828 wrote to memory of 2716 2828 ED6B.tmp 36 PID 2716 wrote to memory of 2576 2716 EDD8.tmp 37 PID 2716 wrote to memory of 2576 2716 EDD8.tmp 37 PID 2716 wrote to memory of 2576 2716 EDD8.tmp 37 PID 2716 wrote to memory of 2576 2716 EDD8.tmp 37 PID 2576 wrote to memory of 2652 2576 EE55.tmp 38 PID 2576 wrote to memory of 2652 2576 EE55.tmp 38 PID 2576 wrote to memory of 2652 2576 EE55.tmp 38 PID 2576 wrote to memory of 2652 2576 EE55.tmp 38 PID 2652 wrote to memory of 2068 2652 EEC2.tmp 39 PID 2652 wrote to memory of 2068 2652 EEC2.tmp 39 PID 2652 wrote to memory of 2068 2652 EEC2.tmp 39 PID 2652 wrote to memory of 2068 2652 EEC2.tmp 39 PID 2068 wrote to memory of 1876 2068 EF20.tmp 40 PID 2068 wrote to memory of 1876 2068 EF20.tmp 40 PID 2068 wrote to memory of 1876 2068 EF20.tmp 40 PID 2068 wrote to memory of 1876 2068 EF20.tmp 40 PID 1876 wrote to memory of 2680 1876 EF8D.tmp 41 PID 1876 wrote to memory of 2680 1876 EF8D.tmp 41 PID 1876 wrote to memory of 2680 1876 EF8D.tmp 41 PID 1876 wrote to memory of 2680 1876 EF8D.tmp 41 PID 2680 wrote to memory of 2964 2680 EFFA.tmp 42 PID 2680 wrote to memory of 2964 2680 EFFA.tmp 42 PID 2680 wrote to memory of 2964 2680 EFFA.tmp 42 PID 2680 wrote to memory of 2964 2680 EFFA.tmp 42 PID 2964 wrote to memory of 2116 2964 F067.tmp 43 PID 2964 wrote to memory of 2116 2964 F067.tmp 43 PID 2964 wrote to memory of 2116 2964 F067.tmp 43 PID 2964 wrote to memory of 2116 2964 F067.tmp 43 PID 2116 wrote to memory of 1272 2116 F0C5.tmp 44 PID 2116 wrote to memory of 1272 2116 F0C5.tmp 44 PID 2116 wrote to memory of 1272 2116 F0C5.tmp 44 PID 2116 wrote to memory of 1272 2116 F0C5.tmp 44 PID 1272 wrote to memory of 596 1272 F142.tmp 45 PID 1272 wrote to memory of 596 1272 F142.tmp 45 PID 1272 wrote to memory of 596 1272 F142.tmp 45 PID 1272 wrote to memory of 596 1272 F142.tmp 45 PID 596 wrote to memory of 352 596 F1AF.tmp 46 PID 596 wrote to memory of 352 596 F1AF.tmp 46 PID 596 wrote to memory of 352 596 F1AF.tmp 46 PID 596 wrote to memory of 352 596 F1AF.tmp 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-15_ceefc8c1d43bcfb27e7fa599cff16e02_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-15_ceefc8c1d43bcfb27e7fa599cff16e02_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\EBA6.tmp"C:\Users\Admin\AppData\Local\Temp\EBA6.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\EC14.tmp"C:\Users\Admin\AppData\Local\Temp\EC14.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\EC90.tmp"C:\Users\Admin\AppData\Local\Temp\EC90.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\ECFE.tmp"C:\Users\Admin\AppData\Local\Temp\ECFE.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\ED6B.tmp"C:\Users\Admin\AppData\Local\Temp\ED6B.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\EDD8.tmp"C:\Users\Admin\AppData\Local\Temp\EDD8.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\EE55.tmp"C:\Users\Admin\AppData\Local\Temp\EE55.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\EEC2.tmp"C:\Users\Admin\AppData\Local\Temp\EEC2.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\EF20.tmp"C:\Users\Admin\AppData\Local\Temp\EF20.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\EF8D.tmp"C:\Users\Admin\AppData\Local\Temp\EF8D.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\EFFA.tmp"C:\Users\Admin\AppData\Local\Temp\EFFA.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\F067.tmp"C:\Users\Admin\AppData\Local\Temp\F067.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\F0C5.tmp"C:\Users\Admin\AppData\Local\Temp\F0C5.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\F142.tmp"C:\Users\Admin\AppData\Local\Temp\F142.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\F1AF.tmp"C:\Users\Admin\AppData\Local\Temp\F1AF.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Users\Admin\AppData\Local\Temp\F22C.tmp"C:\Users\Admin\AppData\Local\Temp\F22C.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:352 -
C:\Users\Admin\AppData\Local\Temp\F289.tmp"C:\Users\Admin\AppData\Local\Temp\F289.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:376 -
C:\Users\Admin\AppData\Local\Temp\F2C8.tmp"C:\Users\Admin\AppData\Local\Temp\F2C8.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\F344.tmp"C:\Users\Admin\AppData\Local\Temp\F344.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\F3B2.tmp"C:\Users\Admin\AppData\Local\Temp\F3B2.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:592 -
C:\Users\Admin\AppData\Local\Temp\F40F.tmp"C:\Users\Admin\AppData\Local\Temp\F40F.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\F47C.tmp"C:\Users\Admin\AppData\Local\Temp\F47C.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\F4DA.tmp"C:\Users\Admin\AppData\Local\Temp\F4DA.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\F518.tmp"C:\Users\Admin\AppData\Local\Temp\F518.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\F557.tmp"C:\Users\Admin\AppData\Local\Temp\F557.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\F595.tmp"C:\Users\Admin\AppData\Local\Temp\F595.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\F5D4.tmp"C:\Users\Admin\AppData\Local\Temp\F5D4.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\F622.tmp"C:\Users\Admin\AppData\Local\Temp\F622.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\F660.tmp"C:\Users\Admin\AppData\Local\Temp\F660.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\F69E.tmp"C:\Users\Admin\AppData\Local\Temp\F69E.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\F6DD.tmp"C:\Users\Admin\AppData\Local\Temp\F6DD.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:848 -
C:\Users\Admin\AppData\Local\Temp\F71B.tmp"C:\Users\Admin\AppData\Local\Temp\F71B.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\F75A.tmp"C:\Users\Admin\AppData\Local\Temp\F75A.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\F798.tmp"C:\Users\Admin\AppData\Local\Temp\F798.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:960 -
C:\Users\Admin\AppData\Local\Temp\F7D6.tmp"C:\Users\Admin\AppData\Local\Temp\F7D6.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\F824.tmp"C:\Users\Admin\AppData\Local\Temp\F824.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\F872.tmp"C:\Users\Admin\AppData\Local\Temp\F872.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\F8B1.tmp"C:\Users\Admin\AppData\Local\Temp\F8B1.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\F8FF.tmp"C:\Users\Admin\AppData\Local\Temp\F8FF.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\F94D.tmp"C:\Users\Admin\AppData\Local\Temp\F94D.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\F98B.tmp"C:\Users\Admin\AppData\Local\Temp\F98B.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:624 -
C:\Users\Admin\AppData\Local\Temp\F9CA.tmp"C:\Users\Admin\AppData\Local\Temp\F9CA.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\FA08.tmp"C:\Users\Admin\AppData\Local\Temp\FA08.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\FA46.tmp"C:\Users\Admin\AppData\Local\Temp\FA46.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\FA85.tmp"C:\Users\Admin\AppData\Local\Temp\FA85.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\FAC3.tmp"C:\Users\Admin\AppData\Local\Temp\FAC3.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\FB02.tmp"C:\Users\Admin\AppData\Local\Temp\FB02.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\FB40.tmp"C:\Users\Admin\AppData\Local\Temp\FB40.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\FB7E.tmp"C:\Users\Admin\AppData\Local\Temp\FB7E.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\FBBD.tmp"C:\Users\Admin\AppData\Local\Temp\FBBD.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\FBFB.tmp"C:\Users\Admin\AppData\Local\Temp\FBFB.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\FC49.tmp"C:\Users\Admin\AppData\Local\Temp\FC49.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\FC88.tmp"C:\Users\Admin\AppData\Local\Temp\FC88.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\FCD6.tmp"C:\Users\Admin\AppData\Local\Temp\FCD6.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\FD14.tmp"C:\Users\Admin\AppData\Local\Temp\FD14.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\FD62.tmp"C:\Users\Admin\AppData\Local\Temp\FD62.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\FDA0.tmp"C:\Users\Admin\AppData\Local\Temp\FDA0.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\FDEE.tmp"C:\Users\Admin\AppData\Local\Temp\FDEE.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\FE2D.tmp"C:\Users\Admin\AppData\Local\Temp\FE2D.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\FE6B.tmp"C:\Users\Admin\AppData\Local\Temp\FE6B.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\FEB9.tmp"C:\Users\Admin\AppData\Local\Temp\FEB9.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\FEF8.tmp"C:\Users\Admin\AppData\Local\Temp\FEF8.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\FF46.tmp"C:\Users\Admin\AppData\Local\Temp\FF46.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\FFA3.tmp"C:\Users\Admin\AppData\Local\Temp\FFA3.tmp"65⤵
- Executes dropped EXE
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\FFE2.tmp"C:\Users\Admin\AppData\Local\Temp\FFE2.tmp"66⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\30.tmp"C:\Users\Admin\AppData\Local\Temp\30.tmp"67⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\6E.tmp"C:\Users\Admin\AppData\Local\Temp\6E.tmp"68⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\AC.tmp"C:\Users\Admin\AppData\Local\Temp\AC.tmp"69⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\EB.tmp"C:\Users\Admin\AppData\Local\Temp\EB.tmp"70⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\129.tmp"C:\Users\Admin\AppData\Local\Temp\129.tmp"71⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\168.tmp"C:\Users\Admin\AppData\Local\Temp\168.tmp"72⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\1B6.tmp"C:\Users\Admin\AppData\Local\Temp\1B6.tmp"73⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\1F4.tmp"C:\Users\Admin\AppData\Local\Temp\1F4.tmp"74⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\232.tmp"C:\Users\Admin\AppData\Local\Temp\232.tmp"75⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\271.tmp"C:\Users\Admin\AppData\Local\Temp\271.tmp"76⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\2AF.tmp"C:\Users\Admin\AppData\Local\Temp\2AF.tmp"77⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\2EE.tmp"C:\Users\Admin\AppData\Local\Temp\2EE.tmp"78⤵PID:352
-
C:\Users\Admin\AppData\Local\Temp\33C.tmp"C:\Users\Admin\AppData\Local\Temp\33C.tmp"79⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\37A.tmp"C:\Users\Admin\AppData\Local\Temp\37A.tmp"80⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\3B8.tmp"C:\Users\Admin\AppData\Local\Temp\3B8.tmp"81⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\3F7.tmp"C:\Users\Admin\AppData\Local\Temp\3F7.tmp"82⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\445.tmp"C:\Users\Admin\AppData\Local\Temp\445.tmp"83⤵PID:604
-
C:\Users\Admin\AppData\Local\Temp\483.tmp"C:\Users\Admin\AppData\Local\Temp\483.tmp"84⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\4D1.tmp"C:\Users\Admin\AppData\Local\Temp\4D1.tmp"85⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\510.tmp"C:\Users\Admin\AppData\Local\Temp\510.tmp"86⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\55E.tmp"C:\Users\Admin\AppData\Local\Temp\55E.tmp"87⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\59C.tmp"C:\Users\Admin\AppData\Local\Temp\59C.tmp"88⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\5EA.tmp"C:\Users\Admin\AppData\Local\Temp\5EA.tmp"89⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\638.tmp"C:\Users\Admin\AppData\Local\Temp\638.tmp"90⤵PID:236
-
C:\Users\Admin\AppData\Local\Temp\676.tmp"C:\Users\Admin\AppData\Local\Temp\676.tmp"91⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\6B5.tmp"C:\Users\Admin\AppData\Local\Temp\6B5.tmp"92⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\703.tmp"C:\Users\Admin\AppData\Local\Temp\703.tmp"93⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\741.tmp"C:\Users\Admin\AppData\Local\Temp\741.tmp"94⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\780.tmp"C:\Users\Admin\AppData\Local\Temp\780.tmp"95⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\7BE.tmp"C:\Users\Admin\AppData\Local\Temp\7BE.tmp"96⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\7FC.tmp"C:\Users\Admin\AppData\Local\Temp\7FC.tmp"97⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\84A.tmp"C:\Users\Admin\AppData\Local\Temp\84A.tmp"98⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\889.tmp"C:\Users\Admin\AppData\Local\Temp\889.tmp"99⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\8C7.tmp"C:\Users\Admin\AppData\Local\Temp\8C7.tmp"100⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\906.tmp"C:\Users\Admin\AppData\Local\Temp\906.tmp"101⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\944.tmp"C:\Users\Admin\AppData\Local\Temp\944.tmp"102⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\992.tmp"C:\Users\Admin\AppData\Local\Temp\992.tmp"103⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\9D0.tmp"C:\Users\Admin\AppData\Local\Temp\9D0.tmp"104⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\A0F.tmp"C:\Users\Admin\AppData\Local\Temp\A0F.tmp"105⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\A4D.tmp"C:\Users\Admin\AppData\Local\Temp\A4D.tmp"106⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\A9B.tmp"C:\Users\Admin\AppData\Local\Temp\A9B.tmp"107⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\ADA.tmp"C:\Users\Admin\AppData\Local\Temp\ADA.tmp"108⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\B18.tmp"C:\Users\Admin\AppData\Local\Temp\B18.tmp"109⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\B56.tmp"C:\Users\Admin\AppData\Local\Temp\B56.tmp"110⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\B95.tmp"C:\Users\Admin\AppData\Local\Temp\B95.tmp"111⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\BE3.tmp"C:\Users\Admin\AppData\Local\Temp\BE3.tmp"112⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\C21.tmp"C:\Users\Admin\AppData\Local\Temp\C21.tmp"113⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\C60.tmp"C:\Users\Admin\AppData\Local\Temp\C60.tmp"114⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\C9E.tmp"C:\Users\Admin\AppData\Local\Temp\C9E.tmp"115⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\CDC.tmp"C:\Users\Admin\AppData\Local\Temp\CDC.tmp"116⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\D1B.tmp"C:\Users\Admin\AppData\Local\Temp\D1B.tmp"117⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\D59.tmp"C:\Users\Admin\AppData\Local\Temp\D59.tmp"118⤵
- System Location Discovery: System Language Discovery
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\D98.tmp"C:\Users\Admin\AppData\Local\Temp\D98.tmp"119⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\DD6.tmp"C:\Users\Admin\AppData\Local\Temp\DD6.tmp"120⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\E14.tmp"C:\Users\Admin\AppData\Local\Temp\E14.tmp"121⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\E53.tmp"C:\Users\Admin\AppData\Local\Temp\E53.tmp"122⤵PID:2784
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-