Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 03:54
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-19_5237cdd765a3ec0a682afc5a19a8dae3_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-09-19_5237cdd765a3ec0a682afc5a19a8dae3_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-19_5237cdd765a3ec0a682afc5a19a8dae3_mafia.exe
-
Size
765KB
-
MD5
5237cdd765a3ec0a682afc5a19a8dae3
-
SHA1
8df1c545256f9069811bd53d25b53229bcaf1d61
-
SHA256
66fd0c320c7a6969b63a30b492402e0df5c13c0a7a5211d9f0d29b4ccc2bf7f1
-
SHA512
a71bfcf77e7e62f6bbf329f6045696c6302cd99b0853fadf5941d7ec76f381e7777c14520278cc1186714c781b34a643b2cf4c98eea7b0061ade80645842820e
-
SSDEEP
12288:ZU5rCOTeiDBw8h99P3pNu9EhItyoRz+DUt3ZF5rn5rLOa54U5w5A:ZUQOJDBwyPXgEhItjRzeUt3vh5Oa+UOS
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2496 A709.tmp 576 A757.tmp 2344 A7E3.tmp 2096 A860.tmp 2404 A8DD.tmp 2660 A93A.tmp 2744 A9A7.tmp 2768 AA15.tmp 2560 AA91.tmp 1980 AAFF.tmp 3064 AB5C.tmp 2780 ABC9.tmp 2604 AC46.tmp 3068 ACD3.tmp 1712 AD11.tmp 944 AD6F.tmp 2820 ADDC.tmp 2088 AE78.tmp 2296 AEE5.tmp 544 AF43.tmp 2456 AFA0.tmp 2860 B01D.tmp 1280 B07B.tmp 1764 B0B9.tmp 2984 B0F7.tmp 2864 B145.tmp 2592 B193.tmp 2264 B1E1.tmp 2156 B220.tmp 2244 B26E.tmp 2204 B2AC.tmp 1488 B2EB.tmp 1804 B329.tmp 1664 B367.tmp 1128 B3A6.tmp 1960 B3E4.tmp 2424 B423.tmp 2220 B461.tmp 1520 B49F.tmp 328 B4DE.tmp 1560 B51C.tmp 1844 B55B.tmp 1620 B599.tmp 1340 B5E7.tmp 2232 B635.tmp 1296 B673.tmp 2068 B6B2.tmp 2148 B700.tmp 2508 B73E.tmp 2320 B77D.tmp 2228 B7CB.tmp 1552 B809.tmp 2488 B847.tmp 1908 B886.tmp 1216 B8C4.tmp 2352 B903.tmp 2480 B951.tmp 2828 B98F.tmp 2880 B9CD.tmp 1628 BA1B.tmp 2696 BA69.tmp 2748 BAA8.tmp 2816 BAE6.tmp 2736 BB25.tmp -
Loads dropped DLL 64 IoCs
pid Process 1540 2024-09-19_5237cdd765a3ec0a682afc5a19a8dae3_mafia.exe 2496 A709.tmp 576 A757.tmp 2344 A7E3.tmp 2096 A860.tmp 2404 A8DD.tmp 2660 A93A.tmp 2744 A9A7.tmp 2768 AA15.tmp 2560 AA91.tmp 1980 AAFF.tmp 3064 AB5C.tmp 2780 ABC9.tmp 2604 AC46.tmp 3068 ACD3.tmp 1712 AD11.tmp 944 AD6F.tmp 2820 ADDC.tmp 2088 AE78.tmp 2296 AEE5.tmp 544 AF43.tmp 2456 AFA0.tmp 2860 B01D.tmp 1280 B07B.tmp 1764 B0B9.tmp 2984 B0F7.tmp 2864 B145.tmp 2592 B193.tmp 2264 B1E1.tmp 2156 B220.tmp 2244 B26E.tmp 2204 B2AC.tmp 1488 B2EB.tmp 1804 B329.tmp 1664 B367.tmp 1128 B3A6.tmp 1960 B3E4.tmp 2424 B423.tmp 2220 B461.tmp 1520 B49F.tmp 328 B4DE.tmp 1560 B51C.tmp 1844 B55B.tmp 1620 B599.tmp 1340 B5E7.tmp 2232 B635.tmp 1296 B673.tmp 2068 B6B2.tmp 2148 B700.tmp 2508 B73E.tmp 2320 B77D.tmp 2228 B7CB.tmp 1552 B809.tmp 2488 B847.tmp 1908 B886.tmp 1216 B8C4.tmp 2352 B903.tmp 2480 B951.tmp 2828 B98F.tmp 2880 B9CD.tmp 1628 BA1B.tmp 2696 BA69.tmp 2748 BAA8.tmp 2816 BAE6.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C10.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A709.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4EEB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 474D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A93A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1526.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF4E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A93B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 847B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7233.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 213.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8823.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D163.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C561.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 866F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 628A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7899.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCE7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D4B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1540 wrote to memory of 2496 1540 2024-09-19_5237cdd765a3ec0a682afc5a19a8dae3_mafia.exe 30 PID 1540 wrote to memory of 2496 1540 2024-09-19_5237cdd765a3ec0a682afc5a19a8dae3_mafia.exe 30 PID 1540 wrote to memory of 2496 1540 2024-09-19_5237cdd765a3ec0a682afc5a19a8dae3_mafia.exe 30 PID 1540 wrote to memory of 2496 1540 2024-09-19_5237cdd765a3ec0a682afc5a19a8dae3_mafia.exe 30 PID 2496 wrote to memory of 576 2496 A709.tmp 31 PID 2496 wrote to memory of 576 2496 A709.tmp 31 PID 2496 wrote to memory of 576 2496 A709.tmp 31 PID 2496 wrote to memory of 576 2496 A709.tmp 31 PID 576 wrote to memory of 2344 576 A757.tmp 32 PID 576 wrote to memory of 2344 576 A757.tmp 32 PID 576 wrote to memory of 2344 576 A757.tmp 32 PID 576 wrote to memory of 2344 576 A757.tmp 32 PID 2344 wrote to memory of 2096 2344 A7E3.tmp 33 PID 2344 wrote to memory of 2096 2344 A7E3.tmp 33 PID 2344 wrote to memory of 2096 2344 A7E3.tmp 33 PID 2344 wrote to memory of 2096 2344 A7E3.tmp 33 PID 2096 wrote to memory of 2404 2096 A860.tmp 34 PID 2096 wrote to memory of 2404 2096 A860.tmp 34 PID 2096 wrote to memory of 2404 2096 A860.tmp 34 PID 2096 wrote to memory of 2404 2096 A860.tmp 34 PID 2404 wrote to memory of 2660 2404 A8DD.tmp 35 PID 2404 wrote to memory of 2660 2404 A8DD.tmp 35 PID 2404 wrote to memory of 2660 2404 A8DD.tmp 35 PID 2404 wrote to memory of 2660 2404 A8DD.tmp 35 PID 2660 wrote to memory of 2744 2660 A93A.tmp 36 PID 2660 wrote to memory of 2744 2660 A93A.tmp 36 PID 2660 wrote to memory of 2744 2660 A93A.tmp 36 PID 2660 wrote to memory of 2744 2660 A93A.tmp 36 PID 2744 wrote to memory of 2768 2744 A9A7.tmp 37 PID 2744 wrote to memory of 2768 2744 A9A7.tmp 37 PID 2744 wrote to memory of 2768 2744 A9A7.tmp 37 PID 2744 wrote to memory of 2768 2744 A9A7.tmp 37 PID 2768 wrote to memory of 2560 2768 AA15.tmp 38 PID 2768 wrote to memory of 2560 2768 AA15.tmp 38 PID 2768 wrote to memory of 2560 2768 AA15.tmp 38 PID 2768 wrote to memory of 2560 2768 AA15.tmp 38 PID 2560 wrote to memory of 1980 2560 AA91.tmp 39 PID 2560 wrote to memory of 1980 2560 AA91.tmp 39 PID 2560 wrote to memory of 1980 2560 AA91.tmp 39 PID 2560 wrote to memory of 1980 2560 AA91.tmp 39 PID 1980 wrote to memory of 3064 1980 AAFF.tmp 40 PID 1980 wrote to memory of 3064 1980 AAFF.tmp 40 PID 1980 wrote to memory of 3064 1980 AAFF.tmp 40 PID 1980 wrote to memory of 3064 1980 AAFF.tmp 40 PID 3064 wrote to memory of 2780 3064 AB5C.tmp 41 PID 3064 wrote to memory of 2780 3064 AB5C.tmp 41 PID 3064 wrote to memory of 2780 3064 AB5C.tmp 41 PID 3064 wrote to memory of 2780 3064 AB5C.tmp 41 PID 2780 wrote to memory of 2604 2780 ABC9.tmp 42 PID 2780 wrote to memory of 2604 2780 ABC9.tmp 42 PID 2780 wrote to memory of 2604 2780 ABC9.tmp 42 PID 2780 wrote to memory of 2604 2780 ABC9.tmp 42 PID 2604 wrote to memory of 3068 2604 AC46.tmp 43 PID 2604 wrote to memory of 3068 2604 AC46.tmp 43 PID 2604 wrote to memory of 3068 2604 AC46.tmp 43 PID 2604 wrote to memory of 3068 2604 AC46.tmp 43 PID 3068 wrote to memory of 1712 3068 ACD3.tmp 44 PID 3068 wrote to memory of 1712 3068 ACD3.tmp 44 PID 3068 wrote to memory of 1712 3068 ACD3.tmp 44 PID 3068 wrote to memory of 1712 3068 ACD3.tmp 44 PID 1712 wrote to memory of 944 1712 AD11.tmp 45 PID 1712 wrote to memory of 944 1712 AD11.tmp 45 PID 1712 wrote to memory of 944 1712 AD11.tmp 45 PID 1712 wrote to memory of 944 1712 AD11.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_5237cdd765a3ec0a682afc5a19a8dae3_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_5237cdd765a3ec0a682afc5a19a8dae3_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\A709.tmp"C:\Users\Admin\AppData\Local\Temp\A709.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\A757.tmp"C:\Users\Admin\AppData\Local\Temp\A757.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Users\Admin\AppData\Local\Temp\A7E3.tmp"C:\Users\Admin\AppData\Local\Temp\A7E3.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\A860.tmp"C:\Users\Admin\AppData\Local\Temp\A860.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\A8DD.tmp"C:\Users\Admin\AppData\Local\Temp\A8DD.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\A93A.tmp"C:\Users\Admin\AppData\Local\Temp\A93A.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\A9A7.tmp"C:\Users\Admin\AppData\Local\Temp\A9A7.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\AA15.tmp"C:\Users\Admin\AppData\Local\Temp\AA15.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\AA91.tmp"C:\Users\Admin\AppData\Local\Temp\AA91.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\AAFF.tmp"C:\Users\Admin\AppData\Local\Temp\AAFF.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\AB5C.tmp"C:\Users\Admin\AppData\Local\Temp\AB5C.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\ABC9.tmp"C:\Users\Admin\AppData\Local\Temp\ABC9.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\AC46.tmp"C:\Users\Admin\AppData\Local\Temp\AC46.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\ACD3.tmp"C:\Users\Admin\AppData\Local\Temp\ACD3.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\AD11.tmp"C:\Users\Admin\AppData\Local\Temp\AD11.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\AD6F.tmp"C:\Users\Admin\AppData\Local\Temp\AD6F.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:944 -
C:\Users\Admin\AppData\Local\Temp\ADDC.tmp"C:\Users\Admin\AppData\Local\Temp\ADDC.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\AE78.tmp"C:\Users\Admin\AppData\Local\Temp\AE78.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\AEE5.tmp"C:\Users\Admin\AppData\Local\Temp\AEE5.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\AF43.tmp"C:\Users\Admin\AppData\Local\Temp\AF43.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:544 -
C:\Users\Admin\AppData\Local\Temp\AFA0.tmp"C:\Users\Admin\AppData\Local\Temp\AFA0.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\B01D.tmp"C:\Users\Admin\AppData\Local\Temp\B01D.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\B07B.tmp"C:\Users\Admin\AppData\Local\Temp\B07B.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\B0B9.tmp"C:\Users\Admin\AppData\Local\Temp\B0B9.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\B145.tmp"C:\Users\Admin\AppData\Local\Temp\B145.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\B193.tmp"C:\Users\Admin\AppData\Local\Temp\B193.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\B1E1.tmp"C:\Users\Admin\AppData\Local\Temp\B1E1.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\B220.tmp"C:\Users\Admin\AppData\Local\Temp\B220.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\B26E.tmp"C:\Users\Admin\AppData\Local\Temp\B26E.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\B2AC.tmp"C:\Users\Admin\AppData\Local\Temp\B2AC.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\B2EB.tmp"C:\Users\Admin\AppData\Local\Temp\B2EB.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\B329.tmp"C:\Users\Admin\AppData\Local\Temp\B329.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\B367.tmp"C:\Users\Admin\AppData\Local\Temp\B367.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\B3A6.tmp"C:\Users\Admin\AppData\Local\Temp\B3A6.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\B3E4.tmp"C:\Users\Admin\AppData\Local\Temp\B3E4.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\B423.tmp"C:\Users\Admin\AppData\Local\Temp\B423.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\B461.tmp"C:\Users\Admin\AppData\Local\Temp\B461.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\B49F.tmp"C:\Users\Admin\AppData\Local\Temp\B49F.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\B4DE.tmp"C:\Users\Admin\AppData\Local\Temp\B4DE.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:328 -
C:\Users\Admin\AppData\Local\Temp\B51C.tmp"C:\Users\Admin\AppData\Local\Temp\B51C.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\B55B.tmp"C:\Users\Admin\AppData\Local\Temp\B55B.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\B599.tmp"C:\Users\Admin\AppData\Local\Temp\B599.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\B5E7.tmp"C:\Users\Admin\AppData\Local\Temp\B5E7.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\B635.tmp"C:\Users\Admin\AppData\Local\Temp\B635.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\B673.tmp"C:\Users\Admin\AppData\Local\Temp\B673.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\B6B2.tmp"C:\Users\Admin\AppData\Local\Temp\B6B2.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\B700.tmp"C:\Users\Admin\AppData\Local\Temp\B700.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\B73E.tmp"C:\Users\Admin\AppData\Local\Temp\B73E.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\B77D.tmp"C:\Users\Admin\AppData\Local\Temp\B77D.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\B7CB.tmp"C:\Users\Admin\AppData\Local\Temp\B7CB.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\B809.tmp"C:\Users\Admin\AppData\Local\Temp\B809.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\B847.tmp"C:\Users\Admin\AppData\Local\Temp\B847.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\B886.tmp"C:\Users\Admin\AppData\Local\Temp\B886.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\B8C4.tmp"C:\Users\Admin\AppData\Local\Temp\B8C4.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\B903.tmp"C:\Users\Admin\AppData\Local\Temp\B903.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\B951.tmp"C:\Users\Admin\AppData\Local\Temp\B951.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\B98F.tmp"C:\Users\Admin\AppData\Local\Temp\B98F.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\B9CD.tmp"C:\Users\Admin\AppData\Local\Temp\B9CD.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\BA1B.tmp"C:\Users\Admin\AppData\Local\Temp\BA1B.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\BA69.tmp"C:\Users\Admin\AppData\Local\Temp\BA69.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\BAA8.tmp"C:\Users\Admin\AppData\Local\Temp\BAA8.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\BAE6.tmp"C:\Users\Admin\AppData\Local\Temp\BAE6.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\BB25.tmp"C:\Users\Admin\AppData\Local\Temp\BB25.tmp"65⤵
- Executes dropped EXE
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\BB63.tmp"C:\Users\Admin\AppData\Local\Temp\BB63.tmp"66⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\BBB1.tmp"C:\Users\Admin\AppData\Local\Temp\BBB1.tmp"67⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\BBFF.tmp"C:\Users\Admin\AppData\Local\Temp\BBFF.tmp"68⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\BC3D.tmp"C:\Users\Admin\AppData\Local\Temp\BC3D.tmp"69⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\BC8B.tmp"C:\Users\Admin\AppData\Local\Temp\BC8B.tmp"70⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\BCCA.tmp"C:\Users\Admin\AppData\Local\Temp\BCCA.tmp"71⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\BD08.tmp"C:\Users\Admin\AppData\Local\Temp\BD08.tmp"72⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\BD56.tmp"C:\Users\Admin\AppData\Local\Temp\BD56.tmp"73⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\BDA4.tmp"C:\Users\Admin\AppData\Local\Temp\BDA4.tmp"74⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\BDE3.tmp"C:\Users\Admin\AppData\Local\Temp\BDE3.tmp"75⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\BE21.tmp"C:\Users\Admin\AppData\Local\Temp\BE21.tmp"76⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\BE5F.tmp"C:\Users\Admin\AppData\Local\Temp\BE5F.tmp"77⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\BE9E.tmp"C:\Users\Admin\AppData\Local\Temp\BE9E.tmp"78⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\BEDC.tmp"C:\Users\Admin\AppData\Local\Temp\BEDC.tmp"79⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\BF1B.tmp"C:\Users\Admin\AppData\Local\Temp\BF1B.tmp"80⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\BF69.tmp"C:\Users\Admin\AppData\Local\Temp\BF69.tmp"81⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\BFA7.tmp"C:\Users\Admin\AppData\Local\Temp\BFA7.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"83⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\C024.tmp"C:\Users\Admin\AppData\Local\Temp\C024.tmp"84⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\C062.tmp"C:\Users\Admin\AppData\Local\Temp\C062.tmp"85⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\C0A1.tmp"C:\Users\Admin\AppData\Local\Temp\C0A1.tmp"86⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"87⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\C11D.tmp"C:\Users\Admin\AppData\Local\Temp\C11D.tmp"88⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\C15C.tmp"C:\Users\Admin\AppData\Local\Temp\C15C.tmp"89⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\C19A.tmp"C:\Users\Admin\AppData\Local\Temp\C19A.tmp"90⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"91⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\C217.tmp"C:\Users\Admin\AppData\Local\Temp\C217.tmp"92⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\C255.tmp"C:\Users\Admin\AppData\Local\Temp\C255.tmp"93⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\C294.tmp"C:\Users\Admin\AppData\Local\Temp\C294.tmp"94⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\C2D2.tmp"C:\Users\Admin\AppData\Local\Temp\C2D2.tmp"95⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\C330.tmp"C:\Users\Admin\AppData\Local\Temp\C330.tmp"96⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\C36E.tmp"C:\Users\Admin\AppData\Local\Temp\C36E.tmp"97⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\C3AD.tmp"C:\Users\Admin\AppData\Local\Temp\C3AD.tmp"98⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\C3EB.tmp"C:\Users\Admin\AppData\Local\Temp\C3EB.tmp"99⤵PID:284
-
C:\Users\Admin\AppData\Local\Temp\C429.tmp"C:\Users\Admin\AppData\Local\Temp\C429.tmp"100⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\C468.tmp"C:\Users\Admin\AppData\Local\Temp\C468.tmp"101⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\C4A6.tmp"C:\Users\Admin\AppData\Local\Temp\C4A6.tmp"102⤵PID:292
-
C:\Users\Admin\AppData\Local\Temp\C4E5.tmp"C:\Users\Admin\AppData\Local\Temp\C4E5.tmp"103⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\C523.tmp"C:\Users\Admin\AppData\Local\Temp\C523.tmp"104⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\C561.tmp"C:\Users\Admin\AppData\Local\Temp\C561.tmp"105⤵
- System Location Discovery: System Language Discovery
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\C5A0.tmp"C:\Users\Admin\AppData\Local\Temp\C5A0.tmp"106⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\C5DE.tmp"C:\Users\Admin\AppData\Local\Temp\C5DE.tmp"107⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\C62C.tmp"C:\Users\Admin\AppData\Local\Temp\C62C.tmp"108⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\C66B.tmp"C:\Users\Admin\AppData\Local\Temp\C66B.tmp"109⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\C6A9.tmp"C:\Users\Admin\AppData\Local\Temp\C6A9.tmp"110⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\C6F7.tmp"C:\Users\Admin\AppData\Local\Temp\C6F7.tmp"111⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\C735.tmp"C:\Users\Admin\AppData\Local\Temp\C735.tmp"112⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\C774.tmp"C:\Users\Admin\AppData\Local\Temp\C774.tmp"113⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\C7C2.tmp"C:\Users\Admin\AppData\Local\Temp\C7C2.tmp"114⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\C800.tmp"C:\Users\Admin\AppData\Local\Temp\C800.tmp"115⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\C83F.tmp"C:\Users\Admin\AppData\Local\Temp\C83F.tmp"116⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\C87D.tmp"C:\Users\Admin\AppData\Local\Temp\C87D.tmp"117⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\C8BB.tmp"C:\Users\Admin\AppData\Local\Temp\C8BB.tmp"118⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\C909.tmp"C:\Users\Admin\AppData\Local\Temp\C909.tmp"119⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\C948.tmp"C:\Users\Admin\AppData\Local\Temp\C948.tmp"120⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\C986.tmp"C:\Users\Admin\AppData\Local\Temp\C986.tmp"121⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\C9C5.tmp"C:\Users\Admin\AppData\Local\Temp\C9C5.tmp"122⤵PID:3004
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-