Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 04:05
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-19_ba5483b11eff2a0e6e80bbec3ef05e05_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-19_ba5483b11eff2a0e6e80bbec3ef05e05_mafia.exe
Resource
win10v2004-20240910-en
General
-
Target
2024-09-19_ba5483b11eff2a0e6e80bbec3ef05e05_mafia.exe
-
Size
536KB
-
MD5
ba5483b11eff2a0e6e80bbec3ef05e05
-
SHA1
153e8e40ffc4f3626b26cf52c543034be2754dc6
-
SHA256
9123c175a009bc98c152758906253e6174f463c63f2222e4a8dc1c699e45c052
-
SHA512
b2cb7b7187906b0f61c73aa2bc7bf387f50dc8075b2270dec099610c922dc08e3d8236da26348c9b1caa1c235c54044b2105ba43de074dcb0ca78d15276321f8
-
SSDEEP
12288:wU5rCOTeiUdXrP15DGRRghK0vezex8oCl7fIZxVJ0ZT9:wUQOJUdXn1hlveiWocfIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2836 6C98.tmp 2700 6D25.tmp 2812 6D73.tmp 2632 6DC1.tmp 2604 6E0F.tmp 2172 6E5D.tmp 536 6EAB.tmp 580 6EF9.tmp 2964 6F47.tmp 2480 6F95.tmp 2132 6FF2.tmp 2824 7050.tmp 2880 70AD.tmp 1824 70FB.tmp 2928 7149.tmp 2056 7197.tmp 352 71E5.tmp 1660 7253.tmp 2236 72B0.tmp 2484 72FE.tmp 2440 735C.tmp 1464 73B9.tmp 1508 7407.tmp 408 7465.tmp 2080 74B3.tmp 1976 7501.tmp 1300 754F.tmp 840 759D.tmp 1776 75EB.tmp 2032 7649.tmp 1720 76A6.tmp 952 76F4.tmp 560 7752.tmp 2000 77A0.tmp 2100 77EE.tmp 1220 783C.tmp 1968 788A.tmp 2396 78E7.tmp 884 7926.tmp 2740 7983.tmp 3000 79E1.tmp 2988 7A2F.tmp 2136 7A8D.tmp 2612 7ADB.tmp 3060 7B29.tmp 264 7B86.tmp 2656 7BD4.tmp 2320 7C22.tmp 1924 7C70.tmp 1896 7CCE.tmp 1832 7D0C.tmp 2944 7D4B.tmp 2556 7D89.tmp 400 7DD7.tmp 836 7E15.tmp 1592 7E63.tmp 1840 7EA2.tmp 2412 7EE0.tmp 1480 7F1F.tmp 2956 7F6D.tmp 2568 7FCA.tmp 1072 8018.tmp 3012 8066.tmp 1992 80A5.tmp -
Loads dropped DLL 64 IoCs
pid Process 2848 2024-09-19_ba5483b11eff2a0e6e80bbec3ef05e05_mafia.exe 2836 6C98.tmp 2700 6D25.tmp 2812 6D73.tmp 2632 6DC1.tmp 2604 6E0F.tmp 2172 6E5D.tmp 536 6EAB.tmp 580 6EF9.tmp 2964 6F47.tmp 2480 6F95.tmp 2132 6FF2.tmp 2824 7050.tmp 2880 70AD.tmp 1824 70FB.tmp 2928 7149.tmp 2056 7197.tmp 352 71E5.tmp 1660 7253.tmp 2236 72B0.tmp 2484 72FE.tmp 2440 735C.tmp 1464 73B9.tmp 1508 7407.tmp 408 7465.tmp 2080 74B3.tmp 1976 7501.tmp 1300 754F.tmp 840 759D.tmp 1776 75EB.tmp 2032 7649.tmp 1720 76A6.tmp 952 76F4.tmp 560 7752.tmp 2000 77A0.tmp 2100 77EE.tmp 1220 783C.tmp 1968 788A.tmp 2396 78E7.tmp 884 7926.tmp 2740 7983.tmp 3000 79E1.tmp 2988 7A2F.tmp 2136 7A8D.tmp 2612 7ADB.tmp 3060 7B29.tmp 264 7B86.tmp 2656 7BD4.tmp 2320 7C22.tmp 1924 7C70.tmp 1896 7CCE.tmp 1832 7D0C.tmp 2944 7D4B.tmp 2556 7D89.tmp 400 7DD7.tmp 836 7E15.tmp 1592 7E63.tmp 1840 7EA2.tmp 2412 7EE0.tmp 1480 7F1F.tmp 2956 7F6D.tmp 2568 7FCA.tmp 1072 8018.tmp 3012 8066.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B922.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1555.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 422E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D3D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B683.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1AF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3350.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DD5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5689.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9962.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 657.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F4B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F383.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 164E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F42.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 783C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E63A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F576.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E48.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C88D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2848 wrote to memory of 2836 2848 2024-09-19_ba5483b11eff2a0e6e80bbec3ef05e05_mafia.exe 31 PID 2848 wrote to memory of 2836 2848 2024-09-19_ba5483b11eff2a0e6e80bbec3ef05e05_mafia.exe 31 PID 2848 wrote to memory of 2836 2848 2024-09-19_ba5483b11eff2a0e6e80bbec3ef05e05_mafia.exe 31 PID 2848 wrote to memory of 2836 2848 2024-09-19_ba5483b11eff2a0e6e80bbec3ef05e05_mafia.exe 31 PID 2836 wrote to memory of 2700 2836 6C98.tmp 32 PID 2836 wrote to memory of 2700 2836 6C98.tmp 32 PID 2836 wrote to memory of 2700 2836 6C98.tmp 32 PID 2836 wrote to memory of 2700 2836 6C98.tmp 32 PID 2700 wrote to memory of 2812 2700 6D25.tmp 33 PID 2700 wrote to memory of 2812 2700 6D25.tmp 33 PID 2700 wrote to memory of 2812 2700 6D25.tmp 33 PID 2700 wrote to memory of 2812 2700 6D25.tmp 33 PID 2812 wrote to memory of 2632 2812 6D73.tmp 34 PID 2812 wrote to memory of 2632 2812 6D73.tmp 34 PID 2812 wrote to memory of 2632 2812 6D73.tmp 34 PID 2812 wrote to memory of 2632 2812 6D73.tmp 34 PID 2632 wrote to memory of 2604 2632 6DC1.tmp 35 PID 2632 wrote to memory of 2604 2632 6DC1.tmp 35 PID 2632 wrote to memory of 2604 2632 6DC1.tmp 35 PID 2632 wrote to memory of 2604 2632 6DC1.tmp 35 PID 2604 wrote to memory of 2172 2604 6E0F.tmp 36 PID 2604 wrote to memory of 2172 2604 6E0F.tmp 36 PID 2604 wrote to memory of 2172 2604 6E0F.tmp 36 PID 2604 wrote to memory of 2172 2604 6E0F.tmp 36 PID 2172 wrote to memory of 536 2172 6E5D.tmp 37 PID 2172 wrote to memory of 536 2172 6E5D.tmp 37 PID 2172 wrote to memory of 536 2172 6E5D.tmp 37 PID 2172 wrote to memory of 536 2172 6E5D.tmp 37 PID 536 wrote to memory of 580 536 6EAB.tmp 38 PID 536 wrote to memory of 580 536 6EAB.tmp 38 PID 536 wrote to memory of 580 536 6EAB.tmp 38 PID 536 wrote to memory of 580 536 6EAB.tmp 38 PID 580 wrote to memory of 2964 580 6EF9.tmp 39 PID 580 wrote to memory of 2964 580 6EF9.tmp 39 PID 580 wrote to memory of 2964 580 6EF9.tmp 39 PID 580 wrote to memory of 2964 580 6EF9.tmp 39 PID 2964 wrote to memory of 2480 2964 6F47.tmp 40 PID 2964 wrote to memory of 2480 2964 6F47.tmp 40 PID 2964 wrote to memory of 2480 2964 6F47.tmp 40 PID 2964 wrote to memory of 2480 2964 6F47.tmp 40 PID 2480 wrote to memory of 2132 2480 6F95.tmp 41 PID 2480 wrote to memory of 2132 2480 6F95.tmp 41 PID 2480 wrote to memory of 2132 2480 6F95.tmp 41 PID 2480 wrote to memory of 2132 2480 6F95.tmp 41 PID 2132 wrote to memory of 2824 2132 6FF2.tmp 42 PID 2132 wrote to memory of 2824 2132 6FF2.tmp 42 PID 2132 wrote to memory of 2824 2132 6FF2.tmp 42 PID 2132 wrote to memory of 2824 2132 6FF2.tmp 42 PID 2824 wrote to memory of 2880 2824 7050.tmp 43 PID 2824 wrote to memory of 2880 2824 7050.tmp 43 PID 2824 wrote to memory of 2880 2824 7050.tmp 43 PID 2824 wrote to memory of 2880 2824 7050.tmp 43 PID 2880 wrote to memory of 1824 2880 70AD.tmp 44 PID 2880 wrote to memory of 1824 2880 70AD.tmp 44 PID 2880 wrote to memory of 1824 2880 70AD.tmp 44 PID 2880 wrote to memory of 1824 2880 70AD.tmp 44 PID 1824 wrote to memory of 2928 1824 70FB.tmp 45 PID 1824 wrote to memory of 2928 1824 70FB.tmp 45 PID 1824 wrote to memory of 2928 1824 70FB.tmp 45 PID 1824 wrote to memory of 2928 1824 70FB.tmp 45 PID 2928 wrote to memory of 2056 2928 7149.tmp 46 PID 2928 wrote to memory of 2056 2928 7149.tmp 46 PID 2928 wrote to memory of 2056 2928 7149.tmp 46 PID 2928 wrote to memory of 2056 2928 7149.tmp 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_ba5483b11eff2a0e6e80bbec3ef05e05_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_ba5483b11eff2a0e6e80bbec3ef05e05_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\6C98.tmp"C:\Users\Admin\AppData\Local\Temp\6C98.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\6D25.tmp"C:\Users\Admin\AppData\Local\Temp\6D25.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\6D73.tmp"C:\Users\Admin\AppData\Local\Temp\6D73.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\6DC1.tmp"C:\Users\Admin\AppData\Local\Temp\6DC1.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\6E0F.tmp"C:\Users\Admin\AppData\Local\Temp\6E0F.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\6E5D.tmp"C:\Users\Admin\AppData\Local\Temp\6E5D.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\6EAB.tmp"C:\Users\Admin\AppData\Local\Temp\6EAB.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Users\Admin\AppData\Local\Temp\6EF9.tmp"C:\Users\Admin\AppData\Local\Temp\6EF9.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:580 -
C:\Users\Admin\AppData\Local\Temp\6F47.tmp"C:\Users\Admin\AppData\Local\Temp\6F47.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\6F95.tmp"C:\Users\Admin\AppData\Local\Temp\6F95.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\6FF2.tmp"C:\Users\Admin\AppData\Local\Temp\6FF2.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\7050.tmp"C:\Users\Admin\AppData\Local\Temp\7050.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\70AD.tmp"C:\Users\Admin\AppData\Local\Temp\70AD.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\70FB.tmp"C:\Users\Admin\AppData\Local\Temp\70FB.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\7149.tmp"C:\Users\Admin\AppData\Local\Temp\7149.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\7197.tmp"C:\Users\Admin\AppData\Local\Temp\7197.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\71E5.tmp"C:\Users\Admin\AppData\Local\Temp\71E5.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:352 -
C:\Users\Admin\AppData\Local\Temp\7253.tmp"C:\Users\Admin\AppData\Local\Temp\7253.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\72B0.tmp"C:\Users\Admin\AppData\Local\Temp\72B0.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\72FE.tmp"C:\Users\Admin\AppData\Local\Temp\72FE.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\735C.tmp"C:\Users\Admin\AppData\Local\Temp\735C.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\73B9.tmp"C:\Users\Admin\AppData\Local\Temp\73B9.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\7465.tmp"C:\Users\Admin\AppData\Local\Temp\7465.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:408 -
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\7501.tmp"C:\Users\Admin\AppData\Local\Temp\7501.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\754F.tmp"C:\Users\Admin\AppData\Local\Temp\754F.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\759D.tmp"C:\Users\Admin\AppData\Local\Temp\759D.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:840 -
C:\Users\Admin\AppData\Local\Temp\75EB.tmp"C:\Users\Admin\AppData\Local\Temp\75EB.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\7649.tmp"C:\Users\Admin\AppData\Local\Temp\7649.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\76A6.tmp"C:\Users\Admin\AppData\Local\Temp\76A6.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\76F4.tmp"C:\Users\Admin\AppData\Local\Temp\76F4.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:952 -
C:\Users\Admin\AppData\Local\Temp\7752.tmp"C:\Users\Admin\AppData\Local\Temp\7752.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:560 -
C:\Users\Admin\AppData\Local\Temp\77A0.tmp"C:\Users\Admin\AppData\Local\Temp\77A0.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\77EE.tmp"C:\Users\Admin\AppData\Local\Temp\77EE.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\783C.tmp"C:\Users\Admin\AppData\Local\Temp\783C.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\788A.tmp"C:\Users\Admin\AppData\Local\Temp\788A.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\78E7.tmp"C:\Users\Admin\AppData\Local\Temp\78E7.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\7926.tmp"C:\Users\Admin\AppData\Local\Temp\7926.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:884 -
C:\Users\Admin\AppData\Local\Temp\7983.tmp"C:\Users\Admin\AppData\Local\Temp\7983.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\79E1.tmp"C:\Users\Admin\AppData\Local\Temp\79E1.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\7A2F.tmp"C:\Users\Admin\AppData\Local\Temp\7A2F.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\7A8D.tmp"C:\Users\Admin\AppData\Local\Temp\7A8D.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\7ADB.tmp"C:\Users\Admin\AppData\Local\Temp\7ADB.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\7B29.tmp"C:\Users\Admin\AppData\Local\Temp\7B29.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\7B86.tmp"C:\Users\Admin\AppData\Local\Temp\7B86.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:264 -
C:\Users\Admin\AppData\Local\Temp\7BD4.tmp"C:\Users\Admin\AppData\Local\Temp\7BD4.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\7C22.tmp"C:\Users\Admin\AppData\Local\Temp\7C22.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\7C70.tmp"C:\Users\Admin\AppData\Local\Temp\7C70.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\7CCE.tmp"C:\Users\Admin\AppData\Local\Temp\7CCE.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\7D0C.tmp"C:\Users\Admin\AppData\Local\Temp\7D0C.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\7D4B.tmp"C:\Users\Admin\AppData\Local\Temp\7D4B.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\7D89.tmp"C:\Users\Admin\AppData\Local\Temp\7D89.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\7DD7.tmp"C:\Users\Admin\AppData\Local\Temp\7DD7.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:400 -
C:\Users\Admin\AppData\Local\Temp\7E15.tmp"C:\Users\Admin\AppData\Local\Temp\7E15.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:836 -
C:\Users\Admin\AppData\Local\Temp\7E63.tmp"C:\Users\Admin\AppData\Local\Temp\7E63.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\7EA2.tmp"C:\Users\Admin\AppData\Local\Temp\7EA2.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\7EE0.tmp"C:\Users\Admin\AppData\Local\Temp\7EE0.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\7F1F.tmp"C:\Users\Admin\AppData\Local\Temp\7F1F.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\7F6D.tmp"C:\Users\Admin\AppData\Local\Temp\7F6D.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\7FCA.tmp"C:\Users\Admin\AppData\Local\Temp\7FCA.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\8018.tmp"C:\Users\Admin\AppData\Local\Temp\8018.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\8066.tmp"C:\Users\Admin\AppData\Local\Temp\8066.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\80A5.tmp"C:\Users\Admin\AppData\Local\Temp\80A5.tmp"65⤵
- Executes dropped EXE
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\80E3.tmp"C:\Users\Admin\AppData\Local\Temp\80E3.tmp"66⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\8121.tmp"C:\Users\Admin\AppData\Local\Temp\8121.tmp"67⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\817F.tmp"C:\Users\Admin\AppData\Local\Temp\817F.tmp"68⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\81BD.tmp"C:\Users\Admin\AppData\Local\Temp\81BD.tmp"69⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\81FC.tmp"C:\Users\Admin\AppData\Local\Temp\81FC.tmp"70⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\823A.tmp"C:\Users\Admin\AppData\Local\Temp\823A.tmp"71⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\8279.tmp"C:\Users\Admin\AppData\Local\Temp\8279.tmp"72⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\82B7.tmp"C:\Users\Admin\AppData\Local\Temp\82B7.tmp"73⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\82F5.tmp"C:\Users\Admin\AppData\Local\Temp\82F5.tmp"74⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\8343.tmp"C:\Users\Admin\AppData\Local\Temp\8343.tmp"75⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\8382.tmp"C:\Users\Admin\AppData\Local\Temp\8382.tmp"76⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\83C0.tmp"C:\Users\Admin\AppData\Local\Temp\83C0.tmp"77⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\83FF.tmp"C:\Users\Admin\AppData\Local\Temp\83FF.tmp"78⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\843D.tmp"C:\Users\Admin\AppData\Local\Temp\843D.tmp"79⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\847B.tmp"C:\Users\Admin\AppData\Local\Temp\847B.tmp"80⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\84C9.tmp"C:\Users\Admin\AppData\Local\Temp\84C9.tmp"81⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\8508.tmp"C:\Users\Admin\AppData\Local\Temp\8508.tmp"82⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\8546.tmp"C:\Users\Admin\AppData\Local\Temp\8546.tmp"83⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\8585.tmp"C:\Users\Admin\AppData\Local\Temp\8585.tmp"84⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\85C3.tmp"C:\Users\Admin\AppData\Local\Temp\85C3.tmp"85⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\8611.tmp"C:\Users\Admin\AppData\Local\Temp\8611.tmp"86⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\865F.tmp"C:\Users\Admin\AppData\Local\Temp\865F.tmp"87⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\869D.tmp"C:\Users\Admin\AppData\Local\Temp\869D.tmp"88⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\86DC.tmp"C:\Users\Admin\AppData\Local\Temp\86DC.tmp"89⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\871A.tmp"C:\Users\Admin\AppData\Local\Temp\871A.tmp"90⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\8759.tmp"C:\Users\Admin\AppData\Local\Temp\8759.tmp"91⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\8797.tmp"C:\Users\Admin\AppData\Local\Temp\8797.tmp"92⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\87E5.tmp"C:\Users\Admin\AppData\Local\Temp\87E5.tmp"93⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\8823.tmp"C:\Users\Admin\AppData\Local\Temp\8823.tmp"94⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\8862.tmp"C:\Users\Admin\AppData\Local\Temp\8862.tmp"95⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\88A0.tmp"C:\Users\Admin\AppData\Local\Temp\88A0.tmp"96⤵PID:608
-
C:\Users\Admin\AppData\Local\Temp\88DF.tmp"C:\Users\Admin\AppData\Local\Temp\88DF.tmp"97⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\892D.tmp"C:\Users\Admin\AppData\Local\Temp\892D.tmp"98⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\896B.tmp"C:\Users\Admin\AppData\Local\Temp\896B.tmp"99⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\89A9.tmp"C:\Users\Admin\AppData\Local\Temp\89A9.tmp"100⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\89E8.tmp"C:\Users\Admin\AppData\Local\Temp\89E8.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\8A26.tmp"C:\Users\Admin\AppData\Local\Temp\8A26.tmp"102⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\8A65.tmp"C:\Users\Admin\AppData\Local\Temp\8A65.tmp"103⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\8AA3.tmp"C:\Users\Admin\AppData\Local\Temp\8AA3.tmp"104⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\8AF1.tmp"C:\Users\Admin\AppData\Local\Temp\8AF1.tmp"105⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\8B2F.tmp"C:\Users\Admin\AppData\Local\Temp\8B2F.tmp"106⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\8B6E.tmp"C:\Users\Admin\AppData\Local\Temp\8B6E.tmp"107⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\8BAC.tmp"C:\Users\Admin\AppData\Local\Temp\8BAC.tmp"108⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\8BEB.tmp"C:\Users\Admin\AppData\Local\Temp\8BEB.tmp"109⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\8C29.tmp"C:\Users\Admin\AppData\Local\Temp\8C29.tmp"110⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\8C67.tmp"C:\Users\Admin\AppData\Local\Temp\8C67.tmp"111⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\8CA6.tmp"C:\Users\Admin\AppData\Local\Temp\8CA6.tmp"112⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\8CE4.tmp"C:\Users\Admin\AppData\Local\Temp\8CE4.tmp"113⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\8D23.tmp"C:\Users\Admin\AppData\Local\Temp\8D23.tmp"114⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\8D61.tmp"C:\Users\Admin\AppData\Local\Temp\8D61.tmp"115⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\8DAF.tmp"C:\Users\Admin\AppData\Local\Temp\8DAF.tmp"116⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\8DED.tmp"C:\Users\Admin\AppData\Local\Temp\8DED.tmp"117⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\8E2C.tmp"C:\Users\Admin\AppData\Local\Temp\8E2C.tmp"118⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\8E7A.tmp"C:\Users\Admin\AppData\Local\Temp\8E7A.tmp"119⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\8EB8.tmp"C:\Users\Admin\AppData\Local\Temp\8EB8.tmp"120⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\8EF7.tmp"C:\Users\Admin\AppData\Local\Temp\8EF7.tmp"121⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\8F35.tmp"C:\Users\Admin\AppData\Local\Temp\8F35.tmp"122⤵PID:1620
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-