Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13-09-2024 06:42
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-13_1de8355e89f6d22bf6c6d98ac2a70a52_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-13_1de8355e89f6d22bf6c6d98ac2a70a52_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-13_1de8355e89f6d22bf6c6d98ac2a70a52_mafia.exe
-
Size
765KB
-
MD5
1de8355e89f6d22bf6c6d98ac2a70a52
-
SHA1
f87c4710f267645dcc987bfb1870c46afd5336d2
-
SHA256
2a97bb3dade3037933ba84e9b6c5ef6b2544ee7ec686637146f22fa1fc3e5f52
-
SHA512
66f90adb46ee0d2a8a739ff5bf7c10591824a763f54c799731b9d4a21f5c1292013b71fdf840aa809125e18043e40704ab63c8afd44c2944120909da9b364760
-
SSDEEP
12288:ZU5rHTeDDys9AJSHtIu8fAh0YvZF5Hn+riOaz4E5p5AHYBfI:ZUxYD+4LvhHvvlHOaMEXSV
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2628 C7C2.tmp 2980 C84E.tmp 680 C8BB.tmp 2812 C929.tmp 3032 C967.tmp 2748 CA03.tmp 2744 CA8F.tmp 2668 CB0C.tmp 2788 CB79.tmp 2680 CBF6.tmp 2716 CC63.tmp 2608 CCD1.tmp 2968 CD4D.tmp 872 CDDA.tmp 1636 CE47.tmp 1868 CEB4.tmp 2328 CF41.tmp 316 CFCD.tmp 2500 D04A.tmp 2008 D0D6.tmp 1732 D143.tmp 1884 D1C0.tmp 1920 D21E.tmp 668 D25C.tmp 1848 D2AA.tmp 2612 D2E9.tmp 1844 D337.tmp 572 D385.tmp 2844 D3C3.tmp 2376 D401.tmp 1924 D44F.tmp 1180 D48E.tmp 484 D4CC.tmp 2432 D50B.tmp 980 D549.tmp 948 D587.tmp 2220 D5D5.tmp 1660 D614.tmp 1676 D652.tmp 964 D6A0.tmp 1572 D6DF.tmp 1424 D72D.tmp 280 D76B.tmp 2224 D7A9.tmp 2504 D7E8.tmp 1516 D826.tmp 2372 D874.tmp 2868 D8B3.tmp 1472 D8F1.tmp 1796 D92F.tmp 2184 D96E.tmp 1656 DA19.tmp 2908 DA67.tmp 2072 DAA6.tmp 2980 DB03.tmp 2852 DB51.tmp 3004 DB90.tmp 792 DBCE.tmp 2740 DC0D.tmp 2772 DC4B.tmp 2780 DC89.tmp 2824 DCD7.tmp 2704 DD16.tmp 2720 DD54.tmp -
Loads dropped DLL 64 IoCs
pid Process 2204 2024-09-13_1de8355e89f6d22bf6c6d98ac2a70a52_mafia.exe 2628 C7C2.tmp 2980 C84E.tmp 680 C8BB.tmp 2812 C929.tmp 3032 C967.tmp 2748 CA03.tmp 2744 CA8F.tmp 2668 CB0C.tmp 2788 CB79.tmp 2680 CBF6.tmp 2716 CC63.tmp 2608 CCD1.tmp 2968 CD4D.tmp 872 CDDA.tmp 1636 CE47.tmp 1868 CEB4.tmp 2328 CF41.tmp 316 CFCD.tmp 2500 D04A.tmp 2008 D0D6.tmp 1732 D143.tmp 1884 D1C0.tmp 1920 D21E.tmp 668 D25C.tmp 1848 D2AA.tmp 2612 D2E9.tmp 1844 D337.tmp 572 D385.tmp 2844 D3C3.tmp 2376 D401.tmp 1924 D44F.tmp 1180 D48E.tmp 484 D4CC.tmp 2432 D50B.tmp 980 D549.tmp 948 D587.tmp 2220 D5D5.tmp 1660 D614.tmp 1676 D652.tmp 964 D6A0.tmp 1572 D6DF.tmp 1424 D72D.tmp 280 D76B.tmp 2224 D7A9.tmp 2504 D7E8.tmp 1516 D826.tmp 2372 D874.tmp 2868 D8B3.tmp 1472 D8F1.tmp 1796 D92F.tmp 2916 D9AC.tmp 1656 DA19.tmp 2908 DA67.tmp 2072 DAA6.tmp 2980 DB03.tmp 2852 DB51.tmp 3004 DB90.tmp 792 DBCE.tmp 2740 DC0D.tmp 2772 DC4B.tmp 2780 DC89.tmp 2824 DCD7.tmp 2704 DD16.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D21E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E485.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBCC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2349.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB2D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E64A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A479.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9933.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C294.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F392.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-09-13_1de8355e89f6d22bf6c6d98ac2a70a52_mafia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8594.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A66D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D92F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1111.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9260.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2204 wrote to memory of 2628 2204 2024-09-13_1de8355e89f6d22bf6c6d98ac2a70a52_mafia.exe 30 PID 2204 wrote to memory of 2628 2204 2024-09-13_1de8355e89f6d22bf6c6d98ac2a70a52_mafia.exe 30 PID 2204 wrote to memory of 2628 2204 2024-09-13_1de8355e89f6d22bf6c6d98ac2a70a52_mafia.exe 30 PID 2204 wrote to memory of 2628 2204 2024-09-13_1de8355e89f6d22bf6c6d98ac2a70a52_mafia.exe 30 PID 2628 wrote to memory of 2980 2628 C7C2.tmp 31 PID 2628 wrote to memory of 2980 2628 C7C2.tmp 31 PID 2628 wrote to memory of 2980 2628 C7C2.tmp 31 PID 2628 wrote to memory of 2980 2628 C7C2.tmp 31 PID 2980 wrote to memory of 680 2980 C84E.tmp 32 PID 2980 wrote to memory of 680 2980 C84E.tmp 32 PID 2980 wrote to memory of 680 2980 C84E.tmp 32 PID 2980 wrote to memory of 680 2980 C84E.tmp 32 PID 680 wrote to memory of 2812 680 C8BB.tmp 34 PID 680 wrote to memory of 2812 680 C8BB.tmp 34 PID 680 wrote to memory of 2812 680 C8BB.tmp 34 PID 680 wrote to memory of 2812 680 C8BB.tmp 34 PID 2812 wrote to memory of 3032 2812 C929.tmp 35 PID 2812 wrote to memory of 3032 2812 C929.tmp 35 PID 2812 wrote to memory of 3032 2812 C929.tmp 35 PID 2812 wrote to memory of 3032 2812 C929.tmp 35 PID 3032 wrote to memory of 2748 3032 C967.tmp 36 PID 3032 wrote to memory of 2748 3032 C967.tmp 36 PID 3032 wrote to memory of 2748 3032 C967.tmp 36 PID 3032 wrote to memory of 2748 3032 C967.tmp 36 PID 2748 wrote to memory of 2744 2748 CA03.tmp 37 PID 2748 wrote to memory of 2744 2748 CA03.tmp 37 PID 2748 wrote to memory of 2744 2748 CA03.tmp 37 PID 2748 wrote to memory of 2744 2748 CA03.tmp 37 PID 2744 wrote to memory of 2668 2744 CA8F.tmp 38 PID 2744 wrote to memory of 2668 2744 CA8F.tmp 38 PID 2744 wrote to memory of 2668 2744 CA8F.tmp 38 PID 2744 wrote to memory of 2668 2744 CA8F.tmp 38 PID 2668 wrote to memory of 2788 2668 CB0C.tmp 39 PID 2668 wrote to memory of 2788 2668 CB0C.tmp 39 PID 2668 wrote to memory of 2788 2668 CB0C.tmp 39 PID 2668 wrote to memory of 2788 2668 CB0C.tmp 39 PID 2788 wrote to memory of 2680 2788 CB79.tmp 40 PID 2788 wrote to memory of 2680 2788 CB79.tmp 40 PID 2788 wrote to memory of 2680 2788 CB79.tmp 40 PID 2788 wrote to memory of 2680 2788 CB79.tmp 40 PID 2680 wrote to memory of 2716 2680 CBF6.tmp 41 PID 2680 wrote to memory of 2716 2680 CBF6.tmp 41 PID 2680 wrote to memory of 2716 2680 CBF6.tmp 41 PID 2680 wrote to memory of 2716 2680 CBF6.tmp 41 PID 2716 wrote to memory of 2608 2716 CC63.tmp 42 PID 2716 wrote to memory of 2608 2716 CC63.tmp 42 PID 2716 wrote to memory of 2608 2716 CC63.tmp 42 PID 2716 wrote to memory of 2608 2716 CC63.tmp 42 PID 2608 wrote to memory of 2968 2608 CCD1.tmp 43 PID 2608 wrote to memory of 2968 2608 CCD1.tmp 43 PID 2608 wrote to memory of 2968 2608 CCD1.tmp 43 PID 2608 wrote to memory of 2968 2608 CCD1.tmp 43 PID 2968 wrote to memory of 872 2968 CD4D.tmp 44 PID 2968 wrote to memory of 872 2968 CD4D.tmp 44 PID 2968 wrote to memory of 872 2968 CD4D.tmp 44 PID 2968 wrote to memory of 872 2968 CD4D.tmp 44 PID 872 wrote to memory of 1636 872 CDDA.tmp 45 PID 872 wrote to memory of 1636 872 CDDA.tmp 45 PID 872 wrote to memory of 1636 872 CDDA.tmp 45 PID 872 wrote to memory of 1636 872 CDDA.tmp 45 PID 1636 wrote to memory of 1868 1636 CE47.tmp 46 PID 1636 wrote to memory of 1868 1636 CE47.tmp 46 PID 1636 wrote to memory of 1868 1636 CE47.tmp 46 PID 1636 wrote to memory of 1868 1636 CE47.tmp 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_1de8355e89f6d22bf6c6d98ac2a70a52_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-13_1de8355e89f6d22bf6c6d98ac2a70a52_mafia.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\C7C2.tmp"C:\Users\Admin\AppData\Local\Temp\C7C2.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\C84E.tmp"C:\Users\Admin\AppData\Local\Temp\C84E.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\C8BB.tmp"C:\Users\Admin\AppData\Local\Temp\C8BB.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Users\Admin\AppData\Local\Temp\C929.tmp"C:\Users\Admin\AppData\Local\Temp\C929.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\C967.tmp"C:\Users\Admin\AppData\Local\Temp\C967.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\CA03.tmp"C:\Users\Admin\AppData\Local\Temp\CA03.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\CA8F.tmp"C:\Users\Admin\AppData\Local\Temp\CA8F.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\CB0C.tmp"C:\Users\Admin\AppData\Local\Temp\CB0C.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\CB79.tmp"C:\Users\Admin\AppData\Local\Temp\CB79.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\CBF6.tmp"C:\Users\Admin\AppData\Local\Temp\CBF6.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\CC63.tmp"C:\Users\Admin\AppData\Local\Temp\CC63.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\CCD1.tmp"C:\Users\Admin\AppData\Local\Temp\CCD1.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\CD4D.tmp"C:\Users\Admin\AppData\Local\Temp\CD4D.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\CDDA.tmp"C:\Users\Admin\AppData\Local\Temp\CDDA.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\AppData\Local\Temp\CE47.tmp"C:\Users\Admin\AppData\Local\Temp\CE47.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\CEB4.tmp"C:\Users\Admin\AppData\Local\Temp\CEB4.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\CF41.tmp"C:\Users\Admin\AppData\Local\Temp\CF41.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\CFCD.tmp"C:\Users\Admin\AppData\Local\Temp\CFCD.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:316 -
C:\Users\Admin\AppData\Local\Temp\D04A.tmp"C:\Users\Admin\AppData\Local\Temp\D04A.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\D0D6.tmp"C:\Users\Admin\AppData\Local\Temp\D0D6.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\D143.tmp"C:\Users\Admin\AppData\Local\Temp\D143.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\D1C0.tmp"C:\Users\Admin\AppData\Local\Temp\D1C0.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\D21E.tmp"C:\Users\Admin\AppData\Local\Temp\D21E.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\D25C.tmp"C:\Users\Admin\AppData\Local\Temp\D25C.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:668 -
C:\Users\Admin\AppData\Local\Temp\D2AA.tmp"C:\Users\Admin\AppData\Local\Temp\D2AA.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\D2E9.tmp"C:\Users\Admin\AppData\Local\Temp\D2E9.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\D337.tmp"C:\Users\Admin\AppData\Local\Temp\D337.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\D385.tmp"C:\Users\Admin\AppData\Local\Temp\D385.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:572 -
C:\Users\Admin\AppData\Local\Temp\D3C3.tmp"C:\Users\Admin\AppData\Local\Temp\D3C3.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\D401.tmp"C:\Users\Admin\AppData\Local\Temp\D401.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\D44F.tmp"C:\Users\Admin\AppData\Local\Temp\D44F.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\D48E.tmp"C:\Users\Admin\AppData\Local\Temp\D48E.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\D4CC.tmp"C:\Users\Admin\AppData\Local\Temp\D4CC.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:484 -
C:\Users\Admin\AppData\Local\Temp\D50B.tmp"C:\Users\Admin\AppData\Local\Temp\D50B.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\D549.tmp"C:\Users\Admin\AppData\Local\Temp\D549.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:980 -
C:\Users\Admin\AppData\Local\Temp\D587.tmp"C:\Users\Admin\AppData\Local\Temp\D587.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:948 -
C:\Users\Admin\AppData\Local\Temp\D5D5.tmp"C:\Users\Admin\AppData\Local\Temp\D5D5.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\D614.tmp"C:\Users\Admin\AppData\Local\Temp\D614.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\D652.tmp"C:\Users\Admin\AppData\Local\Temp\D652.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\D6A0.tmp"C:\Users\Admin\AppData\Local\Temp\D6A0.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:964 -
C:\Users\Admin\AppData\Local\Temp\D6DF.tmp"C:\Users\Admin\AppData\Local\Temp\D6DF.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\D72D.tmp"C:\Users\Admin\AppData\Local\Temp\D72D.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\D76B.tmp"C:\Users\Admin\AppData\Local\Temp\D76B.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:280 -
C:\Users\Admin\AppData\Local\Temp\D7A9.tmp"C:\Users\Admin\AppData\Local\Temp\D7A9.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\D7E8.tmp"C:\Users\Admin\AppData\Local\Temp\D7E8.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\D826.tmp"C:\Users\Admin\AppData\Local\Temp\D826.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\D874.tmp"C:\Users\Admin\AppData\Local\Temp\D874.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\D8B3.tmp"C:\Users\Admin\AppData\Local\Temp\D8B3.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\D8F1.tmp"C:\Users\Admin\AppData\Local\Temp\D8F1.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\D92F.tmp"C:\Users\Admin\AppData\Local\Temp\D92F.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\D96E.tmp"C:\Users\Admin\AppData\Local\Temp\D96E.tmp"52⤵
- Executes dropped EXE
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\D9AC.tmp"C:\Users\Admin\AppData\Local\Temp\D9AC.tmp"53⤵
- Loads dropped DLL
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\DA19.tmp"C:\Users\Admin\AppData\Local\Temp\DA19.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\DA67.tmp"C:\Users\Admin\AppData\Local\Temp\DA67.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\DAA6.tmp"C:\Users\Admin\AppData\Local\Temp\DAA6.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\DB03.tmp"C:\Users\Admin\AppData\Local\Temp\DB03.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\DB51.tmp"C:\Users\Admin\AppData\Local\Temp\DB51.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\DB90.tmp"C:\Users\Admin\AppData\Local\Temp\DB90.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\DBCE.tmp"C:\Users\Admin\AppData\Local\Temp\DBCE.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:792 -
C:\Users\Admin\AppData\Local\Temp\DC0D.tmp"C:\Users\Admin\AppData\Local\Temp\DC0D.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\DC4B.tmp"C:\Users\Admin\AppData\Local\Temp\DC4B.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\DC89.tmp"C:\Users\Admin\AppData\Local\Temp\DC89.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\DCD7.tmp"C:\Users\Admin\AppData\Local\Temp\DCD7.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\DD16.tmp"C:\Users\Admin\AppData\Local\Temp\DD16.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\DD54.tmp"C:\Users\Admin\AppData\Local\Temp\DD54.tmp"66⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\DD93.tmp"C:\Users\Admin\AppData\Local\Temp\DD93.tmp"67⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\DDE1.tmp"C:\Users\Admin\AppData\Local\Temp\DDE1.tmp"68⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\DE1F.tmp"C:\Users\Admin\AppData\Local\Temp\DE1F.tmp"69⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\DE5E.tmp"C:\Users\Admin\AppData\Local\Temp\DE5E.tmp"70⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\DE9C.tmp"C:\Users\Admin\AppData\Local\Temp\DE9C.tmp"71⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\DEEA.tmp"C:\Users\Admin\AppData\Local\Temp\DEEA.tmp"72⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\DF38.tmp"C:\Users\Admin\AppData\Local\Temp\DF38.tmp"73⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\DF76.tmp"C:\Users\Admin\AppData\Local\Temp\DF76.tmp"74⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\DFB5.tmp"C:\Users\Admin\AppData\Local\Temp\DFB5.tmp"75⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\DFF3.tmp"C:\Users\Admin\AppData\Local\Temp\DFF3.tmp"76⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\E041.tmp"C:\Users\Admin\AppData\Local\Temp\E041.tmp"77⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\E080.tmp"C:\Users\Admin\AppData\Local\Temp\E080.tmp"78⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\E0BE.tmp"C:\Users\Admin\AppData\Local\Temp\E0BE.tmp"79⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\E10C.tmp"C:\Users\Admin\AppData\Local\Temp\E10C.tmp"80⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\E14A.tmp"C:\Users\Admin\AppData\Local\Temp\E14A.tmp"81⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\E189.tmp"C:\Users\Admin\AppData\Local\Temp\E189.tmp"82⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\E1D7.tmp"C:\Users\Admin\AppData\Local\Temp\E1D7.tmp"83⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\E225.tmp"C:\Users\Admin\AppData\Local\Temp\E225.tmp"84⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\E263.tmp"C:\Users\Admin\AppData\Local\Temp\E263.tmp"85⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\E2A2.tmp"C:\Users\Admin\AppData\Local\Temp\E2A2.tmp"86⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\E2E0.tmp"C:\Users\Admin\AppData\Local\Temp\E2E0.tmp"87⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\E32E.tmp"C:\Users\Admin\AppData\Local\Temp\E32E.tmp"88⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\E36C.tmp"C:\Users\Admin\AppData\Local\Temp\E36C.tmp"89⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\E3AB.tmp"C:\Users\Admin\AppData\Local\Temp\E3AB.tmp"90⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\E3F9.tmp"C:\Users\Admin\AppData\Local\Temp\E3F9.tmp"91⤵
- System Location Discovery: System Language Discovery
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\E437.tmp"C:\Users\Admin\AppData\Local\Temp\E437.tmp"92⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\E485.tmp"C:\Users\Admin\AppData\Local\Temp\E485.tmp"93⤵
- System Location Discovery: System Language Discovery
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\E4C4.tmp"C:\Users\Admin\AppData\Local\Temp\E4C4.tmp"94⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\E512.tmp"C:\Users\Admin\AppData\Local\Temp\E512.tmp"95⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\E550.tmp"C:\Users\Admin\AppData\Local\Temp\E550.tmp"96⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\E58E.tmp"C:\Users\Admin\AppData\Local\Temp\E58E.tmp"97⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\E5CD.tmp"C:\Users\Admin\AppData\Local\Temp\E5CD.tmp"98⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\E60B.tmp"C:\Users\Admin\AppData\Local\Temp\E60B.tmp"99⤵PID:328
-
C:\Users\Admin\AppData\Local\Temp\E64A.tmp"C:\Users\Admin\AppData\Local\Temp\E64A.tmp"100⤵
- System Location Discovery: System Language Discovery
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\E698.tmp"C:\Users\Admin\AppData\Local\Temp\E698.tmp"101⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\E6D6.tmp"C:\Users\Admin\AppData\Local\Temp\E6D6.tmp"102⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\E714.tmp"C:\Users\Admin\AppData\Local\Temp\E714.tmp"103⤵PID:108
-
C:\Users\Admin\AppData\Local\Temp\E762.tmp"C:\Users\Admin\AppData\Local\Temp\E762.tmp"104⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"105⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\E7DF.tmp"C:\Users\Admin\AppData\Local\Temp\E7DF.tmp"106⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\E81E.tmp"C:\Users\Admin\AppData\Local\Temp\E81E.tmp"107⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\E85C.tmp"C:\Users\Admin\AppData\Local\Temp\E85C.tmp"108⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\E89A.tmp"C:\Users\Admin\AppData\Local\Temp\E89A.tmp"109⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"110⤵
- System Location Discovery: System Language Discovery
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\E917.tmp"C:\Users\Admin\AppData\Local\Temp\E917.tmp"111⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\E965.tmp"C:\Users\Admin\AppData\Local\Temp\E965.tmp"112⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\E9A4.tmp"C:\Users\Admin\AppData\Local\Temp\E9A4.tmp"113⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\E9E2.tmp"C:\Users\Admin\AppData\Local\Temp\E9E2.tmp"114⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\EA30.tmp"C:\Users\Admin\AppData\Local\Temp\EA30.tmp"115⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\EA6E.tmp"C:\Users\Admin\AppData\Local\Temp\EA6E.tmp"116⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\EAAD.tmp"C:\Users\Admin\AppData\Local\Temp\EAAD.tmp"117⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\EAEB.tmp"C:\Users\Admin\AppData\Local\Temp\EAEB.tmp"118⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\EB2A.tmp"C:\Users\Admin\AppData\Local\Temp\EB2A.tmp"119⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\EB78.tmp"C:\Users\Admin\AppData\Local\Temp\EB78.tmp"120⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\EBB6.tmp"C:\Users\Admin\AppData\Local\Temp\EBB6.tmp"121⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\EBF4.tmp"C:\Users\Admin\AppData\Local\Temp\EBF4.tmp"122⤵PID:2812
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-