Analysis
-
max time kernel
150s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
30/09/2024, 08:49
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-30_e03dba4fa7d2d241ac54bd7c8147c7f4_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-09-30_e03dba4fa7d2d241ac54bd7c8147c7f4_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-30_e03dba4fa7d2d241ac54bd7c8147c7f4_mafia.exe
-
Size
520KB
-
MD5
e03dba4fa7d2d241ac54bd7c8147c7f4
-
SHA1
a82f588336b69c3b0173c589979ea7d0782c559f
-
SHA256
0fb5f7b1143413eaafa0fa03050db4ab3009569f8e47a25c7d521480cabb8682
-
SHA512
beb9ec5557322e36b2cdb6a405de5e8ea4dfb895359cc6f344c443e23b7d3f2fae9b61eb169916a90fcf9e2285aa529f1adac0fd80b30aa5ff8180a7747fd226
-
SSDEEP
12288:gj8fuxR21t5i8f4vxOGSXqaCglWn4dRtWX8RlNZ:gj8fuK1GY+OG5nQWn4AklN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2496 A6BB.tmp 2444 A728.tmp 276 A7A5.tmp 2668 A812.tmp 2764 A87F.tmp 2720 A8EC.tmp 2724 A969.tmp 2896 A9D6.tmp 2728 AA43.tmp 2568 AAA1.tmp 2640 AB1E.tmp 348 AB8B.tmp 880 ABF8.tmp 2092 AC75.tmp 2128 ACE2.tmp 1568 AD40.tmp 2804 AD9D.tmp 736 AE0B.tmp 1140 AE78.tmp 2868 AEE5.tmp 1624 AF43.tmp 3040 AFB0.tmp 1116 B00D.tmp 996 B04C.tmp 1076 B09A.tmp 2952 B0D8.tmp 1928 B126.tmp 2348 B174.tmp 1208 B1B3.tmp 2164 B201.tmp 2248 B24F.tmp 2208 B29D.tmp 2032 B2EB.tmp 2892 B329.tmp 1300 B377.tmp 2920 B3C5.tmp 2960 B413.tmp 1028 B451.tmp 1044 B49F.tmp 1988 B4DE.tmp 1780 B51C.tmp 744 B55B.tmp 1956 B5A9.tmp 2132 B5F7.tmp 912 B635.tmp 560 B673.tmp 1216 B6B2.tmp 1664 B700.tmp 2512 B74E.tmp 332 B79C.tmp 2064 B7DA.tmp 2500 B819.tmp 2492 B867.tmp 1512 B8A5.tmp 2324 B8E3.tmp 820 B922.tmp 2744 B970.tmp 552 B9BE.tmp 2524 BA0C.tmp 2928 BA79.tmp 2672 BAC7.tmp 2772 BB05.tmp 2572 BB53.tmp 2696 BB92.tmp -
Loads dropped DLL 64 IoCs
pid Process 2520 2024-09-30_e03dba4fa7d2d241ac54bd7c8147c7f4_mafia.exe 2496 A6BB.tmp 2444 A728.tmp 276 A7A5.tmp 2668 A812.tmp 2764 A87F.tmp 2720 A8EC.tmp 2724 A969.tmp 2896 A9D6.tmp 2728 AA43.tmp 2568 AAA1.tmp 2640 AB1E.tmp 348 AB8B.tmp 880 ABF8.tmp 2092 AC75.tmp 2128 ACE2.tmp 1568 AD40.tmp 2804 AD9D.tmp 736 AE0B.tmp 1140 AE78.tmp 2868 AEE5.tmp 1624 AF43.tmp 3040 AFB0.tmp 1116 B00D.tmp 996 B04C.tmp 1076 B09A.tmp 2952 B0D8.tmp 1928 B126.tmp 2348 B174.tmp 1208 B1B3.tmp 2164 B201.tmp 2248 B24F.tmp 2208 B29D.tmp 2032 B2EB.tmp 2892 B329.tmp 1300 B377.tmp 2920 B3C5.tmp 2960 B413.tmp 1028 B451.tmp 1044 B49F.tmp 1988 B4DE.tmp 1780 B51C.tmp 744 B55B.tmp 1956 B5A9.tmp 2132 B5F7.tmp 912 B635.tmp 560 B673.tmp 1216 B6B2.tmp 1664 B700.tmp 2512 B74E.tmp 332 B79C.tmp 2064 B7DA.tmp 2500 B819.tmp 2492 B867.tmp 1512 B8A5.tmp 2324 B8E3.tmp 820 B922.tmp 2744 B970.tmp 552 B9BE.tmp 2524 BA0C.tmp 2928 BA79.tmp 2672 BAC7.tmp 2772 BB05.tmp 2572 BB53.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9434.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-09-30_e03dba4fa7d2d241ac54bd7c8147c7f4_mafia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3350.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A87F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B201.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB92.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A969.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB4B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F45D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3208.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FD1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2250.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2520 wrote to memory of 2496 2520 2024-09-30_e03dba4fa7d2d241ac54bd7c8147c7f4_mafia.exe 29 PID 2520 wrote to memory of 2496 2520 2024-09-30_e03dba4fa7d2d241ac54bd7c8147c7f4_mafia.exe 29 PID 2520 wrote to memory of 2496 2520 2024-09-30_e03dba4fa7d2d241ac54bd7c8147c7f4_mafia.exe 29 PID 2520 wrote to memory of 2496 2520 2024-09-30_e03dba4fa7d2d241ac54bd7c8147c7f4_mafia.exe 29 PID 2496 wrote to memory of 2444 2496 A6BB.tmp 30 PID 2496 wrote to memory of 2444 2496 A6BB.tmp 30 PID 2496 wrote to memory of 2444 2496 A6BB.tmp 30 PID 2496 wrote to memory of 2444 2496 A6BB.tmp 30 PID 2444 wrote to memory of 276 2444 A728.tmp 31 PID 2444 wrote to memory of 276 2444 A728.tmp 31 PID 2444 wrote to memory of 276 2444 A728.tmp 31 PID 2444 wrote to memory of 276 2444 A728.tmp 31 PID 276 wrote to memory of 2668 276 A7A5.tmp 32 PID 276 wrote to memory of 2668 276 A7A5.tmp 32 PID 276 wrote to memory of 2668 276 A7A5.tmp 32 PID 276 wrote to memory of 2668 276 A7A5.tmp 32 PID 2668 wrote to memory of 2764 2668 A812.tmp 33 PID 2668 wrote to memory of 2764 2668 A812.tmp 33 PID 2668 wrote to memory of 2764 2668 A812.tmp 33 PID 2668 wrote to memory of 2764 2668 A812.tmp 33 PID 2764 wrote to memory of 2720 2764 A87F.tmp 34 PID 2764 wrote to memory of 2720 2764 A87F.tmp 34 PID 2764 wrote to memory of 2720 2764 A87F.tmp 34 PID 2764 wrote to memory of 2720 2764 A87F.tmp 34 PID 2720 wrote to memory of 2724 2720 A8EC.tmp 35 PID 2720 wrote to memory of 2724 2720 A8EC.tmp 35 PID 2720 wrote to memory of 2724 2720 A8EC.tmp 35 PID 2720 wrote to memory of 2724 2720 A8EC.tmp 35 PID 2724 wrote to memory of 2896 2724 A969.tmp 36 PID 2724 wrote to memory of 2896 2724 A969.tmp 36 PID 2724 wrote to memory of 2896 2724 A969.tmp 36 PID 2724 wrote to memory of 2896 2724 A969.tmp 36 PID 2896 wrote to memory of 2728 2896 A9D6.tmp 37 PID 2896 wrote to memory of 2728 2896 A9D6.tmp 37 PID 2896 wrote to memory of 2728 2896 A9D6.tmp 37 PID 2896 wrote to memory of 2728 2896 A9D6.tmp 37 PID 2728 wrote to memory of 2568 2728 AA43.tmp 38 PID 2728 wrote to memory of 2568 2728 AA43.tmp 38 PID 2728 wrote to memory of 2568 2728 AA43.tmp 38 PID 2728 wrote to memory of 2568 2728 AA43.tmp 38 PID 2568 wrote to memory of 2640 2568 AAA1.tmp 39 PID 2568 wrote to memory of 2640 2568 AAA1.tmp 39 PID 2568 wrote to memory of 2640 2568 AAA1.tmp 39 PID 2568 wrote to memory of 2640 2568 AAA1.tmp 39 PID 2640 wrote to memory of 348 2640 AB1E.tmp 40 PID 2640 wrote to memory of 348 2640 AB1E.tmp 40 PID 2640 wrote to memory of 348 2640 AB1E.tmp 40 PID 2640 wrote to memory of 348 2640 AB1E.tmp 40 PID 348 wrote to memory of 880 348 AB8B.tmp 41 PID 348 wrote to memory of 880 348 AB8B.tmp 41 PID 348 wrote to memory of 880 348 AB8B.tmp 41 PID 348 wrote to memory of 880 348 AB8B.tmp 41 PID 880 wrote to memory of 2092 880 ABF8.tmp 42 PID 880 wrote to memory of 2092 880 ABF8.tmp 42 PID 880 wrote to memory of 2092 880 ABF8.tmp 42 PID 880 wrote to memory of 2092 880 ABF8.tmp 42 PID 2092 wrote to memory of 2128 2092 AC75.tmp 43 PID 2092 wrote to memory of 2128 2092 AC75.tmp 43 PID 2092 wrote to memory of 2128 2092 AC75.tmp 43 PID 2092 wrote to memory of 2128 2092 AC75.tmp 43 PID 2128 wrote to memory of 1568 2128 ACE2.tmp 44 PID 2128 wrote to memory of 1568 2128 ACE2.tmp 44 PID 2128 wrote to memory of 1568 2128 ACE2.tmp 44 PID 2128 wrote to memory of 1568 2128 ACE2.tmp 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-30_e03dba4fa7d2d241ac54bd7c8147c7f4_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-30_e03dba4fa7d2d241ac54bd7c8147c7f4_mafia.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\A6BB.tmp"C:\Users\Admin\AppData\Local\Temp\A6BB.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\A728.tmp"C:\Users\Admin\AppData\Local\Temp\A728.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:276 -
C:\Users\Admin\AppData\Local\Temp\A812.tmp"C:\Users\Admin\AppData\Local\Temp\A812.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\A87F.tmp"C:\Users\Admin\AppData\Local\Temp\A87F.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\A8EC.tmp"C:\Users\Admin\AppData\Local\Temp\A8EC.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\A969.tmp"C:\Users\Admin\AppData\Local\Temp\A969.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\A9D6.tmp"C:\Users\Admin\AppData\Local\Temp\A9D6.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\AA43.tmp"C:\Users\Admin\AppData\Local\Temp\AA43.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\AAA1.tmp"C:\Users\Admin\AppData\Local\Temp\AAA1.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\AB1E.tmp"C:\Users\Admin\AppData\Local\Temp\AB1E.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\AB8B.tmp"C:\Users\Admin\AppData\Local\Temp\AB8B.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:348 -
C:\Users\Admin\AppData\Local\Temp\ABF8.tmp"C:\Users\Admin\AppData\Local\Temp\ABF8.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Users\Admin\AppData\Local\Temp\AC75.tmp"C:\Users\Admin\AppData\Local\Temp\AC75.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\ACE2.tmp"C:\Users\Admin\AppData\Local\Temp\ACE2.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\AD40.tmp"C:\Users\Admin\AppData\Local\Temp\AD40.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\AD9D.tmp"C:\Users\Admin\AppData\Local\Temp\AD9D.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\AE0B.tmp"C:\Users\Admin\AppData\Local\Temp\AE0B.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:736 -
C:\Users\Admin\AppData\Local\Temp\AE78.tmp"C:\Users\Admin\AppData\Local\Temp\AE78.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\AEE5.tmp"C:\Users\Admin\AppData\Local\Temp\AEE5.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\AF43.tmp"C:\Users\Admin\AppData\Local\Temp\AF43.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\AFB0.tmp"C:\Users\Admin\AppData\Local\Temp\AFB0.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\B00D.tmp"C:\Users\Admin\AppData\Local\Temp\B00D.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\B04C.tmp"C:\Users\Admin\AppData\Local\Temp\B04C.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:996 -
C:\Users\Admin\AppData\Local\Temp\B09A.tmp"C:\Users\Admin\AppData\Local\Temp\B09A.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\B0D8.tmp"C:\Users\Admin\AppData\Local\Temp\B0D8.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\B126.tmp"C:\Users\Admin\AppData\Local\Temp\B126.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\B174.tmp"C:\Users\Admin\AppData\Local\Temp\B174.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\B1B3.tmp"C:\Users\Admin\AppData\Local\Temp\B1B3.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\B201.tmp"C:\Users\Admin\AppData\Local\Temp\B201.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\B24F.tmp"C:\Users\Admin\AppData\Local\Temp\B24F.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\B29D.tmp"C:\Users\Admin\AppData\Local\Temp\B29D.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\B2EB.tmp"C:\Users\Admin\AppData\Local\Temp\B2EB.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\B329.tmp"C:\Users\Admin\AppData\Local\Temp\B329.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\B377.tmp"C:\Users\Admin\AppData\Local\Temp\B377.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\B3C5.tmp"C:\Users\Admin\AppData\Local\Temp\B3C5.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\B413.tmp"C:\Users\Admin\AppData\Local\Temp\B413.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\B451.tmp"C:\Users\Admin\AppData\Local\Temp\B451.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\B49F.tmp"C:\Users\Admin\AppData\Local\Temp\B49F.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\B4DE.tmp"C:\Users\Admin\AppData\Local\Temp\B4DE.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\B51C.tmp"C:\Users\Admin\AppData\Local\Temp\B51C.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\B55B.tmp"C:\Users\Admin\AppData\Local\Temp\B55B.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:744 -
C:\Users\Admin\AppData\Local\Temp\B5A9.tmp"C:\Users\Admin\AppData\Local\Temp\B5A9.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\B5F7.tmp"C:\Users\Admin\AppData\Local\Temp\B5F7.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\B635.tmp"C:\Users\Admin\AppData\Local\Temp\B635.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:912 -
C:\Users\Admin\AppData\Local\Temp\B673.tmp"C:\Users\Admin\AppData\Local\Temp\B673.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:560 -
C:\Users\Admin\AppData\Local\Temp\B6B2.tmp"C:\Users\Admin\AppData\Local\Temp\B6B2.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\B700.tmp"C:\Users\Admin\AppData\Local\Temp\B700.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\B74E.tmp"C:\Users\Admin\AppData\Local\Temp\B74E.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\B79C.tmp"C:\Users\Admin\AppData\Local\Temp\B79C.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:332 -
C:\Users\Admin\AppData\Local\Temp\B7DA.tmp"C:\Users\Admin\AppData\Local\Temp\B7DA.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\B819.tmp"C:\Users\Admin\AppData\Local\Temp\B819.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\B867.tmp"C:\Users\Admin\AppData\Local\Temp\B867.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\B8A5.tmp"C:\Users\Admin\AppData\Local\Temp\B8A5.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\B8E3.tmp"C:\Users\Admin\AppData\Local\Temp\B8E3.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\B922.tmp"C:\Users\Admin\AppData\Local\Temp\B922.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:820 -
C:\Users\Admin\AppData\Local\Temp\B970.tmp"C:\Users\Admin\AppData\Local\Temp\B970.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\B9BE.tmp"C:\Users\Admin\AppData\Local\Temp\B9BE.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:552 -
C:\Users\Admin\AppData\Local\Temp\BA0C.tmp"C:\Users\Admin\AppData\Local\Temp\BA0C.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\BA79.tmp"C:\Users\Admin\AppData\Local\Temp\BA79.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\BAC7.tmp"C:\Users\Admin\AppData\Local\Temp\BAC7.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\BB05.tmp"C:\Users\Admin\AppData\Local\Temp\BB05.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\BB53.tmp"C:\Users\Admin\AppData\Local\Temp\BB53.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\BB92.tmp"C:\Users\Admin\AppData\Local\Temp\BB92.tmp"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\BBD0.tmp"C:\Users\Admin\AppData\Local\Temp\BBD0.tmp"66⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\BC0F.tmp"C:\Users\Admin\AppData\Local\Temp\BC0F.tmp"67⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\BC5D.tmp"C:\Users\Admin\AppData\Local\Temp\BC5D.tmp"68⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\BC9B.tmp"C:\Users\Admin\AppData\Local\Temp\BC9B.tmp"69⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\BCD9.tmp"C:\Users\Admin\AppData\Local\Temp\BCD9.tmp"70⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\BD18.tmp"C:\Users\Admin\AppData\Local\Temp\BD18.tmp"71⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\BD66.tmp"C:\Users\Admin\AppData\Local\Temp\BD66.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\BDB4.tmp"C:\Users\Admin\AppData\Local\Temp\BDB4.tmp"73⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\BE02.tmp"C:\Users\Admin\AppData\Local\Temp\BE02.tmp"74⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\BE40.tmp"C:\Users\Admin\AppData\Local\Temp\BE40.tmp"75⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\BE8E.tmp"C:\Users\Admin\AppData\Local\Temp\BE8E.tmp"76⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\BECD.tmp"C:\Users\Admin\AppData\Local\Temp\BECD.tmp"77⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\BF0B.tmp"C:\Users\Admin\AppData\Local\Temp\BF0B.tmp"78⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\BF49.tmp"C:\Users\Admin\AppData\Local\Temp\BF49.tmp"79⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\BF97.tmp"C:\Users\Admin\AppData\Local\Temp\BF97.tmp"80⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\BFD6.tmp"C:\Users\Admin\AppData\Local\Temp\BFD6.tmp"81⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\C024.tmp"C:\Users\Admin\AppData\Local\Temp\C024.tmp"82⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\C072.tmp"C:\Users\Admin\AppData\Local\Temp\C072.tmp"83⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"84⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\C10E.tmp"C:\Users\Admin\AppData\Local\Temp\C10E.tmp"85⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\C15C.tmp"C:\Users\Admin\AppData\Local\Temp\C15C.tmp"86⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"87⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"88⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\C227.tmp"C:\Users\Admin\AppData\Local\Temp\C227.tmp"89⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\C275.tmp"C:\Users\Admin\AppData\Local\Temp\C275.tmp"90⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\C2B3.tmp"C:\Users\Admin\AppData\Local\Temp\C2B3.tmp"91⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\C2F1.tmp"C:\Users\Admin\AppData\Local\Temp\C2F1.tmp"92⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\C330.tmp"C:\Users\Admin\AppData\Local\Temp\C330.tmp"93⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\C37E.tmp"C:\Users\Admin\AppData\Local\Temp\C37E.tmp"94⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\C3BC.tmp"C:\Users\Admin\AppData\Local\Temp\C3BC.tmp"95⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\C3FB.tmp"C:\Users\Admin\AppData\Local\Temp\C3FB.tmp"96⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\C439.tmp"C:\Users\Admin\AppData\Local\Temp\C439.tmp"97⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\C477.tmp"C:\Users\Admin\AppData\Local\Temp\C477.tmp"98⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\C4B6.tmp"C:\Users\Admin\AppData\Local\Temp\C4B6.tmp"99⤵PID:596
-
C:\Users\Admin\AppData\Local\Temp\C4F4.tmp"C:\Users\Admin\AppData\Local\Temp\C4F4.tmp"100⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\C533.tmp"C:\Users\Admin\AppData\Local\Temp\C533.tmp"101⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\C581.tmp"C:\Users\Admin\AppData\Local\Temp\C581.tmp"102⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\C5BF.tmp"C:\Users\Admin\AppData\Local\Temp\C5BF.tmp"103⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\C5FE.tmp"C:\Users\Admin\AppData\Local\Temp\C5FE.tmp"104⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\C63C.tmp"C:\Users\Admin\AppData\Local\Temp\C63C.tmp"105⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\C67A.tmp"C:\Users\Admin\AppData\Local\Temp\C67A.tmp"106⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\C6B9.tmp"C:\Users\Admin\AppData\Local\Temp\C6B9.tmp"107⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\C707.tmp"C:\Users\Admin\AppData\Local\Temp\C707.tmp"108⤵PID:292
-
C:\Users\Admin\AppData\Local\Temp\C755.tmp"C:\Users\Admin\AppData\Local\Temp\C755.tmp"109⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\C793.tmp"C:\Users\Admin\AppData\Local\Temp\C793.tmp"110⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\C7D2.tmp"C:\Users\Admin\AppData\Local\Temp\C7D2.tmp"111⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\C810.tmp"C:\Users\Admin\AppData\Local\Temp\C810.tmp"112⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\C85E.tmp"C:\Users\Admin\AppData\Local\Temp\C85E.tmp"113⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\C89C.tmp"C:\Users\Admin\AppData\Local\Temp\C89C.tmp"114⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\C8DB.tmp"C:\Users\Admin\AppData\Local\Temp\C8DB.tmp"115⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\C929.tmp"C:\Users\Admin\AppData\Local\Temp\C929.tmp"116⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\C967.tmp"C:\Users\Admin\AppData\Local\Temp\C967.tmp"117⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\C9A6.tmp"C:\Users\Admin\AppData\Local\Temp\C9A6.tmp"118⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\C9E4.tmp"C:\Users\Admin\AppData\Local\Temp\C9E4.tmp"119⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\CA32.tmp"C:\Users\Admin\AppData\Local\Temp\CA32.tmp"120⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\CA80.tmp"C:\Users\Admin\AppData\Local\Temp\CA80.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\CABE.tmp"C:\Users\Admin\AppData\Local\Temp\CABE.tmp"122⤵PID:1112
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-