Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 03:46
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-19_12d3b9625b70134c1b8edb094491dfcf_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-09-19_12d3b9625b70134c1b8edb094491dfcf_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-19_12d3b9625b70134c1b8edb094491dfcf_mafia.exe
-
Size
487KB
-
MD5
12d3b9625b70134c1b8edb094491dfcf
-
SHA1
383198d51f3b09d50e688b1cb53c43268a473a09
-
SHA256
f1916ff8e6255b34a1f7a6c841810564c67e21eeb6f6c5357d279127d76a0ecb
-
SHA512
a350b1bfffc0c24725f26af5f866390eca62f0ea4f98d66d0a2503decd998ed2e280c8125c8a3346c9c53eaf4513634abe3ff22fe44053bcc7758af9ef2c4296
-
SSDEEP
6144:qorf3lPvovsgZnqG2C7mOTeiL9DUr3F1hpdjQnr/+tZdSj46AwtnyL74HaysH3dZ:HU5rCOTeiJE84ZdSj46ZGzNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2076 3505.tmp 2764 3562.tmp 2896 35EF.tmp 2760 365C.tmp 2752 36C9.tmp 2756 3736.tmp 2700 37A4.tmp 2552 3801.tmp 2960 386E.tmp 2956 38CC.tmp 848 3939.tmp 2480 3997.tmp 1300 3A04.tmp 2516 3A62.tmp 2172 3ACF.tmp 2120 3B2C.tmp 620 3B9A.tmp 1400 3BF7.tmp 2112 3C55.tmp 1440 3CC2.tmp 2356 3D20.tmp 1696 3D9C.tmp 776 3DFA.tmp 1252 3E48.tmp 3052 3E86.tmp 2180 3EC5.tmp 1524 3F13.tmp 2492 3F61.tmp 2920 3F9F.tmp 3068 3FDE.tmp 2948 401C.tmp 1340 406A.tmp 1864 40A8.tmp 1956 40F6.tmp 884 4144.tmp 1028 4192.tmp 1580 41D1.tmp 2944 420F.tmp 1544 425D.tmp 1996 429C.tmp 2020 42EA.tmp 2484 4338.tmp 1428 4386.tmp 1412 43D4.tmp 568 4422.tmp 2260 4470.tmp 2468 44BE.tmp 2368 44FC.tmp 1792 453A.tmp 1844 4579.tmp 876 45B7.tmp 2424 4605.tmp 1712 4644.tmp 2240 4682.tmp 2660 46C0.tmp 2784 470E.tmp 2688 474D.tmp 2540 479B.tmp 3032 47E9.tmp 2692 4837.tmp 2620 4875.tmp 2752 48C3.tmp 2556 4902.tmp 2596 4940.tmp -
Loads dropped DLL 64 IoCs
pid Process 2964 2024-09-19_12d3b9625b70134c1b8edb094491dfcf_mafia.exe 2076 3505.tmp 2764 3562.tmp 2896 35EF.tmp 2760 365C.tmp 2752 36C9.tmp 2756 3736.tmp 2700 37A4.tmp 2552 3801.tmp 2960 386E.tmp 2956 38CC.tmp 848 3939.tmp 2480 3997.tmp 1300 3A04.tmp 2516 3A62.tmp 2172 3ACF.tmp 2120 3B2C.tmp 620 3B9A.tmp 1400 3BF7.tmp 2112 3C55.tmp 1440 3CC2.tmp 2356 3D20.tmp 1696 3D9C.tmp 776 3DFA.tmp 1252 3E48.tmp 3052 3E86.tmp 2180 3EC5.tmp 1524 3F13.tmp 2492 3F61.tmp 2920 3F9F.tmp 3068 3FDE.tmp 2948 401C.tmp 1340 406A.tmp 1864 40A8.tmp 1956 40F6.tmp 884 4144.tmp 1028 4192.tmp 1580 41D1.tmp 2944 420F.tmp 1544 425D.tmp 1996 429C.tmp 2020 42EA.tmp 2484 4338.tmp 1428 4386.tmp 1412 43D4.tmp 568 4422.tmp 2260 4470.tmp 2468 44BE.tmp 2368 44FC.tmp 1792 453A.tmp 1844 4579.tmp 876 45B7.tmp 2424 4605.tmp 1712 4644.tmp 2240 4682.tmp 2660 46C0.tmp 2784 470E.tmp 2688 474D.tmp 2540 479B.tmp 3032 47E9.tmp 2692 4837.tmp 2620 4875.tmp 2752 48C3.tmp 2556 4902.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C40A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 139.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3756.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7FE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9222.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A535.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 470E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7DE7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7649.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7955.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E669.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2185.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5052.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A10.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4682.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1065.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9897.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2964 wrote to memory of 2076 2964 2024-09-19_12d3b9625b70134c1b8edb094491dfcf_mafia.exe 30 PID 2964 wrote to memory of 2076 2964 2024-09-19_12d3b9625b70134c1b8edb094491dfcf_mafia.exe 30 PID 2964 wrote to memory of 2076 2964 2024-09-19_12d3b9625b70134c1b8edb094491dfcf_mafia.exe 30 PID 2964 wrote to memory of 2076 2964 2024-09-19_12d3b9625b70134c1b8edb094491dfcf_mafia.exe 30 PID 2076 wrote to memory of 2764 2076 3505.tmp 31 PID 2076 wrote to memory of 2764 2076 3505.tmp 31 PID 2076 wrote to memory of 2764 2076 3505.tmp 31 PID 2076 wrote to memory of 2764 2076 3505.tmp 31 PID 2764 wrote to memory of 2896 2764 3562.tmp 32 PID 2764 wrote to memory of 2896 2764 3562.tmp 32 PID 2764 wrote to memory of 2896 2764 3562.tmp 32 PID 2764 wrote to memory of 2896 2764 3562.tmp 32 PID 2896 wrote to memory of 2760 2896 35EF.tmp 33 PID 2896 wrote to memory of 2760 2896 35EF.tmp 33 PID 2896 wrote to memory of 2760 2896 35EF.tmp 33 PID 2896 wrote to memory of 2760 2896 35EF.tmp 33 PID 2760 wrote to memory of 2752 2760 365C.tmp 34 PID 2760 wrote to memory of 2752 2760 365C.tmp 34 PID 2760 wrote to memory of 2752 2760 365C.tmp 34 PID 2760 wrote to memory of 2752 2760 365C.tmp 34 PID 2752 wrote to memory of 2756 2752 36C9.tmp 35 PID 2752 wrote to memory of 2756 2752 36C9.tmp 35 PID 2752 wrote to memory of 2756 2752 36C9.tmp 35 PID 2752 wrote to memory of 2756 2752 36C9.tmp 35 PID 2756 wrote to memory of 2700 2756 3736.tmp 36 PID 2756 wrote to memory of 2700 2756 3736.tmp 36 PID 2756 wrote to memory of 2700 2756 3736.tmp 36 PID 2756 wrote to memory of 2700 2756 3736.tmp 36 PID 2700 wrote to memory of 2552 2700 37A4.tmp 37 PID 2700 wrote to memory of 2552 2700 37A4.tmp 37 PID 2700 wrote to memory of 2552 2700 37A4.tmp 37 PID 2700 wrote to memory of 2552 2700 37A4.tmp 37 PID 2552 wrote to memory of 2960 2552 3801.tmp 38 PID 2552 wrote to memory of 2960 2552 3801.tmp 38 PID 2552 wrote to memory of 2960 2552 3801.tmp 38 PID 2552 wrote to memory of 2960 2552 3801.tmp 38 PID 2960 wrote to memory of 2956 2960 386E.tmp 39 PID 2960 wrote to memory of 2956 2960 386E.tmp 39 PID 2960 wrote to memory of 2956 2960 386E.tmp 39 PID 2960 wrote to memory of 2956 2960 386E.tmp 39 PID 2956 wrote to memory of 848 2956 38CC.tmp 40 PID 2956 wrote to memory of 848 2956 38CC.tmp 40 PID 2956 wrote to memory of 848 2956 38CC.tmp 40 PID 2956 wrote to memory of 848 2956 38CC.tmp 40 PID 848 wrote to memory of 2480 848 3939.tmp 41 PID 848 wrote to memory of 2480 848 3939.tmp 41 PID 848 wrote to memory of 2480 848 3939.tmp 41 PID 848 wrote to memory of 2480 848 3939.tmp 41 PID 2480 wrote to memory of 1300 2480 3997.tmp 42 PID 2480 wrote to memory of 1300 2480 3997.tmp 42 PID 2480 wrote to memory of 1300 2480 3997.tmp 42 PID 2480 wrote to memory of 1300 2480 3997.tmp 42 PID 1300 wrote to memory of 2516 1300 3A04.tmp 43 PID 1300 wrote to memory of 2516 1300 3A04.tmp 43 PID 1300 wrote to memory of 2516 1300 3A04.tmp 43 PID 1300 wrote to memory of 2516 1300 3A04.tmp 43 PID 2516 wrote to memory of 2172 2516 3A62.tmp 44 PID 2516 wrote to memory of 2172 2516 3A62.tmp 44 PID 2516 wrote to memory of 2172 2516 3A62.tmp 44 PID 2516 wrote to memory of 2172 2516 3A62.tmp 44 PID 2172 wrote to memory of 2120 2172 3ACF.tmp 45 PID 2172 wrote to memory of 2120 2172 3ACF.tmp 45 PID 2172 wrote to memory of 2120 2172 3ACF.tmp 45 PID 2172 wrote to memory of 2120 2172 3ACF.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_12d3b9625b70134c1b8edb094491dfcf_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_12d3b9625b70134c1b8edb094491dfcf_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\3505.tmp"C:\Users\Admin\AppData\Local\Temp\3505.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\3562.tmp"C:\Users\Admin\AppData\Local\Temp\3562.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\35EF.tmp"C:\Users\Admin\AppData\Local\Temp\35EF.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\365C.tmp"C:\Users\Admin\AppData\Local\Temp\365C.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\36C9.tmp"C:\Users\Admin\AppData\Local\Temp\36C9.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\3736.tmp"C:\Users\Admin\AppData\Local\Temp\3736.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\37A4.tmp"C:\Users\Admin\AppData\Local\Temp\37A4.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\3801.tmp"C:\Users\Admin\AppData\Local\Temp\3801.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\386E.tmp"C:\Users\Admin\AppData\Local\Temp\386E.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\38CC.tmp"C:\Users\Admin\AppData\Local\Temp\38CC.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\3939.tmp"C:\Users\Admin\AppData\Local\Temp\3939.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Users\Admin\AppData\Local\Temp\3997.tmp"C:\Users\Admin\AppData\Local\Temp\3997.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\3A04.tmp"C:\Users\Admin\AppData\Local\Temp\3A04.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\3A62.tmp"C:\Users\Admin\AppData\Local\Temp\3A62.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\3ACF.tmp"C:\Users\Admin\AppData\Local\Temp\3ACF.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\3B2C.tmp"C:\Users\Admin\AppData\Local\Temp\3B2C.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\3B9A.tmp"C:\Users\Admin\AppData\Local\Temp\3B9A.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:620 -
C:\Users\Admin\AppData\Local\Temp\3BF7.tmp"C:\Users\Admin\AppData\Local\Temp\3BF7.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\3C55.tmp"C:\Users\Admin\AppData\Local\Temp\3C55.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\3CC2.tmp"C:\Users\Admin\AppData\Local\Temp\3CC2.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\3D20.tmp"C:\Users\Admin\AppData\Local\Temp\3D20.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\3DFA.tmp"C:\Users\Admin\AppData\Local\Temp\3DFA.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:776 -
C:\Users\Admin\AppData\Local\Temp\3E48.tmp"C:\Users\Admin\AppData\Local\Temp\3E48.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\3E86.tmp"C:\Users\Admin\AppData\Local\Temp\3E86.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\3EC5.tmp"C:\Users\Admin\AppData\Local\Temp\3EC5.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\3F13.tmp"C:\Users\Admin\AppData\Local\Temp\3F13.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\3F61.tmp"C:\Users\Admin\AppData\Local\Temp\3F61.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\3F9F.tmp"C:\Users\Admin\AppData\Local\Temp\3F9F.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\3FDE.tmp"C:\Users\Admin\AppData\Local\Temp\3FDE.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\401C.tmp"C:\Users\Admin\AppData\Local\Temp\401C.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\406A.tmp"C:\Users\Admin\AppData\Local\Temp\406A.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\40A8.tmp"C:\Users\Admin\AppData\Local\Temp\40A8.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\40F6.tmp"C:\Users\Admin\AppData\Local\Temp\40F6.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\4144.tmp"C:\Users\Admin\AppData\Local\Temp\4144.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:884 -
C:\Users\Admin\AppData\Local\Temp\4192.tmp"C:\Users\Admin\AppData\Local\Temp\4192.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\41D1.tmp"C:\Users\Admin\AppData\Local\Temp\41D1.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\420F.tmp"C:\Users\Admin\AppData\Local\Temp\420F.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\425D.tmp"C:\Users\Admin\AppData\Local\Temp\425D.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\429C.tmp"C:\Users\Admin\AppData\Local\Temp\429C.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\42EA.tmp"C:\Users\Admin\AppData\Local\Temp\42EA.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\4338.tmp"C:\Users\Admin\AppData\Local\Temp\4338.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\4386.tmp"C:\Users\Admin\AppData\Local\Temp\4386.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\43D4.tmp"C:\Users\Admin\AppData\Local\Temp\43D4.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\4422.tmp"C:\Users\Admin\AppData\Local\Temp\4422.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:568 -
C:\Users\Admin\AppData\Local\Temp\4470.tmp"C:\Users\Admin\AppData\Local\Temp\4470.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\44BE.tmp"C:\Users\Admin\AppData\Local\Temp\44BE.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\44FC.tmp"C:\Users\Admin\AppData\Local\Temp\44FC.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\453A.tmp"C:\Users\Admin\AppData\Local\Temp\453A.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\4579.tmp"C:\Users\Admin\AppData\Local\Temp\4579.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\45B7.tmp"C:\Users\Admin\AppData\Local\Temp\45B7.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:876 -
C:\Users\Admin\AppData\Local\Temp\4605.tmp"C:\Users\Admin\AppData\Local\Temp\4605.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\4644.tmp"C:\Users\Admin\AppData\Local\Temp\4644.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\4682.tmp"C:\Users\Admin\AppData\Local\Temp\4682.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\46C0.tmp"C:\Users\Admin\AppData\Local\Temp\46C0.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\470E.tmp"C:\Users\Admin\AppData\Local\Temp\470E.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\474D.tmp"C:\Users\Admin\AppData\Local\Temp\474D.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\479B.tmp"C:\Users\Admin\AppData\Local\Temp\479B.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\47E9.tmp"C:\Users\Admin\AppData\Local\Temp\47E9.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\4837.tmp"C:\Users\Admin\AppData\Local\Temp\4837.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\4875.tmp"C:\Users\Admin\AppData\Local\Temp\4875.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\48C3.tmp"C:\Users\Admin\AppData\Local\Temp\48C3.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\4902.tmp"C:\Users\Admin\AppData\Local\Temp\4902.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\4940.tmp"C:\Users\Admin\AppData\Local\Temp\4940.tmp"65⤵
- Executes dropped EXE
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\498E.tmp"C:\Users\Admin\AppData\Local\Temp\498E.tmp"66⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\49CC.tmp"C:\Users\Admin\AppData\Local\Temp\49CC.tmp"67⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\4A1A.tmp"C:\Users\Admin\AppData\Local\Temp\4A1A.tmp"68⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\4A59.tmp"C:\Users\Admin\AppData\Local\Temp\4A59.tmp"69⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\4A97.tmp"C:\Users\Admin\AppData\Local\Temp\4A97.tmp"70⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\4AD6.tmp"C:\Users\Admin\AppData\Local\Temp\4AD6.tmp"71⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\4B14.tmp"C:\Users\Admin\AppData\Local\Temp\4B14.tmp"72⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\4B52.tmp"C:\Users\Admin\AppData\Local\Temp\4B52.tmp"73⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\4B91.tmp"C:\Users\Admin\AppData\Local\Temp\4B91.tmp"74⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\4BCF.tmp"C:\Users\Admin\AppData\Local\Temp\4BCF.tmp"75⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\4C1D.tmp"C:\Users\Admin\AppData\Local\Temp\4C1D.tmp"76⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\4C5C.tmp"C:\Users\Admin\AppData\Local\Temp\4C5C.tmp"77⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\4C9A.tmp"C:\Users\Admin\AppData\Local\Temp\4C9A.tmp"78⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"79⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\4D17.tmp"C:\Users\Admin\AppData\Local\Temp\4D17.tmp"80⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"81⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\4D94.tmp"C:\Users\Admin\AppData\Local\Temp\4D94.tmp"82⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"83⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"84⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"85⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"86⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"87⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"88⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"89⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\4F96.tmp"C:\Users\Admin\AppData\Local\Temp\4F96.tmp"90⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"91⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\5013.tmp"C:\Users\Admin\AppData\Local\Temp\5013.tmp"92⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"93⤵
- System Location Discovery: System Language Discovery
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\5090.tmp"C:\Users\Admin\AppData\Local\Temp\5090.tmp"94⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\50DE.tmp"C:\Users\Admin\AppData\Local\Temp\50DE.tmp"95⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\511C.tmp"C:\Users\Admin\AppData\Local\Temp\511C.tmp"96⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\515B.tmp"C:\Users\Admin\AppData\Local\Temp\515B.tmp"97⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\5199.tmp"C:\Users\Admin\AppData\Local\Temp\5199.tmp"98⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\51D8.tmp"C:\Users\Admin\AppData\Local\Temp\51D8.tmp"99⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\5226.tmp"C:\Users\Admin\AppData\Local\Temp\5226.tmp"100⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\5274.tmp"C:\Users\Admin\AppData\Local\Temp\5274.tmp"101⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\52B2.tmp"C:\Users\Admin\AppData\Local\Temp\52B2.tmp"102⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\52F0.tmp"C:\Users\Admin\AppData\Local\Temp\52F0.tmp"103⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\532F.tmp"C:\Users\Admin\AppData\Local\Temp\532F.tmp"104⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\536D.tmp"C:\Users\Admin\AppData\Local\Temp\536D.tmp"105⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\53AC.tmp"C:\Users\Admin\AppData\Local\Temp\53AC.tmp"106⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\53EA.tmp"C:\Users\Admin\AppData\Local\Temp\53EA.tmp"107⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\5428.tmp"C:\Users\Admin\AppData\Local\Temp\5428.tmp"108⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\5476.tmp"C:\Users\Admin\AppData\Local\Temp\5476.tmp"109⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\54B5.tmp"C:\Users\Admin\AppData\Local\Temp\54B5.tmp"110⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\54F3.tmp"C:\Users\Admin\AppData\Local\Temp\54F3.tmp"111⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\5541.tmp"C:\Users\Admin\AppData\Local\Temp\5541.tmp"112⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\5580.tmp"C:\Users\Admin\AppData\Local\Temp\5580.tmp"113⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\55BE.tmp"C:\Users\Admin\AppData\Local\Temp\55BE.tmp"114⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\560C.tmp"C:\Users\Admin\AppData\Local\Temp\560C.tmp"115⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\565A.tmp"C:\Users\Admin\AppData\Local\Temp\565A.tmp"116⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\5698.tmp"C:\Users\Admin\AppData\Local\Temp\5698.tmp"117⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\56E6.tmp"C:\Users\Admin\AppData\Local\Temp\56E6.tmp"118⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\5725.tmp"C:\Users\Admin\AppData\Local\Temp\5725.tmp"119⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\5773.tmp"C:\Users\Admin\AppData\Local\Temp\5773.tmp"120⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\57B1.tmp"C:\Users\Admin\AppData\Local\Temp\57B1.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\57FF.tmp"C:\Users\Admin\AppData\Local\Temp\57FF.tmp"122⤵PID:2884
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-