Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
09-08-2024 07:55
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-09_d6bd3d633850f76b89d54e6e0620c783_mafia.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-08-09_d6bd3d633850f76b89d54e6e0620c783_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-09_d6bd3d633850f76b89d54e6e0620c783_mafia.exe
-
Size
486KB
-
MD5
d6bd3d633850f76b89d54e6e0620c783
-
SHA1
95723a3ad19d4440dec07b75e84f49a356fdcc79
-
SHA256
8e9d220ba12d1cb8f29515e77ab70bc4c15bed643e2ddbb5b92acfb5017661fd
-
SHA512
47ab659c9a98c3197df809cfa6eb47c69b1e5445c004f1944c9bac6a9d652c765916c0a90d75129a39ee36c3d77398cb8f27f0a69c48e747ccdfabc2fd8d8176
-
SSDEEP
12288:/U5rCOTeiDJbutH1XvTt1UjbNo9YkcNZ:/UQOJDolNSBN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2116 9A4C.tmp 2664 9AAA.tmp 2708 9B36.tmp 2800 9BA3.tmp 2692 9C01.tmp 1440 9C6E.tmp 2936 9CDB.tmp 2712 9D49.tmp 2572 9DB6.tmp 2632 9E23.tmp 2816 9E90.tmp 2040 9EFD.tmp 1768 9F6B.tmp 2088 9FD8.tmp 2528 A045.tmp 2236 A0B2.tmp 2896 A11F.tmp 2996 A18D.tmp 2908 A1EA.tmp 1888 A267.tmp 2384 A2D4.tmp 1208 A341.tmp 544 A39F.tmp 1500 A3DD.tmp 2764 A41C.tmp 2556 A45A.tmp 3020 A499.tmp 1712 A4D7.tmp 3068 A515.tmp 1216 A554.tmp 1120 A592.tmp 2540 A5D1.tmp 2444 A60F.tmp 1088 A64D.tmp 1612 A68C.tmp 900 A6CA.tmp 856 A709.tmp 1468 A747.tmp 1532 A785.tmp 896 A7C4.tmp 760 A802.tmp 1960 A841.tmp 1036 A87F.tmp 848 A8BD.tmp 2264 A8FC.tmp 1636 A93A.tmp 1676 A988.tmp 1920 A9C7.tmp 2452 AA05.tmp 1508 AA53.tmp 624 AA91.tmp 2132 AAD0.tmp 1592 AB0E.tmp 2864 AB4D.tmp 2216 AB8B.tmp 2272 ABC9.tmp 2788 AC08.tmp 2820 AC46.tmp 2724 AC85.tmp 2580 ACC3.tmp 2840 AD01.tmp 2748 AD4F.tmp 1708 ADAD.tmp 2248 ADEB.tmp -
Loads dropped DLL 64 IoCs
pid Process 2208 2024-08-09_d6bd3d633850f76b89d54e6e0620c783_mafia.exe 2116 9A4C.tmp 2664 9AAA.tmp 2708 9B36.tmp 2800 9BA3.tmp 2692 9C01.tmp 1440 9C6E.tmp 2936 9CDB.tmp 2712 9D49.tmp 2572 9DB6.tmp 2632 9E23.tmp 2816 9E90.tmp 2040 9EFD.tmp 1768 9F6B.tmp 2088 9FD8.tmp 2528 A045.tmp 2236 A0B2.tmp 2896 A11F.tmp 2996 A18D.tmp 2908 A1EA.tmp 1888 A267.tmp 2384 A2D4.tmp 1208 A341.tmp 544 A39F.tmp 1500 A3DD.tmp 2764 A41C.tmp 2556 A45A.tmp 3020 A499.tmp 1712 A4D7.tmp 3068 A515.tmp 1216 A554.tmp 1120 A592.tmp 2540 A5D1.tmp 2444 A60F.tmp 1088 A64D.tmp 1612 A68C.tmp 900 A6CA.tmp 856 A709.tmp 1468 A747.tmp 1532 A785.tmp 896 A7C4.tmp 760 A802.tmp 1960 A841.tmp 1036 A87F.tmp 848 A8BD.tmp 2264 A8FC.tmp 1636 A93A.tmp 1676 A988.tmp 1920 A9C7.tmp 2452 AA05.tmp 1508 AA53.tmp 624 AA91.tmp 2132 AAD0.tmp 1592 AB0E.tmp 2864 AB4D.tmp 2216 AB8B.tmp 2272 ABC9.tmp 2788 AC08.tmp 2820 AC46.tmp 2724 AC85.tmp 2580 ACC3.tmp 2840 AD01.tmp 2748 AD4F.tmp 1708 ADAD.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B04.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 708E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 846C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A68C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7723.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C01.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 271.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4099.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB4D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DCD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 935A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F180.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 255C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8009.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1593.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBAF.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2208 wrote to memory of 2116 2208 2024-08-09_d6bd3d633850f76b89d54e6e0620c783_mafia.exe 30 PID 2208 wrote to memory of 2116 2208 2024-08-09_d6bd3d633850f76b89d54e6e0620c783_mafia.exe 30 PID 2208 wrote to memory of 2116 2208 2024-08-09_d6bd3d633850f76b89d54e6e0620c783_mafia.exe 30 PID 2208 wrote to memory of 2116 2208 2024-08-09_d6bd3d633850f76b89d54e6e0620c783_mafia.exe 30 PID 2116 wrote to memory of 2664 2116 9A4C.tmp 31 PID 2116 wrote to memory of 2664 2116 9A4C.tmp 31 PID 2116 wrote to memory of 2664 2116 9A4C.tmp 31 PID 2116 wrote to memory of 2664 2116 9A4C.tmp 31 PID 2664 wrote to memory of 2708 2664 9AAA.tmp 32 PID 2664 wrote to memory of 2708 2664 9AAA.tmp 32 PID 2664 wrote to memory of 2708 2664 9AAA.tmp 32 PID 2664 wrote to memory of 2708 2664 9AAA.tmp 32 PID 2708 wrote to memory of 2800 2708 9B36.tmp 33 PID 2708 wrote to memory of 2800 2708 9B36.tmp 33 PID 2708 wrote to memory of 2800 2708 9B36.tmp 33 PID 2708 wrote to memory of 2800 2708 9B36.tmp 33 PID 2800 wrote to memory of 2692 2800 9BA3.tmp 34 PID 2800 wrote to memory of 2692 2800 9BA3.tmp 34 PID 2800 wrote to memory of 2692 2800 9BA3.tmp 34 PID 2800 wrote to memory of 2692 2800 9BA3.tmp 34 PID 2692 wrote to memory of 1440 2692 9C01.tmp 35 PID 2692 wrote to memory of 1440 2692 9C01.tmp 35 PID 2692 wrote to memory of 1440 2692 9C01.tmp 35 PID 2692 wrote to memory of 1440 2692 9C01.tmp 35 PID 1440 wrote to memory of 2936 1440 9C6E.tmp 36 PID 1440 wrote to memory of 2936 1440 9C6E.tmp 36 PID 1440 wrote to memory of 2936 1440 9C6E.tmp 36 PID 1440 wrote to memory of 2936 1440 9C6E.tmp 36 PID 2936 wrote to memory of 2712 2936 9CDB.tmp 37 PID 2936 wrote to memory of 2712 2936 9CDB.tmp 37 PID 2936 wrote to memory of 2712 2936 9CDB.tmp 37 PID 2936 wrote to memory of 2712 2936 9CDB.tmp 37 PID 2712 wrote to memory of 2572 2712 9D49.tmp 38 PID 2712 wrote to memory of 2572 2712 9D49.tmp 38 PID 2712 wrote to memory of 2572 2712 9D49.tmp 38 PID 2712 wrote to memory of 2572 2712 9D49.tmp 38 PID 2572 wrote to memory of 2632 2572 9DB6.tmp 39 PID 2572 wrote to memory of 2632 2572 9DB6.tmp 39 PID 2572 wrote to memory of 2632 2572 9DB6.tmp 39 PID 2572 wrote to memory of 2632 2572 9DB6.tmp 39 PID 2632 wrote to memory of 2816 2632 9E23.tmp 40 PID 2632 wrote to memory of 2816 2632 9E23.tmp 40 PID 2632 wrote to memory of 2816 2632 9E23.tmp 40 PID 2632 wrote to memory of 2816 2632 9E23.tmp 40 PID 2816 wrote to memory of 2040 2816 9E90.tmp 41 PID 2816 wrote to memory of 2040 2816 9E90.tmp 41 PID 2816 wrote to memory of 2040 2816 9E90.tmp 41 PID 2816 wrote to memory of 2040 2816 9E90.tmp 41 PID 2040 wrote to memory of 1768 2040 9EFD.tmp 42 PID 2040 wrote to memory of 1768 2040 9EFD.tmp 42 PID 2040 wrote to memory of 1768 2040 9EFD.tmp 42 PID 2040 wrote to memory of 1768 2040 9EFD.tmp 42 PID 1768 wrote to memory of 2088 1768 9F6B.tmp 43 PID 1768 wrote to memory of 2088 1768 9F6B.tmp 43 PID 1768 wrote to memory of 2088 1768 9F6B.tmp 43 PID 1768 wrote to memory of 2088 1768 9F6B.tmp 43 PID 2088 wrote to memory of 2528 2088 9FD8.tmp 44 PID 2088 wrote to memory of 2528 2088 9FD8.tmp 44 PID 2088 wrote to memory of 2528 2088 9FD8.tmp 44 PID 2088 wrote to memory of 2528 2088 9FD8.tmp 44 PID 2528 wrote to memory of 2236 2528 A045.tmp 45 PID 2528 wrote to memory of 2236 2528 A045.tmp 45 PID 2528 wrote to memory of 2236 2528 A045.tmp 45 PID 2528 wrote to memory of 2236 2528 A045.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-09_d6bd3d633850f76b89d54e6e0620c783_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-09_d6bd3d633850f76b89d54e6e0620c783_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\9BA3.tmp"C:\Users\Admin\AppData\Local\Temp\9BA3.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\9C01.tmp"C:\Users\Admin\AppData\Local\Temp\9C01.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\9C6E.tmp"C:\Users\Admin\AppData\Local\Temp\9C6E.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\9CDB.tmp"C:\Users\Admin\AppData\Local\Temp\9CDB.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\9D49.tmp"C:\Users\Admin\AppData\Local\Temp\9D49.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\9DB6.tmp"C:\Users\Admin\AppData\Local\Temp\9DB6.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\9E23.tmp"C:\Users\Admin\AppData\Local\Temp\9E23.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\9E90.tmp"C:\Users\Admin\AppData\Local\Temp\9E90.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\9EFD.tmp"C:\Users\Admin\AppData\Local\Temp\9EFD.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\9F6B.tmp"C:\Users\Admin\AppData\Local\Temp\9F6B.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\9FD8.tmp"C:\Users\Admin\AppData\Local\Temp\9FD8.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\A045.tmp"C:\Users\Admin\AppData\Local\Temp\A045.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\A0B2.tmp"C:\Users\Admin\AppData\Local\Temp\A0B2.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\A11F.tmp"C:\Users\Admin\AppData\Local\Temp\A11F.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\A18D.tmp"C:\Users\Admin\AppData\Local\Temp\A18D.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\A1EA.tmp"C:\Users\Admin\AppData\Local\Temp\A1EA.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\A267.tmp"C:\Users\Admin\AppData\Local\Temp\A267.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\A2D4.tmp"C:\Users\Admin\AppData\Local\Temp\A2D4.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\A341.tmp"C:\Users\Admin\AppData\Local\Temp\A341.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\A39F.tmp"C:\Users\Admin\AppData\Local\Temp\A39F.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:544 -
C:\Users\Admin\AppData\Local\Temp\A3DD.tmp"C:\Users\Admin\AppData\Local\Temp\A3DD.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\A41C.tmp"C:\Users\Admin\AppData\Local\Temp\A41C.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\A45A.tmp"C:\Users\Admin\AppData\Local\Temp\A45A.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\A499.tmp"C:\Users\Admin\AppData\Local\Temp\A499.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\A4D7.tmp"C:\Users\Admin\AppData\Local\Temp\A4D7.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\A515.tmp"C:\Users\Admin\AppData\Local\Temp\A515.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\A554.tmp"C:\Users\Admin\AppData\Local\Temp\A554.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\A592.tmp"C:\Users\Admin\AppData\Local\Temp\A592.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\A5D1.tmp"C:\Users\Admin\AppData\Local\Temp\A5D1.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\A60F.tmp"C:\Users\Admin\AppData\Local\Temp\A60F.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\A64D.tmp"C:\Users\Admin\AppData\Local\Temp\A64D.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\A68C.tmp"C:\Users\Admin\AppData\Local\Temp\A68C.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\A6CA.tmp"C:\Users\Admin\AppData\Local\Temp\A6CA.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:900 -
C:\Users\Admin\AppData\Local\Temp\A709.tmp"C:\Users\Admin\AppData\Local\Temp\A709.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:856 -
C:\Users\Admin\AppData\Local\Temp\A747.tmp"C:\Users\Admin\AppData\Local\Temp\A747.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\A785.tmp"C:\Users\Admin\AppData\Local\Temp\A785.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\A7C4.tmp"C:\Users\Admin\AppData\Local\Temp\A7C4.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:896 -
C:\Users\Admin\AppData\Local\Temp\A802.tmp"C:\Users\Admin\AppData\Local\Temp\A802.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:760 -
C:\Users\Admin\AppData\Local\Temp\A841.tmp"C:\Users\Admin\AppData\Local\Temp\A841.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\A87F.tmp"C:\Users\Admin\AppData\Local\Temp\A87F.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\A8BD.tmp"C:\Users\Admin\AppData\Local\Temp\A8BD.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:848 -
C:\Users\Admin\AppData\Local\Temp\A8FC.tmp"C:\Users\Admin\AppData\Local\Temp\A8FC.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\A93A.tmp"C:\Users\Admin\AppData\Local\Temp\A93A.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\A988.tmp"C:\Users\Admin\AppData\Local\Temp\A988.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\A9C7.tmp"C:\Users\Admin\AppData\Local\Temp\A9C7.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\AA05.tmp"C:\Users\Admin\AppData\Local\Temp\AA05.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\AA53.tmp"C:\Users\Admin\AppData\Local\Temp\AA53.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\AA91.tmp"C:\Users\Admin\AppData\Local\Temp\AA91.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:624 -
C:\Users\Admin\AppData\Local\Temp\AAD0.tmp"C:\Users\Admin\AppData\Local\Temp\AAD0.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\AB0E.tmp"C:\Users\Admin\AppData\Local\Temp\AB0E.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\AB4D.tmp"C:\Users\Admin\AppData\Local\Temp\AB4D.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\AB8B.tmp"C:\Users\Admin\AppData\Local\Temp\AB8B.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\ABC9.tmp"C:\Users\Admin\AppData\Local\Temp\ABC9.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\AC08.tmp"C:\Users\Admin\AppData\Local\Temp\AC08.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\AC46.tmp"C:\Users\Admin\AppData\Local\Temp\AC46.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\AC85.tmp"C:\Users\Admin\AppData\Local\Temp\AC85.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\ACC3.tmp"C:\Users\Admin\AppData\Local\Temp\ACC3.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\AD01.tmp"C:\Users\Admin\AppData\Local\Temp\AD01.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\AD4F.tmp"C:\Users\Admin\AppData\Local\Temp\AD4F.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\ADAD.tmp"C:\Users\Admin\AppData\Local\Temp\ADAD.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\ADEB.tmp"C:\Users\Admin\AppData\Local\Temp\ADEB.tmp"65⤵
- Executes dropped EXE
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\AE2A.tmp"C:\Users\Admin\AppData\Local\Temp\AE2A.tmp"66⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\AE68.tmp"C:\Users\Admin\AppData\Local\Temp\AE68.tmp"67⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\AEB6.tmp"C:\Users\Admin\AppData\Local\Temp\AEB6.tmp"68⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\AEF5.tmp"C:\Users\Admin\AppData\Local\Temp\AEF5.tmp"69⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\AF33.tmp"C:\Users\Admin\AppData\Local\Temp\AF33.tmp"70⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\AF71.tmp"C:\Users\Admin\AppData\Local\Temp\AF71.tmp"71⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\AFB0.tmp"C:\Users\Admin\AppData\Local\Temp\AFB0.tmp"72⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\AFEE.tmp"C:\Users\Admin\AppData\Local\Temp\AFEE.tmp"73⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\B02D.tmp"C:\Users\Admin\AppData\Local\Temp\B02D.tmp"74⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\B06B.tmp"C:\Users\Admin\AppData\Local\Temp\B06B.tmp"75⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\B0A9.tmp"C:\Users\Admin\AppData\Local\Temp\B0A9.tmp"76⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\B0E8.tmp"C:\Users\Admin\AppData\Local\Temp\B0E8.tmp"77⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\B126.tmp"C:\Users\Admin\AppData\Local\Temp\B126.tmp"78⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\B165.tmp"C:\Users\Admin\AppData\Local\Temp\B165.tmp"79⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\B1A3.tmp"C:\Users\Admin\AppData\Local\Temp\B1A3.tmp"80⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\B1E1.tmp"C:\Users\Admin\AppData\Local\Temp\B1E1.tmp"81⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\B220.tmp"C:\Users\Admin\AppData\Local\Temp\B220.tmp"82⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\B25E.tmp"C:\Users\Admin\AppData\Local\Temp\B25E.tmp"83⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\B29D.tmp"C:\Users\Admin\AppData\Local\Temp\B29D.tmp"84⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\B2DB.tmp"C:\Users\Admin\AppData\Local\Temp\B2DB.tmp"85⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\B319.tmp"C:\Users\Admin\AppData\Local\Temp\B319.tmp"86⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\B358.tmp"C:\Users\Admin\AppData\Local\Temp\B358.tmp"87⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\B396.tmp"C:\Users\Admin\AppData\Local\Temp\B396.tmp"88⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\B3D5.tmp"C:\Users\Admin\AppData\Local\Temp\B3D5.tmp"89⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\B413.tmp"C:\Users\Admin\AppData\Local\Temp\B413.tmp"90⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\B451.tmp"C:\Users\Admin\AppData\Local\Temp\B451.tmp"91⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\B490.tmp"C:\Users\Admin\AppData\Local\Temp\B490.tmp"92⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\B4CE.tmp"C:\Users\Admin\AppData\Local\Temp\B4CE.tmp"93⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\B50D.tmp"C:\Users\Admin\AppData\Local\Temp\B50D.tmp"94⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\B54B.tmp"C:\Users\Admin\AppData\Local\Temp\B54B.tmp"95⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\B589.tmp"C:\Users\Admin\AppData\Local\Temp\B589.tmp"96⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\B5C8.tmp"C:\Users\Admin\AppData\Local\Temp\B5C8.tmp"97⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\B606.tmp"C:\Users\Admin\AppData\Local\Temp\B606.tmp"98⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\B645.tmp"C:\Users\Admin\AppData\Local\Temp\B645.tmp"99⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\B683.tmp"C:\Users\Admin\AppData\Local\Temp\B683.tmp"100⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\B6C1.tmp"C:\Users\Admin\AppData\Local\Temp\B6C1.tmp"101⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\B700.tmp"C:\Users\Admin\AppData\Local\Temp\B700.tmp"102⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\B73E.tmp"C:\Users\Admin\AppData\Local\Temp\B73E.tmp"103⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\B77D.tmp"C:\Users\Admin\AppData\Local\Temp\B77D.tmp"104⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\B7BB.tmp"C:\Users\Admin\AppData\Local\Temp\B7BB.tmp"105⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\B7F9.tmp"C:\Users\Admin\AppData\Local\Temp\B7F9.tmp"106⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\B838.tmp"C:\Users\Admin\AppData\Local\Temp\B838.tmp"107⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\B876.tmp"C:\Users\Admin\AppData\Local\Temp\B876.tmp"108⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\B8B5.tmp"C:\Users\Admin\AppData\Local\Temp\B8B5.tmp"109⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\B8F3.tmp"C:\Users\Admin\AppData\Local\Temp\B8F3.tmp"110⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\B931.tmp"C:\Users\Admin\AppData\Local\Temp\B931.tmp"111⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\B970.tmp"C:\Users\Admin\AppData\Local\Temp\B970.tmp"112⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\B9AE.tmp"C:\Users\Admin\AppData\Local\Temp\B9AE.tmp"113⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\B9ED.tmp"C:\Users\Admin\AppData\Local\Temp\B9ED.tmp"114⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\BA2B.tmp"C:\Users\Admin\AppData\Local\Temp\BA2B.tmp"115⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\BA69.tmp"C:\Users\Admin\AppData\Local\Temp\BA69.tmp"116⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\BAA8.tmp"C:\Users\Admin\AppData\Local\Temp\BAA8.tmp"117⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\BAE6.tmp"C:\Users\Admin\AppData\Local\Temp\BAE6.tmp"118⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\BB25.tmp"C:\Users\Admin\AppData\Local\Temp\BB25.tmp"119⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\BB63.tmp"C:\Users\Admin\AppData\Local\Temp\BB63.tmp"120⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\BBA1.tmp"C:\Users\Admin\AppData\Local\Temp\BBA1.tmp"121⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\BBE0.tmp"C:\Users\Admin\AppData\Local\Temp\BBE0.tmp"122⤵PID:2708
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-