Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
01/10/2024, 06:30
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-01_80af61a836fbe7d66944a71958e5f68d_mafia.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-10-01_80af61a836fbe7d66944a71958e5f68d_mafia.exe
Resource
win10v2004-20240910-en
General
-
Target
2024-10-01_80af61a836fbe7d66944a71958e5f68d_mafia.exe
-
Size
541KB
-
MD5
80af61a836fbe7d66944a71958e5f68d
-
SHA1
84d9c20262125518ee34baf7d23a96e7e654b555
-
SHA256
74b14f6624991ace3d670b3257748f069542df8eede5323a971f698848056247
-
SHA512
be119b8db89d50663a516b143210656170ebe2491ee78a4e93ad8f63bb08f550efe88d0080addbac3270656e6d4d99dc72fff5eedeb428f379c33b79786c7629
-
SSDEEP
12288:UU5rCOTeifyDdGOmrlBRCEyDtM6SFrZa73ctO:UUQOJfYMOmrZrrU73ctO
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2740 37A4.tmp 2988 3801.tmp 2808 389D.tmp 2668 391A.tmp 2928 3997.tmp 2720 39E5.tmp 2564 3A42.tmp 3056 3ABF.tmp 2184 3B2C.tmp 1592 3BA9.tmp 1552 3C26.tmp 3004 3CA3.tmp 336 3D2F.tmp 916 3D8D.tmp 2148 3DFA.tmp 2612 3E86.tmp 2100 3F13.tmp 2840 3F90.tmp 1060 3FED.tmp 2356 407A.tmp 696 40E7.tmp 596 4164.tmp 2436 41E0.tmp 2080 421F.tmp 2260 425D.tmp 2180 42AB.tmp 3012 42EA.tmp 2232 4338.tmp 2968 4386.tmp 952 43D4.tmp 1560 4422.tmp 1372 4470.tmp 1656 44AE.tmp 348 450C.tmp 1668 455A.tmp 2868 45A8.tmp 1796 45F6.tmp 340 4644.tmp 760 4682.tmp 1972 46D0.tmp 2120 471E.tmp 1096 476C.tmp 3024 47AA.tmp 840 47F8.tmp 2456 4846.tmp 2404 4894.tmp 1476 48D3.tmp 2492 4921.tmp 2292 495F.tmp 1512 49AD.tmp 2636 49EC.tmp 2472 4A2A.tmp 1616 4AC6.tmp 2804 4B04.tmp 2708 4B52.tmp 2676 4B91.tmp 2224 4BDF.tmp 2832 4C1D.tmp 1508 4C6B.tmp 2116 4CAA.tmp 2664 4CE8.tmp 2600 4D36.tmp 3060 4D84.tmp 2604 4DC2.tmp -
Loads dropped DLL 64 IoCs
pid Process 1072 2024-10-01_80af61a836fbe7d66944a71958e5f68d_mafia.exe 2740 37A4.tmp 2988 3801.tmp 2808 389D.tmp 2668 391A.tmp 2928 3997.tmp 2720 39E5.tmp 2564 3A42.tmp 3056 3ABF.tmp 2184 3B2C.tmp 1592 3BA9.tmp 1552 3C26.tmp 3004 3CA3.tmp 336 3D2F.tmp 916 3D8D.tmp 2148 3DFA.tmp 2612 3E86.tmp 2100 3F13.tmp 2840 3F90.tmp 1060 3FED.tmp 2356 407A.tmp 696 40E7.tmp 596 4164.tmp 2436 41E0.tmp 2080 421F.tmp 2260 425D.tmp 2180 42AB.tmp 3012 42EA.tmp 2232 4338.tmp 2968 4386.tmp 952 43D4.tmp 1560 4422.tmp 1372 4470.tmp 1656 44AE.tmp 348 450C.tmp 1668 455A.tmp 2868 45A8.tmp 1796 45F6.tmp 340 4644.tmp 760 4682.tmp 1972 46D0.tmp 2120 471E.tmp 1096 476C.tmp 3024 47AA.tmp 840 47F8.tmp 2456 4846.tmp 2404 4894.tmp 1476 48D3.tmp 2492 4921.tmp 2292 495F.tmp 1512 49AD.tmp 2636 49EC.tmp 2752 4A68.tmp 1616 4AC6.tmp 2804 4B04.tmp 2708 4B52.tmp 2676 4B91.tmp 2224 4BDF.tmp 2832 4C1D.tmp 1508 4C6B.tmp 2116 4CAA.tmp 2664 4CE8.tmp 2600 4D36.tmp 3060 4D84.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E6B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3708.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B27D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF6F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 141D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9FE7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D327.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 624C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2617.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BC5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 928F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BEB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C10.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4921.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1072 wrote to memory of 2740 1072 2024-10-01_80af61a836fbe7d66944a71958e5f68d_mafia.exe 30 PID 1072 wrote to memory of 2740 1072 2024-10-01_80af61a836fbe7d66944a71958e5f68d_mafia.exe 30 PID 1072 wrote to memory of 2740 1072 2024-10-01_80af61a836fbe7d66944a71958e5f68d_mafia.exe 30 PID 1072 wrote to memory of 2740 1072 2024-10-01_80af61a836fbe7d66944a71958e5f68d_mafia.exe 30 PID 2740 wrote to memory of 2988 2740 37A4.tmp 31 PID 2740 wrote to memory of 2988 2740 37A4.tmp 31 PID 2740 wrote to memory of 2988 2740 37A4.tmp 31 PID 2740 wrote to memory of 2988 2740 37A4.tmp 31 PID 2988 wrote to memory of 2808 2988 3801.tmp 32 PID 2988 wrote to memory of 2808 2988 3801.tmp 32 PID 2988 wrote to memory of 2808 2988 3801.tmp 32 PID 2988 wrote to memory of 2808 2988 3801.tmp 32 PID 2808 wrote to memory of 2668 2808 389D.tmp 33 PID 2808 wrote to memory of 2668 2808 389D.tmp 33 PID 2808 wrote to memory of 2668 2808 389D.tmp 33 PID 2808 wrote to memory of 2668 2808 389D.tmp 33 PID 2668 wrote to memory of 2928 2668 391A.tmp 34 PID 2668 wrote to memory of 2928 2668 391A.tmp 34 PID 2668 wrote to memory of 2928 2668 391A.tmp 34 PID 2668 wrote to memory of 2928 2668 391A.tmp 34 PID 2928 wrote to memory of 2720 2928 3997.tmp 35 PID 2928 wrote to memory of 2720 2928 3997.tmp 35 PID 2928 wrote to memory of 2720 2928 3997.tmp 35 PID 2928 wrote to memory of 2720 2928 3997.tmp 35 PID 2720 wrote to memory of 2564 2720 39E5.tmp 36 PID 2720 wrote to memory of 2564 2720 39E5.tmp 36 PID 2720 wrote to memory of 2564 2720 39E5.tmp 36 PID 2720 wrote to memory of 2564 2720 39E5.tmp 36 PID 2564 wrote to memory of 3056 2564 3A42.tmp 37 PID 2564 wrote to memory of 3056 2564 3A42.tmp 37 PID 2564 wrote to memory of 3056 2564 3A42.tmp 37 PID 2564 wrote to memory of 3056 2564 3A42.tmp 37 PID 3056 wrote to memory of 2184 3056 3ABF.tmp 38 PID 3056 wrote to memory of 2184 3056 3ABF.tmp 38 PID 3056 wrote to memory of 2184 3056 3ABF.tmp 38 PID 3056 wrote to memory of 2184 3056 3ABF.tmp 38 PID 2184 wrote to memory of 1592 2184 3B2C.tmp 39 PID 2184 wrote to memory of 1592 2184 3B2C.tmp 39 PID 2184 wrote to memory of 1592 2184 3B2C.tmp 39 PID 2184 wrote to memory of 1592 2184 3B2C.tmp 39 PID 1592 wrote to memory of 1552 1592 3BA9.tmp 40 PID 1592 wrote to memory of 1552 1592 3BA9.tmp 40 PID 1592 wrote to memory of 1552 1592 3BA9.tmp 40 PID 1592 wrote to memory of 1552 1592 3BA9.tmp 40 PID 1552 wrote to memory of 3004 1552 3C26.tmp 41 PID 1552 wrote to memory of 3004 1552 3C26.tmp 41 PID 1552 wrote to memory of 3004 1552 3C26.tmp 41 PID 1552 wrote to memory of 3004 1552 3C26.tmp 41 PID 3004 wrote to memory of 336 3004 3CA3.tmp 42 PID 3004 wrote to memory of 336 3004 3CA3.tmp 42 PID 3004 wrote to memory of 336 3004 3CA3.tmp 42 PID 3004 wrote to memory of 336 3004 3CA3.tmp 42 PID 336 wrote to memory of 916 336 3D2F.tmp 43 PID 336 wrote to memory of 916 336 3D2F.tmp 43 PID 336 wrote to memory of 916 336 3D2F.tmp 43 PID 336 wrote to memory of 916 336 3D2F.tmp 43 PID 916 wrote to memory of 2148 916 3D8D.tmp 44 PID 916 wrote to memory of 2148 916 3D8D.tmp 44 PID 916 wrote to memory of 2148 916 3D8D.tmp 44 PID 916 wrote to memory of 2148 916 3D8D.tmp 44 PID 2148 wrote to memory of 2612 2148 3DFA.tmp 45 PID 2148 wrote to memory of 2612 2148 3DFA.tmp 45 PID 2148 wrote to memory of 2612 2148 3DFA.tmp 45 PID 2148 wrote to memory of 2612 2148 3DFA.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-01_80af61a836fbe7d66944a71958e5f68d_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-01_80af61a836fbe7d66944a71958e5f68d_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\37A4.tmp"C:\Users\Admin\AppData\Local\Temp\37A4.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\3801.tmp"C:\Users\Admin\AppData\Local\Temp\3801.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\389D.tmp"C:\Users\Admin\AppData\Local\Temp\389D.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\391A.tmp"C:\Users\Admin\AppData\Local\Temp\391A.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\3997.tmp"C:\Users\Admin\AppData\Local\Temp\3997.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\39E5.tmp"C:\Users\Admin\AppData\Local\Temp\39E5.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\3A42.tmp"C:\Users\Admin\AppData\Local\Temp\3A42.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\3ABF.tmp"C:\Users\Admin\AppData\Local\Temp\3ABF.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\3B2C.tmp"C:\Users\Admin\AppData\Local\Temp\3B2C.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\3BA9.tmp"C:\Users\Admin\AppData\Local\Temp\3BA9.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\3C26.tmp"C:\Users\Admin\AppData\Local\Temp\3C26.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\3CA3.tmp"C:\Users\Admin\AppData\Local\Temp\3CA3.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\3D2F.tmp"C:\Users\Admin\AppData\Local\Temp\3D2F.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:336 -
C:\Users\Admin\AppData\Local\Temp\3D8D.tmp"C:\Users\Admin\AppData\Local\Temp\3D8D.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\3DFA.tmp"C:\Users\Admin\AppData\Local\Temp\3DFA.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\3E86.tmp"C:\Users\Admin\AppData\Local\Temp\3E86.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\3F13.tmp"C:\Users\Admin\AppData\Local\Temp\3F13.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\3F90.tmp"C:\Users\Admin\AppData\Local\Temp\3F90.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\3FED.tmp"C:\Users\Admin\AppData\Local\Temp\3FED.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\407A.tmp"C:\Users\Admin\AppData\Local\Temp\407A.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\40E7.tmp"C:\Users\Admin\AppData\Local\Temp\40E7.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:696 -
C:\Users\Admin\AppData\Local\Temp\4164.tmp"C:\Users\Admin\AppData\Local\Temp\4164.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:596 -
C:\Users\Admin\AppData\Local\Temp\41E0.tmp"C:\Users\Admin\AppData\Local\Temp\41E0.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\421F.tmp"C:\Users\Admin\AppData\Local\Temp\421F.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\425D.tmp"C:\Users\Admin\AppData\Local\Temp\425D.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\42AB.tmp"C:\Users\Admin\AppData\Local\Temp\42AB.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\42EA.tmp"C:\Users\Admin\AppData\Local\Temp\42EA.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\4338.tmp"C:\Users\Admin\AppData\Local\Temp\4338.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\4386.tmp"C:\Users\Admin\AppData\Local\Temp\4386.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\43D4.tmp"C:\Users\Admin\AppData\Local\Temp\43D4.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:952 -
C:\Users\Admin\AppData\Local\Temp\4422.tmp"C:\Users\Admin\AppData\Local\Temp\4422.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\4470.tmp"C:\Users\Admin\AppData\Local\Temp\4470.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\44AE.tmp"C:\Users\Admin\AppData\Local\Temp\44AE.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\450C.tmp"C:\Users\Admin\AppData\Local\Temp\450C.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:348 -
C:\Users\Admin\AppData\Local\Temp\455A.tmp"C:\Users\Admin\AppData\Local\Temp\455A.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\45A8.tmp"C:\Users\Admin\AppData\Local\Temp\45A8.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\45F6.tmp"C:\Users\Admin\AppData\Local\Temp\45F6.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\4644.tmp"C:\Users\Admin\AppData\Local\Temp\4644.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:340 -
C:\Users\Admin\AppData\Local\Temp\4682.tmp"C:\Users\Admin\AppData\Local\Temp\4682.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:760 -
C:\Users\Admin\AppData\Local\Temp\46D0.tmp"C:\Users\Admin\AppData\Local\Temp\46D0.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\471E.tmp"C:\Users\Admin\AppData\Local\Temp\471E.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\476C.tmp"C:\Users\Admin\AppData\Local\Temp\476C.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\47AA.tmp"C:\Users\Admin\AppData\Local\Temp\47AA.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\47F8.tmp"C:\Users\Admin\AppData\Local\Temp\47F8.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:840 -
C:\Users\Admin\AppData\Local\Temp\4846.tmp"C:\Users\Admin\AppData\Local\Temp\4846.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\4894.tmp"C:\Users\Admin\AppData\Local\Temp\4894.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\48D3.tmp"C:\Users\Admin\AppData\Local\Temp\48D3.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\4921.tmp"C:\Users\Admin\AppData\Local\Temp\4921.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\495F.tmp"C:\Users\Admin\AppData\Local\Temp\495F.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\49AD.tmp"C:\Users\Admin\AppData\Local\Temp\49AD.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\49EC.tmp"C:\Users\Admin\AppData\Local\Temp\49EC.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\4A2A.tmp"C:\Users\Admin\AppData\Local\Temp\4A2A.tmp"53⤵
- Executes dropped EXE
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\4A68.tmp"C:\Users\Admin\AppData\Local\Temp\4A68.tmp"54⤵
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\4AC6.tmp"C:\Users\Admin\AppData\Local\Temp\4AC6.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\4B04.tmp"C:\Users\Admin\AppData\Local\Temp\4B04.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\4B52.tmp"C:\Users\Admin\AppData\Local\Temp\4B52.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\4B91.tmp"C:\Users\Admin\AppData\Local\Temp\4B91.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\4BDF.tmp"C:\Users\Admin\AppData\Local\Temp\4BDF.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\4C1D.tmp"C:\Users\Admin\AppData\Local\Temp\4C1D.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\4C6B.tmp"C:\Users\Admin\AppData\Local\Temp\4C6B.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\4CAA.tmp"C:\Users\Admin\AppData\Local\Temp\4CAA.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\4CE8.tmp"C:\Users\Admin\AppData\Local\Temp\4CE8.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\4D36.tmp"C:\Users\Admin\AppData\Local\Temp\4D36.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"66⤵
- Executes dropped EXE
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"67⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"68⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"69⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"70⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"71⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\4F77.tmp"C:\Users\Admin\AppData\Local\Temp\4F77.tmp"72⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\4FC5.tmp"C:\Users\Admin\AppData\Local\Temp\4FC5.tmp"73⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"74⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"75⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\5090.tmp"C:\Users\Admin\AppData\Local\Temp\5090.tmp"76⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\50CE.tmp"C:\Users\Admin\AppData\Local\Temp\50CE.tmp"77⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\510D.tmp"C:\Users\Admin\AppData\Local\Temp\510D.tmp"78⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\515B.tmp"C:\Users\Admin\AppData\Local\Temp\515B.tmp"79⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\5199.tmp"C:\Users\Admin\AppData\Local\Temp\5199.tmp"80⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\51D8.tmp"C:\Users\Admin\AppData\Local\Temp\51D8.tmp"81⤵
- System Location Discovery: System Language Discovery
PID:444 -
C:\Users\Admin\AppData\Local\Temp\5216.tmp"C:\Users\Admin\AppData\Local\Temp\5216.tmp"82⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\5254.tmp"C:\Users\Admin\AppData\Local\Temp\5254.tmp"83⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\5293.tmp"C:\Users\Admin\AppData\Local\Temp\5293.tmp"84⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\52D1.tmp"C:\Users\Admin\AppData\Local\Temp\52D1.tmp"85⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\5310.tmp"C:\Users\Admin\AppData\Local\Temp\5310.tmp"86⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\535E.tmp"C:\Users\Admin\AppData\Local\Temp\535E.tmp"87⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\539C.tmp"C:\Users\Admin\AppData\Local\Temp\539C.tmp"88⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\53DA.tmp"C:\Users\Admin\AppData\Local\Temp\53DA.tmp"89⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\5419.tmp"C:\Users\Admin\AppData\Local\Temp\5419.tmp"90⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\5457.tmp"C:\Users\Admin\AppData\Local\Temp\5457.tmp"91⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\5496.tmp"C:\Users\Admin\AppData\Local\Temp\5496.tmp"92⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\54D4.tmp"C:\Users\Admin\AppData\Local\Temp\54D4.tmp"93⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\5512.tmp"C:\Users\Admin\AppData\Local\Temp\5512.tmp"94⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\5551.tmp"C:\Users\Admin\AppData\Local\Temp\5551.tmp"95⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\558F.tmp"C:\Users\Admin\AppData\Local\Temp\558F.tmp"96⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\55DD.tmp"C:\Users\Admin\AppData\Local\Temp\55DD.tmp"97⤵
- System Location Discovery: System Language Discovery
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\561C.tmp"C:\Users\Admin\AppData\Local\Temp\561C.tmp"98⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\566A.tmp"C:\Users\Admin\AppData\Local\Temp\566A.tmp"99⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\56A8.tmp"C:\Users\Admin\AppData\Local\Temp\56A8.tmp"100⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\56F6.tmp"C:\Users\Admin\AppData\Local\Temp\56F6.tmp"101⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\5734.tmp"C:\Users\Admin\AppData\Local\Temp\5734.tmp"102⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\5783.tmp"C:\Users\Admin\AppData\Local\Temp\5783.tmp"103⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\57D1.tmp"C:\Users\Admin\AppData\Local\Temp\57D1.tmp"104⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\581F.tmp"C:\Users\Admin\AppData\Local\Temp\581F.tmp"105⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\586D.tmp"C:\Users\Admin\AppData\Local\Temp\586D.tmp"106⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\58AB.tmp"C:\Users\Admin\AppData\Local\Temp\58AB.tmp"107⤵
- System Location Discovery: System Language Discovery
PID:908 -
C:\Users\Admin\AppData\Local\Temp\58E9.tmp"C:\Users\Admin\AppData\Local\Temp\58E9.tmp"108⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\5937.tmp"C:\Users\Admin\AppData\Local\Temp\5937.tmp"109⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\5976.tmp"C:\Users\Admin\AppData\Local\Temp\5976.tmp"110⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\59B4.tmp"C:\Users\Admin\AppData\Local\Temp\59B4.tmp"111⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\59F3.tmp"C:\Users\Admin\AppData\Local\Temp\59F3.tmp"112⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\5A41.tmp"C:\Users\Admin\AppData\Local\Temp\5A41.tmp"113⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\5A7F.tmp"C:\Users\Admin\AppData\Local\Temp\5A7F.tmp"114⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\5ABD.tmp"C:\Users\Admin\AppData\Local\Temp\5ABD.tmp"115⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\5AFC.tmp"C:\Users\Admin\AppData\Local\Temp\5AFC.tmp"116⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\5B4A.tmp"C:\Users\Admin\AppData\Local\Temp\5B4A.tmp"117⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\5B88.tmp"C:\Users\Admin\AppData\Local\Temp\5B88.tmp"118⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\5BC7.tmp"C:\Users\Admin\AppData\Local\Temp\5BC7.tmp"119⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\5C05.tmp"C:\Users\Admin\AppData\Local\Temp\5C05.tmp"120⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\5C43.tmp"C:\Users\Admin\AppData\Local\Temp\5C43.tmp"121⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\5C82.tmp"C:\Users\Admin\AppData\Local\Temp\5C82.tmp"122⤵PID:2988
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-