Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
02/08/2024, 03:50
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-02_d393478ec9d6b709ee7a0a8c81772b80_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-08-02_d393478ec9d6b709ee7a0a8c81772b80_mafia.exe
Resource
win10v2004-20240730-en
General
-
Target
2024-08-02_d393478ec9d6b709ee7a0a8c81772b80_mafia.exe
-
Size
712KB
-
MD5
d393478ec9d6b709ee7a0a8c81772b80
-
SHA1
1b4070d0f41f1d24c350c8d4be7b390f47dceb43
-
SHA256
e5b5a514fe6ee7055a2996e1da0c52fb0acd7d51efe54818d6a35f632c26d796
-
SHA512
e3d71b6a14c63d7a94e40db5dbdde7a3fe77b35e14426ebdedfff7676d62d25602879758fb583122dba1275508769d7888b6a222811f53e6b60460d1d0a97f05
-
SSDEEP
12288:FU5rCOTeiDCLmjEVx0J6qnMWNZdCvq5TJLCvY90D8/LVBlVk736Y79GWzNbA:FUQOJDw8EE6qBNnCvq5TJLCvY90D8/L5
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2864 754F.tmp 2748 75FB.tmp 2876 76E5.tmp 2760 77A0.tmp 2640 782C.tmp 2712 78E7.tmp 2632 7945.tmp 2468 7A10.tmp 1340 7ADB.tmp 648 7B96.tmp 828 7C13.tmp 2416 7CBE.tmp 2536 7D6A.tmp 2504 7E15.tmp 2992 7EC1.tmp 2792 7F6D.tmp 2700 7FF9.tmp 2988 8095.tmp 1688 8150.tmp 1992 81DD.tmp 2944 8298.tmp 760 8353.tmp 704 83DF.tmp 1040 843D.tmp 2984 848B.tmp 2092 84D9.tmp 2196 8537.tmp 2172 8585.tmp 2140 85D3.tmp 1140 8621.tmp 2204 866F.tmp 2260 86BD.tmp 2280 86FB.tmp 2356 8749.tmp 2036 8787.tmp 1592 87E5.tmp 2224 8833.tmp 1804 8881.tmp 1760 88DF.tmp 1648 892D.tmp 1624 897B.tmp 604 89B9.tmp 688 89F7.tmp 3056 8A45.tmp 852 8A84.tmp 560 8AC2.tmp 2080 8B10.tmp 2056 8B5E.tmp 612 8BAC.tmp 1736 8BFA.tmp 1700 8C48.tmp 2868 8C96.tmp 1576 8CE4.tmp 2952 8D32.tmp 2872 8D71.tmp 2724 8DBF.tmp 2428 8E0D.tmp 2844 8E5B.tmp 1708 8EA9.tmp 2900 8EF7.tmp 2656 8F45.tmp 1324 8FA2.tmp 2612 8FF0.tmp 496 903E.tmp -
Loads dropped DLL 64 IoCs
pid Process 2708 2024-08-02_d393478ec9d6b709ee7a0a8c81772b80_mafia.exe 2864 754F.tmp 2748 75FB.tmp 2876 76E5.tmp 2760 77A0.tmp 2640 782C.tmp 2712 78E7.tmp 2632 7945.tmp 2468 7A10.tmp 1340 7ADB.tmp 648 7B96.tmp 828 7C13.tmp 2416 7CBE.tmp 2536 7D6A.tmp 2504 7E15.tmp 2992 7EC1.tmp 2792 7F6D.tmp 2700 7FF9.tmp 2988 8095.tmp 1688 8150.tmp 1992 81DD.tmp 2944 8298.tmp 760 8353.tmp 704 83DF.tmp 1040 843D.tmp 2984 848B.tmp 2092 84D9.tmp 2196 8537.tmp 2172 8585.tmp 2140 85D3.tmp 1140 8621.tmp 2204 866F.tmp 2260 86BD.tmp 2280 86FB.tmp 2356 8749.tmp 2036 8787.tmp 1592 87E5.tmp 2224 8833.tmp 1804 8881.tmp 1760 88DF.tmp 1648 892D.tmp 1624 897B.tmp 604 89B9.tmp 688 89F7.tmp 3056 8A45.tmp 852 8A84.tmp 560 8AC2.tmp 2080 8B10.tmp 2056 8B5E.tmp 612 8BAC.tmp 1736 8BFA.tmp 1700 8C48.tmp 2868 8C96.tmp 1576 8CE4.tmp 2952 8D32.tmp 2872 8D71.tmp 2724 8DBF.tmp 2428 8E0D.tmp 2844 8E5B.tmp 1708 8EA9.tmp 2900 8EF7.tmp 2656 8F45.tmp 1324 8FA2.tmp 2612 8FF0.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2AB8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 318C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1287.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 389D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7291.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8882.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 511C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6900.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4846.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F8C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 959B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8537.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9AAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 697D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA77.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9463.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2708 wrote to memory of 2864 2708 2024-08-02_d393478ec9d6b709ee7a0a8c81772b80_mafia.exe 30 PID 2708 wrote to memory of 2864 2708 2024-08-02_d393478ec9d6b709ee7a0a8c81772b80_mafia.exe 30 PID 2708 wrote to memory of 2864 2708 2024-08-02_d393478ec9d6b709ee7a0a8c81772b80_mafia.exe 30 PID 2708 wrote to memory of 2864 2708 2024-08-02_d393478ec9d6b709ee7a0a8c81772b80_mafia.exe 30 PID 2864 wrote to memory of 2748 2864 754F.tmp 31 PID 2864 wrote to memory of 2748 2864 754F.tmp 31 PID 2864 wrote to memory of 2748 2864 754F.tmp 31 PID 2864 wrote to memory of 2748 2864 754F.tmp 31 PID 2748 wrote to memory of 2876 2748 75FB.tmp 32 PID 2748 wrote to memory of 2876 2748 75FB.tmp 32 PID 2748 wrote to memory of 2876 2748 75FB.tmp 32 PID 2748 wrote to memory of 2876 2748 75FB.tmp 32 PID 2876 wrote to memory of 2760 2876 76E5.tmp 33 PID 2876 wrote to memory of 2760 2876 76E5.tmp 33 PID 2876 wrote to memory of 2760 2876 76E5.tmp 33 PID 2876 wrote to memory of 2760 2876 76E5.tmp 33 PID 2760 wrote to memory of 2640 2760 77A0.tmp 34 PID 2760 wrote to memory of 2640 2760 77A0.tmp 34 PID 2760 wrote to memory of 2640 2760 77A0.tmp 34 PID 2760 wrote to memory of 2640 2760 77A0.tmp 34 PID 2640 wrote to memory of 2712 2640 782C.tmp 35 PID 2640 wrote to memory of 2712 2640 782C.tmp 35 PID 2640 wrote to memory of 2712 2640 782C.tmp 35 PID 2640 wrote to memory of 2712 2640 782C.tmp 35 PID 2712 wrote to memory of 2632 2712 78E7.tmp 36 PID 2712 wrote to memory of 2632 2712 78E7.tmp 36 PID 2712 wrote to memory of 2632 2712 78E7.tmp 36 PID 2712 wrote to memory of 2632 2712 78E7.tmp 36 PID 2632 wrote to memory of 2468 2632 7945.tmp 37 PID 2632 wrote to memory of 2468 2632 7945.tmp 37 PID 2632 wrote to memory of 2468 2632 7945.tmp 37 PID 2632 wrote to memory of 2468 2632 7945.tmp 37 PID 2468 wrote to memory of 1340 2468 7A10.tmp 38 PID 2468 wrote to memory of 1340 2468 7A10.tmp 38 PID 2468 wrote to memory of 1340 2468 7A10.tmp 38 PID 2468 wrote to memory of 1340 2468 7A10.tmp 38 PID 1340 wrote to memory of 648 1340 7ADB.tmp 39 PID 1340 wrote to memory of 648 1340 7ADB.tmp 39 PID 1340 wrote to memory of 648 1340 7ADB.tmp 39 PID 1340 wrote to memory of 648 1340 7ADB.tmp 39 PID 648 wrote to memory of 828 648 7B96.tmp 40 PID 648 wrote to memory of 828 648 7B96.tmp 40 PID 648 wrote to memory of 828 648 7B96.tmp 40 PID 648 wrote to memory of 828 648 7B96.tmp 40 PID 828 wrote to memory of 2416 828 7C13.tmp 41 PID 828 wrote to memory of 2416 828 7C13.tmp 41 PID 828 wrote to memory of 2416 828 7C13.tmp 41 PID 828 wrote to memory of 2416 828 7C13.tmp 41 PID 2416 wrote to memory of 2536 2416 7CBE.tmp 42 PID 2416 wrote to memory of 2536 2416 7CBE.tmp 42 PID 2416 wrote to memory of 2536 2416 7CBE.tmp 42 PID 2416 wrote to memory of 2536 2416 7CBE.tmp 42 PID 2536 wrote to memory of 2504 2536 7D6A.tmp 43 PID 2536 wrote to memory of 2504 2536 7D6A.tmp 43 PID 2536 wrote to memory of 2504 2536 7D6A.tmp 43 PID 2536 wrote to memory of 2504 2536 7D6A.tmp 43 PID 2504 wrote to memory of 2992 2504 7E15.tmp 44 PID 2504 wrote to memory of 2992 2504 7E15.tmp 44 PID 2504 wrote to memory of 2992 2504 7E15.tmp 44 PID 2504 wrote to memory of 2992 2504 7E15.tmp 44 PID 2992 wrote to memory of 2792 2992 7EC1.tmp 45 PID 2992 wrote to memory of 2792 2992 7EC1.tmp 45 PID 2992 wrote to memory of 2792 2992 7EC1.tmp 45 PID 2992 wrote to memory of 2792 2992 7EC1.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-02_d393478ec9d6b709ee7a0a8c81772b80_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-02_d393478ec9d6b709ee7a0a8c81772b80_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\754F.tmp"C:\Users\Admin\AppData\Local\Temp\754F.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\75FB.tmp"C:\Users\Admin\AppData\Local\Temp\75FB.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\76E5.tmp"C:\Users\Admin\AppData\Local\Temp\76E5.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\77A0.tmp"C:\Users\Admin\AppData\Local\Temp\77A0.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\782C.tmp"C:\Users\Admin\AppData\Local\Temp\782C.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\78E7.tmp"C:\Users\Admin\AppData\Local\Temp\78E7.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\7945.tmp"C:\Users\Admin\AppData\Local\Temp\7945.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\7A10.tmp"C:\Users\Admin\AppData\Local\Temp\7A10.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\7ADB.tmp"C:\Users\Admin\AppData\Local\Temp\7ADB.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\7B96.tmp"C:\Users\Admin\AppData\Local\Temp\7B96.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Users\Admin\AppData\Local\Temp\7C13.tmp"C:\Users\Admin\AppData\Local\Temp\7C13.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\7CBE.tmp"C:\Users\Admin\AppData\Local\Temp\7CBE.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\7D6A.tmp"C:\Users\Admin\AppData\Local\Temp\7D6A.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\7E15.tmp"C:\Users\Admin\AppData\Local\Temp\7E15.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\7EC1.tmp"C:\Users\Admin\AppData\Local\Temp\7EC1.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\7F6D.tmp"C:\Users\Admin\AppData\Local\Temp\7F6D.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\7FF9.tmp"C:\Users\Admin\AppData\Local\Temp\7FF9.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\8095.tmp"C:\Users\Admin\AppData\Local\Temp\8095.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\8150.tmp"C:\Users\Admin\AppData\Local\Temp\8150.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\81DD.tmp"C:\Users\Admin\AppData\Local\Temp\81DD.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\8298.tmp"C:\Users\Admin\AppData\Local\Temp\8298.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\8353.tmp"C:\Users\Admin\AppData\Local\Temp\8353.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:760 -
C:\Users\Admin\AppData\Local\Temp\83DF.tmp"C:\Users\Admin\AppData\Local\Temp\83DF.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:704 -
C:\Users\Admin\AppData\Local\Temp\843D.tmp"C:\Users\Admin\AppData\Local\Temp\843D.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\848B.tmp"C:\Users\Admin\AppData\Local\Temp\848B.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\84D9.tmp"C:\Users\Admin\AppData\Local\Temp\84D9.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\8537.tmp"C:\Users\Admin\AppData\Local\Temp\8537.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\8585.tmp"C:\Users\Admin\AppData\Local\Temp\8585.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\85D3.tmp"C:\Users\Admin\AppData\Local\Temp\85D3.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\8621.tmp"C:\Users\Admin\AppData\Local\Temp\8621.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\866F.tmp"C:\Users\Admin\AppData\Local\Temp\866F.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\86BD.tmp"C:\Users\Admin\AppData\Local\Temp\86BD.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\86FB.tmp"C:\Users\Admin\AppData\Local\Temp\86FB.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\8749.tmp"C:\Users\Admin\AppData\Local\Temp\8749.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\8787.tmp"C:\Users\Admin\AppData\Local\Temp\8787.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\87E5.tmp"C:\Users\Admin\AppData\Local\Temp\87E5.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\8833.tmp"C:\Users\Admin\AppData\Local\Temp\8833.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\8881.tmp"C:\Users\Admin\AppData\Local\Temp\8881.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\88DF.tmp"C:\Users\Admin\AppData\Local\Temp\88DF.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\892D.tmp"C:\Users\Admin\AppData\Local\Temp\892D.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\897B.tmp"C:\Users\Admin\AppData\Local\Temp\897B.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\89B9.tmp"C:\Users\Admin\AppData\Local\Temp\89B9.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:604 -
C:\Users\Admin\AppData\Local\Temp\89F7.tmp"C:\Users\Admin\AppData\Local\Temp\89F7.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:688 -
C:\Users\Admin\AppData\Local\Temp\8A45.tmp"C:\Users\Admin\AppData\Local\Temp\8A45.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\8A84.tmp"C:\Users\Admin\AppData\Local\Temp\8A84.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:852 -
C:\Users\Admin\AppData\Local\Temp\8AC2.tmp"C:\Users\Admin\AppData\Local\Temp\8AC2.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:560 -
C:\Users\Admin\AppData\Local\Temp\8B10.tmp"C:\Users\Admin\AppData\Local\Temp\8B10.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\8B5E.tmp"C:\Users\Admin\AppData\Local\Temp\8B5E.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\8BAC.tmp"C:\Users\Admin\AppData\Local\Temp\8BAC.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:612 -
C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\8C48.tmp"C:\Users\Admin\AppData\Local\Temp\8C48.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\8C96.tmp"C:\Users\Admin\AppData\Local\Temp\8C96.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\8CE4.tmp"C:\Users\Admin\AppData\Local\Temp\8CE4.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\8D32.tmp"C:\Users\Admin\AppData\Local\Temp\8D32.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\8D71.tmp"C:\Users\Admin\AppData\Local\Temp\8D71.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\8DBF.tmp"C:\Users\Admin\AppData\Local\Temp\8DBF.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\8E5B.tmp"C:\Users\Admin\AppData\Local\Temp\8E5B.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\8EA9.tmp"C:\Users\Admin\AppData\Local\Temp\8EA9.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\8EF7.tmp"C:\Users\Admin\AppData\Local\Temp\8EF7.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\8F45.tmp"C:\Users\Admin\AppData\Local\Temp\8F45.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\8FA2.tmp"C:\Users\Admin\AppData\Local\Temp\8FA2.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\8FF0.tmp"C:\Users\Admin\AppData\Local\Temp\8FF0.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\903E.tmp"C:\Users\Admin\AppData\Local\Temp\903E.tmp"65⤵
- Executes dropped EXE
PID:496 -
C:\Users\Admin\AppData\Local\Temp\907D.tmp"C:\Users\Admin\AppData\Local\Temp\907D.tmp"66⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\90CB.tmp"C:\Users\Admin\AppData\Local\Temp\90CB.tmp"67⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\9119.tmp"C:\Users\Admin\AppData\Local\Temp\9119.tmp"68⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\9157.tmp"C:\Users\Admin\AppData\Local\Temp\9157.tmp"69⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\91A5.tmp"C:\Users\Admin\AppData\Local\Temp\91A5.tmp"70⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\91F3.tmp"C:\Users\Admin\AppData\Local\Temp\91F3.tmp"71⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\9241.tmp"C:\Users\Admin\AppData\Local\Temp\9241.tmp"72⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\928F.tmp"C:\Users\Admin\AppData\Local\Temp\928F.tmp"73⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\92DD.tmp"C:\Users\Admin\AppData\Local\Temp\92DD.tmp"74⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\931B.tmp"C:\Users\Admin\AppData\Local\Temp\931B.tmp"75⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\9369.tmp"C:\Users\Admin\AppData\Local\Temp\9369.tmp"76⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\93A8.tmp"C:\Users\Admin\AppData\Local\Temp\93A8.tmp"77⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\93F6.tmp"C:\Users\Admin\AppData\Local\Temp\93F6.tmp"78⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\9453.tmp"C:\Users\Admin\AppData\Local\Temp\9453.tmp"79⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\94A1.tmp"C:\Users\Admin\AppData\Local\Temp\94A1.tmp"80⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\94EF.tmp"C:\Users\Admin\AppData\Local\Temp\94EF.tmp"81⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\954D.tmp"C:\Users\Admin\AppData\Local\Temp\954D.tmp"82⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\959B.tmp"C:\Users\Admin\AppData\Local\Temp\959B.tmp"83⤵
- System Location Discovery: System Language Discovery
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\95E9.tmp"C:\Users\Admin\AppData\Local\Temp\95E9.tmp"84⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\9637.tmp"C:\Users\Admin\AppData\Local\Temp\9637.tmp"85⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\9675.tmp"C:\Users\Admin\AppData\Local\Temp\9675.tmp"86⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\96B4.tmp"C:\Users\Admin\AppData\Local\Temp\96B4.tmp"87⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\9702.tmp"C:\Users\Admin\AppData\Local\Temp\9702.tmp"88⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\9740.tmp"C:\Users\Admin\AppData\Local\Temp\9740.tmp"89⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\978E.tmp"C:\Users\Admin\AppData\Local\Temp\978E.tmp"90⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\97CD.tmp"C:\Users\Admin\AppData\Local\Temp\97CD.tmp"91⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\981B.tmp"C:\Users\Admin\AppData\Local\Temp\981B.tmp"92⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\9869.tmp"C:\Users\Admin\AppData\Local\Temp\9869.tmp"93⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\98A7.tmp"C:\Users\Admin\AppData\Local\Temp\98A7.tmp"94⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\98F5.tmp"C:\Users\Admin\AppData\Local\Temp\98F5.tmp"95⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\9943.tmp"C:\Users\Admin\AppData\Local\Temp\9943.tmp"96⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\9981.tmp"C:\Users\Admin\AppData\Local\Temp\9981.tmp"97⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\99C0.tmp"C:\Users\Admin\AppData\Local\Temp\99C0.tmp"98⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\99FE.tmp"C:\Users\Admin\AppData\Local\Temp\99FE.tmp"99⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\9A5C.tmp"C:\Users\Admin\AppData\Local\Temp\9A5C.tmp"100⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"102⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"103⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\9B75.tmp"C:\Users\Admin\AppData\Local\Temp\9B75.tmp"104⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"105⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\9C11.tmp"C:\Users\Admin\AppData\Local\Temp\9C11.tmp"106⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"107⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\9C9D.tmp"C:\Users\Admin\AppData\Local\Temp\9C9D.tmp"108⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\9CDB.tmp"C:\Users\Admin\AppData\Local\Temp\9CDB.tmp"109⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\9D1A.tmp"C:\Users\Admin\AppData\Local\Temp\9D1A.tmp"110⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\9D68.tmp"C:\Users\Admin\AppData\Local\Temp\9D68.tmp"111⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\9DA6.tmp"C:\Users\Admin\AppData\Local\Temp\9DA6.tmp"112⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\9DF4.tmp"C:\Users\Admin\AppData\Local\Temp\9DF4.tmp"113⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\9E33.tmp"C:\Users\Admin\AppData\Local\Temp\9E33.tmp"114⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\9E71.tmp"C:\Users\Admin\AppData\Local\Temp\9E71.tmp"115⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\9EBF.tmp"C:\Users\Admin\AppData\Local\Temp\9EBF.tmp"116⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\9EFD.tmp"C:\Users\Admin\AppData\Local\Temp\9EFD.tmp"117⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\9F4B.tmp"C:\Users\Admin\AppData\Local\Temp\9F4B.tmp"118⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\9F8A.tmp"C:\Users\Admin\AppData\Local\Temp\9F8A.tmp"119⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\9FC8.tmp"C:\Users\Admin\AppData\Local\Temp\9FC8.tmp"120⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\A007.tmp"C:\Users\Admin\AppData\Local\Temp\A007.tmp"121⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\A055.tmp"C:\Users\Admin\AppData\Local\Temp\A055.tmp"122⤵PID:2428
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-