Analysis
-
max time kernel
150s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
06-09-2024 08:42
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-06_0b230c0827774e3f73ee9c9a86ea1501_mafia.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-09-06_0b230c0827774e3f73ee9c9a86ea1501_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-06_0b230c0827774e3f73ee9c9a86ea1501_mafia.exe
-
Size
529KB
-
MD5
0b230c0827774e3f73ee9c9a86ea1501
-
SHA1
dd05ac4d12383ae9e32ee35ccb7b96fe47491926
-
SHA256
67df55ddb14b5bbbed2317ae568ea2e63b9596698f2bcef538620d030ace78e5
-
SHA512
7f5788cdf8c67e467cfcef74338de3a7d08d524790dfe31c4aafd10c4c1412f071b0ca5c8c003b685bbcf93ea6422b7bd9d449411fd19d83146879bb03ff972c
-
SSDEEP
12288:NU5rCOTeijfvpIHH0kRWNJkTf48VGts5f5uZTZwlH4Hp:NUQOJjfsnRWNJsf0ZTSlH4Hp
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 380 C5DE.tmp 484 C65B.tmp 2368 C6D8.tmp 2756 C755.tmp 2964 C7D1.tmp 3052 C81F.tmp 2940 C88D.tmp 2932 C909.tmp 2824 C977.tmp 2440 C9F3.tmp 2716 CA70.tmp 2696 CAED.tmp 1172 CB79.tmp 2388 CBF6.tmp 2272 CC73.tmp 1452 CCF0.tmp 2868 CD4D.tmp 436 CDCA.tmp 1252 CE37.tmp 2896 CEB4.tmp 1740 CF12.tmp 2752 CF8F.tmp 2444 CFDD.tmp 276 D02B.tmp 1168 D069.tmp 2220 D0B7.tmp 2156 D0F5.tmp 2136 D134.tmp 2184 D172.tmp 2608 D1B1.tmp 1060 D1EF.tmp 2404 D22E.tmp 2216 D26C.tmp 1044 D2AA.tmp 552 D2E9.tmp 1052 D327.tmp 696 D366.tmp 1604 D3A4.tmp 1544 D3E2.tmp 2208 D421.tmp 1548 D45F.tmp 2244 D49E.tmp 1936 D4DC.tmp 1368 D51A.tmp 1972 D559.tmp 2600 D597.tmp 1736 D5D6.tmp 2596 D614.tmp 1776 D652.tmp 1592 D691.tmp 1520 D6CF.tmp 1608 D70E.tmp 1964 D74C.tmp 1724 D78A.tmp 1484 D7C9.tmp 2028 D807.tmp 2392 D846.tmp 2792 D884.tmp 2944 D8C2.tmp 2756 D910.tmp 3060 D95E.tmp 2988 D99D.tmp 3048 D9DB.tmp 2972 DA1A.tmp -
Loads dropped DLL 64 IoCs
pid Process 2296 2024-09-06_0b230c0827774e3f73ee9c9a86ea1501_mafia.exe 380 C5DE.tmp 484 C65B.tmp 2368 C6D8.tmp 2756 C755.tmp 2964 C7D1.tmp 3052 C81F.tmp 2940 C88D.tmp 2932 C909.tmp 2824 C977.tmp 2440 C9F3.tmp 2716 CA70.tmp 2696 CAED.tmp 1172 CB79.tmp 2388 CBF6.tmp 2272 CC73.tmp 1452 CCF0.tmp 2868 CD4D.tmp 436 CDCA.tmp 1252 CE37.tmp 2896 CEB4.tmp 1740 CF12.tmp 2752 CF8F.tmp 2444 CFDD.tmp 276 D02B.tmp 1168 D069.tmp 2220 D0B7.tmp 2156 D0F5.tmp 2136 D134.tmp 2184 D172.tmp 2608 D1B1.tmp 1060 D1EF.tmp 2404 D22E.tmp 2216 D26C.tmp 1044 D2AA.tmp 552 D2E9.tmp 1052 D327.tmp 696 D366.tmp 1604 D3A4.tmp 1544 D3E2.tmp 2208 D421.tmp 1548 D45F.tmp 2244 D49E.tmp 1936 D4DC.tmp 1368 D51A.tmp 1972 D559.tmp 2600 D597.tmp 1736 D5D6.tmp 2596 D614.tmp 1776 D652.tmp 1592 D691.tmp 1520 D6CF.tmp 1608 D70E.tmp 1964 D74C.tmp 1724 D78A.tmp 1484 D7C9.tmp 2028 D807.tmp 2392 D846.tmp 2792 D884.tmp 2944 D8C2.tmp 2756 D910.tmp 3060 D95E.tmp 2988 D99D.tmp 3048 D9DB.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4EEB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A3D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 423E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A747.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A44.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFFA.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2296 wrote to memory of 380 2296 2024-09-06_0b230c0827774e3f73ee9c9a86ea1501_mafia.exe 30 PID 2296 wrote to memory of 380 2296 2024-09-06_0b230c0827774e3f73ee9c9a86ea1501_mafia.exe 30 PID 2296 wrote to memory of 380 2296 2024-09-06_0b230c0827774e3f73ee9c9a86ea1501_mafia.exe 30 PID 2296 wrote to memory of 380 2296 2024-09-06_0b230c0827774e3f73ee9c9a86ea1501_mafia.exe 30 PID 380 wrote to memory of 484 380 C5DE.tmp 31 PID 380 wrote to memory of 484 380 C5DE.tmp 31 PID 380 wrote to memory of 484 380 C5DE.tmp 31 PID 380 wrote to memory of 484 380 C5DE.tmp 31 PID 484 wrote to memory of 2368 484 C65B.tmp 32 PID 484 wrote to memory of 2368 484 C65B.tmp 32 PID 484 wrote to memory of 2368 484 C65B.tmp 32 PID 484 wrote to memory of 2368 484 C65B.tmp 32 PID 2368 wrote to memory of 2756 2368 C6D8.tmp 33 PID 2368 wrote to memory of 2756 2368 C6D8.tmp 33 PID 2368 wrote to memory of 2756 2368 C6D8.tmp 33 PID 2368 wrote to memory of 2756 2368 C6D8.tmp 33 PID 2756 wrote to memory of 2964 2756 C755.tmp 34 PID 2756 wrote to memory of 2964 2756 C755.tmp 34 PID 2756 wrote to memory of 2964 2756 C755.tmp 34 PID 2756 wrote to memory of 2964 2756 C755.tmp 34 PID 2964 wrote to memory of 3052 2964 C7D1.tmp 35 PID 2964 wrote to memory of 3052 2964 C7D1.tmp 35 PID 2964 wrote to memory of 3052 2964 C7D1.tmp 35 PID 2964 wrote to memory of 3052 2964 C7D1.tmp 35 PID 3052 wrote to memory of 2940 3052 C81F.tmp 36 PID 3052 wrote to memory of 2940 3052 C81F.tmp 36 PID 3052 wrote to memory of 2940 3052 C81F.tmp 36 PID 3052 wrote to memory of 2940 3052 C81F.tmp 36 PID 2940 wrote to memory of 2932 2940 C88D.tmp 37 PID 2940 wrote to memory of 2932 2940 C88D.tmp 37 PID 2940 wrote to memory of 2932 2940 C88D.tmp 37 PID 2940 wrote to memory of 2932 2940 C88D.tmp 37 PID 2932 wrote to memory of 2824 2932 C909.tmp 38 PID 2932 wrote to memory of 2824 2932 C909.tmp 38 PID 2932 wrote to memory of 2824 2932 C909.tmp 38 PID 2932 wrote to memory of 2824 2932 C909.tmp 38 PID 2824 wrote to memory of 2440 2824 C977.tmp 39 PID 2824 wrote to memory of 2440 2824 C977.tmp 39 PID 2824 wrote to memory of 2440 2824 C977.tmp 39 PID 2824 wrote to memory of 2440 2824 C977.tmp 39 PID 2440 wrote to memory of 2716 2440 C9F3.tmp 40 PID 2440 wrote to memory of 2716 2440 C9F3.tmp 40 PID 2440 wrote to memory of 2716 2440 C9F3.tmp 40 PID 2440 wrote to memory of 2716 2440 C9F3.tmp 40 PID 2716 wrote to memory of 2696 2716 CA70.tmp 41 PID 2716 wrote to memory of 2696 2716 CA70.tmp 41 PID 2716 wrote to memory of 2696 2716 CA70.tmp 41 PID 2716 wrote to memory of 2696 2716 CA70.tmp 41 PID 2696 wrote to memory of 1172 2696 CAED.tmp 42 PID 2696 wrote to memory of 1172 2696 CAED.tmp 42 PID 2696 wrote to memory of 1172 2696 CAED.tmp 42 PID 2696 wrote to memory of 1172 2696 CAED.tmp 42 PID 1172 wrote to memory of 2388 1172 CB79.tmp 43 PID 1172 wrote to memory of 2388 1172 CB79.tmp 43 PID 1172 wrote to memory of 2388 1172 CB79.tmp 43 PID 1172 wrote to memory of 2388 1172 CB79.tmp 43 PID 2388 wrote to memory of 2272 2388 CBF6.tmp 44 PID 2388 wrote to memory of 2272 2388 CBF6.tmp 44 PID 2388 wrote to memory of 2272 2388 CBF6.tmp 44 PID 2388 wrote to memory of 2272 2388 CBF6.tmp 44 PID 2272 wrote to memory of 1452 2272 CC73.tmp 45 PID 2272 wrote to memory of 1452 2272 CC73.tmp 45 PID 2272 wrote to memory of 1452 2272 CC73.tmp 45 PID 2272 wrote to memory of 1452 2272 CC73.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-06_0b230c0827774e3f73ee9c9a86ea1501_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-06_0b230c0827774e3f73ee9c9a86ea1501_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\C5DE.tmp"C:\Users\Admin\AppData\Local\Temp\C5DE.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Users\Admin\AppData\Local\Temp\C65B.tmp"C:\Users\Admin\AppData\Local\Temp\C65B.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:484 -
C:\Users\Admin\AppData\Local\Temp\C6D8.tmp"C:\Users\Admin\AppData\Local\Temp\C6D8.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\C755.tmp"C:\Users\Admin\AppData\Local\Temp\C755.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\C7D1.tmp"C:\Users\Admin\AppData\Local\Temp\C7D1.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\C81F.tmp"C:\Users\Admin\AppData\Local\Temp\C81F.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\C88D.tmp"C:\Users\Admin\AppData\Local\Temp\C88D.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\C909.tmp"C:\Users\Admin\AppData\Local\Temp\C909.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\C977.tmp"C:\Users\Admin\AppData\Local\Temp\C977.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\C9F3.tmp"C:\Users\Admin\AppData\Local\Temp\C9F3.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\CA70.tmp"C:\Users\Admin\AppData\Local\Temp\CA70.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\CAED.tmp"C:\Users\Admin\AppData\Local\Temp\CAED.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\CB79.tmp"C:\Users\Admin\AppData\Local\Temp\CB79.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\CBF6.tmp"C:\Users\Admin\AppData\Local\Temp\CBF6.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\CC73.tmp"C:\Users\Admin\AppData\Local\Temp\CC73.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\CCF0.tmp"C:\Users\Admin\AppData\Local\Temp\CCF0.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\CD4D.tmp"C:\Users\Admin\AppData\Local\Temp\CD4D.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\CDCA.tmp"C:\Users\Admin\AppData\Local\Temp\CDCA.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:436 -
C:\Users\Admin\AppData\Local\Temp\CE37.tmp"C:\Users\Admin\AppData\Local\Temp\CE37.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\CEB4.tmp"C:\Users\Admin\AppData\Local\Temp\CEB4.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\CF12.tmp"C:\Users\Admin\AppData\Local\Temp\CF12.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\CF8F.tmp"C:\Users\Admin\AppData\Local\Temp\CF8F.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\CFDD.tmp"C:\Users\Admin\AppData\Local\Temp\CFDD.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\D02B.tmp"C:\Users\Admin\AppData\Local\Temp\D02B.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:276 -
C:\Users\Admin\AppData\Local\Temp\D069.tmp"C:\Users\Admin\AppData\Local\Temp\D069.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\D0B7.tmp"C:\Users\Admin\AppData\Local\Temp\D0B7.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\D0F5.tmp"C:\Users\Admin\AppData\Local\Temp\D0F5.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\D134.tmp"C:\Users\Admin\AppData\Local\Temp\D134.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\D172.tmp"C:\Users\Admin\AppData\Local\Temp\D172.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\D1B1.tmp"C:\Users\Admin\AppData\Local\Temp\D1B1.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\D1EF.tmp"C:\Users\Admin\AppData\Local\Temp\D1EF.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\D22E.tmp"C:\Users\Admin\AppData\Local\Temp\D22E.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\D26C.tmp"C:\Users\Admin\AppData\Local\Temp\D26C.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\D2AA.tmp"C:\Users\Admin\AppData\Local\Temp\D2AA.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\D2E9.tmp"C:\Users\Admin\AppData\Local\Temp\D2E9.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:552 -
C:\Users\Admin\AppData\Local\Temp\D327.tmp"C:\Users\Admin\AppData\Local\Temp\D327.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\D366.tmp"C:\Users\Admin\AppData\Local\Temp\D366.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:696 -
C:\Users\Admin\AppData\Local\Temp\D3A4.tmp"C:\Users\Admin\AppData\Local\Temp\D3A4.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\D3E2.tmp"C:\Users\Admin\AppData\Local\Temp\D3E2.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\D421.tmp"C:\Users\Admin\AppData\Local\Temp\D421.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\D45F.tmp"C:\Users\Admin\AppData\Local\Temp\D45F.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\D49E.tmp"C:\Users\Admin\AppData\Local\Temp\D49E.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\D4DC.tmp"C:\Users\Admin\AppData\Local\Temp\D4DC.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\D51A.tmp"C:\Users\Admin\AppData\Local\Temp\D51A.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\D559.tmp"C:\Users\Admin\AppData\Local\Temp\D559.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\D597.tmp"C:\Users\Admin\AppData\Local\Temp\D597.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\D5D6.tmp"C:\Users\Admin\AppData\Local\Temp\D5D6.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\D614.tmp"C:\Users\Admin\AppData\Local\Temp\D614.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\D652.tmp"C:\Users\Admin\AppData\Local\Temp\D652.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\D691.tmp"C:\Users\Admin\AppData\Local\Temp\D691.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\D6CF.tmp"C:\Users\Admin\AppData\Local\Temp\D6CF.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\D70E.tmp"C:\Users\Admin\AppData\Local\Temp\D70E.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\D74C.tmp"C:\Users\Admin\AppData\Local\Temp\D74C.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\D78A.tmp"C:\Users\Admin\AppData\Local\Temp\D78A.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\D7C9.tmp"C:\Users\Admin\AppData\Local\Temp\D7C9.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\D807.tmp"C:\Users\Admin\AppData\Local\Temp\D807.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\D846.tmp"C:\Users\Admin\AppData\Local\Temp\D846.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\D884.tmp"C:\Users\Admin\AppData\Local\Temp\D884.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\D8C2.tmp"C:\Users\Admin\AppData\Local\Temp\D8C2.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\D910.tmp"C:\Users\Admin\AppData\Local\Temp\D910.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\D95E.tmp"C:\Users\Admin\AppData\Local\Temp\D95E.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\D99D.tmp"C:\Users\Admin\AppData\Local\Temp\D99D.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\D9DB.tmp"C:\Users\Admin\AppData\Local\Temp\D9DB.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\DA1A.tmp"C:\Users\Admin\AppData\Local\Temp\DA1A.tmp"65⤵
- Executes dropped EXE
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\DA58.tmp"C:\Users\Admin\AppData\Local\Temp\DA58.tmp"66⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\DA96.tmp"C:\Users\Admin\AppData\Local\Temp\DA96.tmp"67⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\DAD5.tmp"C:\Users\Admin\AppData\Local\Temp\DAD5.tmp"68⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\DB13.tmp"C:\Users\Admin\AppData\Local\Temp\DB13.tmp"69⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\DB52.tmp"C:\Users\Admin\AppData\Local\Temp\DB52.tmp"70⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\DB90.tmp"C:\Users\Admin\AppData\Local\Temp\DB90.tmp"71⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\DBCE.tmp"C:\Users\Admin\AppData\Local\Temp\DBCE.tmp"72⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\DC0D.tmp"C:\Users\Admin\AppData\Local\Temp\DC0D.tmp"73⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\DC4B.tmp"C:\Users\Admin\AppData\Local\Temp\DC4B.tmp"74⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\DC8A.tmp"C:\Users\Admin\AppData\Local\Temp\DC8A.tmp"75⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\DCD8.tmp"C:\Users\Admin\AppData\Local\Temp\DCD8.tmp"76⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\DD16.tmp"C:\Users\Admin\AppData\Local\Temp\DD16.tmp"77⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\DD54.tmp"C:\Users\Admin\AppData\Local\Temp\DD54.tmp"78⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\DDA2.tmp"C:\Users\Admin\AppData\Local\Temp\DDA2.tmp"79⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\DDE1.tmp"C:\Users\Admin\AppData\Local\Temp\DDE1.tmp"80⤵
- System Location Discovery: System Language Discovery
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\DE2F.tmp"C:\Users\Admin\AppData\Local\Temp\DE2F.tmp"81⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\DE6D.tmp"C:\Users\Admin\AppData\Local\Temp\DE6D.tmp"82⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\DEAC.tmp"C:\Users\Admin\AppData\Local\Temp\DEAC.tmp"83⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\DEEA.tmp"C:\Users\Admin\AppData\Local\Temp\DEEA.tmp"84⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\DF28.tmp"C:\Users\Admin\AppData\Local\Temp\DF28.tmp"85⤵
- System Location Discovery: System Language Discovery
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\DF67.tmp"C:\Users\Admin\AppData\Local\Temp\DF67.tmp"86⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\DFA5.tmp"C:\Users\Admin\AppData\Local\Temp\DFA5.tmp"87⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\DFE4.tmp"C:\Users\Admin\AppData\Local\Temp\DFE4.tmp"88⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\E022.tmp"C:\Users\Admin\AppData\Local\Temp\E022.tmp"89⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\E060.tmp"C:\Users\Admin\AppData\Local\Temp\E060.tmp"90⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\E09F.tmp"C:\Users\Admin\AppData\Local\Temp\E09F.tmp"91⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\E0DD.tmp"C:\Users\Admin\AppData\Local\Temp\E0DD.tmp"92⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\E11C.tmp"C:\Users\Admin\AppData\Local\Temp\E11C.tmp"93⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\E15A.tmp"C:\Users\Admin\AppData\Local\Temp\E15A.tmp"94⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\E198.tmp"C:\Users\Admin\AppData\Local\Temp\E198.tmp"95⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\E1D7.tmp"C:\Users\Admin\AppData\Local\Temp\E1D7.tmp"96⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\E215.tmp"C:\Users\Admin\AppData\Local\Temp\E215.tmp"97⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\E254.tmp"C:\Users\Admin\AppData\Local\Temp\E254.tmp"98⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\E292.tmp"C:\Users\Admin\AppData\Local\Temp\E292.tmp"99⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\E2D0.tmp"C:\Users\Admin\AppData\Local\Temp\E2D0.tmp"100⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\E30F.tmp"C:\Users\Admin\AppData\Local\Temp\E30F.tmp"101⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\E34D.tmp"C:\Users\Admin\AppData\Local\Temp\E34D.tmp"102⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\E38C.tmp"C:\Users\Admin\AppData\Local\Temp\E38C.tmp"103⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\E3CA.tmp"C:\Users\Admin\AppData\Local\Temp\E3CA.tmp"104⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\E408.tmp"C:\Users\Admin\AppData\Local\Temp\E408.tmp"105⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\E447.tmp"C:\Users\Admin\AppData\Local\Temp\E447.tmp"106⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\E485.tmp"C:\Users\Admin\AppData\Local\Temp\E485.tmp"107⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\E4C4.tmp"C:\Users\Admin\AppData\Local\Temp\E4C4.tmp"108⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\E502.tmp"C:\Users\Admin\AppData\Local\Temp\E502.tmp"109⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\E550.tmp"C:\Users\Admin\AppData\Local\Temp\E550.tmp"110⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\E58E.tmp"C:\Users\Admin\AppData\Local\Temp\E58E.tmp"111⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\E5CD.tmp"C:\Users\Admin\AppData\Local\Temp\E5CD.tmp"112⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\E60B.tmp"C:\Users\Admin\AppData\Local\Temp\E60B.tmp"113⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\E64A.tmp"C:\Users\Admin\AppData\Local\Temp\E64A.tmp"114⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\E688.tmp"C:\Users\Admin\AppData\Local\Temp\E688.tmp"115⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\E6C6.tmp"C:\Users\Admin\AppData\Local\Temp\E6C6.tmp"116⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\E705.tmp"C:\Users\Admin\AppData\Local\Temp\E705.tmp"117⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\E743.tmp"C:\Users\Admin\AppData\Local\Temp\E743.tmp"118⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\E782.tmp"C:\Users\Admin\AppData\Local\Temp\E782.tmp"119⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\E7C0.tmp"C:\Users\Admin\AppData\Local\Temp\E7C0.tmp"120⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\E7FE.tmp"C:\Users\Admin\AppData\Local\Temp\E7FE.tmp"121⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\E83D.tmp"C:\Users\Admin\AppData\Local\Temp\E83D.tmp"122⤵PID:2392
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-