Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07/09/2024, 03:51
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-07_25b693bb7eff4c0438eed2eeeb017d34_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-07_25b693bb7eff4c0438eed2eeeb017d34_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-07_25b693bb7eff4c0438eed2eeeb017d34_mafia.exe
-
Size
765KB
-
MD5
25b693bb7eff4c0438eed2eeeb017d34
-
SHA1
407e75401965cde4aec6c20a4081956fccdebd9d
-
SHA256
48dd06d6a21363c1239c68661ceb4fbc04ad4730e55882229df45826cb307050
-
SHA512
e46e066efb5dc7834ce0575d50a9e0968a3e74de1432b8481a515e492f60daa3d5ab7b615b3eb50e41660c21d2c55d7fe005ccd8314b918c53d9bcbbf5c1dd62
-
SSDEEP
12288:ZU5rCOTeiDmQQuS0RqpzXPrn2mlW33ZF5rn5rLOa54U5w5A:ZUQOJDxQb0R4rBs33vh5Oa+UOS
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3032 D182.tmp 2228 D1DF.tmp 804 D26C.tmp 2216 D2D9.tmp 2452 D346.tmp 2328 D3D3.tmp 2888 D440.tmp 2916 D4BD.tmp 2904 D539.tmp 2892 D5A7.tmp 2752 D614.tmp 2612 D691.tmp 2692 D70D.tmp 1532 D75B.tmp 2356 D7D8.tmp 1704 D826.tmp 1840 D8A3.tmp 1920 D901.tmp 2424 D98D.tmp 1996 D9EB.tmp 1264 DA58.tmp 1712 DAD5.tmp 2864 DB13.tmp 2856 DB71.tmp 2712 DBBF.tmp 2868 DBFD.tmp 2336 DC3B.tmp 2844 DC7A.tmp 904 DCB8.tmp 1080 DD06.tmp 1796 DD54.tmp 2500 DDA2.tmp 1940 DDE1.tmp 1872 DE2F.tmp 1580 DE6D.tmp 1680 DEAC.tmp 860 DEFA.tmp 628 DF38.tmp 2360 DF76.tmp 2304 DFB5.tmp 872 DFF3.tmp 2120 E041.tmp 2144 E080.tmp 1760 E0CE.tmp 1856 E10C.tmp 580 E14A.tmp 1952 E189.tmp 1216 E1C7.tmp 1500 E215.tmp 2040 E263.tmp 1596 E2A2.tmp 1820 E2F0.tmp 3040 E32E.tmp 3036 E36C.tmp 1484 E3AB.tmp 2228 E3E9.tmp 2248 E428.tmp 768 E476.tmp 2216 E4C4.tmp 2760 E521.tmp 2880 E57F.tmp 2912 E5BD.tmp 2992 E5FC.tmp 976 E63A.tmp -
Loads dropped DLL 64 IoCs
pid Process 2112 2024-09-07_25b693bb7eff4c0438eed2eeeb017d34_mafia.exe 3032 D182.tmp 2228 D1DF.tmp 804 D26C.tmp 2216 D2D9.tmp 2452 D346.tmp 2328 D3D3.tmp 2888 D440.tmp 2916 D4BD.tmp 2904 D539.tmp 2892 D5A7.tmp 2752 D614.tmp 2612 D691.tmp 2692 D70D.tmp 1532 D75B.tmp 2356 D7D8.tmp 1704 D826.tmp 1840 D8A3.tmp 1920 D901.tmp 2424 D98D.tmp 1996 D9EB.tmp 1264 DA58.tmp 1712 DAD5.tmp 2864 DB13.tmp 2856 DB71.tmp 2712 DBBF.tmp 2868 DBFD.tmp 2336 DC3B.tmp 2844 DC7A.tmp 904 DCB8.tmp 1080 DD06.tmp 1796 DD54.tmp 2500 DDA2.tmp 1940 DDE1.tmp 1872 DE2F.tmp 1580 DE6D.tmp 1680 DEAC.tmp 860 DEFA.tmp 628 DF38.tmp 2360 DF76.tmp 2304 DFB5.tmp 872 DFF3.tmp 2120 E041.tmp 2144 E080.tmp 1760 E0CE.tmp 1856 E10C.tmp 580 E14A.tmp 1952 E189.tmp 1216 E1C7.tmp 1500 E215.tmp 2040 E263.tmp 1596 E2A2.tmp 1820 E2F0.tmp 3040 E32E.tmp 3036 E36C.tmp 1484 E3AB.tmp 2228 E3E9.tmp 2248 E428.tmp 768 E476.tmp 2216 E4C4.tmp 2760 E521.tmp 2880 E57F.tmp 2912 E5BD.tmp 2992 E5FC.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 581F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E4F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF2A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4338.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 406.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6059.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7407.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8028.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F170.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 867E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 562B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C265.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 118E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 673B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1EA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 601A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E63A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2112 wrote to memory of 3032 2112 2024-09-07_25b693bb7eff4c0438eed2eeeb017d34_mafia.exe 31 PID 2112 wrote to memory of 3032 2112 2024-09-07_25b693bb7eff4c0438eed2eeeb017d34_mafia.exe 31 PID 2112 wrote to memory of 3032 2112 2024-09-07_25b693bb7eff4c0438eed2eeeb017d34_mafia.exe 31 PID 2112 wrote to memory of 3032 2112 2024-09-07_25b693bb7eff4c0438eed2eeeb017d34_mafia.exe 31 PID 3032 wrote to memory of 2228 3032 D182.tmp 32 PID 3032 wrote to memory of 2228 3032 D182.tmp 32 PID 3032 wrote to memory of 2228 3032 D182.tmp 32 PID 3032 wrote to memory of 2228 3032 D182.tmp 32 PID 2228 wrote to memory of 804 2228 D1DF.tmp 33 PID 2228 wrote to memory of 804 2228 D1DF.tmp 33 PID 2228 wrote to memory of 804 2228 D1DF.tmp 33 PID 2228 wrote to memory of 804 2228 D1DF.tmp 33 PID 804 wrote to memory of 2216 804 D26C.tmp 34 PID 804 wrote to memory of 2216 804 D26C.tmp 34 PID 804 wrote to memory of 2216 804 D26C.tmp 34 PID 804 wrote to memory of 2216 804 D26C.tmp 34 PID 2216 wrote to memory of 2452 2216 D2D9.tmp 35 PID 2216 wrote to memory of 2452 2216 D2D9.tmp 35 PID 2216 wrote to memory of 2452 2216 D2D9.tmp 35 PID 2216 wrote to memory of 2452 2216 D2D9.tmp 35 PID 2452 wrote to memory of 2328 2452 D346.tmp 36 PID 2452 wrote to memory of 2328 2452 D346.tmp 36 PID 2452 wrote to memory of 2328 2452 D346.tmp 36 PID 2452 wrote to memory of 2328 2452 D346.tmp 36 PID 2328 wrote to memory of 2888 2328 D3D3.tmp 37 PID 2328 wrote to memory of 2888 2328 D3D3.tmp 37 PID 2328 wrote to memory of 2888 2328 D3D3.tmp 37 PID 2328 wrote to memory of 2888 2328 D3D3.tmp 37 PID 2888 wrote to memory of 2916 2888 D440.tmp 38 PID 2888 wrote to memory of 2916 2888 D440.tmp 38 PID 2888 wrote to memory of 2916 2888 D440.tmp 38 PID 2888 wrote to memory of 2916 2888 D440.tmp 38 PID 2916 wrote to memory of 2904 2916 D4BD.tmp 39 PID 2916 wrote to memory of 2904 2916 D4BD.tmp 39 PID 2916 wrote to memory of 2904 2916 D4BD.tmp 39 PID 2916 wrote to memory of 2904 2916 D4BD.tmp 39 PID 2904 wrote to memory of 2892 2904 D539.tmp 40 PID 2904 wrote to memory of 2892 2904 D539.tmp 40 PID 2904 wrote to memory of 2892 2904 D539.tmp 40 PID 2904 wrote to memory of 2892 2904 D539.tmp 40 PID 2892 wrote to memory of 2752 2892 D5A7.tmp 41 PID 2892 wrote to memory of 2752 2892 D5A7.tmp 41 PID 2892 wrote to memory of 2752 2892 D5A7.tmp 41 PID 2892 wrote to memory of 2752 2892 D5A7.tmp 41 PID 2752 wrote to memory of 2612 2752 D614.tmp 42 PID 2752 wrote to memory of 2612 2752 D614.tmp 42 PID 2752 wrote to memory of 2612 2752 D614.tmp 42 PID 2752 wrote to memory of 2612 2752 D614.tmp 42 PID 2612 wrote to memory of 2692 2612 D691.tmp 43 PID 2612 wrote to memory of 2692 2612 D691.tmp 43 PID 2612 wrote to memory of 2692 2612 D691.tmp 43 PID 2612 wrote to memory of 2692 2612 D691.tmp 43 PID 2692 wrote to memory of 1532 2692 D70D.tmp 44 PID 2692 wrote to memory of 1532 2692 D70D.tmp 44 PID 2692 wrote to memory of 1532 2692 D70D.tmp 44 PID 2692 wrote to memory of 1532 2692 D70D.tmp 44 PID 1532 wrote to memory of 2356 1532 D75B.tmp 45 PID 1532 wrote to memory of 2356 1532 D75B.tmp 45 PID 1532 wrote to memory of 2356 1532 D75B.tmp 45 PID 1532 wrote to memory of 2356 1532 D75B.tmp 45 PID 2356 wrote to memory of 1704 2356 D7D8.tmp 46 PID 2356 wrote to memory of 1704 2356 D7D8.tmp 46 PID 2356 wrote to memory of 1704 2356 D7D8.tmp 46 PID 2356 wrote to memory of 1704 2356 D7D8.tmp 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-07_25b693bb7eff4c0438eed2eeeb017d34_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-07_25b693bb7eff4c0438eed2eeeb017d34_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\D182.tmp"C:\Users\Admin\AppData\Local\Temp\D182.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\D1DF.tmp"C:\Users\Admin\AppData\Local\Temp\D1DF.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\D26C.tmp"C:\Users\Admin\AppData\Local\Temp\D26C.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Users\Admin\AppData\Local\Temp\D2D9.tmp"C:\Users\Admin\AppData\Local\Temp\D2D9.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\D346.tmp"C:\Users\Admin\AppData\Local\Temp\D346.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\D3D3.tmp"C:\Users\Admin\AppData\Local\Temp\D3D3.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\D440.tmp"C:\Users\Admin\AppData\Local\Temp\D440.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\D4BD.tmp"C:\Users\Admin\AppData\Local\Temp\D4BD.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\D539.tmp"C:\Users\Admin\AppData\Local\Temp\D539.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\D5A7.tmp"C:\Users\Admin\AppData\Local\Temp\D5A7.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\D614.tmp"C:\Users\Admin\AppData\Local\Temp\D614.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\D691.tmp"C:\Users\Admin\AppData\Local\Temp\D691.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\D70D.tmp"C:\Users\Admin\AppData\Local\Temp\D70D.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\D75B.tmp"C:\Users\Admin\AppData\Local\Temp\D75B.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\D7D8.tmp"C:\Users\Admin\AppData\Local\Temp\D7D8.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\D826.tmp"C:\Users\Admin\AppData\Local\Temp\D826.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\D8A3.tmp"C:\Users\Admin\AppData\Local\Temp\D8A3.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\D901.tmp"C:\Users\Admin\AppData\Local\Temp\D901.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\D98D.tmp"C:\Users\Admin\AppData\Local\Temp\D98D.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\D9EB.tmp"C:\Users\Admin\AppData\Local\Temp\D9EB.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\DA58.tmp"C:\Users\Admin\AppData\Local\Temp\DA58.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\DAD5.tmp"C:\Users\Admin\AppData\Local\Temp\DAD5.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\DB13.tmp"C:\Users\Admin\AppData\Local\Temp\DB13.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\DB71.tmp"C:\Users\Admin\AppData\Local\Temp\DB71.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\DBBF.tmp"C:\Users\Admin\AppData\Local\Temp\DBBF.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\DBFD.tmp"C:\Users\Admin\AppData\Local\Temp\DBFD.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\DC3B.tmp"C:\Users\Admin\AppData\Local\Temp\DC3B.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\DC7A.tmp"C:\Users\Admin\AppData\Local\Temp\DC7A.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\DCB8.tmp"C:\Users\Admin\AppData\Local\Temp\DCB8.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:904 -
C:\Users\Admin\AppData\Local\Temp\DD06.tmp"C:\Users\Admin\AppData\Local\Temp\DD06.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\DD54.tmp"C:\Users\Admin\AppData\Local\Temp\DD54.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\DDA2.tmp"C:\Users\Admin\AppData\Local\Temp\DDA2.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\DDE1.tmp"C:\Users\Admin\AppData\Local\Temp\DDE1.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\DE2F.tmp"C:\Users\Admin\AppData\Local\Temp\DE2F.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\DE6D.tmp"C:\Users\Admin\AppData\Local\Temp\DE6D.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\DEAC.tmp"C:\Users\Admin\AppData\Local\Temp\DEAC.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\DEFA.tmp"C:\Users\Admin\AppData\Local\Temp\DEFA.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:860 -
C:\Users\Admin\AppData\Local\Temp\DF38.tmp"C:\Users\Admin\AppData\Local\Temp\DF38.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:628 -
C:\Users\Admin\AppData\Local\Temp\DF76.tmp"C:\Users\Admin\AppData\Local\Temp\DF76.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\DFB5.tmp"C:\Users\Admin\AppData\Local\Temp\DFB5.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\DFF3.tmp"C:\Users\Admin\AppData\Local\Temp\DFF3.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:872 -
C:\Users\Admin\AppData\Local\Temp\E041.tmp"C:\Users\Admin\AppData\Local\Temp\E041.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\E080.tmp"C:\Users\Admin\AppData\Local\Temp\E080.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\E0CE.tmp"C:\Users\Admin\AppData\Local\Temp\E0CE.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\E10C.tmp"C:\Users\Admin\AppData\Local\Temp\E10C.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\E14A.tmp"C:\Users\Admin\AppData\Local\Temp\E14A.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:580 -
C:\Users\Admin\AppData\Local\Temp\E189.tmp"C:\Users\Admin\AppData\Local\Temp\E189.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\E1C7.tmp"C:\Users\Admin\AppData\Local\Temp\E1C7.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\E215.tmp"C:\Users\Admin\AppData\Local\Temp\E215.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\E263.tmp"C:\Users\Admin\AppData\Local\Temp\E263.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\E2A2.tmp"C:\Users\Admin\AppData\Local\Temp\E2A2.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\E2F0.tmp"C:\Users\Admin\AppData\Local\Temp\E2F0.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\E32E.tmp"C:\Users\Admin\AppData\Local\Temp\E32E.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\E36C.tmp"C:\Users\Admin\AppData\Local\Temp\E36C.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\E3AB.tmp"C:\Users\Admin\AppData\Local\Temp\E3AB.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\E3E9.tmp"C:\Users\Admin\AppData\Local\Temp\E3E9.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\E428.tmp"C:\Users\Admin\AppData\Local\Temp\E428.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\E476.tmp"C:\Users\Admin\AppData\Local\Temp\E476.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:768 -
C:\Users\Admin\AppData\Local\Temp\E4C4.tmp"C:\Users\Admin\AppData\Local\Temp\E4C4.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\E521.tmp"C:\Users\Admin\AppData\Local\Temp\E521.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\E57F.tmp"C:\Users\Admin\AppData\Local\Temp\E57F.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\E5BD.tmp"C:\Users\Admin\AppData\Local\Temp\E5BD.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\E5FC.tmp"C:\Users\Admin\AppData\Local\Temp\E5FC.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\E63A.tmp"C:\Users\Admin\AppData\Local\Temp\E63A.tmp"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:976 -
C:\Users\Admin\AppData\Local\Temp\E678.tmp"C:\Users\Admin\AppData\Local\Temp\E678.tmp"66⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\E6B7.tmp"C:\Users\Admin\AppData\Local\Temp\E6B7.tmp"67⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\E705.tmp"C:\Users\Admin\AppData\Local\Temp\E705.tmp"68⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\E743.tmp"C:\Users\Admin\AppData\Local\Temp\E743.tmp"69⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\E782.tmp"C:\Users\Admin\AppData\Local\Temp\E782.tmp"70⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\E7C0.tmp"C:\Users\Admin\AppData\Local\Temp\E7C0.tmp"71⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\E80E.tmp"C:\Users\Admin\AppData\Local\Temp\E80E.tmp"72⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\E84C.tmp"C:\Users\Admin\AppData\Local\Temp\E84C.tmp"73⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\E88B.tmp"C:\Users\Admin\AppData\Local\Temp\E88B.tmp"74⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\E8C9.tmp"C:\Users\Admin\AppData\Local\Temp\E8C9.tmp"75⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\E917.tmp"C:\Users\Admin\AppData\Local\Temp\E917.tmp"76⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\E956.tmp"C:\Users\Admin\AppData\Local\Temp\E956.tmp"77⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\E9A4.tmp"C:\Users\Admin\AppData\Local\Temp\E9A4.tmp"78⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\E9E2.tmp"C:\Users\Admin\AppData\Local\Temp\E9E2.tmp"79⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\EA40.tmp"C:\Users\Admin\AppData\Local\Temp\EA40.tmp"80⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\EA7E.tmp"C:\Users\Admin\AppData\Local\Temp\EA7E.tmp"81⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\EACC.tmp"C:\Users\Admin\AppData\Local\Temp\EACC.tmp"82⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\EB0A.tmp"C:\Users\Admin\AppData\Local\Temp\EB0A.tmp"83⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\EB49.tmp"C:\Users\Admin\AppData\Local\Temp\EB49.tmp"84⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\EB87.tmp"C:\Users\Admin\AppData\Local\Temp\EB87.tmp"85⤵
- System Location Discovery: System Language Discovery
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\EBC6.tmp"C:\Users\Admin\AppData\Local\Temp\EBC6.tmp"86⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\EC04.tmp"C:\Users\Admin\AppData\Local\Temp\EC04.tmp"87⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\EC42.tmp"C:\Users\Admin\AppData\Local\Temp\EC42.tmp"88⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\EC81.tmp"C:\Users\Admin\AppData\Local\Temp\EC81.tmp"89⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\ECBF.tmp"C:\Users\Admin\AppData\Local\Temp\ECBF.tmp"90⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\ECFE.tmp"C:\Users\Admin\AppData\Local\Temp\ECFE.tmp"91⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\ED4C.tmp"C:\Users\Admin\AppData\Local\Temp\ED4C.tmp"92⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\ED8A.tmp"C:\Users\Admin\AppData\Local\Temp\ED8A.tmp"93⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\EDC8.tmp"C:\Users\Admin\AppData\Local\Temp\EDC8.tmp"94⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\EE07.tmp"C:\Users\Admin\AppData\Local\Temp\EE07.tmp"95⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\EE45.tmp"C:\Users\Admin\AppData\Local\Temp\EE45.tmp"96⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\EE93.tmp"C:\Users\Admin\AppData\Local\Temp\EE93.tmp"97⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\EED2.tmp"C:\Users\Admin\AppData\Local\Temp\EED2.tmp"98⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\EF10.tmp"C:\Users\Admin\AppData\Local\Temp\EF10.tmp"99⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\EF5E.tmp"C:\Users\Admin\AppData\Local\Temp\EF5E.tmp"100⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\EF9C.tmp"C:\Users\Admin\AppData\Local\Temp\EF9C.tmp"101⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\EFDB.tmp"C:\Users\Admin\AppData\Local\Temp\EFDB.tmp"102⤵PID:492
-
C:\Users\Admin\AppData\Local\Temp\F029.tmp"C:\Users\Admin\AppData\Local\Temp\F029.tmp"103⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\F077.tmp"C:\Users\Admin\AppData\Local\Temp\F077.tmp"104⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\F0B5.tmp"C:\Users\Admin\AppData\Local\Temp\F0B5.tmp"105⤵
- System Location Discovery: System Language Discovery
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\F0F4.tmp"C:\Users\Admin\AppData\Local\Temp\F0F4.tmp"106⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\F132.tmp"C:\Users\Admin\AppData\Local\Temp\F132.tmp"107⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\F170.tmp"C:\Users\Admin\AppData\Local\Temp\F170.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:972 -
C:\Users\Admin\AppData\Local\Temp\F1AF.tmp"C:\Users\Admin\AppData\Local\Temp\F1AF.tmp"109⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\F1FD.tmp"C:\Users\Admin\AppData\Local\Temp\F1FD.tmp"110⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\F23B.tmp"C:\Users\Admin\AppData\Local\Temp\F23B.tmp"111⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\F27A.tmp"C:\Users\Admin\AppData\Local\Temp\F27A.tmp"112⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\F2B8.tmp"C:\Users\Admin\AppData\Local\Temp\F2B8.tmp"113⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\F2F6.tmp"C:\Users\Admin\AppData\Local\Temp\F2F6.tmp"114⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\F335.tmp"C:\Users\Admin\AppData\Local\Temp\F335.tmp"115⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\F373.tmp"C:\Users\Admin\AppData\Local\Temp\F373.tmp"116⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\F3B2.tmp"C:\Users\Admin\AppData\Local\Temp\F3B2.tmp"117⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\F3F0.tmp"C:\Users\Admin\AppData\Local\Temp\F3F0.tmp"118⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\F42E.tmp"C:\Users\Admin\AppData\Local\Temp\F42E.tmp"119⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\F46D.tmp"C:\Users\Admin\AppData\Local\Temp\F46D.tmp"120⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\F4AB.tmp"C:\Users\Admin\AppData\Local\Temp\F4AB.tmp"121⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\F4EA.tmp"C:\Users\Admin\AppData\Local\Temp\F4EA.tmp"122⤵PID:2256
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-