Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
26/07/2024, 09:45
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-26_59f198ae7893ae2632094c624ec4836b_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-07-26_59f198ae7893ae2632094c624ec4836b_mafia.exe
Resource
win10v2004-20240709-en
General
-
Target
2024-07-26_59f198ae7893ae2632094c624ec4836b_mafia.exe
-
Size
541KB
-
MD5
59f198ae7893ae2632094c624ec4836b
-
SHA1
3175b2aea9aba9e62d93b6a9ccc364bee1266c0b
-
SHA256
9382a4edaf2ffd1edeed05ce6c6ba08eb5445db1a8aa4a6683b6086ccb71d871
-
SHA512
8bfb1a51d749615adfa70836b1a1930abc0c20c08f78977edd360de68421b022fe3849e654f40e36dc6c304b8fe657bd36415f2c9d4ee01318794d68b9fede89
-
SSDEEP
12288:UU5rCOTeif7d0uDN3SVyesFGw7arZa73ctO:UUQOJfZFZMyXTerU73ctO
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2316 D901.tmp 2472 D96E.tmp 1636 D9DB.tmp 2052 DA39.tmp 3048 DA77.tmp 2540 DAC5.tmp 2700 DB03.tmp 2524 DB61.tmp 2424 DBAF.tmp 2412 DBFD.tmp 2432 DC7A.tmp 2384 DCD7.tmp 2464 DD25.tmp 2708 DD64.tmp 1988 DDC2.tmp 1904 DE2F.tmp 1872 DE8C.tmp 1576 DEEA.tmp 1040 DF38.tmp 1860 DFB5.tmp 324 E012.tmp 328 E080.tmp 2576 E0BE.tmp 2608 E10C.tmp 756 E14A.tmp 2680 E189.tmp 2800 E1C7.tmp 2664 E206.tmp 2832 E244.tmp 1912 E292.tmp 404 E2F0.tmp 2920 E33E.tmp 684 E38C.tmp 788 E3DA.tmp 1540 E428.tmp 2012 E466.tmp 1364 E4A4.tmp 2772 E4E3.tmp 1272 E521.tmp 1212 E560.tmp 1480 E5AE.tmp 1708 E5FC.tmp 1600 E64A.tmp 2268 E698.tmp 2108 E6D6.tmp 2828 E714.tmp 1248 E762.tmp 3064 E7B0.tmp 1924 E7FE.tmp 2208 E83D.tmp 1744 E87B.tmp 2468 E8F8.tmp 2324 E936.tmp 1356 E975.tmp 2472 E9C3.tmp 2192 EA01.tmp 1164 EA4F.tmp 2536 EA9D.tmp 2588 EAEB.tmp 2548 EB2A.tmp 1184 EB68.tmp 2700 EBA6.tmp 2556 EBF4.tmp 2508 EC33.tmp -
Loads dropped DLL 64 IoCs
pid Process 2300 2024-07-26_59f198ae7893ae2632094c624ec4836b_mafia.exe 2316 D901.tmp 2472 D96E.tmp 1636 D9DB.tmp 2052 DA39.tmp 3048 DA77.tmp 2540 DAC5.tmp 2700 DB03.tmp 2524 DB61.tmp 2424 DBAF.tmp 2412 DBFD.tmp 2432 DC7A.tmp 2384 DCD7.tmp 2464 DD25.tmp 2708 DD64.tmp 1988 DDC2.tmp 1904 DE2F.tmp 1872 DE8C.tmp 1576 DEEA.tmp 1040 DF38.tmp 1860 DFB5.tmp 324 E012.tmp 328 E080.tmp 2576 E0BE.tmp 2608 E10C.tmp 756 E14A.tmp 2680 E189.tmp 2800 E1C7.tmp 2664 E206.tmp 2832 E244.tmp 1912 E292.tmp 404 E2F0.tmp 2920 E33E.tmp 684 E38C.tmp 788 E3DA.tmp 1540 E428.tmp 2012 E466.tmp 1364 E4A4.tmp 2772 E4E3.tmp 1272 E521.tmp 1212 E560.tmp 1480 E5AE.tmp 1708 E5FC.tmp 1600 E64A.tmp 2268 E698.tmp 2108 E6D6.tmp 2828 E714.tmp 1248 E762.tmp 3064 E7B0.tmp 1924 E7FE.tmp 2208 E83D.tmp 1628 E8BA.tmp 2468 E8F8.tmp 2324 E936.tmp 1356 E975.tmp 2472 E9C3.tmp 2192 EA01.tmp 1164 EA4F.tmp 2536 EA9D.tmp 2588 EAEB.tmp 2548 EB2A.tmp 1184 EB68.tmp 2700 EBA6.tmp 2556 EBF4.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 819E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7501.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 674B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 621D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 365C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6900.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 956C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA77.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F354.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8066.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B155.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8527.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2300 wrote to memory of 2316 2300 2024-07-26_59f198ae7893ae2632094c624ec4836b_mafia.exe 30 PID 2300 wrote to memory of 2316 2300 2024-07-26_59f198ae7893ae2632094c624ec4836b_mafia.exe 30 PID 2300 wrote to memory of 2316 2300 2024-07-26_59f198ae7893ae2632094c624ec4836b_mafia.exe 30 PID 2300 wrote to memory of 2316 2300 2024-07-26_59f198ae7893ae2632094c624ec4836b_mafia.exe 30 PID 2316 wrote to memory of 2472 2316 D901.tmp 31 PID 2316 wrote to memory of 2472 2316 D901.tmp 31 PID 2316 wrote to memory of 2472 2316 D901.tmp 31 PID 2316 wrote to memory of 2472 2316 D901.tmp 31 PID 2472 wrote to memory of 1636 2472 D96E.tmp 32 PID 2472 wrote to memory of 1636 2472 D96E.tmp 32 PID 2472 wrote to memory of 1636 2472 D96E.tmp 32 PID 2472 wrote to memory of 1636 2472 D96E.tmp 32 PID 1636 wrote to memory of 2052 1636 D9DB.tmp 33 PID 1636 wrote to memory of 2052 1636 D9DB.tmp 33 PID 1636 wrote to memory of 2052 1636 D9DB.tmp 33 PID 1636 wrote to memory of 2052 1636 D9DB.tmp 33 PID 2052 wrote to memory of 3048 2052 DA39.tmp 34 PID 2052 wrote to memory of 3048 2052 DA39.tmp 34 PID 2052 wrote to memory of 3048 2052 DA39.tmp 34 PID 2052 wrote to memory of 3048 2052 DA39.tmp 34 PID 3048 wrote to memory of 2540 3048 DA77.tmp 35 PID 3048 wrote to memory of 2540 3048 DA77.tmp 35 PID 3048 wrote to memory of 2540 3048 DA77.tmp 35 PID 3048 wrote to memory of 2540 3048 DA77.tmp 35 PID 2540 wrote to memory of 2700 2540 DAC5.tmp 36 PID 2540 wrote to memory of 2700 2540 DAC5.tmp 36 PID 2540 wrote to memory of 2700 2540 DAC5.tmp 36 PID 2540 wrote to memory of 2700 2540 DAC5.tmp 36 PID 2700 wrote to memory of 2524 2700 DB03.tmp 37 PID 2700 wrote to memory of 2524 2700 DB03.tmp 37 PID 2700 wrote to memory of 2524 2700 DB03.tmp 37 PID 2700 wrote to memory of 2524 2700 DB03.tmp 37 PID 2524 wrote to memory of 2424 2524 DB61.tmp 38 PID 2524 wrote to memory of 2424 2524 DB61.tmp 38 PID 2524 wrote to memory of 2424 2524 DB61.tmp 38 PID 2524 wrote to memory of 2424 2524 DB61.tmp 38 PID 2424 wrote to memory of 2412 2424 DBAF.tmp 39 PID 2424 wrote to memory of 2412 2424 DBAF.tmp 39 PID 2424 wrote to memory of 2412 2424 DBAF.tmp 39 PID 2424 wrote to memory of 2412 2424 DBAF.tmp 39 PID 2412 wrote to memory of 2432 2412 DBFD.tmp 40 PID 2412 wrote to memory of 2432 2412 DBFD.tmp 40 PID 2412 wrote to memory of 2432 2412 DBFD.tmp 40 PID 2412 wrote to memory of 2432 2412 DBFD.tmp 40 PID 2432 wrote to memory of 2384 2432 DC7A.tmp 41 PID 2432 wrote to memory of 2384 2432 DC7A.tmp 41 PID 2432 wrote to memory of 2384 2432 DC7A.tmp 41 PID 2432 wrote to memory of 2384 2432 DC7A.tmp 41 PID 2384 wrote to memory of 2464 2384 DCD7.tmp 42 PID 2384 wrote to memory of 2464 2384 DCD7.tmp 42 PID 2384 wrote to memory of 2464 2384 DCD7.tmp 42 PID 2384 wrote to memory of 2464 2384 DCD7.tmp 42 PID 2464 wrote to memory of 2708 2464 DD25.tmp 43 PID 2464 wrote to memory of 2708 2464 DD25.tmp 43 PID 2464 wrote to memory of 2708 2464 DD25.tmp 43 PID 2464 wrote to memory of 2708 2464 DD25.tmp 43 PID 2708 wrote to memory of 1988 2708 DD64.tmp 44 PID 2708 wrote to memory of 1988 2708 DD64.tmp 44 PID 2708 wrote to memory of 1988 2708 DD64.tmp 44 PID 2708 wrote to memory of 1988 2708 DD64.tmp 44 PID 1988 wrote to memory of 1904 1988 DDC2.tmp 45 PID 1988 wrote to memory of 1904 1988 DDC2.tmp 45 PID 1988 wrote to memory of 1904 1988 DDC2.tmp 45 PID 1988 wrote to memory of 1904 1988 DDC2.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-26_59f198ae7893ae2632094c624ec4836b_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-26_59f198ae7893ae2632094c624ec4836b_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\D901.tmp"C:\Users\Admin\AppData\Local\Temp\D901.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\D96E.tmp"C:\Users\Admin\AppData\Local\Temp\D96E.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\D9DB.tmp"C:\Users\Admin\AppData\Local\Temp\D9DB.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\DA39.tmp"C:\Users\Admin\AppData\Local\Temp\DA39.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\DA77.tmp"C:\Users\Admin\AppData\Local\Temp\DA77.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\DAC5.tmp"C:\Users\Admin\AppData\Local\Temp\DAC5.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\DB03.tmp"C:\Users\Admin\AppData\Local\Temp\DB03.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\DB61.tmp"C:\Users\Admin\AppData\Local\Temp\DB61.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\DBAF.tmp"C:\Users\Admin\AppData\Local\Temp\DBAF.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\DBFD.tmp"C:\Users\Admin\AppData\Local\Temp\DBFD.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\DC7A.tmp"C:\Users\Admin\AppData\Local\Temp\DC7A.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\DCD7.tmp"C:\Users\Admin\AppData\Local\Temp\DCD7.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\DD25.tmp"C:\Users\Admin\AppData\Local\Temp\DD25.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\DD64.tmp"C:\Users\Admin\AppData\Local\Temp\DD64.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\DDC2.tmp"C:\Users\Admin\AppData\Local\Temp\DDC2.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\DE2F.tmp"C:\Users\Admin\AppData\Local\Temp\DE2F.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\DE8C.tmp"C:\Users\Admin\AppData\Local\Temp\DE8C.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\DEEA.tmp"C:\Users\Admin\AppData\Local\Temp\DEEA.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\DF38.tmp"C:\Users\Admin\AppData\Local\Temp\DF38.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\DFB5.tmp"C:\Users\Admin\AppData\Local\Temp\DFB5.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\E012.tmp"C:\Users\Admin\AppData\Local\Temp\E012.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:324 -
C:\Users\Admin\AppData\Local\Temp\E080.tmp"C:\Users\Admin\AppData\Local\Temp\E080.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:328 -
C:\Users\Admin\AppData\Local\Temp\E0BE.tmp"C:\Users\Admin\AppData\Local\Temp\E0BE.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\E10C.tmp"C:\Users\Admin\AppData\Local\Temp\E10C.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\E14A.tmp"C:\Users\Admin\AppData\Local\Temp\E14A.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:756 -
C:\Users\Admin\AppData\Local\Temp\E189.tmp"C:\Users\Admin\AppData\Local\Temp\E189.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\E1C7.tmp"C:\Users\Admin\AppData\Local\Temp\E1C7.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\E206.tmp"C:\Users\Admin\AppData\Local\Temp\E206.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\E244.tmp"C:\Users\Admin\AppData\Local\Temp\E244.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\E292.tmp"C:\Users\Admin\AppData\Local\Temp\E292.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\E2F0.tmp"C:\Users\Admin\AppData\Local\Temp\E2F0.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:404 -
C:\Users\Admin\AppData\Local\Temp\E33E.tmp"C:\Users\Admin\AppData\Local\Temp\E33E.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\E38C.tmp"C:\Users\Admin\AppData\Local\Temp\E38C.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:684 -
C:\Users\Admin\AppData\Local\Temp\E3DA.tmp"C:\Users\Admin\AppData\Local\Temp\E3DA.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:788 -
C:\Users\Admin\AppData\Local\Temp\E428.tmp"C:\Users\Admin\AppData\Local\Temp\E428.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\E466.tmp"C:\Users\Admin\AppData\Local\Temp\E466.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\E4A4.tmp"C:\Users\Admin\AppData\Local\Temp\E4A4.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\E4E3.tmp"C:\Users\Admin\AppData\Local\Temp\E4E3.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\E521.tmp"C:\Users\Admin\AppData\Local\Temp\E521.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\E560.tmp"C:\Users\Admin\AppData\Local\Temp\E560.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\E5AE.tmp"C:\Users\Admin\AppData\Local\Temp\E5AE.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\E5FC.tmp"C:\Users\Admin\AppData\Local\Temp\E5FC.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\E64A.tmp"C:\Users\Admin\AppData\Local\Temp\E64A.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\E698.tmp"C:\Users\Admin\AppData\Local\Temp\E698.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\E6D6.tmp"C:\Users\Admin\AppData\Local\Temp\E6D6.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\E714.tmp"C:\Users\Admin\AppData\Local\Temp\E714.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\E762.tmp"C:\Users\Admin\AppData\Local\Temp\E762.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\E7FE.tmp"C:\Users\Admin\AppData\Local\Temp\E7FE.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\E83D.tmp"C:\Users\Admin\AppData\Local\Temp\E83D.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\E87B.tmp"C:\Users\Admin\AppData\Local\Temp\E87B.tmp"52⤵
- Executes dropped EXE
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"53⤵
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\E8F8.tmp"C:\Users\Admin\AppData\Local\Temp\E8F8.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\E936.tmp"C:\Users\Admin\AppData\Local\Temp\E936.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\E975.tmp"C:\Users\Admin\AppData\Local\Temp\E975.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\E9C3.tmp"C:\Users\Admin\AppData\Local\Temp\E9C3.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\EA01.tmp"C:\Users\Admin\AppData\Local\Temp\EA01.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\EA4F.tmp"C:\Users\Admin\AppData\Local\Temp\EA4F.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\EA9D.tmp"C:\Users\Admin\AppData\Local\Temp\EA9D.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\EAEB.tmp"C:\Users\Admin\AppData\Local\Temp\EAEB.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\EB2A.tmp"C:\Users\Admin\AppData\Local\Temp\EB2A.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\EB68.tmp"C:\Users\Admin\AppData\Local\Temp\EB68.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\EBA6.tmp"C:\Users\Admin\AppData\Local\Temp\EBA6.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\EBF4.tmp"C:\Users\Admin\AppData\Local\Temp\EBF4.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\EC33.tmp"C:\Users\Admin\AppData\Local\Temp\EC33.tmp"66⤵
- Executes dropped EXE
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\EC90.tmp"C:\Users\Admin\AppData\Local\Temp\EC90.tmp"67⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\ECCF.tmp"C:\Users\Admin\AppData\Local\Temp\ECCF.tmp"68⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\ED1D.tmp"C:\Users\Admin\AppData\Local\Temp\ED1D.tmp"69⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\ED5B.tmp"C:\Users\Admin\AppData\Local\Temp\ED5B.tmp"70⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\ED9A.tmp"C:\Users\Admin\AppData\Local\Temp\ED9A.tmp"71⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\EDD8.tmp"C:\Users\Admin\AppData\Local\Temp\EDD8.tmp"72⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\EE26.tmp"C:\Users\Admin\AppData\Local\Temp\EE26.tmp"73⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\EE64.tmp"C:\Users\Admin\AppData\Local\Temp\EE64.tmp"74⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\EEB2.tmp"C:\Users\Admin\AppData\Local\Temp\EEB2.tmp"75⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\EEF1.tmp"C:\Users\Admin\AppData\Local\Temp\EEF1.tmp"76⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\EF2F.tmp"C:\Users\Admin\AppData\Local\Temp\EF2F.tmp"77⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\EF6E.tmp"C:\Users\Admin\AppData\Local\Temp\EF6E.tmp"78⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\EFBC.tmp"C:\Users\Admin\AppData\Local\Temp\EFBC.tmp"79⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\EFFA.tmp"C:\Users\Admin\AppData\Local\Temp\EFFA.tmp"80⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\F038.tmp"C:\Users\Admin\AppData\Local\Temp\F038.tmp"81⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\F077.tmp"C:\Users\Admin\AppData\Local\Temp\F077.tmp"82⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\F0C5.tmp"C:\Users\Admin\AppData\Local\Temp\F0C5.tmp"83⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\F103.tmp"C:\Users\Admin\AppData\Local\Temp\F103.tmp"84⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\F151.tmp"C:\Users\Admin\AppData\Local\Temp\F151.tmp"85⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\F190.tmp"C:\Users\Admin\AppData\Local\Temp\F190.tmp"86⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\F1CE.tmp"C:\Users\Admin\AppData\Local\Temp\F1CE.tmp"87⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\F20C.tmp"C:\Users\Admin\AppData\Local\Temp\F20C.tmp"88⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\F25A.tmp"C:\Users\Admin\AppData\Local\Temp\F25A.tmp"89⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\F299.tmp"C:\Users\Admin\AppData\Local\Temp\F299.tmp"90⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\F2D7.tmp"C:\Users\Admin\AppData\Local\Temp\F2D7.tmp"91⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\F316.tmp"C:\Users\Admin\AppData\Local\Temp\F316.tmp"92⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\F354.tmp"C:\Users\Admin\AppData\Local\Temp\F354.tmp"93⤵
- System Location Discovery: System Language Discovery
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\F392.tmp"C:\Users\Admin\AppData\Local\Temp\F392.tmp"94⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\F3D1.tmp"C:\Users\Admin\AppData\Local\Temp\F3D1.tmp"95⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\F40F.tmp"C:\Users\Admin\AppData\Local\Temp\F40F.tmp"96⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\F44E.tmp"C:\Users\Admin\AppData\Local\Temp\F44E.tmp"97⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\F49C.tmp"C:\Users\Admin\AppData\Local\Temp\F49C.tmp"98⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\F4DA.tmp"C:\Users\Admin\AppData\Local\Temp\F4DA.tmp"99⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\F518.tmp"C:\Users\Admin\AppData\Local\Temp\F518.tmp"100⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\F557.tmp"C:\Users\Admin\AppData\Local\Temp\F557.tmp"101⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\F595.tmp"C:\Users\Admin\AppData\Local\Temp\F595.tmp"102⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\F5D4.tmp"C:\Users\Admin\AppData\Local\Temp\F5D4.tmp"103⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\F612.tmp"C:\Users\Admin\AppData\Local\Temp\F612.tmp"104⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\F650.tmp"C:\Users\Admin\AppData\Local\Temp\F650.tmp"105⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\F68F.tmp"C:\Users\Admin\AppData\Local\Temp\F68F.tmp"106⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\F6DD.tmp"C:\Users\Admin\AppData\Local\Temp\F6DD.tmp"107⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\F71B.tmp"C:\Users\Admin\AppData\Local\Temp\F71B.tmp"108⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\F75A.tmp"C:\Users\Admin\AppData\Local\Temp\F75A.tmp"109⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\F798.tmp"C:\Users\Admin\AppData\Local\Temp\F798.tmp"110⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\F7D6.tmp"C:\Users\Admin\AppData\Local\Temp\F7D6.tmp"111⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\F824.tmp"C:\Users\Admin\AppData\Local\Temp\F824.tmp"112⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\F863.tmp"C:\Users\Admin\AppData\Local\Temp\F863.tmp"113⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\F8A1.tmp"C:\Users\Admin\AppData\Local\Temp\F8A1.tmp"114⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\F8E0.tmp"C:\Users\Admin\AppData\Local\Temp\F8E0.tmp"115⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\F91E.tmp"C:\Users\Admin\AppData\Local\Temp\F91E.tmp"116⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\F96C.tmp"C:\Users\Admin\AppData\Local\Temp\F96C.tmp"117⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\F9AA.tmp"C:\Users\Admin\AppData\Local\Temp\F9AA.tmp"118⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\F9E9.tmp"C:\Users\Admin\AppData\Local\Temp\F9E9.tmp"119⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\FA27.tmp"C:\Users\Admin\AppData\Local\Temp\FA27.tmp"120⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\FA66.tmp"C:\Users\Admin\AppData\Local\Temp\FA66.tmp"121⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\FAB4.tmp"C:\Users\Admin\AppData\Local\Temp\FAB4.tmp"122⤵PID:2084
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-