Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13/09/2024, 09:29
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-13_f1e4b20457add399860e609f85c24e0b_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-13_f1e4b20457add399860e609f85c24e0b_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-13_f1e4b20457add399860e609f85c24e0b_mafia.exe
-
Size
765KB
-
MD5
f1e4b20457add399860e609f85c24e0b
-
SHA1
71aefda80257f93b8abdc33416632a9f1a2e72a6
-
SHA256
cdee29702c8b38e7206c66d6a57f1f8f2ec00d0d7feac4cfffc162329d6fd2ac
-
SHA512
52ccbcd2d405ba0f360730915337211aee95919c26c4e00f1954c39a578f54c16fdc454a285afbb7d705d956bd254c1974db8b2c87f3728bfe9cb44eed1d456d
-
SSDEEP
12288:ZU5rCOTeiD2tt4vT59vker8mH8GbthkL3ZF5rn5rLOa54U5w5A:ZUQOJD2ttm5tgFkU3vh5Oa+UOS
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1664 C9A5.tmp 2384 C9F3.tmp 2156 CA32.tmp 1824 CA9F.tmp 2716 CAED.tmp 2848 CB4B.tmp 2844 CB89.tmp 2840 CBE7.tmp 2628 CC25.tmp 2772 CC73.tmp 2600 CCB1.tmp 2680 CCFF.tmp 2888 CD3E.tmp 2344 CD7C.tmp 2928 CDBB.tmp 1288 CDF9.tmp 2000 CE37.tmp 1792 CE76.tmp 2692 CEB4.tmp 1628 CEF3.tmp 1592 CF31.tmp 3052 CF6F.tmp 2948 CFAE.tmp 2180 CFEC.tmp 2376 D02B.tmp 2240 D069.tmp 540 D0A7.tmp 1860 D0E6.tmp 1128 D134.tmp 1764 D172.tmp 2808 D1B1.tmp 604 D1EF.tmp 956 D22D.tmp 844 D27B.tmp 1996 D49D.tmp 2004 D4DC.tmp 328 D51A.tmp 1804 D559.tmp 1800 D597.tmp 2264 D5D5.tmp 1036 D614.tmp 2448 D652.tmp 1976 D6BF.tmp 2204 D6FE.tmp 2324 D74C.tmp 1812 D7B9.tmp 1980 D826.tmp 812 D865.tmp 2512 D8B3.tmp 1808 D8F1.tmp 3044 D93F.tmp 1732 D97D.tmp 2392 D9BC.tmp 1720 D9FA.tmp 2384 DA39.tmp 2312 DA77.tmp 2796 DAC5.tmp 2220 DB03.tmp 2788 DB42.tmp 2980 DB90.tmp 2804 DBCE.tmp 2768 DC0D.tmp 2372 DC4B.tmp 2824 DC89.tmp -
Loads dropped DLL 64 IoCs
pid Process 3044 2024-09-13_f1e4b20457add399860e609f85c24e0b_mafia.exe 1664 C9A5.tmp 2384 C9F3.tmp 2156 CA32.tmp 1824 CA9F.tmp 2716 CAED.tmp 2848 CB4B.tmp 2844 CB89.tmp 2840 CBE7.tmp 2628 CC25.tmp 2772 CC73.tmp 2600 CCB1.tmp 2680 CCFF.tmp 2888 CD3E.tmp 2344 CD7C.tmp 2928 CDBB.tmp 1288 CDF9.tmp 2000 CE37.tmp 1792 CE76.tmp 2692 CEB4.tmp 1628 CEF3.tmp 1592 CF31.tmp 3052 CF6F.tmp 2948 CFAE.tmp 2180 CFEC.tmp 2376 D02B.tmp 2240 D069.tmp 540 D0A7.tmp 1860 D0E6.tmp 1128 D134.tmp 1764 D172.tmp 2808 D1B1.tmp 604 D1EF.tmp 956 D22D.tmp 844 D27B.tmp 1996 D49D.tmp 2004 D4DC.tmp 328 D51A.tmp 1804 D559.tmp 1800 D597.tmp 2264 D5D5.tmp 1036 D614.tmp 2448 D652.tmp 1976 D6BF.tmp 2204 D6FE.tmp 2324 D74C.tmp 1812 D7B9.tmp 1980 D826.tmp 812 D865.tmp 2512 D8B3.tmp 1808 D8F1.tmp 3044 D93F.tmp 1732 D97D.tmp 2392 D9BC.tmp 1720 D9FA.tmp 2384 DA39.tmp 2312 DA77.tmp 2796 DAC5.tmp 2220 DB03.tmp 2788 DB42.tmp 2980 DB90.tmp 2804 DBCE.tmp 2768 DC0D.tmp 2372 DC4B.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED8A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1027.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1297.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB73.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1738.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D02B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6326.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B00D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8778.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D76.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6365.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A38F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B348.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A583.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 251D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4173.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C15C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3044 wrote to memory of 1664 3044 2024-09-13_f1e4b20457add399860e609f85c24e0b_mafia.exe 31 PID 3044 wrote to memory of 1664 3044 2024-09-13_f1e4b20457add399860e609f85c24e0b_mafia.exe 31 PID 3044 wrote to memory of 1664 3044 2024-09-13_f1e4b20457add399860e609f85c24e0b_mafia.exe 31 PID 3044 wrote to memory of 1664 3044 2024-09-13_f1e4b20457add399860e609f85c24e0b_mafia.exe 31 PID 1664 wrote to memory of 2384 1664 C9A5.tmp 32 PID 1664 wrote to memory of 2384 1664 C9A5.tmp 32 PID 1664 wrote to memory of 2384 1664 C9A5.tmp 32 PID 1664 wrote to memory of 2384 1664 C9A5.tmp 32 PID 2384 wrote to memory of 2156 2384 C9F3.tmp 33 PID 2384 wrote to memory of 2156 2384 C9F3.tmp 33 PID 2384 wrote to memory of 2156 2384 C9F3.tmp 33 PID 2384 wrote to memory of 2156 2384 C9F3.tmp 33 PID 2156 wrote to memory of 1824 2156 CA32.tmp 34 PID 2156 wrote to memory of 1824 2156 CA32.tmp 34 PID 2156 wrote to memory of 1824 2156 CA32.tmp 34 PID 2156 wrote to memory of 1824 2156 CA32.tmp 34 PID 1824 wrote to memory of 2716 1824 CA9F.tmp 35 PID 1824 wrote to memory of 2716 1824 CA9F.tmp 35 PID 1824 wrote to memory of 2716 1824 CA9F.tmp 35 PID 1824 wrote to memory of 2716 1824 CA9F.tmp 35 PID 2716 wrote to memory of 2848 2716 CAED.tmp 36 PID 2716 wrote to memory of 2848 2716 CAED.tmp 36 PID 2716 wrote to memory of 2848 2716 CAED.tmp 36 PID 2716 wrote to memory of 2848 2716 CAED.tmp 36 PID 2848 wrote to memory of 2844 2848 CB4B.tmp 37 PID 2848 wrote to memory of 2844 2848 CB4B.tmp 37 PID 2848 wrote to memory of 2844 2848 CB4B.tmp 37 PID 2848 wrote to memory of 2844 2848 CB4B.tmp 37 PID 2844 wrote to memory of 2840 2844 CB89.tmp 38 PID 2844 wrote to memory of 2840 2844 CB89.tmp 38 PID 2844 wrote to memory of 2840 2844 CB89.tmp 38 PID 2844 wrote to memory of 2840 2844 CB89.tmp 38 PID 2840 wrote to memory of 2628 2840 CBE7.tmp 39 PID 2840 wrote to memory of 2628 2840 CBE7.tmp 39 PID 2840 wrote to memory of 2628 2840 CBE7.tmp 39 PID 2840 wrote to memory of 2628 2840 CBE7.tmp 39 PID 2628 wrote to memory of 2772 2628 CC25.tmp 40 PID 2628 wrote to memory of 2772 2628 CC25.tmp 40 PID 2628 wrote to memory of 2772 2628 CC25.tmp 40 PID 2628 wrote to memory of 2772 2628 CC25.tmp 40 PID 2772 wrote to memory of 2600 2772 CC73.tmp 41 PID 2772 wrote to memory of 2600 2772 CC73.tmp 41 PID 2772 wrote to memory of 2600 2772 CC73.tmp 41 PID 2772 wrote to memory of 2600 2772 CC73.tmp 41 PID 2600 wrote to memory of 2680 2600 CCB1.tmp 42 PID 2600 wrote to memory of 2680 2600 CCB1.tmp 42 PID 2600 wrote to memory of 2680 2600 CCB1.tmp 42 PID 2600 wrote to memory of 2680 2600 CCB1.tmp 42 PID 2680 wrote to memory of 2888 2680 CCFF.tmp 43 PID 2680 wrote to memory of 2888 2680 CCFF.tmp 43 PID 2680 wrote to memory of 2888 2680 CCFF.tmp 43 PID 2680 wrote to memory of 2888 2680 CCFF.tmp 43 PID 2888 wrote to memory of 2344 2888 CD3E.tmp 44 PID 2888 wrote to memory of 2344 2888 CD3E.tmp 44 PID 2888 wrote to memory of 2344 2888 CD3E.tmp 44 PID 2888 wrote to memory of 2344 2888 CD3E.tmp 44 PID 2344 wrote to memory of 2928 2344 CD7C.tmp 45 PID 2344 wrote to memory of 2928 2344 CD7C.tmp 45 PID 2344 wrote to memory of 2928 2344 CD7C.tmp 45 PID 2344 wrote to memory of 2928 2344 CD7C.tmp 45 PID 2928 wrote to memory of 1288 2928 CDBB.tmp 46 PID 2928 wrote to memory of 1288 2928 CDBB.tmp 46 PID 2928 wrote to memory of 1288 2928 CDBB.tmp 46 PID 2928 wrote to memory of 1288 2928 CDBB.tmp 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_f1e4b20457add399860e609f85c24e0b_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-13_f1e4b20457add399860e609f85c24e0b_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\C9A5.tmp"C:\Users\Admin\AppData\Local\Temp\C9A5.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\C9F3.tmp"C:\Users\Admin\AppData\Local\Temp\C9F3.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\CA32.tmp"C:\Users\Admin\AppData\Local\Temp\CA32.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\CA9F.tmp"C:\Users\Admin\AppData\Local\Temp\CA9F.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\CAED.tmp"C:\Users\Admin\AppData\Local\Temp\CAED.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\CB4B.tmp"C:\Users\Admin\AppData\Local\Temp\CB4B.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\CB89.tmp"C:\Users\Admin\AppData\Local\Temp\CB89.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\CBE7.tmp"C:\Users\Admin\AppData\Local\Temp\CBE7.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\CC25.tmp"C:\Users\Admin\AppData\Local\Temp\CC25.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\CC73.tmp"C:\Users\Admin\AppData\Local\Temp\CC73.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\CCB1.tmp"C:\Users\Admin\AppData\Local\Temp\CCB1.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\CCFF.tmp"C:\Users\Admin\AppData\Local\Temp\CCFF.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\CD3E.tmp"C:\Users\Admin\AppData\Local\Temp\CD3E.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\CDBB.tmp"C:\Users\Admin\AppData\Local\Temp\CDBB.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\CDF9.tmp"C:\Users\Admin\AppData\Local\Temp\CDF9.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\CE37.tmp"C:\Users\Admin\AppData\Local\Temp\CE37.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\CE76.tmp"C:\Users\Admin\AppData\Local\Temp\CE76.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\CEB4.tmp"C:\Users\Admin\AppData\Local\Temp\CEB4.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\CEF3.tmp"C:\Users\Admin\AppData\Local\Temp\CEF3.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\CF31.tmp"C:\Users\Admin\AppData\Local\Temp\CF31.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\CF6F.tmp"C:\Users\Admin\AppData\Local\Temp\CF6F.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\CFAE.tmp"C:\Users\Admin\AppData\Local\Temp\CFAE.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\CFEC.tmp"C:\Users\Admin\AppData\Local\Temp\CFEC.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\D02B.tmp"C:\Users\Admin\AppData\Local\Temp\D02B.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\D069.tmp"C:\Users\Admin\AppData\Local\Temp\D069.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\D0A7.tmp"C:\Users\Admin\AppData\Local\Temp\D0A7.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:540 -
C:\Users\Admin\AppData\Local\Temp\D0E6.tmp"C:\Users\Admin\AppData\Local\Temp\D0E6.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\D134.tmp"C:\Users\Admin\AppData\Local\Temp\D134.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\D172.tmp"C:\Users\Admin\AppData\Local\Temp\D172.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\D1B1.tmp"C:\Users\Admin\AppData\Local\Temp\D1B1.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\D1EF.tmp"C:\Users\Admin\AppData\Local\Temp\D1EF.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:604 -
C:\Users\Admin\AppData\Local\Temp\D22D.tmp"C:\Users\Admin\AppData\Local\Temp\D22D.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:956 -
C:\Users\Admin\AppData\Local\Temp\D27B.tmp"C:\Users\Admin\AppData\Local\Temp\D27B.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:844 -
C:\Users\Admin\AppData\Local\Temp\D49D.tmp"C:\Users\Admin\AppData\Local\Temp\D49D.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\D4DC.tmp"C:\Users\Admin\AppData\Local\Temp\D4DC.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\D51A.tmp"C:\Users\Admin\AppData\Local\Temp\D51A.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:328 -
C:\Users\Admin\AppData\Local\Temp\D559.tmp"C:\Users\Admin\AppData\Local\Temp\D559.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\D597.tmp"C:\Users\Admin\AppData\Local\Temp\D597.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\D5D5.tmp"C:\Users\Admin\AppData\Local\Temp\D5D5.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\D614.tmp"C:\Users\Admin\AppData\Local\Temp\D614.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\D652.tmp"C:\Users\Admin\AppData\Local\Temp\D652.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\D6BF.tmp"C:\Users\Admin\AppData\Local\Temp\D6BF.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\D6FE.tmp"C:\Users\Admin\AppData\Local\Temp\D6FE.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\D74C.tmp"C:\Users\Admin\AppData\Local\Temp\D74C.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\D7B9.tmp"C:\Users\Admin\AppData\Local\Temp\D7B9.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\D826.tmp"C:\Users\Admin\AppData\Local\Temp\D826.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\D865.tmp"C:\Users\Admin\AppData\Local\Temp\D865.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:812 -
C:\Users\Admin\AppData\Local\Temp\D8B3.tmp"C:\Users\Admin\AppData\Local\Temp\D8B3.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\D8F1.tmp"C:\Users\Admin\AppData\Local\Temp\D8F1.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\D93F.tmp"C:\Users\Admin\AppData\Local\Temp\D93F.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\D97D.tmp"C:\Users\Admin\AppData\Local\Temp\D97D.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\D9BC.tmp"C:\Users\Admin\AppData\Local\Temp\D9BC.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\D9FA.tmp"C:\Users\Admin\AppData\Local\Temp\D9FA.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\DA39.tmp"C:\Users\Admin\AppData\Local\Temp\DA39.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\DA77.tmp"C:\Users\Admin\AppData\Local\Temp\DA77.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\DAC5.tmp"C:\Users\Admin\AppData\Local\Temp\DAC5.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\DB03.tmp"C:\Users\Admin\AppData\Local\Temp\DB03.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\DB42.tmp"C:\Users\Admin\AppData\Local\Temp\DB42.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\DB90.tmp"C:\Users\Admin\AppData\Local\Temp\DB90.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\DBCE.tmp"C:\Users\Admin\AppData\Local\Temp\DBCE.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\DC0D.tmp"C:\Users\Admin\AppData\Local\Temp\DC0D.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\DC4B.tmp"C:\Users\Admin\AppData\Local\Temp\DC4B.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\DC89.tmp"C:\Users\Admin\AppData\Local\Temp\DC89.tmp"65⤵
- Executes dropped EXE
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\DCE7.tmp"C:\Users\Admin\AppData\Local\Temp\DCE7.tmp"66⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\DD25.tmp"C:\Users\Admin\AppData\Local\Temp\DD25.tmp"67⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\DD64.tmp"C:\Users\Admin\AppData\Local\Temp\DD64.tmp"68⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\DDA2.tmp"C:\Users\Admin\AppData\Local\Temp\DDA2.tmp"69⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\DDE1.tmp"C:\Users\Admin\AppData\Local\Temp\DDE1.tmp"70⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\DE1F.tmp"C:\Users\Admin\AppData\Local\Temp\DE1F.tmp"71⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\DE5E.tmp"C:\Users\Admin\AppData\Local\Temp\DE5E.tmp"72⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\DE9C.tmp"C:\Users\Admin\AppData\Local\Temp\DE9C.tmp"73⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\DEDA.tmp"C:\Users\Admin\AppData\Local\Temp\DEDA.tmp"74⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\DF19.tmp"C:\Users\Admin\AppData\Local\Temp\DF19.tmp"75⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\DF57.tmp"C:\Users\Admin\AppData\Local\Temp\DF57.tmp"76⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\DF96.tmp"C:\Users\Admin\AppData\Local\Temp\DF96.tmp"77⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\DFD4.tmp"C:\Users\Admin\AppData\Local\Temp\DFD4.tmp"78⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\E012.tmp"C:\Users\Admin\AppData\Local\Temp\E012.tmp"79⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\E051.tmp"C:\Users\Admin\AppData\Local\Temp\E051.tmp"80⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\E08F.tmp"C:\Users\Admin\AppData\Local\Temp\E08F.tmp"81⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\E0CE.tmp"C:\Users\Admin\AppData\Local\Temp\E0CE.tmp"82⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\E10C.tmp"C:\Users\Admin\AppData\Local\Temp\E10C.tmp"83⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\E14A.tmp"C:\Users\Admin\AppData\Local\Temp\E14A.tmp"84⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\E189.tmp"C:\Users\Admin\AppData\Local\Temp\E189.tmp"85⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\E1C7.tmp"C:\Users\Admin\AppData\Local\Temp\E1C7.tmp"86⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\E206.tmp"C:\Users\Admin\AppData\Local\Temp\E206.tmp"87⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\E244.tmp"C:\Users\Admin\AppData\Local\Temp\E244.tmp"88⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\E282.tmp"C:\Users\Admin\AppData\Local\Temp\E282.tmp"89⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\E2C1.tmp"C:\Users\Admin\AppData\Local\Temp\E2C1.tmp"90⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\E2FF.tmp"C:\Users\Admin\AppData\Local\Temp\E2FF.tmp"91⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\E33E.tmp"C:\Users\Admin\AppData\Local\Temp\E33E.tmp"92⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\E37C.tmp"C:\Users\Admin\AppData\Local\Temp\E37C.tmp"93⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\E3BA.tmp"C:\Users\Admin\AppData\Local\Temp\E3BA.tmp"94⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\E3F9.tmp"C:\Users\Admin\AppData\Local\Temp\E3F9.tmp"95⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\E437.tmp"C:\Users\Admin\AppData\Local\Temp\E437.tmp"96⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\E476.tmp"C:\Users\Admin\AppData\Local\Temp\E476.tmp"97⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\E4B4.tmp"C:\Users\Admin\AppData\Local\Temp\E4B4.tmp"98⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\E4F2.tmp"C:\Users\Admin\AppData\Local\Temp\E4F2.tmp"99⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\E531.tmp"C:\Users\Admin\AppData\Local\Temp\E531.tmp"100⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\E56F.tmp"C:\Users\Admin\AppData\Local\Temp\E56F.tmp"101⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\E5AE.tmp"C:\Users\Admin\AppData\Local\Temp\E5AE.tmp"102⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\E5EC.tmp"C:\Users\Admin\AppData\Local\Temp\E5EC.tmp"103⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\E63A.tmp"C:\Users\Admin\AppData\Local\Temp\E63A.tmp"104⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\E678.tmp"C:\Users\Admin\AppData\Local\Temp\E678.tmp"105⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\E6B7.tmp"C:\Users\Admin\AppData\Local\Temp\E6B7.tmp"106⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"107⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\E734.tmp"C:\Users\Admin\AppData\Local\Temp\E734.tmp"108⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\E782.tmp"C:\Users\Admin\AppData\Local\Temp\E782.tmp"109⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\E7C0.tmp"C:\Users\Admin\AppData\Local\Temp\E7C0.tmp"110⤵PID:308
-
C:\Users\Admin\AppData\Local\Temp\E7FE.tmp"C:\Users\Admin\AppData\Local\Temp\E7FE.tmp"111⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\E84C.tmp"C:\Users\Admin\AppData\Local\Temp\E84C.tmp"112⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\E88B.tmp"C:\Users\Admin\AppData\Local\Temp\E88B.tmp"113⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\E8C9.tmp"C:\Users\Admin\AppData\Local\Temp\E8C9.tmp"114⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\E908.tmp"C:\Users\Admin\AppData\Local\Temp\E908.tmp"115⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\E946.tmp"C:\Users\Admin\AppData\Local\Temp\E946.tmp"116⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\E984.tmp"C:\Users\Admin\AppData\Local\Temp\E984.tmp"117⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\E9C3.tmp"C:\Users\Admin\AppData\Local\Temp\E9C3.tmp"118⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\EA01.tmp"C:\Users\Admin\AppData\Local\Temp\EA01.tmp"119⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\EA40.tmp"C:\Users\Admin\AppData\Local\Temp\EA40.tmp"120⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\EA7E.tmp"C:\Users\Admin\AppData\Local\Temp\EA7E.tmp"121⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\EABC.tmp"C:\Users\Admin\AppData\Local\Temp\EABC.tmp"122⤵PID:2860
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-