Analysis
-
max time kernel
151s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 03:49
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-19_1ead698077b4e22f984cb2a6961108de_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-19_1ead698077b4e22f984cb2a6961108de_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-19_1ead698077b4e22f984cb2a6961108de_mafia.exe
-
Size
527KB
-
MD5
1ead698077b4e22f984cb2a6961108de
-
SHA1
34f6b549cc0aa2e63d95e57762e5131c03018d6f
-
SHA256
b4aeb241d9bbc35d70a4fecf258ad36515bc73b2bd97b3f9165544c256aafe62
-
SHA512
3a9a1afaba7e5600a4b7a4b84884fe008c2d35e543f7a46d287838e10a62d41d168a17079f4719c7865e62d63ac9f47453afd8a9ea6e23a883a577b8d39d6461
-
SSDEEP
12288:fU5rCOTeidvRyX+fUEHoWDSlrxhjoh7hBRDZu:fUQOJdvRyX+fTHZS9xhchLRDo
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2236 1CF3.tmp 2452 1D7F.tmp 2844 1E1B.tmp 2784 1EC7.tmp 2116 1FE0.tmp 2924 20CA.tmp 2936 21B4.tmp 2684 226F.tmp 2648 233A.tmp 2140 23C6.tmp 2496 24C0.tmp 2856 259A.tmp 2364 2646.tmp 664 278D.tmp 2440 2848.tmp 2344 2923.tmp 1636 29DE.tmp 2868 2A7A.tmp 2892 2B35.tmp 1064 2BF0.tmp 1624 2C6D.tmp 856 32E3.tmp 620 344A.tmp 2284 34E6.tmp 2528 3562.tmp 2404 35FE.tmp 2372 368B.tmp 2192 3736.tmp 2252 37A4.tmp 968 3830.tmp 680 38BC.tmp 1452 3939.tmp 1044 39E5.tmp 824 3A71.tmp 1644 3AEE.tmp 1960 3BB9.tmp 1952 3C45.tmp 1148 3CD2.tmp 1528 3D3F.tmp 2072 3DDB.tmp 1984 3E77.tmp 948 3EF4.tmp 1744 3F80.tmp 960 404B.tmp 2576 40A8.tmp 2176 4164.tmp 2088 41E0.tmp 2580 425D.tmp 2292 42DA.tmp 1612 4347.tmp 456 43C4.tmp 1424 4450.tmp 1720 44CD.tmp 2308 452B.tmp 2916 4598.tmp 2136 4624.tmp 2840 4692.tmp 2848 472E.tmp 2792 48F2.tmp 2944 498E.tmp 2820 49FB.tmp 2924 4A78.tmp 2908 4AD6.tmp 2688 4B53.tmp -
Loads dropped DLL 64 IoCs
pid Process 1288 2024-09-19_1ead698077b4e22f984cb2a6961108de_mafia.exe 2236 1CF3.tmp 2452 1D7F.tmp 2844 1E1B.tmp 2784 1EC7.tmp 2116 1FE0.tmp 2924 20CA.tmp 2936 21B4.tmp 2684 226F.tmp 2648 233A.tmp 2140 23C6.tmp 2496 24C0.tmp 2856 259A.tmp 2364 2646.tmp 664 278D.tmp 2440 2848.tmp 2344 2923.tmp 1636 29DE.tmp 2868 2A7A.tmp 2892 2B35.tmp 1064 2BF0.tmp 1624 2C6D.tmp 856 32E3.tmp 620 344A.tmp 2284 34E6.tmp 2528 3562.tmp 2404 35FE.tmp 2372 368B.tmp 2192 3736.tmp 2252 37A4.tmp 968 3830.tmp 680 38BC.tmp 1452 3939.tmp 1044 39E5.tmp 824 3A71.tmp 1644 3AEE.tmp 1960 3BB9.tmp 1952 3C45.tmp 1148 3CD2.tmp 1528 3D3F.tmp 2072 3DDB.tmp 1984 3E77.tmp 948 3EF4.tmp 1744 3F80.tmp 960 404B.tmp 2576 40A8.tmp 2176 4164.tmp 2088 41E0.tmp 2580 425D.tmp 2292 42DA.tmp 1612 4347.tmp 456 43C4.tmp 1424 4450.tmp 1720 44CD.tmp 2308 452B.tmp 2916 4598.tmp 2136 4624.tmp 2840 4692.tmp 2848 472E.tmp 2792 48F2.tmp 2944 498E.tmp 2820 49FB.tmp 2924 4A78.tmp 2908 4AD6.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D328.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8833.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F97C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7197.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7649.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A8B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 139.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 452B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B27D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4EBC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4AB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B664.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D153.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F49C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 464.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 233B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD4F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 958B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9EDE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B358.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB44.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B56.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A045.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CF6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8363.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B77D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F75A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 278D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35FE.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1288 wrote to memory of 2236 1288 2024-09-19_1ead698077b4e22f984cb2a6961108de_mafia.exe 29 PID 1288 wrote to memory of 2236 1288 2024-09-19_1ead698077b4e22f984cb2a6961108de_mafia.exe 29 PID 1288 wrote to memory of 2236 1288 2024-09-19_1ead698077b4e22f984cb2a6961108de_mafia.exe 29 PID 1288 wrote to memory of 2236 1288 2024-09-19_1ead698077b4e22f984cb2a6961108de_mafia.exe 29 PID 2236 wrote to memory of 2452 2236 1CF3.tmp 30 PID 2236 wrote to memory of 2452 2236 1CF3.tmp 30 PID 2236 wrote to memory of 2452 2236 1CF3.tmp 30 PID 2236 wrote to memory of 2452 2236 1CF3.tmp 30 PID 2452 wrote to memory of 2844 2452 1D7F.tmp 31 PID 2452 wrote to memory of 2844 2452 1D7F.tmp 31 PID 2452 wrote to memory of 2844 2452 1D7F.tmp 31 PID 2452 wrote to memory of 2844 2452 1D7F.tmp 31 PID 2844 wrote to memory of 2784 2844 1E1B.tmp 32 PID 2844 wrote to memory of 2784 2844 1E1B.tmp 32 PID 2844 wrote to memory of 2784 2844 1E1B.tmp 32 PID 2844 wrote to memory of 2784 2844 1E1B.tmp 32 PID 2784 wrote to memory of 2116 2784 1EC7.tmp 33 PID 2784 wrote to memory of 2116 2784 1EC7.tmp 33 PID 2784 wrote to memory of 2116 2784 1EC7.tmp 33 PID 2784 wrote to memory of 2116 2784 1EC7.tmp 33 PID 2116 wrote to memory of 2924 2116 1FE0.tmp 34 PID 2116 wrote to memory of 2924 2116 1FE0.tmp 34 PID 2116 wrote to memory of 2924 2116 1FE0.tmp 34 PID 2116 wrote to memory of 2924 2116 1FE0.tmp 34 PID 2924 wrote to memory of 2936 2924 20CA.tmp 35 PID 2924 wrote to memory of 2936 2924 20CA.tmp 35 PID 2924 wrote to memory of 2936 2924 20CA.tmp 35 PID 2924 wrote to memory of 2936 2924 20CA.tmp 35 PID 2936 wrote to memory of 2684 2936 21B4.tmp 36 PID 2936 wrote to memory of 2684 2936 21B4.tmp 36 PID 2936 wrote to memory of 2684 2936 21B4.tmp 36 PID 2936 wrote to memory of 2684 2936 21B4.tmp 36 PID 2684 wrote to memory of 2648 2684 226F.tmp 37 PID 2684 wrote to memory of 2648 2684 226F.tmp 37 PID 2684 wrote to memory of 2648 2684 226F.tmp 37 PID 2684 wrote to memory of 2648 2684 226F.tmp 37 PID 2648 wrote to memory of 2140 2648 233A.tmp 38 PID 2648 wrote to memory of 2140 2648 233A.tmp 38 PID 2648 wrote to memory of 2140 2648 233A.tmp 38 PID 2648 wrote to memory of 2140 2648 233A.tmp 38 PID 2140 wrote to memory of 2496 2140 23C6.tmp 39 PID 2140 wrote to memory of 2496 2140 23C6.tmp 39 PID 2140 wrote to memory of 2496 2140 23C6.tmp 39 PID 2140 wrote to memory of 2496 2140 23C6.tmp 39 PID 2496 wrote to memory of 2856 2496 24C0.tmp 40 PID 2496 wrote to memory of 2856 2496 24C0.tmp 40 PID 2496 wrote to memory of 2856 2496 24C0.tmp 40 PID 2496 wrote to memory of 2856 2496 24C0.tmp 40 PID 2856 wrote to memory of 2364 2856 259A.tmp 41 PID 2856 wrote to memory of 2364 2856 259A.tmp 41 PID 2856 wrote to memory of 2364 2856 259A.tmp 41 PID 2856 wrote to memory of 2364 2856 259A.tmp 41 PID 2364 wrote to memory of 664 2364 2646.tmp 42 PID 2364 wrote to memory of 664 2364 2646.tmp 42 PID 2364 wrote to memory of 664 2364 2646.tmp 42 PID 2364 wrote to memory of 664 2364 2646.tmp 42 PID 664 wrote to memory of 2440 664 278D.tmp 43 PID 664 wrote to memory of 2440 664 278D.tmp 43 PID 664 wrote to memory of 2440 664 278D.tmp 43 PID 664 wrote to memory of 2440 664 278D.tmp 43 PID 2440 wrote to memory of 2344 2440 2848.tmp 44 PID 2440 wrote to memory of 2344 2440 2848.tmp 44 PID 2440 wrote to memory of 2344 2440 2848.tmp 44 PID 2440 wrote to memory of 2344 2440 2848.tmp 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_1ead698077b4e22f984cb2a6961108de_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_1ead698077b4e22f984cb2a6961108de_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\20CA.tmp"C:\Users\Admin\AppData\Local\Temp\20CA.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\21B4.tmp"C:\Users\Admin\AppData\Local\Temp\21B4.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\226F.tmp"C:\Users\Admin\AppData\Local\Temp\226F.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\233A.tmp"C:\Users\Admin\AppData\Local\Temp\233A.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\23C6.tmp"C:\Users\Admin\AppData\Local\Temp\23C6.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\24C0.tmp"C:\Users\Admin\AppData\Local\Temp\24C0.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\259A.tmp"C:\Users\Admin\AppData\Local\Temp\259A.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\2646.tmp"C:\Users\Admin\AppData\Local\Temp\2646.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\278D.tmp"C:\Users\Admin\AppData\Local\Temp\278D.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Users\Admin\AppData\Local\Temp\2848.tmp"C:\Users\Admin\AppData\Local\Temp\2848.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\2923.tmp"C:\Users\Admin\AppData\Local\Temp\2923.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\29DE.tmp"C:\Users\Admin\AppData\Local\Temp\29DE.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\2B35.tmp"C:\Users\Admin\AppData\Local\Temp\2B35.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\32E3.tmp"C:\Users\Admin\AppData\Local\Temp\32E3.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:856 -
C:\Users\Admin\AppData\Local\Temp\344A.tmp"C:\Users\Admin\AppData\Local\Temp\344A.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:620 -
C:\Users\Admin\AppData\Local\Temp\34E6.tmp"C:\Users\Admin\AppData\Local\Temp\34E6.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\3562.tmp"C:\Users\Admin\AppData\Local\Temp\3562.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\35FE.tmp"C:\Users\Admin\AppData\Local\Temp\35FE.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\368B.tmp"C:\Users\Admin\AppData\Local\Temp\368B.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\3736.tmp"C:\Users\Admin\AppData\Local\Temp\3736.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\37A4.tmp"C:\Users\Admin\AppData\Local\Temp\37A4.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\3830.tmp"C:\Users\Admin\AppData\Local\Temp\3830.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:968 -
C:\Users\Admin\AppData\Local\Temp\38BC.tmp"C:\Users\Admin\AppData\Local\Temp\38BC.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:680 -
C:\Users\Admin\AppData\Local\Temp\3939.tmp"C:\Users\Admin\AppData\Local\Temp\3939.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\39E5.tmp"C:\Users\Admin\AppData\Local\Temp\39E5.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\3A71.tmp"C:\Users\Admin\AppData\Local\Temp\3A71.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:824 -
C:\Users\Admin\AppData\Local\Temp\3AEE.tmp"C:\Users\Admin\AppData\Local\Temp\3AEE.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\3BB9.tmp"C:\Users\Admin\AppData\Local\Temp\3BB9.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\3C45.tmp"C:\Users\Admin\AppData\Local\Temp\3C45.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\3CD2.tmp"C:\Users\Admin\AppData\Local\Temp\3CD2.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\3D3F.tmp"C:\Users\Admin\AppData\Local\Temp\3D3F.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\3DDB.tmp"C:\Users\Admin\AppData\Local\Temp\3DDB.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\3E77.tmp"C:\Users\Admin\AppData\Local\Temp\3E77.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\3EF4.tmp"C:\Users\Admin\AppData\Local\Temp\3EF4.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:948 -
C:\Users\Admin\AppData\Local\Temp\3F80.tmp"C:\Users\Admin\AppData\Local\Temp\3F80.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\404B.tmp"C:\Users\Admin\AppData\Local\Temp\404B.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:960 -
C:\Users\Admin\AppData\Local\Temp\40A8.tmp"C:\Users\Admin\AppData\Local\Temp\40A8.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\4164.tmp"C:\Users\Admin\AppData\Local\Temp\4164.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\41E0.tmp"C:\Users\Admin\AppData\Local\Temp\41E0.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\425D.tmp"C:\Users\Admin\AppData\Local\Temp\425D.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\42DA.tmp"C:\Users\Admin\AppData\Local\Temp\42DA.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\4347.tmp"C:\Users\Admin\AppData\Local\Temp\4347.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\43C4.tmp"C:\Users\Admin\AppData\Local\Temp\43C4.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:456 -
C:\Users\Admin\AppData\Local\Temp\4450.tmp"C:\Users\Admin\AppData\Local\Temp\4450.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\44CD.tmp"C:\Users\Admin\AppData\Local\Temp\44CD.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\452B.tmp"C:\Users\Admin\AppData\Local\Temp\452B.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\4598.tmp"C:\Users\Admin\AppData\Local\Temp\4598.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\4624.tmp"C:\Users\Admin\AppData\Local\Temp\4624.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\4692.tmp"C:\Users\Admin\AppData\Local\Temp\4692.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\472E.tmp"C:\Users\Admin\AppData\Local\Temp\472E.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\48F2.tmp"C:\Users\Admin\AppData\Local\Temp\48F2.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\498E.tmp"C:\Users\Admin\AppData\Local\Temp\498E.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\49FB.tmp"C:\Users\Admin\AppData\Local\Temp\49FB.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\4A78.tmp"C:\Users\Admin\AppData\Local\Temp\4A78.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\4AD6.tmp"C:\Users\Admin\AppData\Local\Temp\4AD6.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\4B53.tmp"C:\Users\Admin\AppData\Local\Temp\4B53.tmp"65⤵
- Executes dropped EXE
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\4BCF.tmp"C:\Users\Admin\AppData\Local\Temp\4BCF.tmp"66⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\4C5C.tmp"C:\Users\Admin\AppData\Local\Temp\4C5C.tmp"67⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\4CD9.tmp"C:\Users\Admin\AppData\Local\Temp\4CD9.tmp"68⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"69⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"70⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"71⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"73⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\4FC5.tmp"C:\Users\Admin\AppData\Local\Temp\4FC5.tmp"74⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\5061.tmp"C:\Users\Admin\AppData\Local\Temp\5061.tmp"75⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"76⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\513C.tmp"C:\Users\Admin\AppData\Local\Temp\513C.tmp"77⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\51B9.tmp"C:\Users\Admin\AppData\Local\Temp\51B9.tmp"78⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\5235.tmp"C:\Users\Admin\AppData\Local\Temp\5235.tmp"79⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\52A3.tmp"C:\Users\Admin\AppData\Local\Temp\52A3.tmp"80⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\531F.tmp"C:\Users\Admin\AppData\Local\Temp\531F.tmp"81⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\539C.tmp"C:\Users\Admin\AppData\Local\Temp\539C.tmp"82⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\5409.tmp"C:\Users\Admin\AppData\Local\Temp\5409.tmp"83⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\5477.tmp"C:\Users\Admin\AppData\Local\Temp\5477.tmp"84⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\54F3.tmp"C:\Users\Admin\AppData\Local\Temp\54F3.tmp"85⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\5570.tmp"C:\Users\Admin\AppData\Local\Temp\5570.tmp"86⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\55ED.tmp"C:\Users\Admin\AppData\Local\Temp\55ED.tmp"87⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\566A.tmp"C:\Users\Admin\AppData\Local\Temp\566A.tmp"88⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\56E7.tmp"C:\Users\Admin\AppData\Local\Temp\56E7.tmp"89⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\5754.tmp"C:\Users\Admin\AppData\Local\Temp\5754.tmp"90⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\57D1.tmp"C:\Users\Admin\AppData\Local\Temp\57D1.tmp"91⤵
- System Location Discovery: System Language Discovery
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\584D.tmp"C:\Users\Admin\AppData\Local\Temp\584D.tmp"92⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\58AB.tmp"C:\Users\Admin\AppData\Local\Temp\58AB.tmp"93⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\5937.tmp"C:\Users\Admin\AppData\Local\Temp\5937.tmp"94⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\59B4.tmp"C:\Users\Admin\AppData\Local\Temp\59B4.tmp"95⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\5A21.tmp"C:\Users\Admin\AppData\Local\Temp\5A21.tmp"96⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"97⤵
- System Location Discovery: System Language Discovery
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\5B2B.tmp"C:\Users\Admin\AppData\Local\Temp\5B2B.tmp"98⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\5B98.tmp"C:\Users\Admin\AppData\Local\Temp\5B98.tmp"99⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\5C05.tmp"C:\Users\Admin\AppData\Local\Temp\5C05.tmp"100⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\5C91.tmp"C:\Users\Admin\AppData\Local\Temp\5C91.tmp"101⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\5E17.tmp"C:\Users\Admin\AppData\Local\Temp\5E17.tmp"102⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\5F5F.tmp"C:\Users\Admin\AppData\Local\Temp\5F5F.tmp"103⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\5FCC.tmp"C:\Users\Admin\AppData\Local\Temp\5FCC.tmp"104⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\6039.tmp"C:\Users\Admin\AppData\Local\Temp\6039.tmp"105⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\60A7.tmp"C:\Users\Admin\AppData\Local\Temp\60A7.tmp"106⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\6123.tmp"C:\Users\Admin\AppData\Local\Temp\6123.tmp"107⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\61B0.tmp"C:\Users\Admin\AppData\Local\Temp\61B0.tmp"108⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\621D.tmp"C:\Users\Admin\AppData\Local\Temp\621D.tmp"109⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\62B9.tmp"C:\Users\Admin\AppData\Local\Temp\62B9.tmp"110⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\6317.tmp"C:\Users\Admin\AppData\Local\Temp\6317.tmp"111⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\6374.tmp"C:\Users\Admin\AppData\Local\Temp\6374.tmp"112⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\63C2.tmp"C:\Users\Admin\AppData\Local\Temp\63C2.tmp"113⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\6410.tmp"C:\Users\Admin\AppData\Local\Temp\6410.tmp"114⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\647D.tmp"C:\Users\Admin\AppData\Local\Temp\647D.tmp"115⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\64EB.tmp"C:\Users\Admin\AppData\Local\Temp\64EB.tmp"116⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\6548.tmp"C:\Users\Admin\AppData\Local\Temp\6548.tmp"117⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\65D5.tmp"C:\Users\Admin\AppData\Local\Temp\65D5.tmp"118⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\6661.tmp"C:\Users\Admin\AppData\Local\Temp\6661.tmp"119⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\66DE.tmp"C:\Users\Admin\AppData\Local\Temp\66DE.tmp"120⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\673B.tmp"C:\Users\Admin\AppData\Local\Temp\673B.tmp"121⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\67B8.tmp"C:\Users\Admin\AppData\Local\Temp\67B8.tmp"122⤵PID:2940
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-