Analysis
-
max time kernel
147s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
06-08-2024 07:51
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-06_74bfd1d27ad9ea7ba1cfeb86ad3f4c67_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-08-06_74bfd1d27ad9ea7ba1cfeb86ad3f4c67_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-06_74bfd1d27ad9ea7ba1cfeb86ad3f4c67_mafia.exe
-
Size
486KB
-
MD5
74bfd1d27ad9ea7ba1cfeb86ad3f4c67
-
SHA1
dcd6ba38d3387380a732b36ee0855f59150ce673
-
SHA256
d85377e1d9b40b972f9b0a04b8c24bf35cc9646934a693019a451ea291da3263
-
SHA512
b975ad4a30b78f11b374b38edb902fda214e2bf8e5b7d677e0faacb2cc481ec22fdd3cc6d3cdf2c4a4b784ea5c99c56e88ad3c54739019dfab417d91c886e406
-
SSDEEP
6144:Borf3lPvovsgZnqG2C7mOTeiLfD7thvSQhJnRMfofhgxod27nM3LORuiXRyLZR/n:oU5rCOTeiDthvb7YoaByLZT/4WTNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2820 5AEC.tmp 2688 5BA7.tmp 2592 5C82.tmp 2620 5D8B.tmp 2624 5E56.tmp 2784 5F30.tmp 2616 5FEB.tmp 3060 60B6.tmp 3044 61A0.tmp 2684 627B.tmp 1968 6374.tmp 1988 645E.tmp 2964 6519.tmp 2268 6613.tmp 2108 66DE.tmp 1340 6806.tmp 2908 68A2.tmp 588 697D.tmp 2512 6A28.tmp 1196 6B31.tmp 1092 6BFC.tmp 544 6E0F.tmp 520 6EAB.tmp 2248 6F18.tmp 2072 6FA4.tmp 2556 7031.tmp 2260 70BD.tmp 2480 713A.tmp 2376 71B7.tmp 1108 7224.tmp 1156 72C0.tmp 1812 732D.tmp 1792 73AA.tmp 884 7427.tmp 1856 7494.tmp 1604 7511.tmp 328 758D.tmp 1780 7639.tmp 2444 76A6.tmp 3048 7723.tmp 1732 77AF.tmp 2664 782C.tmp 3068 7899.tmp 1064 7907.tmp 2452 7993.tmp 1348 7A1F.tmp 3020 7A9C.tmp 1936 7B29.tmp 1144 7BB5.tmp 2940 7C32.tmp 1888 7CBE.tmp 1912 7D2B.tmp 1552 7D99.tmp 1572 7E15.tmp 2740 7E92.tmp 2956 7F2E.tmp 2688 7FBB.tmp 2768 8028.tmp 2904 80C4.tmp 2748 8160.tmp 2752 8363.tmp 2588 83D0.tmp 2660 848B.tmp 3032 84E9.tmp -
Loads dropped DLL 64 IoCs
pid Process 2728 2024-08-06_74bfd1d27ad9ea7ba1cfeb86ad3f4c67_mafia.exe 2820 5AEC.tmp 2688 5BA7.tmp 2592 5C82.tmp 2620 5D8B.tmp 2624 5E56.tmp 2784 5F30.tmp 2616 5FEB.tmp 3060 60B6.tmp 3044 61A0.tmp 2684 627B.tmp 1968 6374.tmp 1988 645E.tmp 2964 6519.tmp 2268 6613.tmp 2108 66DE.tmp 1340 6806.tmp 2908 68A2.tmp 588 697D.tmp 2512 6A28.tmp 1196 6B31.tmp 1092 6BFC.tmp 544 6E0F.tmp 520 6EAB.tmp 2248 6F18.tmp 2072 6FA4.tmp 2556 7031.tmp 2260 70BD.tmp 2480 713A.tmp 2376 71B7.tmp 1108 7224.tmp 1156 72C0.tmp 1812 732D.tmp 1792 73AA.tmp 884 7427.tmp 1856 7494.tmp 1604 7511.tmp 328 758D.tmp 1780 7639.tmp 2444 76A6.tmp 3048 7723.tmp 1732 77AF.tmp 2664 782C.tmp 3068 7899.tmp 1064 7907.tmp 2452 7993.tmp 1348 7A1F.tmp 3020 7A9C.tmp 1936 7B29.tmp 1144 7BB5.tmp 2940 7C32.tmp 1888 7CBE.tmp 1912 7D2B.tmp 1552 7D99.tmp 1572 7E15.tmp 2740 7E92.tmp 2956 7F2E.tmp 2688 7FBB.tmp 2768 8028.tmp 2904 80C4.tmp 2748 8160.tmp 2752 8363.tmp 2588 83D0.tmp 2660 848B.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E37D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2452.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEFB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBDC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBC8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8814.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 760A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2359.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 898A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5522.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D89.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 315D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F103.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9415.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E89.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E01.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A2D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2404.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3756.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7724.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9933.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 158.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9482.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 979E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D115.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3987.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F94D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2646.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2CAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1120.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C65B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C755.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 361E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E070.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F844.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2728 wrote to memory of 2820 2728 2024-08-06_74bfd1d27ad9ea7ba1cfeb86ad3f4c67_mafia.exe 30 PID 2728 wrote to memory of 2820 2728 2024-08-06_74bfd1d27ad9ea7ba1cfeb86ad3f4c67_mafia.exe 30 PID 2728 wrote to memory of 2820 2728 2024-08-06_74bfd1d27ad9ea7ba1cfeb86ad3f4c67_mafia.exe 30 PID 2728 wrote to memory of 2820 2728 2024-08-06_74bfd1d27ad9ea7ba1cfeb86ad3f4c67_mafia.exe 30 PID 2820 wrote to memory of 2688 2820 5AEC.tmp 31 PID 2820 wrote to memory of 2688 2820 5AEC.tmp 31 PID 2820 wrote to memory of 2688 2820 5AEC.tmp 31 PID 2820 wrote to memory of 2688 2820 5AEC.tmp 31 PID 2688 wrote to memory of 2592 2688 5BA7.tmp 32 PID 2688 wrote to memory of 2592 2688 5BA7.tmp 32 PID 2688 wrote to memory of 2592 2688 5BA7.tmp 32 PID 2688 wrote to memory of 2592 2688 5BA7.tmp 32 PID 2592 wrote to memory of 2620 2592 5C82.tmp 33 PID 2592 wrote to memory of 2620 2592 5C82.tmp 33 PID 2592 wrote to memory of 2620 2592 5C82.tmp 33 PID 2592 wrote to memory of 2620 2592 5C82.tmp 33 PID 2620 wrote to memory of 2624 2620 5D8B.tmp 34 PID 2620 wrote to memory of 2624 2620 5D8B.tmp 34 PID 2620 wrote to memory of 2624 2620 5D8B.tmp 34 PID 2620 wrote to memory of 2624 2620 5D8B.tmp 34 PID 2624 wrote to memory of 2784 2624 5E56.tmp 35 PID 2624 wrote to memory of 2784 2624 5E56.tmp 35 PID 2624 wrote to memory of 2784 2624 5E56.tmp 35 PID 2624 wrote to memory of 2784 2624 5E56.tmp 35 PID 2784 wrote to memory of 2616 2784 5F30.tmp 36 PID 2784 wrote to memory of 2616 2784 5F30.tmp 36 PID 2784 wrote to memory of 2616 2784 5F30.tmp 36 PID 2784 wrote to memory of 2616 2784 5F30.tmp 36 PID 2616 wrote to memory of 3060 2616 5FEB.tmp 37 PID 2616 wrote to memory of 3060 2616 5FEB.tmp 37 PID 2616 wrote to memory of 3060 2616 5FEB.tmp 37 PID 2616 wrote to memory of 3060 2616 5FEB.tmp 37 PID 3060 wrote to memory of 3044 3060 60B6.tmp 38 PID 3060 wrote to memory of 3044 3060 60B6.tmp 38 PID 3060 wrote to memory of 3044 3060 60B6.tmp 38 PID 3060 wrote to memory of 3044 3060 60B6.tmp 38 PID 3044 wrote to memory of 2684 3044 61A0.tmp 39 PID 3044 wrote to memory of 2684 3044 61A0.tmp 39 PID 3044 wrote to memory of 2684 3044 61A0.tmp 39 PID 3044 wrote to memory of 2684 3044 61A0.tmp 39 PID 2684 wrote to memory of 1968 2684 627B.tmp 40 PID 2684 wrote to memory of 1968 2684 627B.tmp 40 PID 2684 wrote to memory of 1968 2684 627B.tmp 40 PID 2684 wrote to memory of 1968 2684 627B.tmp 40 PID 1968 wrote to memory of 1988 1968 6374.tmp 41 PID 1968 wrote to memory of 1988 1968 6374.tmp 41 PID 1968 wrote to memory of 1988 1968 6374.tmp 41 PID 1968 wrote to memory of 1988 1968 6374.tmp 41 PID 1988 wrote to memory of 2964 1988 645E.tmp 42 PID 1988 wrote to memory of 2964 1988 645E.tmp 42 PID 1988 wrote to memory of 2964 1988 645E.tmp 42 PID 1988 wrote to memory of 2964 1988 645E.tmp 42 PID 2964 wrote to memory of 2268 2964 6519.tmp 43 PID 2964 wrote to memory of 2268 2964 6519.tmp 43 PID 2964 wrote to memory of 2268 2964 6519.tmp 43 PID 2964 wrote to memory of 2268 2964 6519.tmp 43 PID 2268 wrote to memory of 2108 2268 6613.tmp 44 PID 2268 wrote to memory of 2108 2268 6613.tmp 44 PID 2268 wrote to memory of 2108 2268 6613.tmp 44 PID 2268 wrote to memory of 2108 2268 6613.tmp 44 PID 2108 wrote to memory of 1340 2108 66DE.tmp 45 PID 2108 wrote to memory of 1340 2108 66DE.tmp 45 PID 2108 wrote to memory of 1340 2108 66DE.tmp 45 PID 2108 wrote to memory of 1340 2108 66DE.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-06_74bfd1d27ad9ea7ba1cfeb86ad3f4c67_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-06_74bfd1d27ad9ea7ba1cfeb86ad3f4c67_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\5AEC.tmp"C:\Users\Admin\AppData\Local\Temp\5AEC.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\5BA7.tmp"C:\Users\Admin\AppData\Local\Temp\5BA7.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\5C82.tmp"C:\Users\Admin\AppData\Local\Temp\5C82.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\5D8B.tmp"C:\Users\Admin\AppData\Local\Temp\5D8B.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\5E56.tmp"C:\Users\Admin\AppData\Local\Temp\5E56.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\5F30.tmp"C:\Users\Admin\AppData\Local\Temp\5F30.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\5FEB.tmp"C:\Users\Admin\AppData\Local\Temp\5FEB.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\60B6.tmp"C:\Users\Admin\AppData\Local\Temp\60B6.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\61A0.tmp"C:\Users\Admin\AppData\Local\Temp\61A0.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\627B.tmp"C:\Users\Admin\AppData\Local\Temp\627B.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\6374.tmp"C:\Users\Admin\AppData\Local\Temp\6374.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\645E.tmp"C:\Users\Admin\AppData\Local\Temp\645E.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\6519.tmp"C:\Users\Admin\AppData\Local\Temp\6519.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\6613.tmp"C:\Users\Admin\AppData\Local\Temp\6613.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\66DE.tmp"C:\Users\Admin\AppData\Local\Temp\66DE.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\6806.tmp"C:\Users\Admin\AppData\Local\Temp\6806.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\68A2.tmp"C:\Users\Admin\AppData\Local\Temp\68A2.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\697D.tmp"C:\Users\Admin\AppData\Local\Temp\697D.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:588 -
C:\Users\Admin\AppData\Local\Temp\6A28.tmp"C:\Users\Admin\AppData\Local\Temp\6A28.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\6B31.tmp"C:\Users\Admin\AppData\Local\Temp\6B31.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\6BFC.tmp"C:\Users\Admin\AppData\Local\Temp\6BFC.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\6E0F.tmp"C:\Users\Admin\AppData\Local\Temp\6E0F.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:544 -
C:\Users\Admin\AppData\Local\Temp\6EAB.tmp"C:\Users\Admin\AppData\Local\Temp\6EAB.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:520 -
C:\Users\Admin\AppData\Local\Temp\6F18.tmp"C:\Users\Admin\AppData\Local\Temp\6F18.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\6FA4.tmp"C:\Users\Admin\AppData\Local\Temp\6FA4.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\7031.tmp"C:\Users\Admin\AppData\Local\Temp\7031.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\70BD.tmp"C:\Users\Admin\AppData\Local\Temp\70BD.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\713A.tmp"C:\Users\Admin\AppData\Local\Temp\713A.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\71B7.tmp"C:\Users\Admin\AppData\Local\Temp\71B7.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\7224.tmp"C:\Users\Admin\AppData\Local\Temp\7224.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\72C0.tmp"C:\Users\Admin\AppData\Local\Temp\72C0.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\732D.tmp"C:\Users\Admin\AppData\Local\Temp\732D.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\73AA.tmp"C:\Users\Admin\AppData\Local\Temp\73AA.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\7427.tmp"C:\Users\Admin\AppData\Local\Temp\7427.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:884 -
C:\Users\Admin\AppData\Local\Temp\7494.tmp"C:\Users\Admin\AppData\Local\Temp\7494.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\758D.tmp"C:\Users\Admin\AppData\Local\Temp\758D.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:328 -
C:\Users\Admin\AppData\Local\Temp\7639.tmp"C:\Users\Admin\AppData\Local\Temp\7639.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\76A6.tmp"C:\Users\Admin\AppData\Local\Temp\76A6.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\7723.tmp"C:\Users\Admin\AppData\Local\Temp\7723.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\77AF.tmp"C:\Users\Admin\AppData\Local\Temp\77AF.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\782C.tmp"C:\Users\Admin\AppData\Local\Temp\782C.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\7899.tmp"C:\Users\Admin\AppData\Local\Temp\7899.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\7907.tmp"C:\Users\Admin\AppData\Local\Temp\7907.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\7993.tmp"C:\Users\Admin\AppData\Local\Temp\7993.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\7A1F.tmp"C:\Users\Admin\AppData\Local\Temp\7A1F.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\7A9C.tmp"C:\Users\Admin\AppData\Local\Temp\7A9C.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\7B29.tmp"C:\Users\Admin\AppData\Local\Temp\7B29.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\7BB5.tmp"C:\Users\Admin\AppData\Local\Temp\7BB5.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\7C32.tmp"C:\Users\Admin\AppData\Local\Temp\7C32.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\7CBE.tmp"C:\Users\Admin\AppData\Local\Temp\7CBE.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\7D2B.tmp"C:\Users\Admin\AppData\Local\Temp\7D2B.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\7D99.tmp"C:\Users\Admin\AppData\Local\Temp\7D99.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\7E15.tmp"C:\Users\Admin\AppData\Local\Temp\7E15.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\7E92.tmp"C:\Users\Admin\AppData\Local\Temp\7E92.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\7F2E.tmp"C:\Users\Admin\AppData\Local\Temp\7F2E.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\7FBB.tmp"C:\Users\Admin\AppData\Local\Temp\7FBB.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\8028.tmp"C:\Users\Admin\AppData\Local\Temp\8028.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\80C4.tmp"C:\Users\Admin\AppData\Local\Temp\80C4.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\8160.tmp"C:\Users\Admin\AppData\Local\Temp\8160.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\8363.tmp"C:\Users\Admin\AppData\Local\Temp\8363.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\83D0.tmp"C:\Users\Admin\AppData\Local\Temp\83D0.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\848B.tmp"C:\Users\Admin\AppData\Local\Temp\848B.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\84E9.tmp"C:\Users\Admin\AppData\Local\Temp\84E9.tmp"65⤵
- Executes dropped EXE
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\8565.tmp"C:\Users\Admin\AppData\Local\Temp\8565.tmp"66⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\85C3.tmp"C:\Users\Admin\AppData\Local\Temp\85C3.tmp"67⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\8630.tmp"C:\Users\Admin\AppData\Local\Temp\8630.tmp"68⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\869D.tmp"C:\Users\Admin\AppData\Local\Temp\869D.tmp"69⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\872A.tmp"C:\Users\Admin\AppData\Local\Temp\872A.tmp"70⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\87A7.tmp"C:\Users\Admin\AppData\Local\Temp\87A7.tmp"71⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\8814.tmp"C:\Users\Admin\AppData\Local\Temp\8814.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\8891.tmp"C:\Users\Admin\AppData\Local\Temp\8891.tmp"73⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\890D.tmp"C:\Users\Admin\AppData\Local\Temp\890D.tmp"74⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\898A.tmp"C:\Users\Admin\AppData\Local\Temp\898A.tmp"75⤵
- System Location Discovery: System Language Discovery
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\8A26.tmp"C:\Users\Admin\AppData\Local\Temp\8A26.tmp"76⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\8AB3.tmp"C:\Users\Admin\AppData\Local\Temp\8AB3.tmp"77⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\8B3F.tmp"C:\Users\Admin\AppData\Local\Temp\8B3F.tmp"78⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\8BAC.tmp"C:\Users\Admin\AppData\Local\Temp\8BAC.tmp"79⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\8C29.tmp"C:\Users\Admin\AppData\Local\Temp\8C29.tmp"80⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\8C96.tmp"C:\Users\Admin\AppData\Local\Temp\8C96.tmp"81⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\8D13.tmp"C:\Users\Admin\AppData\Local\Temp\8D13.tmp"82⤵PID:588
-
C:\Users\Admin\AppData\Local\Temp\8D80.tmp"C:\Users\Admin\AppData\Local\Temp\8D80.tmp"83⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\8DED.tmp"C:\Users\Admin\AppData\Local\Temp\8DED.tmp"84⤵PID:596
-
C:\Users\Admin\AppData\Local\Temp\8E5B.tmp"C:\Users\Admin\AppData\Local\Temp\8E5B.tmp"85⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\8EC8.tmp"C:\Users\Admin\AppData\Local\Temp\8EC8.tmp"86⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\8F35.tmp"C:\Users\Admin\AppData\Local\Temp\8F35.tmp"87⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\8FB2.tmp"C:\Users\Admin\AppData\Local\Temp\8FB2.tmp"88⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\904E.tmp"C:\Users\Admin\AppData\Local\Temp\904E.tmp"89⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\90BB.tmp"C:\Users\Admin\AppData\Local\Temp\90BB.tmp"90⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\9157.tmp"C:\Users\Admin\AppData\Local\Temp\9157.tmp"91⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\91B5.tmp"C:\Users\Admin\AppData\Local\Temp\91B5.tmp"92⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\9222.tmp"C:\Users\Admin\AppData\Local\Temp\9222.tmp"93⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\928F.tmp"C:\Users\Admin\AppData\Local\Temp\928F.tmp"94⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\92FC.tmp"C:\Users\Admin\AppData\Local\Temp\92FC.tmp"95⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\9379.tmp"C:\Users\Admin\AppData\Local\Temp\9379.tmp"96⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\93F6.tmp"C:\Users\Admin\AppData\Local\Temp\93F6.tmp"97⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\9463.tmp"C:\Users\Admin\AppData\Local\Temp\9463.tmp"98⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\94EF.tmp"C:\Users\Admin\AppData\Local\Temp\94EF.tmp"99⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\955D.tmp"C:\Users\Admin\AppData\Local\Temp\955D.tmp"100⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\95D9.tmp"C:\Users\Admin\AppData\Local\Temp\95D9.tmp"101⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\9647.tmp"C:\Users\Admin\AppData\Local\Temp\9647.tmp"102⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\96B4.tmp"C:\Users\Admin\AppData\Local\Temp\96B4.tmp"103⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\9731.tmp"C:\Users\Admin\AppData\Local\Temp\9731.tmp"104⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\979E.tmp"C:\Users\Admin\AppData\Local\Temp\979E.tmp"105⤵
- System Location Discovery: System Language Discovery
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\98C6.tmp"C:\Users\Admin\AppData\Local\Temp\98C6.tmp"106⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\9933.tmp"C:\Users\Admin\AppData\Local\Temp\9933.tmp"107⤵
- System Location Discovery: System Language Discovery
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\99C0.tmp"C:\Users\Admin\AppData\Local\Temp\99C0.tmp"108⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"109⤵
- System Location Discovery: System Language Discovery
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"110⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\9B27.tmp"C:\Users\Admin\AppData\Local\Temp\9B27.tmp"111⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\9BA3.tmp"C:\Users\Admin\AppData\Local\Temp\9BA3.tmp"112⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\9C20.tmp"C:\Users\Admin\AppData\Local\Temp\9C20.tmp"113⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\9C8D.tmp"C:\Users\Admin\AppData\Local\Temp\9C8D.tmp"114⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\9D1A.tmp"C:\Users\Admin\AppData\Local\Temp\9D1A.tmp"115⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\9D87.tmp"C:\Users\Admin\AppData\Local\Temp\9D87.tmp"116⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\9E13.tmp"C:\Users\Admin\AppData\Local\Temp\9E13.tmp"117⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\9E90.tmp"C:\Users\Admin\AppData\Local\Temp\9E90.tmp"118⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\9F0D.tmp"C:\Users\Admin\AppData\Local\Temp\9F0D.tmp"119⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\9F99.tmp"C:\Users\Admin\AppData\Local\Temp\9F99.tmp"120⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\A035.tmp"C:\Users\Admin\AppData\Local\Temp\A035.tmp"121⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\A0B2.tmp"C:\Users\Admin\AppData\Local\Temp\A0B2.tmp"122⤵PID:2700
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-