Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
02/10/2024, 03:00
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-02_d6b0135a41bb8f625e9fbd08efa96e85_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-10-02_d6b0135a41bb8f625e9fbd08efa96e85_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-10-02_d6b0135a41bb8f625e9fbd08efa96e85_mafia.exe
-
Size
486KB
-
MD5
d6b0135a41bb8f625e9fbd08efa96e85
-
SHA1
1859c66f21e2fe97071fae80f959701587e1fd00
-
SHA256
cbd03d2a44f0c56312739edf93184466a5d2621389c3391f8eb77b0136af1b3c
-
SHA512
5e5721756edd5153257586863010a47e6b255cb424e3a9260c97870789be9ff2e9d3470be67130e7580f74df2b69c199fcc2d66fd41691f708a17bcb0193d656
-
SSDEEP
12288:/U5rCOTeiDl+4MbdEDLoA4z+JFnM3RcdxYNZ:/UQOJDUzEDkA4zSFMhkCN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2160 580F.tmp 2700 585D.tmp 2792 58BB.tmp 2844 5937.tmp 2988 5995.tmp 2928 5A02.tmp 2688 5A60.tmp 2548 5ACD.tmp 2672 5B2B.tmp 2344 5B88.tmp 2968 5BF5.tmp 2908 5C63.tmp 1228 5CD0.tmp 2532 5D3D.tmp 1892 5DAA.tmp 2912 5E17.tmp 700 5E85.tmp 2796 5EE2.tmp 2888 5F4F.tmp 2904 5FBD.tmp 2476 601A.tmp 2916 6087.tmp 2112 60E5.tmp 776 6133.tmp 2356 6171.tmp 2192 61B0.tmp 2196 61EE.tmp 2100 622D.tmp 1492 626B.tmp 2184 62A9.tmp 1884 62E8.tmp 1320 6326.tmp 1824 6365.tmp 844 63A3.tmp 1384 63E1.tmp 568 6420.tmp 2292 645E.tmp 1060 649D.tmp 1564 64DB.tmp 1244 6519.tmp 1224 6567.tmp 1604 65B5.tmp 288 6603.tmp 1904 6642.tmp 764 6680.tmp 2528 66BF.tmp 1912 66FD.tmp 1728 673B.tmp 1064 677A.tmp 1008 67C8.tmp 1992 6806.tmp 3060 6845.tmp 2168 6883.tmp 1588 68C1.tmp 1616 6900.tmp 2656 693E.tmp 2780 698C.tmp 2704 69DA.tmp 2676 6A28.tmp 2392 6A76.tmp 2712 6AC4.tmp 2588 6B03.tmp 2720 6B41.tmp 2664 6B8F.tmp -
Loads dropped DLL 64 IoCs
pid Process 1960 2024-10-02_d6b0135a41bb8f625e9fbd08efa96e85_mafia.exe 2160 580F.tmp 2700 585D.tmp 2792 58BB.tmp 2844 5937.tmp 2988 5995.tmp 2928 5A02.tmp 2688 5A60.tmp 2548 5ACD.tmp 2672 5B2B.tmp 2344 5B88.tmp 2968 5BF5.tmp 2908 5C63.tmp 1228 5CD0.tmp 2532 5D3D.tmp 1892 5DAA.tmp 2912 5E17.tmp 700 5E85.tmp 2796 5EE2.tmp 2888 5F4F.tmp 2904 5FBD.tmp 2476 601A.tmp 2916 6087.tmp 2112 60E5.tmp 776 6133.tmp 2356 6171.tmp 2192 61B0.tmp 2196 61EE.tmp 2100 622D.tmp 1492 626B.tmp 2184 62A9.tmp 1884 62E8.tmp 1320 6326.tmp 1824 6365.tmp 844 63A3.tmp 1384 63E1.tmp 568 6420.tmp 2292 645E.tmp 1060 649D.tmp 1564 64DB.tmp 1244 6519.tmp 1224 6567.tmp 1604 65B5.tmp 288 6603.tmp 1904 6642.tmp 764 6680.tmp 2528 66BF.tmp 1912 66FD.tmp 1728 673B.tmp 1064 677A.tmp 1008 67C8.tmp 1992 6806.tmp 3060 6845.tmp 2168 6883.tmp 1588 68C1.tmp 1616 6900.tmp 2656 693E.tmp 2780 698C.tmp 2704 69DA.tmp 2676 6A28.tmp 2392 6A76.tmp 2712 6AC4.tmp 2588 6B03.tmp 2720 6B41.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E273.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 786B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 820B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3830.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CD0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3025.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B616.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7926.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D51A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C2D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 731D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DCE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5570.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D75C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1960 wrote to memory of 2160 1960 2024-10-02_d6b0135a41bb8f625e9fbd08efa96e85_mafia.exe 30 PID 1960 wrote to memory of 2160 1960 2024-10-02_d6b0135a41bb8f625e9fbd08efa96e85_mafia.exe 30 PID 1960 wrote to memory of 2160 1960 2024-10-02_d6b0135a41bb8f625e9fbd08efa96e85_mafia.exe 30 PID 1960 wrote to memory of 2160 1960 2024-10-02_d6b0135a41bb8f625e9fbd08efa96e85_mafia.exe 30 PID 2160 wrote to memory of 2700 2160 580F.tmp 31 PID 2160 wrote to memory of 2700 2160 580F.tmp 31 PID 2160 wrote to memory of 2700 2160 580F.tmp 31 PID 2160 wrote to memory of 2700 2160 580F.tmp 31 PID 2700 wrote to memory of 2792 2700 585D.tmp 32 PID 2700 wrote to memory of 2792 2700 585D.tmp 32 PID 2700 wrote to memory of 2792 2700 585D.tmp 32 PID 2700 wrote to memory of 2792 2700 585D.tmp 32 PID 2792 wrote to memory of 2844 2792 58BB.tmp 33 PID 2792 wrote to memory of 2844 2792 58BB.tmp 33 PID 2792 wrote to memory of 2844 2792 58BB.tmp 33 PID 2792 wrote to memory of 2844 2792 58BB.tmp 33 PID 2844 wrote to memory of 2988 2844 5937.tmp 34 PID 2844 wrote to memory of 2988 2844 5937.tmp 34 PID 2844 wrote to memory of 2988 2844 5937.tmp 34 PID 2844 wrote to memory of 2988 2844 5937.tmp 34 PID 2988 wrote to memory of 2928 2988 5995.tmp 35 PID 2988 wrote to memory of 2928 2988 5995.tmp 35 PID 2988 wrote to memory of 2928 2988 5995.tmp 35 PID 2988 wrote to memory of 2928 2988 5995.tmp 35 PID 2928 wrote to memory of 2688 2928 5A02.tmp 36 PID 2928 wrote to memory of 2688 2928 5A02.tmp 36 PID 2928 wrote to memory of 2688 2928 5A02.tmp 36 PID 2928 wrote to memory of 2688 2928 5A02.tmp 36 PID 2688 wrote to memory of 2548 2688 5A60.tmp 37 PID 2688 wrote to memory of 2548 2688 5A60.tmp 37 PID 2688 wrote to memory of 2548 2688 5A60.tmp 37 PID 2688 wrote to memory of 2548 2688 5A60.tmp 37 PID 2548 wrote to memory of 2672 2548 5ACD.tmp 38 PID 2548 wrote to memory of 2672 2548 5ACD.tmp 38 PID 2548 wrote to memory of 2672 2548 5ACD.tmp 38 PID 2548 wrote to memory of 2672 2548 5ACD.tmp 38 PID 2672 wrote to memory of 2344 2672 5B2B.tmp 39 PID 2672 wrote to memory of 2344 2672 5B2B.tmp 39 PID 2672 wrote to memory of 2344 2672 5B2B.tmp 39 PID 2672 wrote to memory of 2344 2672 5B2B.tmp 39 PID 2344 wrote to memory of 2968 2344 5B88.tmp 40 PID 2344 wrote to memory of 2968 2344 5B88.tmp 40 PID 2344 wrote to memory of 2968 2344 5B88.tmp 40 PID 2344 wrote to memory of 2968 2344 5B88.tmp 40 PID 2968 wrote to memory of 2908 2968 5BF5.tmp 41 PID 2968 wrote to memory of 2908 2968 5BF5.tmp 41 PID 2968 wrote to memory of 2908 2968 5BF5.tmp 41 PID 2968 wrote to memory of 2908 2968 5BF5.tmp 41 PID 2908 wrote to memory of 1228 2908 5C63.tmp 42 PID 2908 wrote to memory of 1228 2908 5C63.tmp 42 PID 2908 wrote to memory of 1228 2908 5C63.tmp 42 PID 2908 wrote to memory of 1228 2908 5C63.tmp 42 PID 1228 wrote to memory of 2532 1228 5CD0.tmp 43 PID 1228 wrote to memory of 2532 1228 5CD0.tmp 43 PID 1228 wrote to memory of 2532 1228 5CD0.tmp 43 PID 1228 wrote to memory of 2532 1228 5CD0.tmp 43 PID 2532 wrote to memory of 1892 2532 5D3D.tmp 44 PID 2532 wrote to memory of 1892 2532 5D3D.tmp 44 PID 2532 wrote to memory of 1892 2532 5D3D.tmp 44 PID 2532 wrote to memory of 1892 2532 5D3D.tmp 44 PID 1892 wrote to memory of 2912 1892 5DAA.tmp 45 PID 1892 wrote to memory of 2912 1892 5DAA.tmp 45 PID 1892 wrote to memory of 2912 1892 5DAA.tmp 45 PID 1892 wrote to memory of 2912 1892 5DAA.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-02_d6b0135a41bb8f625e9fbd08efa96e85_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-02_d6b0135a41bb8f625e9fbd08efa96e85_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\580F.tmp"C:\Users\Admin\AppData\Local\Temp\580F.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\585D.tmp"C:\Users\Admin\AppData\Local\Temp\585D.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\58BB.tmp"C:\Users\Admin\AppData\Local\Temp\58BB.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\5937.tmp"C:\Users\Admin\AppData\Local\Temp\5937.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\5995.tmp"C:\Users\Admin\AppData\Local\Temp\5995.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\5A02.tmp"C:\Users\Admin\AppData\Local\Temp\5A02.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\5A60.tmp"C:\Users\Admin\AppData\Local\Temp\5A60.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\5ACD.tmp"C:\Users\Admin\AppData\Local\Temp\5ACD.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\5B2B.tmp"C:\Users\Admin\AppData\Local\Temp\5B2B.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\5B88.tmp"C:\Users\Admin\AppData\Local\Temp\5B88.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\5BF5.tmp"C:\Users\Admin\AppData\Local\Temp\5BF5.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\5C63.tmp"C:\Users\Admin\AppData\Local\Temp\5C63.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\5CD0.tmp"C:\Users\Admin\AppData\Local\Temp\5CD0.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\5D3D.tmp"C:\Users\Admin\AppData\Local\Temp\5D3D.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\5DAA.tmp"C:\Users\Admin\AppData\Local\Temp\5DAA.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\5E17.tmp"C:\Users\Admin\AppData\Local\Temp\5E17.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\5E85.tmp"C:\Users\Admin\AppData\Local\Temp\5E85.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:700 -
C:\Users\Admin\AppData\Local\Temp\5EE2.tmp"C:\Users\Admin\AppData\Local\Temp\5EE2.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\5F4F.tmp"C:\Users\Admin\AppData\Local\Temp\5F4F.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\5FBD.tmp"C:\Users\Admin\AppData\Local\Temp\5FBD.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\601A.tmp"C:\Users\Admin\AppData\Local\Temp\601A.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\6087.tmp"C:\Users\Admin\AppData\Local\Temp\6087.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\60E5.tmp"C:\Users\Admin\AppData\Local\Temp\60E5.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\6133.tmp"C:\Users\Admin\AppData\Local\Temp\6133.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:776 -
C:\Users\Admin\AppData\Local\Temp\6171.tmp"C:\Users\Admin\AppData\Local\Temp\6171.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\61B0.tmp"C:\Users\Admin\AppData\Local\Temp\61B0.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\61EE.tmp"C:\Users\Admin\AppData\Local\Temp\61EE.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\622D.tmp"C:\Users\Admin\AppData\Local\Temp\622D.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\626B.tmp"C:\Users\Admin\AppData\Local\Temp\626B.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\62A9.tmp"C:\Users\Admin\AppData\Local\Temp\62A9.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\62E8.tmp"C:\Users\Admin\AppData\Local\Temp\62E8.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\6326.tmp"C:\Users\Admin\AppData\Local\Temp\6326.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\6365.tmp"C:\Users\Admin\AppData\Local\Temp\6365.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\63A3.tmp"C:\Users\Admin\AppData\Local\Temp\63A3.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:844 -
C:\Users\Admin\AppData\Local\Temp\63E1.tmp"C:\Users\Admin\AppData\Local\Temp\63E1.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\6420.tmp"C:\Users\Admin\AppData\Local\Temp\6420.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:568 -
C:\Users\Admin\AppData\Local\Temp\645E.tmp"C:\Users\Admin\AppData\Local\Temp\645E.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\649D.tmp"C:\Users\Admin\AppData\Local\Temp\649D.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\64DB.tmp"C:\Users\Admin\AppData\Local\Temp\64DB.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\6519.tmp"C:\Users\Admin\AppData\Local\Temp\6519.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\6567.tmp"C:\Users\Admin\AppData\Local\Temp\6567.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\65B5.tmp"C:\Users\Admin\AppData\Local\Temp\65B5.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\6603.tmp"C:\Users\Admin\AppData\Local\Temp\6603.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:288 -
C:\Users\Admin\AppData\Local\Temp\6642.tmp"C:\Users\Admin\AppData\Local\Temp\6642.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\6680.tmp"C:\Users\Admin\AppData\Local\Temp\6680.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:764 -
C:\Users\Admin\AppData\Local\Temp\66BF.tmp"C:\Users\Admin\AppData\Local\Temp\66BF.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\66FD.tmp"C:\Users\Admin\AppData\Local\Temp\66FD.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\673B.tmp"C:\Users\Admin\AppData\Local\Temp\673B.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\677A.tmp"C:\Users\Admin\AppData\Local\Temp\677A.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\67C8.tmp"C:\Users\Admin\AppData\Local\Temp\67C8.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\6806.tmp"C:\Users\Admin\AppData\Local\Temp\6806.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\6845.tmp"C:\Users\Admin\AppData\Local\Temp\6845.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\6883.tmp"C:\Users\Admin\AppData\Local\Temp\6883.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\68C1.tmp"C:\Users\Admin\AppData\Local\Temp\68C1.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\6900.tmp"C:\Users\Admin\AppData\Local\Temp\6900.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\693E.tmp"C:\Users\Admin\AppData\Local\Temp\693E.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\698C.tmp"C:\Users\Admin\AppData\Local\Temp\698C.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\69DA.tmp"C:\Users\Admin\AppData\Local\Temp\69DA.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\6A28.tmp"C:\Users\Admin\AppData\Local\Temp\6A28.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\6A76.tmp"C:\Users\Admin\AppData\Local\Temp\6A76.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\6AC4.tmp"C:\Users\Admin\AppData\Local\Temp\6AC4.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\6B03.tmp"C:\Users\Admin\AppData\Local\Temp\6B03.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\6B41.tmp"C:\Users\Admin\AppData\Local\Temp\6B41.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\6B8F.tmp"C:\Users\Admin\AppData\Local\Temp\6B8F.tmp"65⤵
- Executes dropped EXE
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\6BCD.tmp"C:\Users\Admin\AppData\Local\Temp\6BCD.tmp"66⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\6C0C.tmp"C:\Users\Admin\AppData\Local\Temp\6C0C.tmp"67⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\6C4A.tmp"C:\Users\Admin\AppData\Local\Temp\6C4A.tmp"68⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\6C98.tmp"C:\Users\Admin\AppData\Local\Temp\6C98.tmp"69⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\6CD7.tmp"C:\Users\Admin\AppData\Local\Temp\6CD7.tmp"70⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\6D15.tmp"C:\Users\Admin\AppData\Local\Temp\6D15.tmp"71⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\6D53.tmp"C:\Users\Admin\AppData\Local\Temp\6D53.tmp"72⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\6D92.tmp"C:\Users\Admin\AppData\Local\Temp\6D92.tmp"73⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\6DD0.tmp"C:\Users\Admin\AppData\Local\Temp\6DD0.tmp"74⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\6E0F.tmp"C:\Users\Admin\AppData\Local\Temp\6E0F.tmp"75⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\6E4D.tmp"C:\Users\Admin\AppData\Local\Temp\6E4D.tmp"76⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\6E9B.tmp"C:\Users\Admin\AppData\Local\Temp\6E9B.tmp"77⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\6ED9.tmp"C:\Users\Admin\AppData\Local\Temp\6ED9.tmp"78⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\6F27.tmp"C:\Users\Admin\AppData\Local\Temp\6F27.tmp"79⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\6F66.tmp"C:\Users\Admin\AppData\Local\Temp\6F66.tmp"80⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\6FA4.tmp"C:\Users\Admin\AppData\Local\Temp\6FA4.tmp"81⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\6FE3.tmp"C:\Users\Admin\AppData\Local\Temp\6FE3.tmp"82⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\7021.tmp"C:\Users\Admin\AppData\Local\Temp\7021.tmp"83⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\705F.tmp"C:\Users\Admin\AppData\Local\Temp\705F.tmp"84⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\70AD.tmp"C:\Users\Admin\AppData\Local\Temp\70AD.tmp"85⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\70EC.tmp"C:\Users\Admin\AppData\Local\Temp\70EC.tmp"86⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\712A.tmp"C:\Users\Admin\AppData\Local\Temp\712A.tmp"87⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\7169.tmp"C:\Users\Admin\AppData\Local\Temp\7169.tmp"88⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\71A7.tmp"C:\Users\Admin\AppData\Local\Temp\71A7.tmp"89⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\71E5.tmp"C:\Users\Admin\AppData\Local\Temp\71E5.tmp"90⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\7224.tmp"C:\Users\Admin\AppData\Local\Temp\7224.tmp"91⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\7262.tmp"C:\Users\Admin\AppData\Local\Temp\7262.tmp"92⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\72A1.tmp"C:\Users\Admin\AppData\Local\Temp\72A1.tmp"93⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\72DF.tmp"C:\Users\Admin\AppData\Local\Temp\72DF.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:264 -
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"95⤵
- System Location Discovery: System Language Discovery
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\735C.tmp"C:\Users\Admin\AppData\Local\Temp\735C.tmp"96⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\739A.tmp"C:\Users\Admin\AppData\Local\Temp\739A.tmp"97⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\73D9.tmp"C:\Users\Admin\AppData\Local\Temp\73D9.tmp"98⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"99⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"100⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\7494.tmp"C:\Users\Admin\AppData\Local\Temp\7494.tmp"101⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"102⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"103⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\754F.tmp"C:\Users\Admin\AppData\Local\Temp\754F.tmp"104⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\758D.tmp"C:\Users\Admin\AppData\Local\Temp\758D.tmp"105⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\75DB.tmp"C:\Users\Admin\AppData\Local\Temp\75DB.tmp"106⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"107⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\7658.tmp"C:\Users\Admin\AppData\Local\Temp\7658.tmp"108⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\7697.tmp"C:\Users\Admin\AppData\Local\Temp\7697.tmp"109⤵PID:288
-
C:\Users\Admin\AppData\Local\Temp\76D5.tmp"C:\Users\Admin\AppData\Local\Temp\76D5.tmp"110⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\7713.tmp"C:\Users\Admin\AppData\Local\Temp\7713.tmp"111⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\7752.tmp"C:\Users\Admin\AppData\Local\Temp\7752.tmp"112⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\7790.tmp"C:\Users\Admin\AppData\Local\Temp\7790.tmp"113⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\77DE.tmp"C:\Users\Admin\AppData\Local\Temp\77DE.tmp"114⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\781D.tmp"C:\Users\Admin\AppData\Local\Temp\781D.tmp"115⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\786B.tmp"C:\Users\Admin\AppData\Local\Temp\786B.tmp"116⤵
- System Location Discovery: System Language Discovery
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\78A9.tmp"C:\Users\Admin\AppData\Local\Temp\78A9.tmp"117⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\78E7.tmp"C:\Users\Admin\AppData\Local\Temp\78E7.tmp"118⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\7926.tmp"C:\Users\Admin\AppData\Local\Temp\7926.tmp"119⤵
- System Location Discovery: System Language Discovery
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\7974.tmp"C:\Users\Admin\AppData\Local\Temp\7974.tmp"120⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\79B2.tmp"C:\Users\Admin\AppData\Local\Temp\79B2.tmp"121⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\79F1.tmp"C:\Users\Admin\AppData\Local\Temp\79F1.tmp"122⤵PID:2700
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-