Analysis
-
max time kernel
150s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
27/07/2024, 08:00
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-27_8d9906eb2f522513c6ce41bb6ad2cc70_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-07-27_8d9906eb2f522513c6ce41bb6ad2cc70_mafia.exe
Resource
win10v2004-20240709-en
General
-
Target
2024-07-27_8d9906eb2f522513c6ce41bb6ad2cc70_mafia.exe
-
Size
486KB
-
MD5
8d9906eb2f522513c6ce41bb6ad2cc70
-
SHA1
87c5e6250e7e1c1f1abd168de37ecb260908e63a
-
SHA256
673f049029948dd46f60d7018ea560a972a9a458a24797829c3be0eb06b6367a
-
SHA512
1963232c339fe0acb8825342e2ea9ba004dd2ebbbd1dee3286236c4fcb0705d40c588633746c06070e1bf1ca1b4d79e262e6911299fe00cb9c02e839e4ad1cdb
-
SSDEEP
12288:/U5rCOTeiDOlGP9rIxqUOkJCoHz7w7H85NZ:/UQOJDOl1qUOkooT7L5N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2408 2694.tmp 2320 279D.tmp 2780 2896.tmp 2864 2980.tmp 2896 2AD8.tmp 2748 2BA2.tmp 2904 2C5E.tmp 2796 2D28.tmp 2644 2E03.tmp 2708 2EFC.tmp 1308 2FB8.tmp 2916 3092.tmp 2132 313E.tmp 2384 31F9.tmp 3028 32B4.tmp 2620 3350.tmp 2948 33CD.tmp 3008 3469.tmp 564 34E6.tmp 2276 35A1.tmp 1396 362D.tmp 1712 3708.tmp 840 37D2.tmp 656 3D8D.tmp 3052 401C.tmp 2464 42BB.tmp 2184 4328.tmp 2420 43A5.tmp 2240 4422.tmp 752 449E.tmp 1988 44FC.tmp 852 4569.tmp 2548 45E6.tmp 1940 4663.tmp 2180 46E0.tmp 2540 474D.tmp 236 47BA.tmp 2260 4846.tmp 1532 48D3.tmp 1664 4940.tmp 1100 49BD.tmp 1936 4A3A.tmp 1140 4AB6.tmp 948 4B24.tmp 732 4B91.tmp 2712 4BEF.tmp 2128 4C5C.tmp 1672 4CB9.tmp 2140 4D36.tmp 868 4DB3.tmp 1636 4E20.tmp 1556 4E8D.tmp 1580 4EFB.tmp 2828 4F77.tmp 2408 4FF4.tmp 2760 5081.tmp 2840 50EE.tmp 2860 515B.tmp 2868 51D8.tmp 2900 5255.tmp 2812 52D1.tmp 2932 534E.tmp 2104 53BB.tmp 2904 5429.tmp -
Loads dropped DLL 64 IoCs
pid Process 560 2024-07-27_8d9906eb2f522513c6ce41bb6ad2cc70_mafia.exe 2408 2694.tmp 2320 279D.tmp 2780 2896.tmp 2864 2980.tmp 2896 2AD8.tmp 2748 2BA2.tmp 2904 2C5E.tmp 2796 2D28.tmp 2644 2E03.tmp 2708 2EFC.tmp 1308 2FB8.tmp 2916 3092.tmp 2132 313E.tmp 2384 31F9.tmp 3028 32B4.tmp 2620 3350.tmp 2948 33CD.tmp 3008 3469.tmp 564 34E6.tmp 2276 35A1.tmp 1396 362D.tmp 1712 3708.tmp 840 37D2.tmp 656 3D8D.tmp 3052 401C.tmp 2464 42BB.tmp 2184 4328.tmp 2420 43A5.tmp 2240 4422.tmp 752 449E.tmp 1988 44FC.tmp 852 4569.tmp 2548 45E6.tmp 1940 4663.tmp 2180 46E0.tmp 2540 474D.tmp 236 47BA.tmp 2260 4846.tmp 1532 48D3.tmp 1664 4940.tmp 1100 49BD.tmp 1936 4A3A.tmp 1140 4AB6.tmp 948 4B24.tmp 732 4B91.tmp 2712 4BEF.tmp 2128 4C5C.tmp 1672 4CB9.tmp 2140 4D36.tmp 868 4DB3.tmp 1636 4E20.tmp 1556 4E8D.tmp 1580 4EFB.tmp 2828 4F77.tmp 2408 4FF4.tmp 2760 5081.tmp 2840 50EE.tmp 2860 515B.tmp 2868 51D8.tmp 2900 5255.tmp 2812 52D1.tmp 2932 534E.tmp 2104 53BB.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A87F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2185.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E42.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E234.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3256.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8150.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B76.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3092.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E31E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E9B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C77.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C65C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FA2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7742.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D328.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8009.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C294.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 787A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A593.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D460.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C938.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D9AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F096.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 401C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7291.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 904E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB0E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5429.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA56.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5486.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DD0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9453.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 707F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9FA9.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 560 wrote to memory of 2408 560 2024-07-27_8d9906eb2f522513c6ce41bb6ad2cc70_mafia.exe 29 PID 560 wrote to memory of 2408 560 2024-07-27_8d9906eb2f522513c6ce41bb6ad2cc70_mafia.exe 29 PID 560 wrote to memory of 2408 560 2024-07-27_8d9906eb2f522513c6ce41bb6ad2cc70_mafia.exe 29 PID 560 wrote to memory of 2408 560 2024-07-27_8d9906eb2f522513c6ce41bb6ad2cc70_mafia.exe 29 PID 2408 wrote to memory of 2320 2408 2694.tmp 30 PID 2408 wrote to memory of 2320 2408 2694.tmp 30 PID 2408 wrote to memory of 2320 2408 2694.tmp 30 PID 2408 wrote to memory of 2320 2408 2694.tmp 30 PID 2320 wrote to memory of 2780 2320 279D.tmp 31 PID 2320 wrote to memory of 2780 2320 279D.tmp 31 PID 2320 wrote to memory of 2780 2320 279D.tmp 31 PID 2320 wrote to memory of 2780 2320 279D.tmp 31 PID 2780 wrote to memory of 2864 2780 2896.tmp 32 PID 2780 wrote to memory of 2864 2780 2896.tmp 32 PID 2780 wrote to memory of 2864 2780 2896.tmp 32 PID 2780 wrote to memory of 2864 2780 2896.tmp 32 PID 2864 wrote to memory of 2896 2864 2980.tmp 33 PID 2864 wrote to memory of 2896 2864 2980.tmp 33 PID 2864 wrote to memory of 2896 2864 2980.tmp 33 PID 2864 wrote to memory of 2896 2864 2980.tmp 33 PID 2896 wrote to memory of 2748 2896 2AD8.tmp 34 PID 2896 wrote to memory of 2748 2896 2AD8.tmp 34 PID 2896 wrote to memory of 2748 2896 2AD8.tmp 34 PID 2896 wrote to memory of 2748 2896 2AD8.tmp 34 PID 2748 wrote to memory of 2904 2748 2BA2.tmp 35 PID 2748 wrote to memory of 2904 2748 2BA2.tmp 35 PID 2748 wrote to memory of 2904 2748 2BA2.tmp 35 PID 2748 wrote to memory of 2904 2748 2BA2.tmp 35 PID 2904 wrote to memory of 2796 2904 2C5E.tmp 36 PID 2904 wrote to memory of 2796 2904 2C5E.tmp 36 PID 2904 wrote to memory of 2796 2904 2C5E.tmp 36 PID 2904 wrote to memory of 2796 2904 2C5E.tmp 36 PID 2796 wrote to memory of 2644 2796 2D28.tmp 37 PID 2796 wrote to memory of 2644 2796 2D28.tmp 37 PID 2796 wrote to memory of 2644 2796 2D28.tmp 37 PID 2796 wrote to memory of 2644 2796 2D28.tmp 37 PID 2644 wrote to memory of 2708 2644 2E03.tmp 38 PID 2644 wrote to memory of 2708 2644 2E03.tmp 38 PID 2644 wrote to memory of 2708 2644 2E03.tmp 38 PID 2644 wrote to memory of 2708 2644 2E03.tmp 38 PID 2708 wrote to memory of 1308 2708 2EFC.tmp 39 PID 2708 wrote to memory of 1308 2708 2EFC.tmp 39 PID 2708 wrote to memory of 1308 2708 2EFC.tmp 39 PID 2708 wrote to memory of 1308 2708 2EFC.tmp 39 PID 1308 wrote to memory of 2916 1308 2FB8.tmp 40 PID 1308 wrote to memory of 2916 1308 2FB8.tmp 40 PID 1308 wrote to memory of 2916 1308 2FB8.tmp 40 PID 1308 wrote to memory of 2916 1308 2FB8.tmp 40 PID 2916 wrote to memory of 2132 2916 3092.tmp 41 PID 2916 wrote to memory of 2132 2916 3092.tmp 41 PID 2916 wrote to memory of 2132 2916 3092.tmp 41 PID 2916 wrote to memory of 2132 2916 3092.tmp 41 PID 2132 wrote to memory of 2384 2132 313E.tmp 42 PID 2132 wrote to memory of 2384 2132 313E.tmp 42 PID 2132 wrote to memory of 2384 2132 313E.tmp 42 PID 2132 wrote to memory of 2384 2132 313E.tmp 42 PID 2384 wrote to memory of 3028 2384 31F9.tmp 43 PID 2384 wrote to memory of 3028 2384 31F9.tmp 43 PID 2384 wrote to memory of 3028 2384 31F9.tmp 43 PID 2384 wrote to memory of 3028 2384 31F9.tmp 43 PID 3028 wrote to memory of 2620 3028 32B4.tmp 44 PID 3028 wrote to memory of 2620 3028 32B4.tmp 44 PID 3028 wrote to memory of 2620 3028 32B4.tmp 44 PID 3028 wrote to memory of 2620 3028 32B4.tmp 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-27_8d9906eb2f522513c6ce41bb6ad2cc70_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-27_8d9906eb2f522513c6ce41bb6ad2cc70_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Users\Admin\AppData\Local\Temp\2694.tmp"C:\Users\Admin\AppData\Local\Temp\2694.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\279D.tmp"C:\Users\Admin\AppData\Local\Temp\279D.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\2896.tmp"C:\Users\Admin\AppData\Local\Temp\2896.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\2980.tmp"C:\Users\Admin\AppData\Local\Temp\2980.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\2D28.tmp"C:\Users\Admin\AppData\Local\Temp\2D28.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\2E03.tmp"C:\Users\Admin\AppData\Local\Temp\2E03.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\3092.tmp"C:\Users\Admin\AppData\Local\Temp\3092.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\313E.tmp"C:\Users\Admin\AppData\Local\Temp\313E.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\31F9.tmp"C:\Users\Admin\AppData\Local\Temp\31F9.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\32B4.tmp"C:\Users\Admin\AppData\Local\Temp\32B4.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\3350.tmp"C:\Users\Admin\AppData\Local\Temp\3350.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\33CD.tmp"C:\Users\Admin\AppData\Local\Temp\33CD.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\3469.tmp"C:\Users\Admin\AppData\Local\Temp\3469.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\34E6.tmp"C:\Users\Admin\AppData\Local\Temp\34E6.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:564 -
C:\Users\Admin\AppData\Local\Temp\35A1.tmp"C:\Users\Admin\AppData\Local\Temp\35A1.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\362D.tmp"C:\Users\Admin\AppData\Local\Temp\362D.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\3708.tmp"C:\Users\Admin\AppData\Local\Temp\3708.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\37D2.tmp"C:\Users\Admin\AppData\Local\Temp\37D2.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:840 -
C:\Users\Admin\AppData\Local\Temp\3D8D.tmp"C:\Users\Admin\AppData\Local\Temp\3D8D.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:656 -
C:\Users\Admin\AppData\Local\Temp\401C.tmp"C:\Users\Admin\AppData\Local\Temp\401C.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\42BB.tmp"C:\Users\Admin\AppData\Local\Temp\42BB.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\4328.tmp"C:\Users\Admin\AppData\Local\Temp\4328.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\43A5.tmp"C:\Users\Admin\AppData\Local\Temp\43A5.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\4422.tmp"C:\Users\Admin\AppData\Local\Temp\4422.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\449E.tmp"C:\Users\Admin\AppData\Local\Temp\449E.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:752 -
C:\Users\Admin\AppData\Local\Temp\44FC.tmp"C:\Users\Admin\AppData\Local\Temp\44FC.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\4569.tmp"C:\Users\Admin\AppData\Local\Temp\4569.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:852 -
C:\Users\Admin\AppData\Local\Temp\45E6.tmp"C:\Users\Admin\AppData\Local\Temp\45E6.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\4663.tmp"C:\Users\Admin\AppData\Local\Temp\4663.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\46E0.tmp"C:\Users\Admin\AppData\Local\Temp\46E0.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\474D.tmp"C:\Users\Admin\AppData\Local\Temp\474D.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\47BA.tmp"C:\Users\Admin\AppData\Local\Temp\47BA.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:236 -
C:\Users\Admin\AppData\Local\Temp\4846.tmp"C:\Users\Admin\AppData\Local\Temp\4846.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\48D3.tmp"C:\Users\Admin\AppData\Local\Temp\48D3.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\4940.tmp"C:\Users\Admin\AppData\Local\Temp\4940.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\49BD.tmp"C:\Users\Admin\AppData\Local\Temp\49BD.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\4A3A.tmp"C:\Users\Admin\AppData\Local\Temp\4A3A.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\4AB6.tmp"C:\Users\Admin\AppData\Local\Temp\4AB6.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\4B24.tmp"C:\Users\Admin\AppData\Local\Temp\4B24.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:948 -
C:\Users\Admin\AppData\Local\Temp\4B91.tmp"C:\Users\Admin\AppData\Local\Temp\4B91.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:732 -
C:\Users\Admin\AppData\Local\Temp\4BEF.tmp"C:\Users\Admin\AppData\Local\Temp\4BEF.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\4C5C.tmp"C:\Users\Admin\AppData\Local\Temp\4C5C.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\4CB9.tmp"C:\Users\Admin\AppData\Local\Temp\4CB9.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\4D36.tmp"C:\Users\Admin\AppData\Local\Temp\4D36.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\4DB3.tmp"C:\Users\Admin\AppData\Local\Temp\4DB3.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:868 -
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\4F77.tmp"C:\Users\Admin\AppData\Local\Temp\4F77.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\4FF4.tmp"C:\Users\Admin\AppData\Local\Temp\4FF4.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\5081.tmp"C:\Users\Admin\AppData\Local\Temp\5081.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\50EE.tmp"C:\Users\Admin\AppData\Local\Temp\50EE.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\515B.tmp"C:\Users\Admin\AppData\Local\Temp\515B.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\51D8.tmp"C:\Users\Admin\AppData\Local\Temp\51D8.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\5255.tmp"C:\Users\Admin\AppData\Local\Temp\5255.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\52D1.tmp"C:\Users\Admin\AppData\Local\Temp\52D1.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\534E.tmp"C:\Users\Admin\AppData\Local\Temp\534E.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\53BB.tmp"C:\Users\Admin\AppData\Local\Temp\53BB.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\5429.tmp"C:\Users\Admin\AppData\Local\Temp\5429.tmp"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\54A5.tmp"C:\Users\Admin\AppData\Local\Temp\54A5.tmp"66⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\5522.tmp"C:\Users\Admin\AppData\Local\Temp\5522.tmp"67⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\559F.tmp"C:\Users\Admin\AppData\Local\Temp\559F.tmp"68⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\562B.tmp"C:\Users\Admin\AppData\Local\Temp\562B.tmp"69⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\5B69.tmp"C:\Users\Admin\AppData\Local\Temp\5B69.tmp"70⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\5BF5.tmp"C:\Users\Admin\AppData\Local\Temp\5BF5.tmp"71⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\5CFF.tmp"C:\Users\Admin\AppData\Local\Temp\5CFF.tmp"72⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\5D7B.tmp"C:\Users\Admin\AppData\Local\Temp\5D7B.tmp"73⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\5DF8.tmp"C:\Users\Admin\AppData\Local\Temp\5DF8.tmp"74⤵
- System Location Discovery: System Language Discovery
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\5E75.tmp"C:\Users\Admin\AppData\Local\Temp\5E75.tmp"75⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\5EE2.tmp"C:\Users\Admin\AppData\Local\Temp\5EE2.tmp"76⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\5F4F.tmp"C:\Users\Admin\AppData\Local\Temp\5F4F.tmp"77⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\5FCC.tmp"C:\Users\Admin\AppData\Local\Temp\5FCC.tmp"78⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\6059.tmp"C:\Users\Admin\AppData\Local\Temp\6059.tmp"79⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\60D5.tmp"C:\Users\Admin\AppData\Local\Temp\60D5.tmp"80⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\6152.tmp"C:\Users\Admin\AppData\Local\Temp\6152.tmp"81⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\61CF.tmp"C:\Users\Admin\AppData\Local\Temp\61CF.tmp"82⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\624C.tmp"C:\Users\Admin\AppData\Local\Temp\624C.tmp"83⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\62C9.tmp"C:\Users\Admin\AppData\Local\Temp\62C9.tmp"84⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\6345.tmp"C:\Users\Admin\AppData\Local\Temp\6345.tmp"85⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\63B3.tmp"C:\Users\Admin\AppData\Local\Temp\63B3.tmp"86⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\642F.tmp"C:\Users\Admin\AppData\Local\Temp\642F.tmp"87⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\649D.tmp"C:\Users\Admin\AppData\Local\Temp\649D.tmp"88⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\6519.tmp"C:\Users\Admin\AppData\Local\Temp\6519.tmp"89⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\6587.tmp"C:\Users\Admin\AppData\Local\Temp\6587.tmp"90⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\65F4.tmp"C:\Users\Admin\AppData\Local\Temp\65F4.tmp"91⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\6661.tmp"C:\Users\Admin\AppData\Local\Temp\6661.tmp"92⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\66CE.tmp"C:\Users\Admin\AppData\Local\Temp\66CE.tmp"93⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\673B.tmp"C:\Users\Admin\AppData\Local\Temp\673B.tmp"94⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\67B8.tmp"C:\Users\Admin\AppData\Local\Temp\67B8.tmp"95⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\6825.tmp"C:\Users\Admin\AppData\Local\Temp\6825.tmp"96⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\68A2.tmp"C:\Users\Admin\AppData\Local\Temp\68A2.tmp"97⤵
- System Location Discovery: System Language Discovery
PID:876 -
C:\Users\Admin\AppData\Local\Temp\691F.tmp"C:\Users\Admin\AppData\Local\Temp\691F.tmp"98⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\699C.tmp"C:\Users\Admin\AppData\Local\Temp\699C.tmp"99⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\6A19.tmp"C:\Users\Admin\AppData\Local\Temp\6A19.tmp"100⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\6A95.tmp"C:\Users\Admin\AppData\Local\Temp\6A95.tmp"101⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\6AF3.tmp"C:\Users\Admin\AppData\Local\Temp\6AF3.tmp"102⤵PID:236
-
C:\Users\Admin\AppData\Local\Temp\6B60.tmp"C:\Users\Admin\AppData\Local\Temp\6B60.tmp"103⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\6BCD.tmp"C:\Users\Admin\AppData\Local\Temp\6BCD.tmp"104⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\6C3B.tmp"C:\Users\Admin\AppData\Local\Temp\6C3B.tmp"105⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\6CA8.tmp"C:\Users\Admin\AppData\Local\Temp\6CA8.tmp"106⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\6D15.tmp"C:\Users\Admin\AppData\Local\Temp\6D15.tmp"107⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\6D82.tmp"C:\Users\Admin\AppData\Local\Temp\6D82.tmp"108⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\6DFF.tmp"C:\Users\Admin\AppData\Local\Temp\6DFF.tmp"109⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\6E7C.tmp"C:\Users\Admin\AppData\Local\Temp\6E7C.tmp"110⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\6EE9.tmp"C:\Users\Admin\AppData\Local\Temp\6EE9.tmp"111⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\6F56.tmp"C:\Users\Admin\AppData\Local\Temp\6F56.tmp"112⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\6FC3.tmp"C:\Users\Admin\AppData\Local\Temp\6FC3.tmp"113⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\7040.tmp"C:\Users\Admin\AppData\Local\Temp\7040.tmp"114⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\7291.tmp"C:\Users\Admin\AppData\Local\Temp\7291.tmp"115⤵
- System Location Discovery: System Language Discovery
PID:868 -
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"116⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\739A.tmp"C:\Users\Admin\AppData\Local\Temp\739A.tmp"117⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\73F8.tmp"C:\Users\Admin\AppData\Local\Temp\73F8.tmp"118⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\7475.tmp"C:\Users\Admin\AppData\Local\Temp\7475.tmp"119⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"120⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\754F.tmp"C:\Users\Admin\AppData\Local\Temp\754F.tmp"121⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\75BC.tmp"C:\Users\Admin\AppData\Local\Temp\75BC.tmp"122⤵PID:2840
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-