Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 13:27
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-19_56b7cb5f1536cdc9cf1375bbeb86e39e_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-09-19_56b7cb5f1536cdc9cf1375bbeb86e39e_mafia.exe
Resource
win10v2004-20240910-en
General
-
Target
2024-09-19_56b7cb5f1536cdc9cf1375bbeb86e39e_mafia.exe
-
Size
529KB
-
MD5
56b7cb5f1536cdc9cf1375bbeb86e39e
-
SHA1
10526a31a8232e08a681cca1ad50a2a9396643db
-
SHA256
b7f8dcaaa7abe9d951741b70b9527833d9d423f0c566fd400ee295ed7501829d
-
SHA512
8dd43fbb55a9a99f6a3a9dfa391eb73a3ca53653029c2eb0afc786f17d78e24f0678e8dcdc6de4c836215fe8076cc73ba4fb2dd3953c2c763b5ce4ab384dd1ed
-
SSDEEP
12288:NU5rCOTeijK46VLmkPhQca9k6tTZwlH4Hp:NUQOJjK44LmwgTSlH4Hp
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3056 BB34.tmp 544 BBA1.tmp 1056 BC0F.tmp 2076 BC6C.tmp 2348 BCCA.tmp 2408 BD18.tmp 2740 BD85.tmp 2936 BDE3.tmp 2676 BE50.tmp 2820 BEAD.tmp 2900 BF1B.tmp 2688 BF88.tmp 2784 BFE5.tmp 2584 C043.tmp 3060 C0B0.tmp 1824 C10E.tmp 2016 C17B.tmp 1952 C1D9.tmp 2092 C236.tmp 1988 C2A3.tmp 1288 C311.tmp 1732 C37E.tmp 1916 C3DB.tmp 1936 C41A.tmp 2732 C458.tmp 2788 C497.tmp 2440 C4D5.tmp 3016 C513.tmp 2136 C552.tmp 3020 C590.tmp 2080 C5CF.tmp 1484 C60D.tmp 2312 C64B.tmp 2152 C68A.tmp 2000 C6C8.tmp 1352 C707.tmp 1828 C745.tmp 1332 C793.tmp 1748 C7D1.tmp 836 C810.tmp 1792 C84E.tmp 632 C88D.tmp 1128 C8CB.tmp 760 C909.tmp 2328 C948.tmp 568 C986.tmp 2224 C9C5.tmp 1516 CA13.tmp 2932 CA51.tmp 2432 CA8F.tmp 1868 CB1C.tmp 2916 CB5A.tmp 3056 CB99.tmp 284 CBD7.tmp 2484 CC15.tmp 2052 CC54.tmp 1924 CC92.tmp 2068 CCD1.tmp 2348 CD0F.tmp 2752 CD5D.tmp 2756 CD9B.tmp 2740 CDDA.tmp 2684 CE28.tmp 2252 CE76.tmp -
Loads dropped DLL 64 IoCs
pid Process 2992 2024-09-19_56b7cb5f1536cdc9cf1375bbeb86e39e_mafia.exe 3056 BB34.tmp 544 BBA1.tmp 1056 BC0F.tmp 2076 BC6C.tmp 2348 BCCA.tmp 2408 BD18.tmp 2740 BD85.tmp 2936 BDE3.tmp 2676 BE50.tmp 2820 BEAD.tmp 2900 BF1B.tmp 2688 BF88.tmp 2784 BFE5.tmp 2584 C043.tmp 3060 C0B0.tmp 1824 C10E.tmp 2016 C17B.tmp 1952 C1D9.tmp 2092 C236.tmp 1988 C2A3.tmp 1288 C311.tmp 1732 C37E.tmp 1916 C3DB.tmp 1936 C41A.tmp 2732 C458.tmp 2788 C497.tmp 2440 C4D5.tmp 3016 C513.tmp 2136 C552.tmp 3020 C590.tmp 2080 C5CF.tmp 1484 C60D.tmp 2312 C64B.tmp 2152 C68A.tmp 2000 C6C8.tmp 1352 C707.tmp 1828 C745.tmp 1332 C793.tmp 1748 C7D1.tmp 836 C810.tmp 1792 C84E.tmp 632 C88D.tmp 1128 C8CB.tmp 760 C909.tmp 2328 C948.tmp 568 C986.tmp 2224 C9C5.tmp 1516 CA13.tmp 2932 CA51.tmp 2972 CACE.tmp 1868 CB1C.tmp 2916 CB5A.tmp 3056 CB99.tmp 284 CBD7.tmp 2484 CC15.tmp 2052 CC54.tmp 1924 CC92.tmp 2068 CCD1.tmp 2348 CD0F.tmp 2752 CD5D.tmp 2756 CD9B.tmp 2740 CDDA.tmp 2684 CE28.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2607.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B78C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CFB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB1C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D42.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E456.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8269.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D440.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D3D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 951E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F180.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8814.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C458.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E09F.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2992 wrote to memory of 3056 2992 2024-09-19_56b7cb5f1536cdc9cf1375bbeb86e39e_mafia.exe 30 PID 2992 wrote to memory of 3056 2992 2024-09-19_56b7cb5f1536cdc9cf1375bbeb86e39e_mafia.exe 30 PID 2992 wrote to memory of 3056 2992 2024-09-19_56b7cb5f1536cdc9cf1375bbeb86e39e_mafia.exe 30 PID 2992 wrote to memory of 3056 2992 2024-09-19_56b7cb5f1536cdc9cf1375bbeb86e39e_mafia.exe 30 PID 3056 wrote to memory of 544 3056 BB34.tmp 31 PID 3056 wrote to memory of 544 3056 BB34.tmp 31 PID 3056 wrote to memory of 544 3056 BB34.tmp 31 PID 3056 wrote to memory of 544 3056 BB34.tmp 31 PID 544 wrote to memory of 1056 544 BBA1.tmp 32 PID 544 wrote to memory of 1056 544 BBA1.tmp 32 PID 544 wrote to memory of 1056 544 BBA1.tmp 32 PID 544 wrote to memory of 1056 544 BBA1.tmp 32 PID 1056 wrote to memory of 2076 1056 BC0F.tmp 33 PID 1056 wrote to memory of 2076 1056 BC0F.tmp 33 PID 1056 wrote to memory of 2076 1056 BC0F.tmp 33 PID 1056 wrote to memory of 2076 1056 BC0F.tmp 33 PID 2076 wrote to memory of 2348 2076 BC6C.tmp 34 PID 2076 wrote to memory of 2348 2076 BC6C.tmp 34 PID 2076 wrote to memory of 2348 2076 BC6C.tmp 34 PID 2076 wrote to memory of 2348 2076 BC6C.tmp 34 PID 2348 wrote to memory of 2408 2348 BCCA.tmp 35 PID 2348 wrote to memory of 2408 2348 BCCA.tmp 35 PID 2348 wrote to memory of 2408 2348 BCCA.tmp 35 PID 2348 wrote to memory of 2408 2348 BCCA.tmp 35 PID 2408 wrote to memory of 2740 2408 BD18.tmp 36 PID 2408 wrote to memory of 2740 2408 BD18.tmp 36 PID 2408 wrote to memory of 2740 2408 BD18.tmp 36 PID 2408 wrote to memory of 2740 2408 BD18.tmp 36 PID 2740 wrote to memory of 2936 2740 BD85.tmp 37 PID 2740 wrote to memory of 2936 2740 BD85.tmp 37 PID 2740 wrote to memory of 2936 2740 BD85.tmp 37 PID 2740 wrote to memory of 2936 2740 BD85.tmp 37 PID 2936 wrote to memory of 2676 2936 BDE3.tmp 38 PID 2936 wrote to memory of 2676 2936 BDE3.tmp 38 PID 2936 wrote to memory of 2676 2936 BDE3.tmp 38 PID 2936 wrote to memory of 2676 2936 BDE3.tmp 38 PID 2676 wrote to memory of 2820 2676 BE50.tmp 39 PID 2676 wrote to memory of 2820 2676 BE50.tmp 39 PID 2676 wrote to memory of 2820 2676 BE50.tmp 39 PID 2676 wrote to memory of 2820 2676 BE50.tmp 39 PID 2820 wrote to memory of 2900 2820 BEAD.tmp 40 PID 2820 wrote to memory of 2900 2820 BEAD.tmp 40 PID 2820 wrote to memory of 2900 2820 BEAD.tmp 40 PID 2820 wrote to memory of 2900 2820 BEAD.tmp 40 PID 2900 wrote to memory of 2688 2900 BF1B.tmp 41 PID 2900 wrote to memory of 2688 2900 BF1B.tmp 41 PID 2900 wrote to memory of 2688 2900 BF1B.tmp 41 PID 2900 wrote to memory of 2688 2900 BF1B.tmp 41 PID 2688 wrote to memory of 2784 2688 BF88.tmp 42 PID 2688 wrote to memory of 2784 2688 BF88.tmp 42 PID 2688 wrote to memory of 2784 2688 BF88.tmp 42 PID 2688 wrote to memory of 2784 2688 BF88.tmp 42 PID 2784 wrote to memory of 2584 2784 BFE5.tmp 43 PID 2784 wrote to memory of 2584 2784 BFE5.tmp 43 PID 2784 wrote to memory of 2584 2784 BFE5.tmp 43 PID 2784 wrote to memory of 2584 2784 BFE5.tmp 43 PID 2584 wrote to memory of 3060 2584 C043.tmp 44 PID 2584 wrote to memory of 3060 2584 C043.tmp 44 PID 2584 wrote to memory of 3060 2584 C043.tmp 44 PID 2584 wrote to memory of 3060 2584 C043.tmp 44 PID 3060 wrote to memory of 1824 3060 C0B0.tmp 45 PID 3060 wrote to memory of 1824 3060 C0B0.tmp 45 PID 3060 wrote to memory of 1824 3060 C0B0.tmp 45 PID 3060 wrote to memory of 1824 3060 C0B0.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_56b7cb5f1536cdc9cf1375bbeb86e39e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_56b7cb5f1536cdc9cf1375bbeb86e39e_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\BB34.tmp"C:\Users\Admin\AppData\Local\Temp\BB34.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\BBA1.tmp"C:\Users\Admin\AppData\Local\Temp\BBA1.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Users\Admin\AppData\Local\Temp\BC0F.tmp"C:\Users\Admin\AppData\Local\Temp\BC0F.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\BC6C.tmp"C:\Users\Admin\AppData\Local\Temp\BC6C.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\BCCA.tmp"C:\Users\Admin\AppData\Local\Temp\BCCA.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\BD18.tmp"C:\Users\Admin\AppData\Local\Temp\BD18.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\BD85.tmp"C:\Users\Admin\AppData\Local\Temp\BD85.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\BDE3.tmp"C:\Users\Admin\AppData\Local\Temp\BDE3.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\BE50.tmp"C:\Users\Admin\AppData\Local\Temp\BE50.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\BEAD.tmp"C:\Users\Admin\AppData\Local\Temp\BEAD.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\BF1B.tmp"C:\Users\Admin\AppData\Local\Temp\BF1B.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\BF88.tmp"C:\Users\Admin\AppData\Local\Temp\BF88.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\C043.tmp"C:\Users\Admin\AppData\Local\Temp\C043.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\C10E.tmp"C:\Users\Admin\AppData\Local\Temp\C10E.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\C17B.tmp"C:\Users\Admin\AppData\Local\Temp\C17B.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\C236.tmp"C:\Users\Admin\AppData\Local\Temp\C236.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\C2A3.tmp"C:\Users\Admin\AppData\Local\Temp\C2A3.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\C311.tmp"C:\Users\Admin\AppData\Local\Temp\C311.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\C37E.tmp"C:\Users\Admin\AppData\Local\Temp\C37E.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\C3DB.tmp"C:\Users\Admin\AppData\Local\Temp\C3DB.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\C41A.tmp"C:\Users\Admin\AppData\Local\Temp\C41A.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\C458.tmp"C:\Users\Admin\AppData\Local\Temp\C458.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\C497.tmp"C:\Users\Admin\AppData\Local\Temp\C497.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\C4D5.tmp"C:\Users\Admin\AppData\Local\Temp\C4D5.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\C513.tmp"C:\Users\Admin\AppData\Local\Temp\C513.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\C552.tmp"C:\Users\Admin\AppData\Local\Temp\C552.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\C590.tmp"C:\Users\Admin\AppData\Local\Temp\C590.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\C5CF.tmp"C:\Users\Admin\AppData\Local\Temp\C5CF.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\C60D.tmp"C:\Users\Admin\AppData\Local\Temp\C60D.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\C64B.tmp"C:\Users\Admin\AppData\Local\Temp\C64B.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\C68A.tmp"C:\Users\Admin\AppData\Local\Temp\C68A.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\C6C8.tmp"C:\Users\Admin\AppData\Local\Temp\C6C8.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\C707.tmp"C:\Users\Admin\AppData\Local\Temp\C707.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\C745.tmp"C:\Users\Admin\AppData\Local\Temp\C745.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\C793.tmp"C:\Users\Admin\AppData\Local\Temp\C793.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\C7D1.tmp"C:\Users\Admin\AppData\Local\Temp\C7D1.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\C810.tmp"C:\Users\Admin\AppData\Local\Temp\C810.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:836 -
C:\Users\Admin\AppData\Local\Temp\C84E.tmp"C:\Users\Admin\AppData\Local\Temp\C84E.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\C88D.tmp"C:\Users\Admin\AppData\Local\Temp\C88D.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:632 -
C:\Users\Admin\AppData\Local\Temp\C8CB.tmp"C:\Users\Admin\AppData\Local\Temp\C8CB.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\C909.tmp"C:\Users\Admin\AppData\Local\Temp\C909.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:760 -
C:\Users\Admin\AppData\Local\Temp\C948.tmp"C:\Users\Admin\AppData\Local\Temp\C948.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\C986.tmp"C:\Users\Admin\AppData\Local\Temp\C986.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:568 -
C:\Users\Admin\AppData\Local\Temp\C9C5.tmp"C:\Users\Admin\AppData\Local\Temp\C9C5.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\CA13.tmp"C:\Users\Admin\AppData\Local\Temp\CA13.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\CA51.tmp"C:\Users\Admin\AppData\Local\Temp\CA51.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\CA8F.tmp"C:\Users\Admin\AppData\Local\Temp\CA8F.tmp"51⤵
- Executes dropped EXE
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\CACE.tmp"C:\Users\Admin\AppData\Local\Temp\CACE.tmp"52⤵
- Loads dropped DLL
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\CB1C.tmp"C:\Users\Admin\AppData\Local\Temp\CB1C.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\CB5A.tmp"C:\Users\Admin\AppData\Local\Temp\CB5A.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\CB99.tmp"C:\Users\Admin\AppData\Local\Temp\CB99.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\CBD7.tmp"C:\Users\Admin\AppData\Local\Temp\CBD7.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:284 -
C:\Users\Admin\AppData\Local\Temp\CC15.tmp"C:\Users\Admin\AppData\Local\Temp\CC15.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\CC54.tmp"C:\Users\Admin\AppData\Local\Temp\CC54.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\CC92.tmp"C:\Users\Admin\AppData\Local\Temp\CC92.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\CCD1.tmp"C:\Users\Admin\AppData\Local\Temp\CCD1.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\CD0F.tmp"C:\Users\Admin\AppData\Local\Temp\CD0F.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\CD5D.tmp"C:\Users\Admin\AppData\Local\Temp\CD5D.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\CD9B.tmp"C:\Users\Admin\AppData\Local\Temp\CD9B.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\CDDA.tmp"C:\Users\Admin\AppData\Local\Temp\CDDA.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\CE28.tmp"C:\Users\Admin\AppData\Local\Temp\CE28.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\CE76.tmp"C:\Users\Admin\AppData\Local\Temp\CE76.tmp"66⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\CEB4.tmp"C:\Users\Admin\AppData\Local\Temp\CEB4.tmp"67⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\CF02.tmp"C:\Users\Admin\AppData\Local\Temp\CF02.tmp"68⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\CF41.tmp"C:\Users\Admin\AppData\Local\Temp\CF41.tmp"69⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\CF7F.tmp"C:\Users\Admin\AppData\Local\Temp\CF7F.tmp"70⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\CFBD.tmp"C:\Users\Admin\AppData\Local\Temp\CFBD.tmp"71⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\CFFC.tmp"C:\Users\Admin\AppData\Local\Temp\CFFC.tmp"72⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\D03A.tmp"C:\Users\Admin\AppData\Local\Temp\D03A.tmp"73⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\D079.tmp"C:\Users\Admin\AppData\Local\Temp\D079.tmp"74⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\D0B7.tmp"C:\Users\Admin\AppData\Local\Temp\D0B7.tmp"75⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\D0F5.tmp"C:\Users\Admin\AppData\Local\Temp\D0F5.tmp"76⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\D134.tmp"C:\Users\Admin\AppData\Local\Temp\D134.tmp"77⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\D172.tmp"C:\Users\Admin\AppData\Local\Temp\D172.tmp"78⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\D1B1.tmp"C:\Users\Admin\AppData\Local\Temp\D1B1.tmp"79⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\D1EF.tmp"C:\Users\Admin\AppData\Local\Temp\D1EF.tmp"80⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\D22D.tmp"C:\Users\Admin\AppData\Local\Temp\D22D.tmp"81⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\D26C.tmp"C:\Users\Admin\AppData\Local\Temp\D26C.tmp"82⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\D2AA.tmp"C:\Users\Admin\AppData\Local\Temp\D2AA.tmp"83⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\D2E9.tmp"C:\Users\Admin\AppData\Local\Temp\D2E9.tmp"84⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\D337.tmp"C:\Users\Admin\AppData\Local\Temp\D337.tmp"85⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\D375.tmp"C:\Users\Admin\AppData\Local\Temp\D375.tmp"86⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\D3C3.tmp"C:\Users\Admin\AppData\Local\Temp\D3C3.tmp"87⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\D401.tmp"C:\Users\Admin\AppData\Local\Temp\D401.tmp"88⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\D440.tmp"C:\Users\Admin\AppData\Local\Temp\D440.tmp"89⤵
- System Location Discovery: System Language Discovery
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\D47E.tmp"C:\Users\Admin\AppData\Local\Temp\D47E.tmp"90⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\D4CC.tmp"C:\Users\Admin\AppData\Local\Temp\D4CC.tmp"91⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\D50B.tmp"C:\Users\Admin\AppData\Local\Temp\D50B.tmp"92⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\D549.tmp"C:\Users\Admin\AppData\Local\Temp\D549.tmp"93⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\D587.tmp"C:\Users\Admin\AppData\Local\Temp\D587.tmp"94⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\D5C6.tmp"C:\Users\Admin\AppData\Local\Temp\D5C6.tmp"95⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\D604.tmp"C:\Users\Admin\AppData\Local\Temp\D604.tmp"96⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\D643.tmp"C:\Users\Admin\AppData\Local\Temp\D643.tmp"97⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\D681.tmp"C:\Users\Admin\AppData\Local\Temp\D681.tmp"98⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\D6BF.tmp"C:\Users\Admin\AppData\Local\Temp\D6BF.tmp"99⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\D6FE.tmp"C:\Users\Admin\AppData\Local\Temp\D6FE.tmp"100⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\D73C.tmp"C:\Users\Admin\AppData\Local\Temp\D73C.tmp"101⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\D77B.tmp"C:\Users\Admin\AppData\Local\Temp\D77B.tmp"102⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\D7B9.tmp"C:\Users\Admin\AppData\Local\Temp\D7B9.tmp"103⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\D7F7.tmp"C:\Users\Admin\AppData\Local\Temp\D7F7.tmp"104⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\D836.tmp"C:\Users\Admin\AppData\Local\Temp\D836.tmp"105⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\D874.tmp"C:\Users\Admin\AppData\Local\Temp\D874.tmp"106⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\D8B3.tmp"C:\Users\Admin\AppData\Local\Temp\D8B3.tmp"107⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\D8F1.tmp"C:\Users\Admin\AppData\Local\Temp\D8F1.tmp"108⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\D92F.tmp"C:\Users\Admin\AppData\Local\Temp\D92F.tmp"109⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\D96E.tmp"C:\Users\Admin\AppData\Local\Temp\D96E.tmp"110⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\D9AC.tmp"C:\Users\Admin\AppData\Local\Temp\D9AC.tmp"111⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\D9EB.tmp"C:\Users\Admin\AppData\Local\Temp\D9EB.tmp"112⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\DA39.tmp"C:\Users\Admin\AppData\Local\Temp\DA39.tmp"113⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\DA77.tmp"C:\Users\Admin\AppData\Local\Temp\DA77.tmp"114⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\DAB5.tmp"C:\Users\Admin\AppData\Local\Temp\DAB5.tmp"115⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\DAF4.tmp"C:\Users\Admin\AppData\Local\Temp\DAF4.tmp"116⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\DB32.tmp"C:\Users\Admin\AppData\Local\Temp\DB32.tmp"117⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\DB71.tmp"C:\Users\Admin\AppData\Local\Temp\DB71.tmp"118⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\DBAF.tmp"C:\Users\Admin\AppData\Local\Temp\DBAF.tmp"119⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\DBED.tmp"C:\Users\Admin\AppData\Local\Temp\DBED.tmp"120⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\DC2C.tmp"C:\Users\Admin\AppData\Local\Temp\DC2C.tmp"121⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\DC6A.tmp"C:\Users\Admin\AppData\Local\Temp\DC6A.tmp"122⤵PID:2836
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-