Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 03:50
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-19_29a6b917986bf01589dba61ed15faaed_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-19_29a6b917986bf01589dba61ed15faaed_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-19_29a6b917986bf01589dba61ed15faaed_mafia.exe
-
Size
536KB
-
MD5
29a6b917986bf01589dba61ed15faaed
-
SHA1
54bfcad0508186dffd353ea51a7817c02afbd515
-
SHA256
8d1cc96a2411390f84973d73e4aa1735dd965c87df0c6515cedfe105bcda559c
-
SHA512
29032aaeca9d250a1d75606dd1cce98eec7f20ed82be5dff37ce9c34aac8d341479230c70e3b8de1ef145c394e05a0076cd0089b8f7d5706bf4316c6a8b9a019
-
SSDEEP
12288:wU5rCOTeiUR7lVRlsS9rqm0E1+ZNFBIZxVJ0ZT9:wUQOJUR7NR+s+1BIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2760 F5B4.tmp 2640 F670.tmp 2776 F6DD.tmp 2944 F788.tmp 2536 F805.tmp 2612 F8C0.tmp 2936 F95C.tmp 2520 FA18.tmp 2372 FAB4.tmp 2388 FB40.tmp 484 FB8E.tmp 1984 FC68.tmp 1716 FCE5.tmp 988 FD33.tmp 2312 FD81.tmp 584 FDCF.tmp 2864 FE1D.tmp 1696 FE6B.tmp 2620 FEB9.tmp 916 FF07.tmp 2408 FF55.tmp 1916 FFB3.tmp 1256 FFF1.tmp 2496 3F.tmp 912 8D.tmp 1772 DB.tmp 3048 129.tmp 1768 177.tmp 1676 1C5.tmp 2084 213.tmp 2508 261.tmp 1596 2AF.tmp 3068 2FD.tmp 3064 34B.tmp 2976 3A9.tmp 892 406.tmp 316 454.tmp 2232 4B2.tmp 1572 500.tmp 2784 58C.tmp 2692 638.tmp 2640 6A5.tmp 2824 6E4.tmp 2748 741.tmp 2788 7AE.tmp 2584 7FC.tmp 2536 84A.tmp 2328 889.tmp 576 8E6.tmp 2820 944.tmp 2376 982.tmp 2352 9C1.tmp 2372 9FF.tmp 1612 A3E.tmp 1964 A8C.tmp 1520 ACA.tmp 2424 B08.tmp 2512 B47.tmp 2972 B85.tmp 2616 BC4.tmp 2516 C02.tmp 1476 C40.tmp 2436 C7F.tmp 3024 CBD.tmp -
Loads dropped DLL 64 IoCs
pid Process 2132 2024-09-19_29a6b917986bf01589dba61ed15faaed_mafia.exe 2760 F5B4.tmp 2640 F670.tmp 2776 F6DD.tmp 2944 F788.tmp 2536 F805.tmp 2612 F8C0.tmp 2936 F95C.tmp 2520 FA18.tmp 2372 FAB4.tmp 2388 FB40.tmp 484 FB8E.tmp 1984 FC68.tmp 1716 FCE5.tmp 988 FD33.tmp 2312 FD81.tmp 584 FDCF.tmp 2864 FE1D.tmp 1696 FE6B.tmp 2620 FEB9.tmp 916 FF07.tmp 2408 FF55.tmp 1916 FFB3.tmp 1256 FFF1.tmp 2496 3F.tmp 912 8D.tmp 1772 DB.tmp 3048 129.tmp 1768 177.tmp 1676 1C5.tmp 2084 213.tmp 2508 261.tmp 1596 2AF.tmp 3068 2FD.tmp 3064 34B.tmp 2976 3A9.tmp 892 406.tmp 316 454.tmp 2232 4B2.tmp 1572 500.tmp 2784 58C.tmp 2692 638.tmp 2640 6A5.tmp 2824 6E4.tmp 2748 741.tmp 2788 7AE.tmp 2584 7FC.tmp 2536 84A.tmp 2328 889.tmp 576 8E6.tmp 2820 944.tmp 2376 982.tmp 2352 9C1.tmp 2372 9FF.tmp 1612 A3E.tmp 1964 A8C.tmp 1520 ACA.tmp 2424 B08.tmp 2512 B47.tmp 2972 B85.tmp 2616 BC4.tmp 2516 C02.tmp 1476 C40.tmp 2436 C7F.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E77.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 982.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3987.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF2A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB73.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4357.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7501.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F547.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3801.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6FE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 818F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 958B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 281A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA58.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 588C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E512.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2132 wrote to memory of 2760 2132 2024-09-19_29a6b917986bf01589dba61ed15faaed_mafia.exe 30 PID 2132 wrote to memory of 2760 2132 2024-09-19_29a6b917986bf01589dba61ed15faaed_mafia.exe 30 PID 2132 wrote to memory of 2760 2132 2024-09-19_29a6b917986bf01589dba61ed15faaed_mafia.exe 30 PID 2132 wrote to memory of 2760 2132 2024-09-19_29a6b917986bf01589dba61ed15faaed_mafia.exe 30 PID 2760 wrote to memory of 2640 2760 F5B4.tmp 31 PID 2760 wrote to memory of 2640 2760 F5B4.tmp 31 PID 2760 wrote to memory of 2640 2760 F5B4.tmp 31 PID 2760 wrote to memory of 2640 2760 F5B4.tmp 31 PID 2640 wrote to memory of 2776 2640 F670.tmp 32 PID 2640 wrote to memory of 2776 2640 F670.tmp 32 PID 2640 wrote to memory of 2776 2640 F670.tmp 32 PID 2640 wrote to memory of 2776 2640 F670.tmp 32 PID 2776 wrote to memory of 2944 2776 F6DD.tmp 33 PID 2776 wrote to memory of 2944 2776 F6DD.tmp 33 PID 2776 wrote to memory of 2944 2776 F6DD.tmp 33 PID 2776 wrote to memory of 2944 2776 F6DD.tmp 33 PID 2944 wrote to memory of 2536 2944 F788.tmp 34 PID 2944 wrote to memory of 2536 2944 F788.tmp 34 PID 2944 wrote to memory of 2536 2944 F788.tmp 34 PID 2944 wrote to memory of 2536 2944 F788.tmp 34 PID 2536 wrote to memory of 2612 2536 F805.tmp 35 PID 2536 wrote to memory of 2612 2536 F805.tmp 35 PID 2536 wrote to memory of 2612 2536 F805.tmp 35 PID 2536 wrote to memory of 2612 2536 F805.tmp 35 PID 2612 wrote to memory of 2936 2612 F8C0.tmp 36 PID 2612 wrote to memory of 2936 2612 F8C0.tmp 36 PID 2612 wrote to memory of 2936 2612 F8C0.tmp 36 PID 2612 wrote to memory of 2936 2612 F8C0.tmp 36 PID 2936 wrote to memory of 2520 2936 F95C.tmp 37 PID 2936 wrote to memory of 2520 2936 F95C.tmp 37 PID 2936 wrote to memory of 2520 2936 F95C.tmp 37 PID 2936 wrote to memory of 2520 2936 F95C.tmp 37 PID 2520 wrote to memory of 2372 2520 FA18.tmp 38 PID 2520 wrote to memory of 2372 2520 FA18.tmp 38 PID 2520 wrote to memory of 2372 2520 FA18.tmp 38 PID 2520 wrote to memory of 2372 2520 FA18.tmp 38 PID 2372 wrote to memory of 2388 2372 FAB4.tmp 39 PID 2372 wrote to memory of 2388 2372 FAB4.tmp 39 PID 2372 wrote to memory of 2388 2372 FAB4.tmp 39 PID 2372 wrote to memory of 2388 2372 FAB4.tmp 39 PID 2388 wrote to memory of 484 2388 FB40.tmp 40 PID 2388 wrote to memory of 484 2388 FB40.tmp 40 PID 2388 wrote to memory of 484 2388 FB40.tmp 40 PID 2388 wrote to memory of 484 2388 FB40.tmp 40 PID 484 wrote to memory of 1984 484 FB8E.tmp 41 PID 484 wrote to memory of 1984 484 FB8E.tmp 41 PID 484 wrote to memory of 1984 484 FB8E.tmp 41 PID 484 wrote to memory of 1984 484 FB8E.tmp 41 PID 1984 wrote to memory of 1716 1984 FC68.tmp 42 PID 1984 wrote to memory of 1716 1984 FC68.tmp 42 PID 1984 wrote to memory of 1716 1984 FC68.tmp 42 PID 1984 wrote to memory of 1716 1984 FC68.tmp 42 PID 1716 wrote to memory of 988 1716 FCE5.tmp 43 PID 1716 wrote to memory of 988 1716 FCE5.tmp 43 PID 1716 wrote to memory of 988 1716 FCE5.tmp 43 PID 1716 wrote to memory of 988 1716 FCE5.tmp 43 PID 988 wrote to memory of 2312 988 FD33.tmp 44 PID 988 wrote to memory of 2312 988 FD33.tmp 44 PID 988 wrote to memory of 2312 988 FD33.tmp 44 PID 988 wrote to memory of 2312 988 FD33.tmp 44 PID 2312 wrote to memory of 584 2312 FD81.tmp 45 PID 2312 wrote to memory of 584 2312 FD81.tmp 45 PID 2312 wrote to memory of 584 2312 FD81.tmp 45 PID 2312 wrote to memory of 584 2312 FD81.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_29a6b917986bf01589dba61ed15faaed_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_29a6b917986bf01589dba61ed15faaed_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\F5B4.tmp"C:\Users\Admin\AppData\Local\Temp\F5B4.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\F670.tmp"C:\Users\Admin\AppData\Local\Temp\F670.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\F6DD.tmp"C:\Users\Admin\AppData\Local\Temp\F6DD.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\F788.tmp"C:\Users\Admin\AppData\Local\Temp\F788.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\F805.tmp"C:\Users\Admin\AppData\Local\Temp\F805.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\F8C0.tmp"C:\Users\Admin\AppData\Local\Temp\F8C0.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\F95C.tmp"C:\Users\Admin\AppData\Local\Temp\F95C.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\FA18.tmp"C:\Users\Admin\AppData\Local\Temp\FA18.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\FAB4.tmp"C:\Users\Admin\AppData\Local\Temp\FAB4.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\FB40.tmp"C:\Users\Admin\AppData\Local\Temp\FB40.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\FB8E.tmp"C:\Users\Admin\AppData\Local\Temp\FB8E.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:484 -
C:\Users\Admin\AppData\Local\Temp\FC68.tmp"C:\Users\Admin\AppData\Local\Temp\FC68.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\FCE5.tmp"C:\Users\Admin\AppData\Local\Temp\FCE5.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\FD33.tmp"C:\Users\Admin\AppData\Local\Temp\FD33.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Users\Admin\AppData\Local\Temp\FD81.tmp"C:\Users\Admin\AppData\Local\Temp\FD81.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\FDCF.tmp"C:\Users\Admin\AppData\Local\Temp\FDCF.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:584 -
C:\Users\Admin\AppData\Local\Temp\FE1D.tmp"C:\Users\Admin\AppData\Local\Temp\FE1D.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\FE6B.tmp"C:\Users\Admin\AppData\Local\Temp\FE6B.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\FEB9.tmp"C:\Users\Admin\AppData\Local\Temp\FEB9.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\FF07.tmp"C:\Users\Admin\AppData\Local\Temp\FF07.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:916 -
C:\Users\Admin\AppData\Local\Temp\FF55.tmp"C:\Users\Admin\AppData\Local\Temp\FF55.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\FFB3.tmp"C:\Users\Admin\AppData\Local\Temp\FFB3.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\FFF1.tmp"C:\Users\Admin\AppData\Local\Temp\FFF1.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\3F.tmp"C:\Users\Admin\AppData\Local\Temp\3F.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\8D.tmp"C:\Users\Admin\AppData\Local\Temp\8D.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:912 -
C:\Users\Admin\AppData\Local\Temp\DB.tmp"C:\Users\Admin\AppData\Local\Temp\DB.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\129.tmp"C:\Users\Admin\AppData\Local\Temp\129.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\177.tmp"C:\Users\Admin\AppData\Local\Temp\177.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\1C5.tmp"C:\Users\Admin\AppData\Local\Temp\1C5.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\213.tmp"C:\Users\Admin\AppData\Local\Temp\213.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\261.tmp"C:\Users\Admin\AppData\Local\Temp\261.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\2AF.tmp"C:\Users\Admin\AppData\Local\Temp\2AF.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\2FD.tmp"C:\Users\Admin\AppData\Local\Temp\2FD.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\34B.tmp"C:\Users\Admin\AppData\Local\Temp\34B.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\3A9.tmp"C:\Users\Admin\AppData\Local\Temp\3A9.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\406.tmp"C:\Users\Admin\AppData\Local\Temp\406.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:892 -
C:\Users\Admin\AppData\Local\Temp\454.tmp"C:\Users\Admin\AppData\Local\Temp\454.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:316 -
C:\Users\Admin\AppData\Local\Temp\4B2.tmp"C:\Users\Admin\AppData\Local\Temp\4B2.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\500.tmp"C:\Users\Admin\AppData\Local\Temp\500.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\58C.tmp"C:\Users\Admin\AppData\Local\Temp\58C.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\638.tmp"C:\Users\Admin\AppData\Local\Temp\638.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\6A5.tmp"C:\Users\Admin\AppData\Local\Temp\6A5.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\6E4.tmp"C:\Users\Admin\AppData\Local\Temp\6E4.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\741.tmp"C:\Users\Admin\AppData\Local\Temp\741.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\7AE.tmp"C:\Users\Admin\AppData\Local\Temp\7AE.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\7FC.tmp"C:\Users\Admin\AppData\Local\Temp\7FC.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\84A.tmp"C:\Users\Admin\AppData\Local\Temp\84A.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\889.tmp"C:\Users\Admin\AppData\Local\Temp\889.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\8E6.tmp"C:\Users\Admin\AppData\Local\Temp\8E6.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:576 -
C:\Users\Admin\AppData\Local\Temp\944.tmp"C:\Users\Admin\AppData\Local\Temp\944.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\982.tmp"C:\Users\Admin\AppData\Local\Temp\982.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\9C1.tmp"C:\Users\Admin\AppData\Local\Temp\9C1.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\9FF.tmp"C:\Users\Admin\AppData\Local\Temp\9FF.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\A3E.tmp"C:\Users\Admin\AppData\Local\Temp\A3E.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\A8C.tmp"C:\Users\Admin\AppData\Local\Temp\A8C.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\ACA.tmp"C:\Users\Admin\AppData\Local\Temp\ACA.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\B08.tmp"C:\Users\Admin\AppData\Local\Temp\B08.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\B47.tmp"C:\Users\Admin\AppData\Local\Temp\B47.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\B85.tmp"C:\Users\Admin\AppData\Local\Temp\B85.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\BC4.tmp"C:\Users\Admin\AppData\Local\Temp\BC4.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\C02.tmp"C:\Users\Admin\AppData\Local\Temp\C02.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\C40.tmp"C:\Users\Admin\AppData\Local\Temp\C40.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\C7F.tmp"C:\Users\Admin\AppData\Local\Temp\C7F.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\CBD.tmp"C:\Users\Admin\AppData\Local\Temp\CBD.tmp"65⤵
- Executes dropped EXE
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\CFC.tmp"C:\Users\Admin\AppData\Local\Temp\CFC.tmp"66⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\D3A.tmp"C:\Users\Admin\AppData\Local\Temp\D3A.tmp"67⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\D78.tmp"C:\Users\Admin\AppData\Local\Temp\D78.tmp"68⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\DB7.tmp"C:\Users\Admin\AppData\Local\Temp\DB7.tmp"69⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\DF5.tmp"C:\Users\Admin\AppData\Local\Temp\DF5.tmp"70⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\E34.tmp"C:\Users\Admin\AppData\Local\Temp\E34.tmp"71⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\E72.tmp"C:\Users\Admin\AppData\Local\Temp\E72.tmp"72⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\EB0.tmp"C:\Users\Admin\AppData\Local\Temp\EB0.tmp"73⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\EEF.tmp"C:\Users\Admin\AppData\Local\Temp\EEF.tmp"74⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\F2D.tmp"C:\Users\Admin\AppData\Local\Temp\F2D.tmp"75⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\F6C.tmp"C:\Users\Admin\AppData\Local\Temp\F6C.tmp"76⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\FAA.tmp"C:\Users\Admin\AppData\Local\Temp\FAA.tmp"77⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\FE8.tmp"C:\Users\Admin\AppData\Local\Temp\FE8.tmp"78⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\1027.tmp"C:\Users\Admin\AppData\Local\Temp\1027.tmp"79⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\1065.tmp"C:\Users\Admin\AppData\Local\Temp\1065.tmp"80⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\10A4.tmp"C:\Users\Admin\AppData\Local\Temp\10A4.tmp"81⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\10E2.tmp"C:\Users\Admin\AppData\Local\Temp\10E2.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\1120.tmp"C:\Users\Admin\AppData\Local\Temp\1120.tmp"83⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\115F.tmp"C:\Users\Admin\AppData\Local\Temp\115F.tmp"84⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\119D.tmp"C:\Users\Admin\AppData\Local\Temp\119D.tmp"85⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\11DC.tmp"C:\Users\Admin\AppData\Local\Temp\11DC.tmp"86⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\121A.tmp"C:\Users\Admin\AppData\Local\Temp\121A.tmp"87⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\1278.tmp"C:\Users\Admin\AppData\Local\Temp\1278.tmp"88⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\12B6.tmp"C:\Users\Admin\AppData\Local\Temp\12B6.tmp"89⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\12F4.tmp"C:\Users\Admin\AppData\Local\Temp\12F4.tmp"90⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\1333.tmp"C:\Users\Admin\AppData\Local\Temp\1333.tmp"91⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\1371.tmp"C:\Users\Admin\AppData\Local\Temp\1371.tmp"92⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\13BF.tmp"C:\Users\Admin\AppData\Local\Temp\13BF.tmp"93⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\13FE.tmp"C:\Users\Admin\AppData\Local\Temp\13FE.tmp"94⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\143C.tmp"C:\Users\Admin\AppData\Local\Temp\143C.tmp"95⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\147A.tmp"C:\Users\Admin\AppData\Local\Temp\147A.tmp"96⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\14B9.tmp"C:\Users\Admin\AppData\Local\Temp\14B9.tmp"97⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\14F7.tmp"C:\Users\Admin\AppData\Local\Temp\14F7.tmp"98⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\1536.tmp"C:\Users\Admin\AppData\Local\Temp\1536.tmp"99⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\1574.tmp"C:\Users\Admin\AppData\Local\Temp\1574.tmp"100⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\15B2.tmp"C:\Users\Admin\AppData\Local\Temp\15B2.tmp"101⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\15F1.tmp"C:\Users\Admin\AppData\Local\Temp\15F1.tmp"102⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\162F.tmp"C:\Users\Admin\AppData\Local\Temp\162F.tmp"103⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\166E.tmp"C:\Users\Admin\AppData\Local\Temp\166E.tmp"104⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\16AC.tmp"C:\Users\Admin\AppData\Local\Temp\16AC.tmp"105⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\16EA.tmp"C:\Users\Admin\AppData\Local\Temp\16EA.tmp"106⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\1729.tmp"C:\Users\Admin\AppData\Local\Temp\1729.tmp"107⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\1767.tmp"C:\Users\Admin\AppData\Local\Temp\1767.tmp"108⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\17A6.tmp"C:\Users\Admin\AppData\Local\Temp\17A6.tmp"109⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\17E4.tmp"C:\Users\Admin\AppData\Local\Temp\17E4.tmp"110⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\1822.tmp"C:\Users\Admin\AppData\Local\Temp\1822.tmp"111⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\1861.tmp"C:\Users\Admin\AppData\Local\Temp\1861.tmp"112⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\189F.tmp"C:\Users\Admin\AppData\Local\Temp\189F.tmp"113⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\18DE.tmp"C:\Users\Admin\AppData\Local\Temp\18DE.tmp"114⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\191C.tmp"C:\Users\Admin\AppData\Local\Temp\191C.tmp"115⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\195A.tmp"C:\Users\Admin\AppData\Local\Temp\195A.tmp"116⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\1999.tmp"C:\Users\Admin\AppData\Local\Temp\1999.tmp"117⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\19D7.tmp"C:\Users\Admin\AppData\Local\Temp\19D7.tmp"118⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\1A16.tmp"C:\Users\Admin\AppData\Local\Temp\1A16.tmp"119⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\1A54.tmp"C:\Users\Admin\AppData\Local\Temp\1A54.tmp"120⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\1A92.tmp"C:\Users\Admin\AppData\Local\Temp\1A92.tmp"121⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"122⤵PID:1748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-