Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 04:07
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-19_cd05e285523949cd2d71849ae11cfffd_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-09-19_cd05e285523949cd2d71849ae11cfffd_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-19_cd05e285523949cd2d71849ae11cfffd_mafia.exe
-
Size
530KB
-
MD5
cd05e285523949cd2d71849ae11cfffd
-
SHA1
ab4e21b9b36ed3a2eca698b91ee4b61ec240d779
-
SHA256
67025d063deb6b2952b70837c0e2e19f7300403722fc7e7671470534c970106f
-
SHA512
274dada9fc12baa59b7a947f966e5b35f3c63edd6fc7212d96d3a778b414be3e8d09a20c31681d7c6e38049d27cfb1856eed5b96d892bc1a39c148929af563ef
-
SSDEEP
12288:AU5rCOTeioSOJpmGRuF3LI+NZulFVg0M1:AUQOJoSOJpmGMF3L7NclFV/M1
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2508 A7A5.tmp 2200 A841.tmp 804 A8EC.tmp 2792 A969.tmp 2804 A9F5.tmp 3032 AA43.tmp 2248 AAA1.tmp 2316 AB7B.tmp 2644 ABE9.tmp 2884 AC85.tmp 2664 ACD3.tmp 2652 AD6F.tmp 1680 ADBD.tmp 2044 AE49.tmp 1364 AEB6.tmp 2984 AF52.tmp 1636 AFEE.tmp 2920 B04C.tmp 540 B09A.tmp 656 B126.tmp 1732 B165.tmp 2024 B210.tmp 1156 B29D.tmp 2344 B2EB.tmp 2188 B339.tmp 2208 B387.tmp 2560 B3C5.tmp 2536 B413.tmp 1988 B461.tmp 1632 B49F.tmp 1536 B4ED.tmp 816 B53B.tmp 3044 B589.tmp 2924 B5D7.tmp 1860 B616.tmp 1620 B654.tmp 2328 B693.tmp 836 B6D1.tmp 1628 B71F.tmp 1576 B75D.tmp 1612 B7AB.tmp 752 B7EA.tmp 2288 B838.tmp 2484 B876.tmp 2456 B8C4.tmp 2256 B912.tmp 2380 B960.tmp 1660 B99F.tmp 536 B9ED.tmp 1644 BA2B.tmp 876 BA89.tmp 2068 BAC7.tmp 1592 BB15.tmp 2324 BB63.tmp 3064 BBA1.tmp 1672 BBE0.tmp 1940 BC2E.tmp 1708 BC7C.tmp 2372 BCCA.tmp 2756 BD08.tmp 2792 BD47.tmp 2532 BD85.tmp 2216 BDD3.tmp 3032 BE21.tmp -
Loads dropped DLL 64 IoCs
pid Process 3064 2024-09-19_cd05e285523949cd2d71849ae11cfffd_mafia.exe 2508 A7A5.tmp 2200 A841.tmp 804 A8EC.tmp 2792 A969.tmp 2804 A9F5.tmp 3032 AA43.tmp 2248 AAA1.tmp 2316 AB7B.tmp 2644 ABE9.tmp 2884 AC85.tmp 2664 ACD3.tmp 2652 AD6F.tmp 1680 ADBD.tmp 2044 AE49.tmp 1364 AEB6.tmp 2984 AF52.tmp 1636 AFEE.tmp 2920 B04C.tmp 540 B09A.tmp 656 B126.tmp 1732 B165.tmp 2024 B210.tmp 1156 B29D.tmp 2344 B2EB.tmp 2188 B339.tmp 2208 B387.tmp 2560 B3C5.tmp 2536 B413.tmp 1988 B461.tmp 1632 B49F.tmp 1536 B4ED.tmp 816 B53B.tmp 3044 B589.tmp 2924 B5D7.tmp 1860 B616.tmp 1620 B654.tmp 2328 B693.tmp 836 B6D1.tmp 1628 B71F.tmp 1576 B75D.tmp 1612 B7AB.tmp 752 B7EA.tmp 2288 B838.tmp 2484 B876.tmp 2456 B8C4.tmp 2256 B912.tmp 2380 B960.tmp 1660 B99F.tmp 536 B9ED.tmp 1644 BA2B.tmp 876 BA89.tmp 2068 BAC7.tmp 1592 BB15.tmp 2324 BB63.tmp 3064 BBA1.tmp 1672 BBE0.tmp 1940 BC2E.tmp 1708 BC7C.tmp 2372 BCCA.tmp 2756 BD08.tmp 2792 BD47.tmp 2532 BD85.tmp 2216 BDD3.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 824A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2980.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B480.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5032.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 344A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B4E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 423E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D172.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B26E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C439.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B413.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4CC.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3064 wrote to memory of 2508 3064 2024-09-19_cd05e285523949cd2d71849ae11cfffd_mafia.exe 30 PID 3064 wrote to memory of 2508 3064 2024-09-19_cd05e285523949cd2d71849ae11cfffd_mafia.exe 30 PID 3064 wrote to memory of 2508 3064 2024-09-19_cd05e285523949cd2d71849ae11cfffd_mafia.exe 30 PID 3064 wrote to memory of 2508 3064 2024-09-19_cd05e285523949cd2d71849ae11cfffd_mafia.exe 30 PID 2508 wrote to memory of 2200 2508 A7A5.tmp 31 PID 2508 wrote to memory of 2200 2508 A7A5.tmp 31 PID 2508 wrote to memory of 2200 2508 A7A5.tmp 31 PID 2508 wrote to memory of 2200 2508 A7A5.tmp 31 PID 2200 wrote to memory of 804 2200 A841.tmp 32 PID 2200 wrote to memory of 804 2200 A841.tmp 32 PID 2200 wrote to memory of 804 2200 A841.tmp 32 PID 2200 wrote to memory of 804 2200 A841.tmp 32 PID 804 wrote to memory of 2792 804 A8EC.tmp 33 PID 804 wrote to memory of 2792 804 A8EC.tmp 33 PID 804 wrote to memory of 2792 804 A8EC.tmp 33 PID 804 wrote to memory of 2792 804 A8EC.tmp 33 PID 2792 wrote to memory of 2804 2792 A969.tmp 34 PID 2792 wrote to memory of 2804 2792 A969.tmp 34 PID 2792 wrote to memory of 2804 2792 A969.tmp 34 PID 2792 wrote to memory of 2804 2792 A969.tmp 34 PID 2804 wrote to memory of 3032 2804 A9F5.tmp 35 PID 2804 wrote to memory of 3032 2804 A9F5.tmp 35 PID 2804 wrote to memory of 3032 2804 A9F5.tmp 35 PID 2804 wrote to memory of 3032 2804 A9F5.tmp 35 PID 3032 wrote to memory of 2248 3032 AA43.tmp 36 PID 3032 wrote to memory of 2248 3032 AA43.tmp 36 PID 3032 wrote to memory of 2248 3032 AA43.tmp 36 PID 3032 wrote to memory of 2248 3032 AA43.tmp 36 PID 2248 wrote to memory of 2316 2248 AAA1.tmp 37 PID 2248 wrote to memory of 2316 2248 AAA1.tmp 37 PID 2248 wrote to memory of 2316 2248 AAA1.tmp 37 PID 2248 wrote to memory of 2316 2248 AAA1.tmp 37 PID 2316 wrote to memory of 2644 2316 AB7B.tmp 38 PID 2316 wrote to memory of 2644 2316 AB7B.tmp 38 PID 2316 wrote to memory of 2644 2316 AB7B.tmp 38 PID 2316 wrote to memory of 2644 2316 AB7B.tmp 38 PID 2644 wrote to memory of 2884 2644 ABE9.tmp 39 PID 2644 wrote to memory of 2884 2644 ABE9.tmp 39 PID 2644 wrote to memory of 2884 2644 ABE9.tmp 39 PID 2644 wrote to memory of 2884 2644 ABE9.tmp 39 PID 2884 wrote to memory of 2664 2884 AC85.tmp 40 PID 2884 wrote to memory of 2664 2884 AC85.tmp 40 PID 2884 wrote to memory of 2664 2884 AC85.tmp 40 PID 2884 wrote to memory of 2664 2884 AC85.tmp 40 PID 2664 wrote to memory of 2652 2664 ACD3.tmp 41 PID 2664 wrote to memory of 2652 2664 ACD3.tmp 41 PID 2664 wrote to memory of 2652 2664 ACD3.tmp 41 PID 2664 wrote to memory of 2652 2664 ACD3.tmp 41 PID 2652 wrote to memory of 1680 2652 AD6F.tmp 42 PID 2652 wrote to memory of 1680 2652 AD6F.tmp 42 PID 2652 wrote to memory of 1680 2652 AD6F.tmp 42 PID 2652 wrote to memory of 1680 2652 AD6F.tmp 42 PID 1680 wrote to memory of 2044 1680 ADBD.tmp 43 PID 1680 wrote to memory of 2044 1680 ADBD.tmp 43 PID 1680 wrote to memory of 2044 1680 ADBD.tmp 43 PID 1680 wrote to memory of 2044 1680 ADBD.tmp 43 PID 2044 wrote to memory of 1364 2044 AE49.tmp 44 PID 2044 wrote to memory of 1364 2044 AE49.tmp 44 PID 2044 wrote to memory of 1364 2044 AE49.tmp 44 PID 2044 wrote to memory of 1364 2044 AE49.tmp 44 PID 1364 wrote to memory of 2984 1364 AEB6.tmp 45 PID 1364 wrote to memory of 2984 1364 AEB6.tmp 45 PID 1364 wrote to memory of 2984 1364 AEB6.tmp 45 PID 1364 wrote to memory of 2984 1364 AEB6.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_cd05e285523949cd2d71849ae11cfffd_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_cd05e285523949cd2d71849ae11cfffd_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\A841.tmp"C:\Users\Admin\AppData\Local\Temp\A841.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\A8EC.tmp"C:\Users\Admin\AppData\Local\Temp\A8EC.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Users\Admin\AppData\Local\Temp\A969.tmp"C:\Users\Admin\AppData\Local\Temp\A969.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\A9F5.tmp"C:\Users\Admin\AppData\Local\Temp\A9F5.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\AA43.tmp"C:\Users\Admin\AppData\Local\Temp\AA43.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\AAA1.tmp"C:\Users\Admin\AppData\Local\Temp\AAA1.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\AB7B.tmp"C:\Users\Admin\AppData\Local\Temp\AB7B.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\ABE9.tmp"C:\Users\Admin\AppData\Local\Temp\ABE9.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\AC85.tmp"C:\Users\Admin\AppData\Local\Temp\AC85.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\ACD3.tmp"C:\Users\Admin\AppData\Local\Temp\ACD3.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\AD6F.tmp"C:\Users\Admin\AppData\Local\Temp\AD6F.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\ADBD.tmp"C:\Users\Admin\AppData\Local\Temp\ADBD.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\AE49.tmp"C:\Users\Admin\AppData\Local\Temp\AE49.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\AEB6.tmp"C:\Users\Admin\AppData\Local\Temp\AEB6.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\AF52.tmp"C:\Users\Admin\AppData\Local\Temp\AF52.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\AFEE.tmp"C:\Users\Admin\AppData\Local\Temp\AFEE.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\B04C.tmp"C:\Users\Admin\AppData\Local\Temp\B04C.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\B09A.tmp"C:\Users\Admin\AppData\Local\Temp\B09A.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:540 -
C:\Users\Admin\AppData\Local\Temp\B126.tmp"C:\Users\Admin\AppData\Local\Temp\B126.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:656 -
C:\Users\Admin\AppData\Local\Temp\B165.tmp"C:\Users\Admin\AppData\Local\Temp\B165.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\B210.tmp"C:\Users\Admin\AppData\Local\Temp\B210.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\B29D.tmp"C:\Users\Admin\AppData\Local\Temp\B29D.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\B2EB.tmp"C:\Users\Admin\AppData\Local\Temp\B2EB.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\B339.tmp"C:\Users\Admin\AppData\Local\Temp\B339.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\B387.tmp"C:\Users\Admin\AppData\Local\Temp\B387.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\B3C5.tmp"C:\Users\Admin\AppData\Local\Temp\B3C5.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\B413.tmp"C:\Users\Admin\AppData\Local\Temp\B413.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\B461.tmp"C:\Users\Admin\AppData\Local\Temp\B461.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\B49F.tmp"C:\Users\Admin\AppData\Local\Temp\B49F.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\B4ED.tmp"C:\Users\Admin\AppData\Local\Temp\B4ED.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\B53B.tmp"C:\Users\Admin\AppData\Local\Temp\B53B.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:816 -
C:\Users\Admin\AppData\Local\Temp\B589.tmp"C:\Users\Admin\AppData\Local\Temp\B589.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\B5D7.tmp"C:\Users\Admin\AppData\Local\Temp\B5D7.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\B616.tmp"C:\Users\Admin\AppData\Local\Temp\B616.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\B654.tmp"C:\Users\Admin\AppData\Local\Temp\B654.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\B693.tmp"C:\Users\Admin\AppData\Local\Temp\B693.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\B6D1.tmp"C:\Users\Admin\AppData\Local\Temp\B6D1.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:836 -
C:\Users\Admin\AppData\Local\Temp\B71F.tmp"C:\Users\Admin\AppData\Local\Temp\B71F.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\B75D.tmp"C:\Users\Admin\AppData\Local\Temp\B75D.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\B7AB.tmp"C:\Users\Admin\AppData\Local\Temp\B7AB.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\B7EA.tmp"C:\Users\Admin\AppData\Local\Temp\B7EA.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:752 -
C:\Users\Admin\AppData\Local\Temp\B838.tmp"C:\Users\Admin\AppData\Local\Temp\B838.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\B876.tmp"C:\Users\Admin\AppData\Local\Temp\B876.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\B8C4.tmp"C:\Users\Admin\AppData\Local\Temp\B8C4.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\B912.tmp"C:\Users\Admin\AppData\Local\Temp\B912.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\B960.tmp"C:\Users\Admin\AppData\Local\Temp\B960.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\B99F.tmp"C:\Users\Admin\AppData\Local\Temp\B99F.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\B9ED.tmp"C:\Users\Admin\AppData\Local\Temp\B9ED.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:536 -
C:\Users\Admin\AppData\Local\Temp\BA2B.tmp"C:\Users\Admin\AppData\Local\Temp\BA2B.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\BA89.tmp"C:\Users\Admin\AppData\Local\Temp\BA89.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:876 -
C:\Users\Admin\AppData\Local\Temp\BAC7.tmp"C:\Users\Admin\AppData\Local\Temp\BAC7.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\BB15.tmp"C:\Users\Admin\AppData\Local\Temp\BB15.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\BB63.tmp"C:\Users\Admin\AppData\Local\Temp\BB63.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\BBA1.tmp"C:\Users\Admin\AppData\Local\Temp\BBA1.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\BBE0.tmp"C:\Users\Admin\AppData\Local\Temp\BBE0.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\BC2E.tmp"C:\Users\Admin\AppData\Local\Temp\BC2E.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\BC7C.tmp"C:\Users\Admin\AppData\Local\Temp\BC7C.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\BCCA.tmp"C:\Users\Admin\AppData\Local\Temp\BCCA.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\BD08.tmp"C:\Users\Admin\AppData\Local\Temp\BD08.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\BD47.tmp"C:\Users\Admin\AppData\Local\Temp\BD47.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\BD85.tmp"C:\Users\Admin\AppData\Local\Temp\BD85.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\BDD3.tmp"C:\Users\Admin\AppData\Local\Temp\BDD3.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\BE21.tmp"C:\Users\Admin\AppData\Local\Temp\BE21.tmp"65⤵
- Executes dropped EXE
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\BE6F.tmp"C:\Users\Admin\AppData\Local\Temp\BE6F.tmp"66⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\BEBD.tmp"C:\Users\Admin\AppData\Local\Temp\BEBD.tmp"67⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\BEFB.tmp"C:\Users\Admin\AppData\Local\Temp\BEFB.tmp"68⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\BF3A.tmp"C:\Users\Admin\AppData\Local\Temp\BF3A.tmp"69⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\BF88.tmp"C:\Users\Admin\AppData\Local\Temp\BF88.tmp"70⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"71⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\C024.tmp"C:\Users\Admin\AppData\Local\Temp\C024.tmp"72⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\C081.tmp"C:\Users\Admin\AppData\Local\Temp\C081.tmp"73⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"74⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\C11D.tmp"C:\Users\Admin\AppData\Local\Temp\C11D.tmp"75⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\C16B.tmp"C:\Users\Admin\AppData\Local\Temp\C16B.tmp"76⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"77⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"78⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\C227.tmp"C:\Users\Admin\AppData\Local\Temp\C227.tmp"79⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\C265.tmp"C:\Users\Admin\AppData\Local\Temp\C265.tmp"80⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\C2B3.tmp"C:\Users\Admin\AppData\Local\Temp\C2B3.tmp"81⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\C301.tmp"C:\Users\Admin\AppData\Local\Temp\C301.tmp"82⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\C33F.tmp"C:\Users\Admin\AppData\Local\Temp\C33F.tmp"83⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\C38D.tmp"C:\Users\Admin\AppData\Local\Temp\C38D.tmp"84⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\C3EB.tmp"C:\Users\Admin\AppData\Local\Temp\C3EB.tmp"85⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\C439.tmp"C:\Users\Admin\AppData\Local\Temp\C439.tmp"86⤵
- System Location Discovery: System Language Discovery
PID:596 -
C:\Users\Admin\AppData\Local\Temp\C487.tmp"C:\Users\Admin\AppData\Local\Temp\C487.tmp"87⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\C4D5.tmp"C:\Users\Admin\AppData\Local\Temp\C4D5.tmp"88⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\C523.tmp"C:\Users\Admin\AppData\Local\Temp\C523.tmp"89⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\C581.tmp"C:\Users\Admin\AppData\Local\Temp\C581.tmp"90⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\C5BF.tmp"C:\Users\Admin\AppData\Local\Temp\C5BF.tmp"91⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\C60D.tmp"C:\Users\Admin\AppData\Local\Temp\C60D.tmp"92⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\C65B.tmp"C:\Users\Admin\AppData\Local\Temp\C65B.tmp"93⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\C6A9.tmp"C:\Users\Admin\AppData\Local\Temp\C6A9.tmp"94⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\C6E7.tmp"C:\Users\Admin\AppData\Local\Temp\C6E7.tmp"95⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\C726.tmp"C:\Users\Admin\AppData\Local\Temp\C726.tmp"96⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\C764.tmp"C:\Users\Admin\AppData\Local\Temp\C764.tmp"97⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\C7B2.tmp"C:\Users\Admin\AppData\Local\Temp\C7B2.tmp"98⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\C7F1.tmp"C:\Users\Admin\AppData\Local\Temp\C7F1.tmp"99⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\C82F.tmp"C:\Users\Admin\AppData\Local\Temp\C82F.tmp"100⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\C86D.tmp"C:\Users\Admin\AppData\Local\Temp\C86D.tmp"101⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\C8AC.tmp"C:\Users\Admin\AppData\Local\Temp\C8AC.tmp"102⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\C909.tmp"C:\Users\Admin\AppData\Local\Temp\C909.tmp"103⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\C957.tmp"C:\Users\Admin\AppData\Local\Temp\C957.tmp"104⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\C996.tmp"C:\Users\Admin\AppData\Local\Temp\C996.tmp"105⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\C9E4.tmp"C:\Users\Admin\AppData\Local\Temp\C9E4.tmp"106⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\CA22.tmp"C:\Users\Admin\AppData\Local\Temp\CA22.tmp"107⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\CA70.tmp"C:\Users\Admin\AppData\Local\Temp\CA70.tmp"108⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\CABE.tmp"C:\Users\Admin\AppData\Local\Temp\CABE.tmp"109⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\CB0C.tmp"C:\Users\Admin\AppData\Local\Temp\CB0C.tmp"110⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\CB4B.tmp"C:\Users\Admin\AppData\Local\Temp\CB4B.tmp"111⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\CB99.tmp"C:\Users\Admin\AppData\Local\Temp\CB99.tmp"112⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\CBD7.tmp"C:\Users\Admin\AppData\Local\Temp\CBD7.tmp"113⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\CC25.tmp"C:\Users\Admin\AppData\Local\Temp\CC25.tmp"114⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\CC63.tmp"C:\Users\Admin\AppData\Local\Temp\CC63.tmp"115⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\CCB1.tmp"C:\Users\Admin\AppData\Local\Temp\CCB1.tmp"116⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\CCF0.tmp"C:\Users\Admin\AppData\Local\Temp\CCF0.tmp"117⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\CD3E.tmp"C:\Users\Admin\AppData\Local\Temp\CD3E.tmp"118⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"119⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\CDCA.tmp"C:\Users\Admin\AppData\Local\Temp\CDCA.tmp"120⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\CE09.tmp"C:\Users\Admin\AppData\Local\Temp\CE09.tmp"121⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\CE66.tmp"C:\Users\Admin\AppData\Local\Temp\CE66.tmp"122⤵PID:804
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-