Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
01/09/2024, 06:12
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-01_e7334e495ca720a255d73cc17d66fe2a_mafia.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-09-01_e7334e495ca720a255d73cc17d66fe2a_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-01_e7334e495ca720a255d73cc17d66fe2a_mafia.exe
-
Size
530KB
-
MD5
e7334e495ca720a255d73cc17d66fe2a
-
SHA1
42ca69fc1d4d94bbabfc71b2c48f5d17f1fa74b2
-
SHA256
d865d1e762e93b3869b8cceaef0062d8d990931178d9d112fe8bec5ad061a944
-
SHA512
2c90528392d02daf89e6582c14afd1dfc62609183a352270e5e6aef47b2a4176de81693e18b7c7bc0a3778b390e9d2fd8d2432043deb0767e8fe1d27893b620a
-
SSDEEP
12288:AU5rCOTeioBeLf9MgY1hupYe+PEZfINZulFVg0M1:AUQOJoBeLi3ulCNclFV/M1
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2100 C957.tmp 2084 C9B5.tmp 2552 CA41.tmp 2216 CAAF.tmp 2716 CB1C.tmp 2820 CB99.tmp 1668 CBE7.tmp 2724 CC63.tmp 2876 CCD1.tmp 2408 CD3E.tmp 2720 CDAB.tmp 2400 CE18.tmp 3068 CE76.tmp 2388 CEE3.tmp 1096 CF41.tmp 1652 CFAE.tmp 1232 D01B.tmp 2228 D098.tmp 1736 D0F5.tmp 2516 D172.tmp 1728 D1DF.tmp 2008 D24D.tmp 1784 D2AA.tmp 996 D2E9.tmp 2668 D327.tmp 2308 D365.tmp 1888 D3A4.tmp 2488 D3E2.tmp 2920 D421.tmp 2964 D45F.tmp 2384 D49D.tmp 2696 D4DC.tmp 844 D51A.tmp 964 D559.tmp 2428 D597.tmp 2376 D5E5.tmp 2160 D623.tmp 1704 D662.tmp 2972 D6A0.tmp 1444 D6DF.tmp 1828 D71D.tmp 2168 D75B.tmp 2184 D79A.tmp 2984 D7D8.tmp 1940 D817.tmp 328 D855.tmp 3064 D893.tmp 1408 D8D2.tmp 1992 D910.tmp 2020 D94F.tmp 3048 D98D.tmp 1628 D9CB.tmp 2264 DA0A.tmp 1388 DA48.tmp 2100 DA87.tmp 2200 DAC5.tmp 2176 DB03.tmp 2344 DB42.tmp 2204 DB80.tmp 2748 DBBF.tmp 2836 DBFD.tmp 2832 DC3B.tmp 2080 DC7A.tmp 2944 DCB8.tmp -
Loads dropped DLL 64 IoCs
pid Process 2172 2024-09-01_e7334e495ca720a255d73cc17d66fe2a_mafia.exe 2100 C957.tmp 2084 C9B5.tmp 2552 CA41.tmp 2216 CAAF.tmp 2716 CB1C.tmp 2820 CB99.tmp 1668 CBE7.tmp 2724 CC63.tmp 2876 CCD1.tmp 2408 CD3E.tmp 2720 CDAB.tmp 2400 CE18.tmp 3068 CE76.tmp 2388 CEE3.tmp 1096 CF41.tmp 1652 CFAE.tmp 1232 D01B.tmp 2228 D098.tmp 1736 D0F5.tmp 2516 D172.tmp 1728 D1DF.tmp 2008 D24D.tmp 1784 D2AA.tmp 996 D2E9.tmp 2668 D327.tmp 2308 D365.tmp 1888 D3A4.tmp 2488 D3E2.tmp 2920 D421.tmp 2964 D45F.tmp 2384 D49D.tmp 2696 D4DC.tmp 844 D51A.tmp 964 D559.tmp 2428 D597.tmp 2376 D5E5.tmp 2160 D623.tmp 1704 D662.tmp 2972 D6A0.tmp 1444 D6DF.tmp 1828 D71D.tmp 2168 D75B.tmp 2184 D79A.tmp 2984 D7D8.tmp 1940 D817.tmp 328 D855.tmp 3064 D893.tmp 1408 D8D2.tmp 1992 D910.tmp 2020 D94F.tmp 3048 D98D.tmp 1628 D9CB.tmp 2264 DA0A.tmp 1388 DA48.tmp 2100 DA87.tmp 2200 DAC5.tmp 2176 DB03.tmp 2344 DB42.tmp 2204 DB80.tmp 2748 DBBF.tmp 2836 DBFD.tmp 2832 DC3B.tmp 2080 DC7A.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 207C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CBE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDCF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4FF4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 626B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D01C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE76.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD91.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4AD6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8814.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B01D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D01B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A90B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB1C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E263.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2452.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2172 wrote to memory of 2100 2172 2024-09-01_e7334e495ca720a255d73cc17d66fe2a_mafia.exe 30 PID 2172 wrote to memory of 2100 2172 2024-09-01_e7334e495ca720a255d73cc17d66fe2a_mafia.exe 30 PID 2172 wrote to memory of 2100 2172 2024-09-01_e7334e495ca720a255d73cc17d66fe2a_mafia.exe 30 PID 2172 wrote to memory of 2100 2172 2024-09-01_e7334e495ca720a255d73cc17d66fe2a_mafia.exe 30 PID 2100 wrote to memory of 2084 2100 C957.tmp 31 PID 2100 wrote to memory of 2084 2100 C957.tmp 31 PID 2100 wrote to memory of 2084 2100 C957.tmp 31 PID 2100 wrote to memory of 2084 2100 C957.tmp 31 PID 2084 wrote to memory of 2552 2084 C9B5.tmp 32 PID 2084 wrote to memory of 2552 2084 C9B5.tmp 32 PID 2084 wrote to memory of 2552 2084 C9B5.tmp 32 PID 2084 wrote to memory of 2552 2084 C9B5.tmp 32 PID 2552 wrote to memory of 2216 2552 CA41.tmp 33 PID 2552 wrote to memory of 2216 2552 CA41.tmp 33 PID 2552 wrote to memory of 2216 2552 CA41.tmp 33 PID 2552 wrote to memory of 2216 2552 CA41.tmp 33 PID 2216 wrote to memory of 2716 2216 CAAF.tmp 34 PID 2216 wrote to memory of 2716 2216 CAAF.tmp 34 PID 2216 wrote to memory of 2716 2216 CAAF.tmp 34 PID 2216 wrote to memory of 2716 2216 CAAF.tmp 34 PID 2716 wrote to memory of 2820 2716 CB1C.tmp 35 PID 2716 wrote to memory of 2820 2716 CB1C.tmp 35 PID 2716 wrote to memory of 2820 2716 CB1C.tmp 35 PID 2716 wrote to memory of 2820 2716 CB1C.tmp 35 PID 2820 wrote to memory of 1668 2820 CB99.tmp 36 PID 2820 wrote to memory of 1668 2820 CB99.tmp 36 PID 2820 wrote to memory of 1668 2820 CB99.tmp 36 PID 2820 wrote to memory of 1668 2820 CB99.tmp 36 PID 1668 wrote to memory of 2724 1668 CBE7.tmp 37 PID 1668 wrote to memory of 2724 1668 CBE7.tmp 37 PID 1668 wrote to memory of 2724 1668 CBE7.tmp 37 PID 1668 wrote to memory of 2724 1668 CBE7.tmp 37 PID 2724 wrote to memory of 2876 2724 CC63.tmp 38 PID 2724 wrote to memory of 2876 2724 CC63.tmp 38 PID 2724 wrote to memory of 2876 2724 CC63.tmp 38 PID 2724 wrote to memory of 2876 2724 CC63.tmp 38 PID 2876 wrote to memory of 2408 2876 CCD1.tmp 39 PID 2876 wrote to memory of 2408 2876 CCD1.tmp 39 PID 2876 wrote to memory of 2408 2876 CCD1.tmp 39 PID 2876 wrote to memory of 2408 2876 CCD1.tmp 39 PID 2408 wrote to memory of 2720 2408 CD3E.tmp 40 PID 2408 wrote to memory of 2720 2408 CD3E.tmp 40 PID 2408 wrote to memory of 2720 2408 CD3E.tmp 40 PID 2408 wrote to memory of 2720 2408 CD3E.tmp 40 PID 2720 wrote to memory of 2400 2720 CDAB.tmp 41 PID 2720 wrote to memory of 2400 2720 CDAB.tmp 41 PID 2720 wrote to memory of 2400 2720 CDAB.tmp 41 PID 2720 wrote to memory of 2400 2720 CDAB.tmp 41 PID 2400 wrote to memory of 3068 2400 CE18.tmp 42 PID 2400 wrote to memory of 3068 2400 CE18.tmp 42 PID 2400 wrote to memory of 3068 2400 CE18.tmp 42 PID 2400 wrote to memory of 3068 2400 CE18.tmp 42 PID 3068 wrote to memory of 2388 3068 CE76.tmp 43 PID 3068 wrote to memory of 2388 3068 CE76.tmp 43 PID 3068 wrote to memory of 2388 3068 CE76.tmp 43 PID 3068 wrote to memory of 2388 3068 CE76.tmp 43 PID 2388 wrote to memory of 1096 2388 CEE3.tmp 44 PID 2388 wrote to memory of 1096 2388 CEE3.tmp 44 PID 2388 wrote to memory of 1096 2388 CEE3.tmp 44 PID 2388 wrote to memory of 1096 2388 CEE3.tmp 44 PID 1096 wrote to memory of 1652 1096 CF41.tmp 45 PID 1096 wrote to memory of 1652 1096 CF41.tmp 45 PID 1096 wrote to memory of 1652 1096 CF41.tmp 45 PID 1096 wrote to memory of 1652 1096 CF41.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-01_e7334e495ca720a255d73cc17d66fe2a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-01_e7334e495ca720a255d73cc17d66fe2a_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\C957.tmp"C:\Users\Admin\AppData\Local\Temp\C957.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\C9B5.tmp"C:\Users\Admin\AppData\Local\Temp\C9B5.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\CA41.tmp"C:\Users\Admin\AppData\Local\Temp\CA41.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\CAAF.tmp"C:\Users\Admin\AppData\Local\Temp\CAAF.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\CB1C.tmp"C:\Users\Admin\AppData\Local\Temp\CB1C.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\CB99.tmp"C:\Users\Admin\AppData\Local\Temp\CB99.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\CBE7.tmp"C:\Users\Admin\AppData\Local\Temp\CBE7.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\CC63.tmp"C:\Users\Admin\AppData\Local\Temp\CC63.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\CCD1.tmp"C:\Users\Admin\AppData\Local\Temp\CCD1.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\CD3E.tmp"C:\Users\Admin\AppData\Local\Temp\CD3E.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\CDAB.tmp"C:\Users\Admin\AppData\Local\Temp\CDAB.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\CE18.tmp"C:\Users\Admin\AppData\Local\Temp\CE18.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\CE76.tmp"C:\Users\Admin\AppData\Local\Temp\CE76.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\CEE3.tmp"C:\Users\Admin\AppData\Local\Temp\CEE3.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\CF41.tmp"C:\Users\Admin\AppData\Local\Temp\CF41.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\CFAE.tmp"C:\Users\Admin\AppData\Local\Temp\CFAE.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\D01B.tmp"C:\Users\Admin\AppData\Local\Temp\D01B.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\D098.tmp"C:\Users\Admin\AppData\Local\Temp\D098.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\D0F5.tmp"C:\Users\Admin\AppData\Local\Temp\D0F5.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\D172.tmp"C:\Users\Admin\AppData\Local\Temp\D172.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\D1DF.tmp"C:\Users\Admin\AppData\Local\Temp\D1DF.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\D24D.tmp"C:\Users\Admin\AppData\Local\Temp\D24D.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\D2AA.tmp"C:\Users\Admin\AppData\Local\Temp\D2AA.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\D2E9.tmp"C:\Users\Admin\AppData\Local\Temp\D2E9.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:996 -
C:\Users\Admin\AppData\Local\Temp\D327.tmp"C:\Users\Admin\AppData\Local\Temp\D327.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\D365.tmp"C:\Users\Admin\AppData\Local\Temp\D365.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\D3A4.tmp"C:\Users\Admin\AppData\Local\Temp\D3A4.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\D3E2.tmp"C:\Users\Admin\AppData\Local\Temp\D3E2.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\D421.tmp"C:\Users\Admin\AppData\Local\Temp\D421.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\D45F.tmp"C:\Users\Admin\AppData\Local\Temp\D45F.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\D49D.tmp"C:\Users\Admin\AppData\Local\Temp\D49D.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\D4DC.tmp"C:\Users\Admin\AppData\Local\Temp\D4DC.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\D51A.tmp"C:\Users\Admin\AppData\Local\Temp\D51A.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:844 -
C:\Users\Admin\AppData\Local\Temp\D559.tmp"C:\Users\Admin\AppData\Local\Temp\D559.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:964 -
C:\Users\Admin\AppData\Local\Temp\D597.tmp"C:\Users\Admin\AppData\Local\Temp\D597.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\D5E5.tmp"C:\Users\Admin\AppData\Local\Temp\D5E5.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\D623.tmp"C:\Users\Admin\AppData\Local\Temp\D623.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\D662.tmp"C:\Users\Admin\AppData\Local\Temp\D662.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\D6A0.tmp"C:\Users\Admin\AppData\Local\Temp\D6A0.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\D6DF.tmp"C:\Users\Admin\AppData\Local\Temp\D6DF.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\D71D.tmp"C:\Users\Admin\AppData\Local\Temp\D71D.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\D75B.tmp"C:\Users\Admin\AppData\Local\Temp\D75B.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\D79A.tmp"C:\Users\Admin\AppData\Local\Temp\D79A.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\D7D8.tmp"C:\Users\Admin\AppData\Local\Temp\D7D8.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\D817.tmp"C:\Users\Admin\AppData\Local\Temp\D817.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\D855.tmp"C:\Users\Admin\AppData\Local\Temp\D855.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:328 -
C:\Users\Admin\AppData\Local\Temp\D893.tmp"C:\Users\Admin\AppData\Local\Temp\D893.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\D8D2.tmp"C:\Users\Admin\AppData\Local\Temp\D8D2.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\D910.tmp"C:\Users\Admin\AppData\Local\Temp\D910.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\D94F.tmp"C:\Users\Admin\AppData\Local\Temp\D94F.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\D98D.tmp"C:\Users\Admin\AppData\Local\Temp\D98D.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\D9CB.tmp"C:\Users\Admin\AppData\Local\Temp\D9CB.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\DA0A.tmp"C:\Users\Admin\AppData\Local\Temp\DA0A.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\DA48.tmp"C:\Users\Admin\AppData\Local\Temp\DA48.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\DA87.tmp"C:\Users\Admin\AppData\Local\Temp\DA87.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\DAC5.tmp"C:\Users\Admin\AppData\Local\Temp\DAC5.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\DB03.tmp"C:\Users\Admin\AppData\Local\Temp\DB03.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\DB42.tmp"C:\Users\Admin\AppData\Local\Temp\DB42.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\DB80.tmp"C:\Users\Admin\AppData\Local\Temp\DB80.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\DBBF.tmp"C:\Users\Admin\AppData\Local\Temp\DBBF.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\DBFD.tmp"C:\Users\Admin\AppData\Local\Temp\DBFD.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\DC3B.tmp"C:\Users\Admin\AppData\Local\Temp\DC3B.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\DC7A.tmp"C:\Users\Admin\AppData\Local\Temp\DC7A.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\DCB8.tmp"C:\Users\Admin\AppData\Local\Temp\DCB8.tmp"65⤵
- Executes dropped EXE
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\DCF7.tmp"C:\Users\Admin\AppData\Local\Temp\DCF7.tmp"66⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\DD45.tmp"C:\Users\Admin\AppData\Local\Temp\DD45.tmp"67⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\DD83.tmp"C:\Users\Admin\AppData\Local\Temp\DD83.tmp"68⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\DDC2.tmp"C:\Users\Admin\AppData\Local\Temp\DDC2.tmp"69⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\DE00.tmp"C:\Users\Admin\AppData\Local\Temp\DE00.tmp"70⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\DE3E.tmp"C:\Users\Admin\AppData\Local\Temp\DE3E.tmp"71⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\DE7D.tmp"C:\Users\Admin\AppData\Local\Temp\DE7D.tmp"72⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\DEBB.tmp"C:\Users\Admin\AppData\Local\Temp\DEBB.tmp"73⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\DEFA.tmp"C:\Users\Admin\AppData\Local\Temp\DEFA.tmp"74⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\DF38.tmp"C:\Users\Admin\AppData\Local\Temp\DF38.tmp"75⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\DF76.tmp"C:\Users\Admin\AppData\Local\Temp\DF76.tmp"76⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\DFB5.tmp"C:\Users\Admin\AppData\Local\Temp\DFB5.tmp"77⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\DFF3.tmp"C:\Users\Admin\AppData\Local\Temp\DFF3.tmp"78⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\E032.tmp"C:\Users\Admin\AppData\Local\Temp\E032.tmp"79⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\E070.tmp"C:\Users\Admin\AppData\Local\Temp\E070.tmp"80⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\E0AE.tmp"C:\Users\Admin\AppData\Local\Temp\E0AE.tmp"81⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\E0ED.tmp"C:\Users\Admin\AppData\Local\Temp\E0ED.tmp"82⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\E12B.tmp"C:\Users\Admin\AppData\Local\Temp\E12B.tmp"83⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\E16A.tmp"C:\Users\Admin\AppData\Local\Temp\E16A.tmp"84⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\E1A8.tmp"C:\Users\Admin\AppData\Local\Temp\E1A8.tmp"85⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\E1E6.tmp"C:\Users\Admin\AppData\Local\Temp\E1E6.tmp"86⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\E225.tmp"C:\Users\Admin\AppData\Local\Temp\E225.tmp"87⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\E263.tmp"C:\Users\Admin\AppData\Local\Temp\E263.tmp"88⤵
- System Location Discovery: System Language Discovery
PID:996 -
C:\Users\Admin\AppData\Local\Temp\E2B1.tmp"C:\Users\Admin\AppData\Local\Temp\E2B1.tmp"89⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\E2F0.tmp"C:\Users\Admin\AppData\Local\Temp\E2F0.tmp"90⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\E32E.tmp"C:\Users\Admin\AppData\Local\Temp\E32E.tmp"91⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\E36C.tmp"C:\Users\Admin\AppData\Local\Temp\E36C.tmp"92⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\E3AB.tmp"C:\Users\Admin\AppData\Local\Temp\E3AB.tmp"93⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\E3E9.tmp"C:\Users\Admin\AppData\Local\Temp\E3E9.tmp"94⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\E428.tmp"C:\Users\Admin\AppData\Local\Temp\E428.tmp"95⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\E466.tmp"C:\Users\Admin\AppData\Local\Temp\E466.tmp"96⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\E4A4.tmp"C:\Users\Admin\AppData\Local\Temp\E4A4.tmp"97⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\E4E3.tmp"C:\Users\Admin\AppData\Local\Temp\E4E3.tmp"98⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\E521.tmp"C:\Users\Admin\AppData\Local\Temp\E521.tmp"99⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\E56F.tmp"C:\Users\Admin\AppData\Local\Temp\E56F.tmp"100⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\E5AE.tmp"C:\Users\Admin\AppData\Local\Temp\E5AE.tmp"101⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\E5EC.tmp"C:\Users\Admin\AppData\Local\Temp\E5EC.tmp"102⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\E62A.tmp"C:\Users\Admin\AppData\Local\Temp\E62A.tmp"103⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\E669.tmp"C:\Users\Admin\AppData\Local\Temp\E669.tmp"104⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"105⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\E6E6.tmp"C:\Users\Admin\AppData\Local\Temp\E6E6.tmp"106⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\E724.tmp"C:\Users\Admin\AppData\Local\Temp\E724.tmp"107⤵PID:352
-
C:\Users\Admin\AppData\Local\Temp\E762.tmp"C:\Users\Admin\AppData\Local\Temp\E762.tmp"108⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"109⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\E7DF.tmp"C:\Users\Admin\AppData\Local\Temp\E7DF.tmp"110⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\E81E.tmp"C:\Users\Admin\AppData\Local\Temp\E81E.tmp"111⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\E85C.tmp"C:\Users\Admin\AppData\Local\Temp\E85C.tmp"112⤵PID:344
-
C:\Users\Admin\AppData\Local\Temp\E89A.tmp"C:\Users\Admin\AppData\Local\Temp\E89A.tmp"113⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"114⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\E917.tmp"C:\Users\Admin\AppData\Local\Temp\E917.tmp"115⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\E956.tmp"C:\Users\Admin\AppData\Local\Temp\E956.tmp"116⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\E994.tmp"C:\Users\Admin\AppData\Local\Temp\E994.tmp"117⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\E9E2.tmp"C:\Users\Admin\AppData\Local\Temp\E9E2.tmp"118⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\EA20.tmp"C:\Users\Admin\AppData\Local\Temp\EA20.tmp"119⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\EA5F.tmp"C:\Users\Admin\AppData\Local\Temp\EA5F.tmp"120⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\EA9D.tmp"C:\Users\Admin\AppData\Local\Temp\EA9D.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\EADC.tmp"C:\Users\Admin\AppData\Local\Temp\EADC.tmp"122⤵PID:2808
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-