Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
07/09/2024, 11:34
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-07_c3b81fa367c8a20a83bd39906fdb4b2a_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-09-07_c3b81fa367c8a20a83bd39906fdb4b2a_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-07_c3b81fa367c8a20a83bd39906fdb4b2a_mafia.exe
-
Size
488KB
-
MD5
c3b81fa367c8a20a83bd39906fdb4b2a
-
SHA1
989bb6d59871cfb13f5c984426d83f41e6bab91d
-
SHA256
50f4788164e758c7bffc8d5371c8febb8f03eebccad26789935e89e610041d8e
-
SHA512
983a28cfad4500c73db51f7ee8b0ed718fee65a104b026bfda1fda7cbaa05b2bae600a68dc29dfef26570f84ff4021008a4c9710b8d538c142e9138c8279ffed
-
SSDEEP
12288:/U5rCOTeiDA0djlstCvlT2Cp3nDe+MvtrjJNZ:/UQOJDA0hlstZay5trFN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2432 6789.tmp 2976 67F7.tmp 2820 6873.tmp 2728 68E1.tmp 2648 694E.tmp 2176 69BB.tmp 2348 6A28.tmp 756 6A86.tmp 1504 6AF3.tmp 2836 6B51.tmp 2184 6BCD.tmp 2076 6C2B.tmp 2068 6CA8.tmp 2952 6D05.tmp 2456 6D53.tmp 2840 6DB1.tmp 2924 6E2E.tmp 2520 6E8B.tmp 2268 6F18.tmp 2452 6F75.tmp 1584 6FE3.tmp 2488 7050.tmp 1984 70BD.tmp 2008 70FB.tmp 2272 7159.tmp 2588 71A7.tmp 2196 71F5.tmp 1108 7243.tmp 1652 72A1.tmp 1644 72EF.tmp 408 733D.tmp 1204 738B.tmp 1820 73C9.tmp 684 7417.tmp 1612 7455.tmp 2200 74A3.tmp 1540 74F1.tmp 1792 753F.tmp 2700 758D.tmp 916 75DB.tmp 2256 7629.tmp 1780 7668.tmp 2356 76A6.tmp 2116 76F4.tmp 2372 7742.tmp 2532 7790.tmp 1292 77CF.tmp 304 780D.tmp 2208 784B.tmp 1840 788A.tmp 1720 78C8.tmp 2624 7916.tmp 1700 7964.tmp 2772 79B2.tmp 1936 79F1.tmp 2644 7A3F.tmp 2752 7A9C.tmp 2040 7AEA.tmp 2612 7B29.tmp 2900 7B77.tmp 2660 7BC5.tmp 2312 7C13.tmp 1812 7C51.tmp 2620 7C9F.tmp -
Loads dropped DLL 64 IoCs
pid Process 2768 2024-09-07_c3b81fa367c8a20a83bd39906fdb4b2a_mafia.exe 2432 6789.tmp 2976 67F7.tmp 2820 6873.tmp 2728 68E1.tmp 2648 694E.tmp 2176 69BB.tmp 2348 6A28.tmp 756 6A86.tmp 1504 6AF3.tmp 2836 6B51.tmp 2184 6BCD.tmp 2076 6C2B.tmp 2068 6CA8.tmp 2952 6D05.tmp 2456 6D53.tmp 2840 6DB1.tmp 2924 6E2E.tmp 2520 6E8B.tmp 2268 6F18.tmp 2452 6F75.tmp 1584 6FE3.tmp 2488 7050.tmp 1984 70BD.tmp 2008 70FB.tmp 2272 7159.tmp 2588 71A7.tmp 2196 71F5.tmp 1108 7243.tmp 1652 72A1.tmp 1644 72EF.tmp 408 733D.tmp 1204 738B.tmp 1820 73C9.tmp 684 7417.tmp 1612 7455.tmp 2200 74A3.tmp 1540 74F1.tmp 1792 753F.tmp 2700 758D.tmp 916 75DB.tmp 2256 7629.tmp 1780 7668.tmp 2356 76A6.tmp 2116 76F4.tmp 2372 7742.tmp 2532 7790.tmp 1292 77CF.tmp 304 780D.tmp 2208 784B.tmp 1840 788A.tmp 1720 78C8.tmp 2624 7916.tmp 1700 7964.tmp 2772 79B2.tmp 1936 79F1.tmp 2644 7A3F.tmp 2752 7A9C.tmp 2040 7AEA.tmp 2612 7B29.tmp 2900 7B77.tmp 2660 7BC5.tmp 2312 7C13.tmp 1812 7C51.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2923.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D48E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E244.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED8A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 229E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 366C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7455.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAC3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA48.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6893.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6558.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 694E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E206.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 963.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A1C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 758D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B71F.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2768 wrote to memory of 2432 2768 2024-09-07_c3b81fa367c8a20a83bd39906fdb4b2a_mafia.exe 30 PID 2768 wrote to memory of 2432 2768 2024-09-07_c3b81fa367c8a20a83bd39906fdb4b2a_mafia.exe 30 PID 2768 wrote to memory of 2432 2768 2024-09-07_c3b81fa367c8a20a83bd39906fdb4b2a_mafia.exe 30 PID 2768 wrote to memory of 2432 2768 2024-09-07_c3b81fa367c8a20a83bd39906fdb4b2a_mafia.exe 30 PID 2432 wrote to memory of 2976 2432 6789.tmp 31 PID 2432 wrote to memory of 2976 2432 6789.tmp 31 PID 2432 wrote to memory of 2976 2432 6789.tmp 31 PID 2432 wrote to memory of 2976 2432 6789.tmp 31 PID 2976 wrote to memory of 2820 2976 67F7.tmp 32 PID 2976 wrote to memory of 2820 2976 67F7.tmp 32 PID 2976 wrote to memory of 2820 2976 67F7.tmp 32 PID 2976 wrote to memory of 2820 2976 67F7.tmp 32 PID 2820 wrote to memory of 2728 2820 6873.tmp 33 PID 2820 wrote to memory of 2728 2820 6873.tmp 33 PID 2820 wrote to memory of 2728 2820 6873.tmp 33 PID 2820 wrote to memory of 2728 2820 6873.tmp 33 PID 2728 wrote to memory of 2648 2728 68E1.tmp 34 PID 2728 wrote to memory of 2648 2728 68E1.tmp 34 PID 2728 wrote to memory of 2648 2728 68E1.tmp 34 PID 2728 wrote to memory of 2648 2728 68E1.tmp 34 PID 2648 wrote to memory of 2176 2648 694E.tmp 35 PID 2648 wrote to memory of 2176 2648 694E.tmp 35 PID 2648 wrote to memory of 2176 2648 694E.tmp 35 PID 2648 wrote to memory of 2176 2648 694E.tmp 35 PID 2176 wrote to memory of 2348 2176 69BB.tmp 36 PID 2176 wrote to memory of 2348 2176 69BB.tmp 36 PID 2176 wrote to memory of 2348 2176 69BB.tmp 36 PID 2176 wrote to memory of 2348 2176 69BB.tmp 36 PID 2348 wrote to memory of 756 2348 6A28.tmp 37 PID 2348 wrote to memory of 756 2348 6A28.tmp 37 PID 2348 wrote to memory of 756 2348 6A28.tmp 37 PID 2348 wrote to memory of 756 2348 6A28.tmp 37 PID 756 wrote to memory of 1504 756 6A86.tmp 38 PID 756 wrote to memory of 1504 756 6A86.tmp 38 PID 756 wrote to memory of 1504 756 6A86.tmp 38 PID 756 wrote to memory of 1504 756 6A86.tmp 38 PID 1504 wrote to memory of 2836 1504 6AF3.tmp 39 PID 1504 wrote to memory of 2836 1504 6AF3.tmp 39 PID 1504 wrote to memory of 2836 1504 6AF3.tmp 39 PID 1504 wrote to memory of 2836 1504 6AF3.tmp 39 PID 2836 wrote to memory of 2184 2836 6B51.tmp 40 PID 2836 wrote to memory of 2184 2836 6B51.tmp 40 PID 2836 wrote to memory of 2184 2836 6B51.tmp 40 PID 2836 wrote to memory of 2184 2836 6B51.tmp 40 PID 2184 wrote to memory of 2076 2184 6BCD.tmp 41 PID 2184 wrote to memory of 2076 2184 6BCD.tmp 41 PID 2184 wrote to memory of 2076 2184 6BCD.tmp 41 PID 2184 wrote to memory of 2076 2184 6BCD.tmp 41 PID 2076 wrote to memory of 2068 2076 6C2B.tmp 42 PID 2076 wrote to memory of 2068 2076 6C2B.tmp 42 PID 2076 wrote to memory of 2068 2076 6C2B.tmp 42 PID 2076 wrote to memory of 2068 2076 6C2B.tmp 42 PID 2068 wrote to memory of 2952 2068 6CA8.tmp 43 PID 2068 wrote to memory of 2952 2068 6CA8.tmp 43 PID 2068 wrote to memory of 2952 2068 6CA8.tmp 43 PID 2068 wrote to memory of 2952 2068 6CA8.tmp 43 PID 2952 wrote to memory of 2456 2952 6D05.tmp 44 PID 2952 wrote to memory of 2456 2952 6D05.tmp 44 PID 2952 wrote to memory of 2456 2952 6D05.tmp 44 PID 2952 wrote to memory of 2456 2952 6D05.tmp 44 PID 2456 wrote to memory of 2840 2456 6D53.tmp 45 PID 2456 wrote to memory of 2840 2456 6D53.tmp 45 PID 2456 wrote to memory of 2840 2456 6D53.tmp 45 PID 2456 wrote to memory of 2840 2456 6D53.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-07_c3b81fa367c8a20a83bd39906fdb4b2a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-07_c3b81fa367c8a20a83bd39906fdb4b2a_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\6789.tmp"C:\Users\Admin\AppData\Local\Temp\6789.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\67F7.tmp"C:\Users\Admin\AppData\Local\Temp\67F7.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\6873.tmp"C:\Users\Admin\AppData\Local\Temp\6873.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\68E1.tmp"C:\Users\Admin\AppData\Local\Temp\68E1.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\694E.tmp"C:\Users\Admin\AppData\Local\Temp\694E.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\69BB.tmp"C:\Users\Admin\AppData\Local\Temp\69BB.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\6A28.tmp"C:\Users\Admin\AppData\Local\Temp\6A28.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\6A86.tmp"C:\Users\Admin\AppData\Local\Temp\6A86.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\6AF3.tmp"C:\Users\Admin\AppData\Local\Temp\6AF3.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\6B51.tmp"C:\Users\Admin\AppData\Local\Temp\6B51.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\6BCD.tmp"C:\Users\Admin\AppData\Local\Temp\6BCD.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\6C2B.tmp"C:\Users\Admin\AppData\Local\Temp\6C2B.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\6CA8.tmp"C:\Users\Admin\AppData\Local\Temp\6CA8.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\6D05.tmp"C:\Users\Admin\AppData\Local\Temp\6D05.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\6D53.tmp"C:\Users\Admin\AppData\Local\Temp\6D53.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\6DB1.tmp"C:\Users\Admin\AppData\Local\Temp\6DB1.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\6E2E.tmp"C:\Users\Admin\AppData\Local\Temp\6E2E.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\6E8B.tmp"C:\Users\Admin\AppData\Local\Temp\6E8B.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\6F18.tmp"C:\Users\Admin\AppData\Local\Temp\6F18.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\6F75.tmp"C:\Users\Admin\AppData\Local\Temp\6F75.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\6FE3.tmp"C:\Users\Admin\AppData\Local\Temp\6FE3.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\7050.tmp"C:\Users\Admin\AppData\Local\Temp\7050.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\70BD.tmp"C:\Users\Admin\AppData\Local\Temp\70BD.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\70FB.tmp"C:\Users\Admin\AppData\Local\Temp\70FB.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\7159.tmp"C:\Users\Admin\AppData\Local\Temp\7159.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\71A7.tmp"C:\Users\Admin\AppData\Local\Temp\71A7.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\71F5.tmp"C:\Users\Admin\AppData\Local\Temp\71F5.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\7243.tmp"C:\Users\Admin\AppData\Local\Temp\7243.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\72A1.tmp"C:\Users\Admin\AppData\Local\Temp\72A1.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\72EF.tmp"C:\Users\Admin\AppData\Local\Temp\72EF.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\733D.tmp"C:\Users\Admin\AppData\Local\Temp\733D.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:408 -
C:\Users\Admin\AppData\Local\Temp\738B.tmp"C:\Users\Admin\AppData\Local\Temp\738B.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\73C9.tmp"C:\Users\Admin\AppData\Local\Temp\73C9.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:684 -
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\74A3.tmp"C:\Users\Admin\AppData\Local\Temp\74A3.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\74F1.tmp"C:\Users\Admin\AppData\Local\Temp\74F1.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\753F.tmp"C:\Users\Admin\AppData\Local\Temp\753F.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\758D.tmp"C:\Users\Admin\AppData\Local\Temp\758D.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\75DB.tmp"C:\Users\Admin\AppData\Local\Temp\75DB.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:916 -
C:\Users\Admin\AppData\Local\Temp\7629.tmp"C:\Users\Admin\AppData\Local\Temp\7629.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\7668.tmp"C:\Users\Admin\AppData\Local\Temp\7668.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\76A6.tmp"C:\Users\Admin\AppData\Local\Temp\76A6.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\76F4.tmp"C:\Users\Admin\AppData\Local\Temp\76F4.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\7742.tmp"C:\Users\Admin\AppData\Local\Temp\7742.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\7790.tmp"C:\Users\Admin\AppData\Local\Temp\7790.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\77CF.tmp"C:\Users\Admin\AppData\Local\Temp\77CF.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\780D.tmp"C:\Users\Admin\AppData\Local\Temp\780D.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:304 -
C:\Users\Admin\AppData\Local\Temp\784B.tmp"C:\Users\Admin\AppData\Local\Temp\784B.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\788A.tmp"C:\Users\Admin\AppData\Local\Temp\788A.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\78C8.tmp"C:\Users\Admin\AppData\Local\Temp\78C8.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\7916.tmp"C:\Users\Admin\AppData\Local\Temp\7916.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\7964.tmp"C:\Users\Admin\AppData\Local\Temp\7964.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\79B2.tmp"C:\Users\Admin\AppData\Local\Temp\79B2.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\79F1.tmp"C:\Users\Admin\AppData\Local\Temp\79F1.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\7A3F.tmp"C:\Users\Admin\AppData\Local\Temp\7A3F.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\7A9C.tmp"C:\Users\Admin\AppData\Local\Temp\7A9C.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\7AEA.tmp"C:\Users\Admin\AppData\Local\Temp\7AEA.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\7B29.tmp"C:\Users\Admin\AppData\Local\Temp\7B29.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\7B77.tmp"C:\Users\Admin\AppData\Local\Temp\7B77.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\7BC5.tmp"C:\Users\Admin\AppData\Local\Temp\7BC5.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\7C13.tmp"C:\Users\Admin\AppData\Local\Temp\7C13.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\7C51.tmp"C:\Users\Admin\AppData\Local\Temp\7C51.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\7C9F.tmp"C:\Users\Admin\AppData\Local\Temp\7C9F.tmp"65⤵
- Executes dropped EXE
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\7CDD.tmp"C:\Users\Admin\AppData\Local\Temp\7CDD.tmp"66⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\7D2B.tmp"C:\Users\Admin\AppData\Local\Temp\7D2B.tmp"67⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\7D6A.tmp"C:\Users\Admin\AppData\Local\Temp\7D6A.tmp"68⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\7DB8.tmp"C:\Users\Admin\AppData\Local\Temp\7DB8.tmp"69⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\7E06.tmp"C:\Users\Admin\AppData\Local\Temp\7E06.tmp"70⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\7E54.tmp"C:\Users\Admin\AppData\Local\Temp\7E54.tmp"71⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\7EA2.tmp"C:\Users\Admin\AppData\Local\Temp\7EA2.tmp"72⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\7EF0.tmp"C:\Users\Admin\AppData\Local\Temp\7EF0.tmp"73⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\7F3E.tmp"C:\Users\Admin\AppData\Local\Temp\7F3E.tmp"74⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\7F7C.tmp"C:\Users\Admin\AppData\Local\Temp\7F7C.tmp"75⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\7FBB.tmp"C:\Users\Admin\AppData\Local\Temp\7FBB.tmp"76⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\7FF9.tmp"C:\Users\Admin\AppData\Local\Temp\7FF9.tmp"77⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\8037.tmp"C:\Users\Admin\AppData\Local\Temp\8037.tmp"78⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\8076.tmp"C:\Users\Admin\AppData\Local\Temp\8076.tmp"79⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\80C4.tmp"C:\Users\Admin\AppData\Local\Temp\80C4.tmp"80⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\8112.tmp"C:\Users\Admin\AppData\Local\Temp\8112.tmp"81⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\8150.tmp"C:\Users\Admin\AppData\Local\Temp\8150.tmp"82⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\819E.tmp"C:\Users\Admin\AppData\Local\Temp\819E.tmp"83⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\81EC.tmp"C:\Users\Admin\AppData\Local\Temp\81EC.tmp"84⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\822B.tmp"C:\Users\Admin\AppData\Local\Temp\822B.tmp"85⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\8269.tmp"C:\Users\Admin\AppData\Local\Temp\8269.tmp"86⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\82A7.tmp"C:\Users\Admin\AppData\Local\Temp\82A7.tmp"87⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\82F5.tmp"C:\Users\Admin\AppData\Local\Temp\82F5.tmp"88⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\8343.tmp"C:\Users\Admin\AppData\Local\Temp\8343.tmp"89⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\8391.tmp"C:\Users\Admin\AppData\Local\Temp\8391.tmp"90⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\83D0.tmp"C:\Users\Admin\AppData\Local\Temp\83D0.tmp"91⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\840E.tmp"C:\Users\Admin\AppData\Local\Temp\840E.tmp"92⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\844D.tmp"C:\Users\Admin\AppData\Local\Temp\844D.tmp"93⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\848B.tmp"C:\Users\Admin\AppData\Local\Temp\848B.tmp"94⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\84C9.tmp"C:\Users\Admin\AppData\Local\Temp\84C9.tmp"95⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\8508.tmp"C:\Users\Admin\AppData\Local\Temp\8508.tmp"96⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\8546.tmp"C:\Users\Admin\AppData\Local\Temp\8546.tmp"97⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\85A4.tmp"C:\Users\Admin\AppData\Local\Temp\85A4.tmp"98⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\85F2.tmp"C:\Users\Admin\AppData\Local\Temp\85F2.tmp"99⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\8640.tmp"C:\Users\Admin\AppData\Local\Temp\8640.tmp"100⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\868E.tmp"C:\Users\Admin\AppData\Local\Temp\868E.tmp"101⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\86CC.tmp"C:\Users\Admin\AppData\Local\Temp\86CC.tmp"102⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\870B.tmp"C:\Users\Admin\AppData\Local\Temp\870B.tmp"103⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\8759.tmp"C:\Users\Admin\AppData\Local\Temp\8759.tmp"104⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\87A7.tmp"C:\Users\Admin\AppData\Local\Temp\87A7.tmp"105⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\87F5.tmp"C:\Users\Admin\AppData\Local\Temp\87F5.tmp"106⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\8852.tmp"C:\Users\Admin\AppData\Local\Temp\8852.tmp"107⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\88B0.tmp"C:\Users\Admin\AppData\Local\Temp\88B0.tmp"108⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\88FE.tmp"C:\Users\Admin\AppData\Local\Temp\88FE.tmp"109⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\893C.tmp"C:\Users\Admin\AppData\Local\Temp\893C.tmp"110⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\89D8.tmp"C:\Users\Admin\AppData\Local\Temp\89D8.tmp"111⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\8A26.tmp"C:\Users\Admin\AppData\Local\Temp\8A26.tmp"112⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\8A65.tmp"C:\Users\Admin\AppData\Local\Temp\8A65.tmp"113⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\8AA3.tmp"C:\Users\Admin\AppData\Local\Temp\8AA3.tmp"114⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\8AF1.tmp"C:\Users\Admin\AppData\Local\Temp\8AF1.tmp"115⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\8B4F.tmp"C:\Users\Admin\AppData\Local\Temp\8B4F.tmp"116⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\8B9D.tmp"C:\Users\Admin\AppData\Local\Temp\8B9D.tmp"117⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\8BEB.tmp"C:\Users\Admin\AppData\Local\Temp\8BEB.tmp"118⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\8C39.tmp"C:\Users\Admin\AppData\Local\Temp\8C39.tmp"119⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\8C87.tmp"C:\Users\Admin\AppData\Local\Temp\8C87.tmp"120⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\8CD5.tmp"C:\Users\Admin\AppData\Local\Temp\8CD5.tmp"121⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\8D13.tmp"C:\Users\Admin\AppData\Local\Temp\8D13.tmp"122⤵PID:2752
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-