Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
20/08/2024, 09:36
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-20_fd2c0b13e008aa65c8643144f0d715c1_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-08-20_fd2c0b13e008aa65c8643144f0d715c1_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-20_fd2c0b13e008aa65c8643144f0d715c1_mafia.exe
-
Size
520KB
-
MD5
fd2c0b13e008aa65c8643144f0d715c1
-
SHA1
2da937eb7633292ed992c9771bc155791d49c72d
-
SHA256
f91f458f5b34b23c4a3e41b0bfb078aea8c789e754d6b756178ba7d1e1483442
-
SHA512
6f21c58bab47c34b4378562d6589a2e8555baab414a30cbc14d9ce2cc009d7570020961f15a0a581eb77fafff46cdf23f26184df4f1dcc68d998b5c8c2abf2e1
-
SSDEEP
12288:roRXOQjmOyof4H4g8OmWv2w/a0y30OyrkRyaH7cNZ:rogQ9yRYg8OBvvaBTegwN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2776 F038.tmp 2920 F086.tmp 2824 F0D4.tmp 2704 F142.tmp 2740 F1AF.tmp 2628 F21C.tmp 2612 F289.tmp 1096 F2E7.tmp 292 F325.tmp 3024 F383.tmp 2124 F400.tmp 2140 F45D.tmp 316 F4DA.tmp 1844 F557.tmp 1052 F5B4.tmp 1260 F622.tmp 2828 F67F.tmp 2888 F6EC.tmp 588 F75A.tmp 780 F7C7.tmp 2288 F824.tmp 2952 F882.tmp 2116 F8EF.tmp 2324 F92E.tmp 1784 F96C.tmp 1800 F9AA.tmp 1900 F9E9.tmp 2016 FA27.tmp 2040 FA66.tmp 340 FAA4.tmp 1540 FAE2.tmp 1400 FB21.tmp 2036 FB5F.tmp 788 FB9E.tmp 696 FBDC.tmp 1704 FC1A.tmp 2536 FC59.tmp 1656 FC97.tmp 1872 FCD6.tmp 1460 FD14.tmp 564 FD52.tmp 2524 FD91.tmp 2080 FDDF.tmp 1948 FE1D.tmp 620 FE5C.tmp 568 FE9A.tmp 2660 FED8.tmp 1432 FF17.tmp 2088 FF65.tmp 2332 FFA3.tmp 1520 FFF1.tmp 1496 30.tmp 2692 6E.tmp 2844 AC.tmp 2880 FA.tmp 580 139.tmp 3028 177.tmp 2732 1C5.tmp 2620 204.tmp 2604 242.tmp 3008 280.tmp 1232 2BF.tmp 2612 2FD.tmp 1476 34B.tmp -
Loads dropped DLL 64 IoCs
pid Process 2924 2024-08-20_fd2c0b13e008aa65c8643144f0d715c1_mafia.exe 2776 F038.tmp 2920 F086.tmp 2824 F0D4.tmp 2704 F142.tmp 2740 F1AF.tmp 2628 F21C.tmp 2612 F289.tmp 1096 F2E7.tmp 292 F325.tmp 3024 F383.tmp 2124 F400.tmp 2140 F45D.tmp 316 F4DA.tmp 1844 F557.tmp 1052 F5B4.tmp 1260 F622.tmp 2828 F67F.tmp 2888 F6EC.tmp 588 F75A.tmp 780 F7C7.tmp 2288 F824.tmp 2952 F882.tmp 2116 F8EF.tmp 2324 F92E.tmp 1784 F96C.tmp 1800 F9AA.tmp 1900 F9E9.tmp 2016 FA27.tmp 2040 FA66.tmp 340 FAA4.tmp 1540 FAE2.tmp 1400 FB21.tmp 2036 FB5F.tmp 788 FB9E.tmp 696 FBDC.tmp 1704 FC1A.tmp 2536 FC59.tmp 1656 FC97.tmp 1872 FCD6.tmp 1460 FD14.tmp 564 FD52.tmp 2524 FD91.tmp 2080 FDDF.tmp 1948 FE1D.tmp 620 FE5C.tmp 568 FE9A.tmp 2660 FED8.tmp 1432 FF17.tmp 2088 FF65.tmp 2332 FFA3.tmp 1520 FFF1.tmp 1496 30.tmp 2692 6E.tmp 2844 AC.tmp 2880 FA.tmp 580 139.tmp 3028 177.tmp 2732 1C5.tmp 2620 204.tmp 2604 242.tmp 3008 280.tmp 1232 2BF.tmp 2612 2FD.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3794.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 402C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6883.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DDE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3469.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6651.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4376.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7149.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 581F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 957C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2924 wrote to memory of 2776 2924 2024-08-20_fd2c0b13e008aa65c8643144f0d715c1_mafia.exe 31 PID 2924 wrote to memory of 2776 2924 2024-08-20_fd2c0b13e008aa65c8643144f0d715c1_mafia.exe 31 PID 2924 wrote to memory of 2776 2924 2024-08-20_fd2c0b13e008aa65c8643144f0d715c1_mafia.exe 31 PID 2924 wrote to memory of 2776 2924 2024-08-20_fd2c0b13e008aa65c8643144f0d715c1_mafia.exe 31 PID 2776 wrote to memory of 2920 2776 F038.tmp 32 PID 2776 wrote to memory of 2920 2776 F038.tmp 32 PID 2776 wrote to memory of 2920 2776 F038.tmp 32 PID 2776 wrote to memory of 2920 2776 F038.tmp 32 PID 2920 wrote to memory of 2824 2920 F086.tmp 33 PID 2920 wrote to memory of 2824 2920 F086.tmp 33 PID 2920 wrote to memory of 2824 2920 F086.tmp 33 PID 2920 wrote to memory of 2824 2920 F086.tmp 33 PID 2824 wrote to memory of 2704 2824 F0D4.tmp 34 PID 2824 wrote to memory of 2704 2824 F0D4.tmp 34 PID 2824 wrote to memory of 2704 2824 F0D4.tmp 34 PID 2824 wrote to memory of 2704 2824 F0D4.tmp 34 PID 2704 wrote to memory of 2740 2704 F142.tmp 35 PID 2704 wrote to memory of 2740 2704 F142.tmp 35 PID 2704 wrote to memory of 2740 2704 F142.tmp 35 PID 2704 wrote to memory of 2740 2704 F142.tmp 35 PID 2740 wrote to memory of 2628 2740 F1AF.tmp 36 PID 2740 wrote to memory of 2628 2740 F1AF.tmp 36 PID 2740 wrote to memory of 2628 2740 F1AF.tmp 36 PID 2740 wrote to memory of 2628 2740 F1AF.tmp 36 PID 2628 wrote to memory of 2612 2628 F21C.tmp 37 PID 2628 wrote to memory of 2612 2628 F21C.tmp 37 PID 2628 wrote to memory of 2612 2628 F21C.tmp 37 PID 2628 wrote to memory of 2612 2628 F21C.tmp 37 PID 2612 wrote to memory of 1096 2612 F289.tmp 38 PID 2612 wrote to memory of 1096 2612 F289.tmp 38 PID 2612 wrote to memory of 1096 2612 F289.tmp 38 PID 2612 wrote to memory of 1096 2612 F289.tmp 38 PID 1096 wrote to memory of 292 1096 F2E7.tmp 39 PID 1096 wrote to memory of 292 1096 F2E7.tmp 39 PID 1096 wrote to memory of 292 1096 F2E7.tmp 39 PID 1096 wrote to memory of 292 1096 F2E7.tmp 39 PID 292 wrote to memory of 3024 292 F325.tmp 40 PID 292 wrote to memory of 3024 292 F325.tmp 40 PID 292 wrote to memory of 3024 292 F325.tmp 40 PID 292 wrote to memory of 3024 292 F325.tmp 40 PID 3024 wrote to memory of 2124 3024 F383.tmp 41 PID 3024 wrote to memory of 2124 3024 F383.tmp 41 PID 3024 wrote to memory of 2124 3024 F383.tmp 41 PID 3024 wrote to memory of 2124 3024 F383.tmp 41 PID 2124 wrote to memory of 2140 2124 F400.tmp 42 PID 2124 wrote to memory of 2140 2124 F400.tmp 42 PID 2124 wrote to memory of 2140 2124 F400.tmp 42 PID 2124 wrote to memory of 2140 2124 F400.tmp 42 PID 2140 wrote to memory of 316 2140 F45D.tmp 43 PID 2140 wrote to memory of 316 2140 F45D.tmp 43 PID 2140 wrote to memory of 316 2140 F45D.tmp 43 PID 2140 wrote to memory of 316 2140 F45D.tmp 43 PID 316 wrote to memory of 1844 316 F4DA.tmp 44 PID 316 wrote to memory of 1844 316 F4DA.tmp 44 PID 316 wrote to memory of 1844 316 F4DA.tmp 44 PID 316 wrote to memory of 1844 316 F4DA.tmp 44 PID 1844 wrote to memory of 1052 1844 F557.tmp 45 PID 1844 wrote to memory of 1052 1844 F557.tmp 45 PID 1844 wrote to memory of 1052 1844 F557.tmp 45 PID 1844 wrote to memory of 1052 1844 F557.tmp 45 PID 1052 wrote to memory of 1260 1052 F5B4.tmp 46 PID 1052 wrote to memory of 1260 1052 F5B4.tmp 46 PID 1052 wrote to memory of 1260 1052 F5B4.tmp 46 PID 1052 wrote to memory of 1260 1052 F5B4.tmp 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-20_fd2c0b13e008aa65c8643144f0d715c1_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-20_fd2c0b13e008aa65c8643144f0d715c1_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\F038.tmp"C:\Users\Admin\AppData\Local\Temp\F038.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\F086.tmp"C:\Users\Admin\AppData\Local\Temp\F086.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\F0D4.tmp"C:\Users\Admin\AppData\Local\Temp\F0D4.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\F142.tmp"C:\Users\Admin\AppData\Local\Temp\F142.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\F1AF.tmp"C:\Users\Admin\AppData\Local\Temp\F1AF.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\F21C.tmp"C:\Users\Admin\AppData\Local\Temp\F21C.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\F289.tmp"C:\Users\Admin\AppData\Local\Temp\F289.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\F2E7.tmp"C:\Users\Admin\AppData\Local\Temp\F2E7.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\F325.tmp"C:\Users\Admin\AppData\Local\Temp\F325.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:292 -
C:\Users\Admin\AppData\Local\Temp\F383.tmp"C:\Users\Admin\AppData\Local\Temp\F383.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\F400.tmp"C:\Users\Admin\AppData\Local\Temp\F400.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\F45D.tmp"C:\Users\Admin\AppData\Local\Temp\F45D.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\F4DA.tmp"C:\Users\Admin\AppData\Local\Temp\F4DA.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Users\Admin\AppData\Local\Temp\F557.tmp"C:\Users\Admin\AppData\Local\Temp\F557.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\F5B4.tmp"C:\Users\Admin\AppData\Local\Temp\F5B4.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\F622.tmp"C:\Users\Admin\AppData\Local\Temp\F622.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\F67F.tmp"C:\Users\Admin\AppData\Local\Temp\F67F.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\F6EC.tmp"C:\Users\Admin\AppData\Local\Temp\F6EC.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\F75A.tmp"C:\Users\Admin\AppData\Local\Temp\F75A.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:588 -
C:\Users\Admin\AppData\Local\Temp\F7C7.tmp"C:\Users\Admin\AppData\Local\Temp\F7C7.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:780 -
C:\Users\Admin\AppData\Local\Temp\F824.tmp"C:\Users\Admin\AppData\Local\Temp\F824.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\F882.tmp"C:\Users\Admin\AppData\Local\Temp\F882.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\F8EF.tmp"C:\Users\Admin\AppData\Local\Temp\F8EF.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\F92E.tmp"C:\Users\Admin\AppData\Local\Temp\F92E.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\F96C.tmp"C:\Users\Admin\AppData\Local\Temp\F96C.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\F9AA.tmp"C:\Users\Admin\AppData\Local\Temp\F9AA.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\F9E9.tmp"C:\Users\Admin\AppData\Local\Temp\F9E9.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\FA27.tmp"C:\Users\Admin\AppData\Local\Temp\FA27.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\FA66.tmp"C:\Users\Admin\AppData\Local\Temp\FA66.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\FAA4.tmp"C:\Users\Admin\AppData\Local\Temp\FAA4.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:340 -
C:\Users\Admin\AppData\Local\Temp\FAE2.tmp"C:\Users\Admin\AppData\Local\Temp\FAE2.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\FB21.tmp"C:\Users\Admin\AppData\Local\Temp\FB21.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\FB5F.tmp"C:\Users\Admin\AppData\Local\Temp\FB5F.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\FB9E.tmp"C:\Users\Admin\AppData\Local\Temp\FB9E.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:788 -
C:\Users\Admin\AppData\Local\Temp\FBDC.tmp"C:\Users\Admin\AppData\Local\Temp\FBDC.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:696 -
C:\Users\Admin\AppData\Local\Temp\FC1A.tmp"C:\Users\Admin\AppData\Local\Temp\FC1A.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\FC59.tmp"C:\Users\Admin\AppData\Local\Temp\FC59.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\FC97.tmp"C:\Users\Admin\AppData\Local\Temp\FC97.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\FCD6.tmp"C:\Users\Admin\AppData\Local\Temp\FCD6.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\FD14.tmp"C:\Users\Admin\AppData\Local\Temp\FD14.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\FD52.tmp"C:\Users\Admin\AppData\Local\Temp\FD52.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:564 -
C:\Users\Admin\AppData\Local\Temp\FD91.tmp"C:\Users\Admin\AppData\Local\Temp\FD91.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\FDDF.tmp"C:\Users\Admin\AppData\Local\Temp\FDDF.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\FE1D.tmp"C:\Users\Admin\AppData\Local\Temp\FE1D.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\FE5C.tmp"C:\Users\Admin\AppData\Local\Temp\FE5C.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:620 -
C:\Users\Admin\AppData\Local\Temp\FE9A.tmp"C:\Users\Admin\AppData\Local\Temp\FE9A.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:568 -
C:\Users\Admin\AppData\Local\Temp\FED8.tmp"C:\Users\Admin\AppData\Local\Temp\FED8.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\FF17.tmp"C:\Users\Admin\AppData\Local\Temp\FF17.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\FF65.tmp"C:\Users\Admin\AppData\Local\Temp\FF65.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\FFA3.tmp"C:\Users\Admin\AppData\Local\Temp\FFA3.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\FFF1.tmp"C:\Users\Admin\AppData\Local\Temp\FFF1.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\30.tmp"C:\Users\Admin\AppData\Local\Temp\30.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\6E.tmp"C:\Users\Admin\AppData\Local\Temp\6E.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\AC.tmp"C:\Users\Admin\AppData\Local\Temp\AC.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\FA.tmp"C:\Users\Admin\AppData\Local\Temp\FA.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\139.tmp"C:\Users\Admin\AppData\Local\Temp\139.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:580 -
C:\Users\Admin\AppData\Local\Temp\177.tmp"C:\Users\Admin\AppData\Local\Temp\177.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\1C5.tmp"C:\Users\Admin\AppData\Local\Temp\1C5.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\204.tmp"C:\Users\Admin\AppData\Local\Temp\204.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\242.tmp"C:\Users\Admin\AppData\Local\Temp\242.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\280.tmp"C:\Users\Admin\AppData\Local\Temp\280.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\2BF.tmp"C:\Users\Admin\AppData\Local\Temp\2BF.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\2FD.tmp"C:\Users\Admin\AppData\Local\Temp\2FD.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\34B.tmp"C:\Users\Admin\AppData\Local\Temp\34B.tmp"65⤵
- Executes dropped EXE
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\38A.tmp"C:\Users\Admin\AppData\Local\Temp\38A.tmp"66⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\3C8.tmp"C:\Users\Admin\AppData\Local\Temp\3C8.tmp"67⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\406.tmp"C:\Users\Admin\AppData\Local\Temp\406.tmp"68⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\445.tmp"C:\Users\Admin\AppData\Local\Temp\445.tmp"69⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\493.tmp"C:\Users\Admin\AppData\Local\Temp\493.tmp"70⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\4D1.tmp"C:\Users\Admin\AppData\Local\Temp\4D1.tmp"71⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\510.tmp"C:\Users\Admin\AppData\Local\Temp\510.tmp"72⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\54E.tmp"C:\Users\Admin\AppData\Local\Temp\54E.tmp"73⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\58C.tmp"C:\Users\Admin\AppData\Local\Temp\58C.tmp"74⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\5CB.tmp"C:\Users\Admin\AppData\Local\Temp\5CB.tmp"75⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\609.tmp"C:\Users\Admin\AppData\Local\Temp\609.tmp"76⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\648.tmp"C:\Users\Admin\AppData\Local\Temp\648.tmp"77⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\696.tmp"C:\Users\Admin\AppData\Local\Temp\696.tmp"78⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\6D4.tmp"C:\Users\Admin\AppData\Local\Temp\6D4.tmp"79⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\712.tmp"C:\Users\Admin\AppData\Local\Temp\712.tmp"80⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\760.tmp"C:\Users\Admin\AppData\Local\Temp\760.tmp"81⤵PID:596
-
C:\Users\Admin\AppData\Local\Temp\79F.tmp"C:\Users\Admin\AppData\Local\Temp\79F.tmp"82⤵PID:480
-
C:\Users\Admin\AppData\Local\Temp\7DD.tmp"C:\Users\Admin\AppData\Local\Temp\7DD.tmp"83⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\81C.tmp"C:\Users\Admin\AppData\Local\Temp\81C.tmp"84⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\85A.tmp"C:\Users\Admin\AppData\Local\Temp\85A.tmp"85⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\8A8.tmp"C:\Users\Admin\AppData\Local\Temp\8A8.tmp"86⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\8E6.tmp"C:\Users\Admin\AppData\Local\Temp\8E6.tmp"87⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\925.tmp"C:\Users\Admin\AppData\Local\Temp\925.tmp"88⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\963.tmp"C:\Users\Admin\AppData\Local\Temp\963.tmp"89⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\9B1.tmp"C:\Users\Admin\AppData\Local\Temp\9B1.tmp"90⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\9F0.tmp"C:\Users\Admin\AppData\Local\Temp\9F0.tmp"91⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\A2E.tmp"C:\Users\Admin\AppData\Local\Temp\A2E.tmp"92⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\A6C.tmp"C:\Users\Admin\AppData\Local\Temp\A6C.tmp"93⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\AAB.tmp"C:\Users\Admin\AppData\Local\Temp\AAB.tmp"94⤵PID:340
-
C:\Users\Admin\AppData\Local\Temp\AE9.tmp"C:\Users\Admin\AppData\Local\Temp\AE9.tmp"95⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\B37.tmp"C:\Users\Admin\AppData\Local\Temp\B37.tmp"96⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\B76.tmp"C:\Users\Admin\AppData\Local\Temp\B76.tmp"97⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\BB4.tmp"C:\Users\Admin\AppData\Local\Temp\BB4.tmp"98⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\C02.tmp"C:\Users\Admin\AppData\Local\Temp\C02.tmp"99⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\C40.tmp"C:\Users\Admin\AppData\Local\Temp\C40.tmp"100⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\C7F.tmp"C:\Users\Admin\AppData\Local\Temp\C7F.tmp"101⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\CCD.tmp"C:\Users\Admin\AppData\Local\Temp\CCD.tmp"102⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\D0B.tmp"C:\Users\Admin\AppData\Local\Temp\D0B.tmp"103⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\D4A.tmp"C:\Users\Admin\AppData\Local\Temp\D4A.tmp"104⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\D88.tmp"C:\Users\Admin\AppData\Local\Temp\D88.tmp"105⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\DD6.tmp"C:\Users\Admin\AppData\Local\Temp\DD6.tmp"106⤵
- System Location Discovery: System Language Discovery
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\E14.tmp"C:\Users\Admin\AppData\Local\Temp\E14.tmp"107⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\E53.tmp"C:\Users\Admin\AppData\Local\Temp\E53.tmp"108⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\E91.tmp"C:\Users\Admin\AppData\Local\Temp\E91.tmp"109⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\ED0.tmp"C:\Users\Admin\AppData\Local\Temp\ED0.tmp"110⤵PID:352
-
C:\Users\Admin\AppData\Local\Temp\F0E.tmp"C:\Users\Admin\AppData\Local\Temp\F0E.tmp"111⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\F4C.tmp"C:\Users\Admin\AppData\Local\Temp\F4C.tmp"112⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\F8B.tmp"C:\Users\Admin\AppData\Local\Temp\F8B.tmp"113⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\FC9.tmp"C:\Users\Admin\AppData\Local\Temp\FC9.tmp"114⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\1008.tmp"C:\Users\Admin\AppData\Local\Temp\1008.tmp"115⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\1046.tmp"C:\Users\Admin\AppData\Local\Temp\1046.tmp"116⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\1094.tmp"C:\Users\Admin\AppData\Local\Temp\1094.tmp"117⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\10D2.tmp"C:\Users\Admin\AppData\Local\Temp\10D2.tmp"118⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\1111.tmp"C:\Users\Admin\AppData\Local\Temp\1111.tmp"119⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\114F.tmp"C:\Users\Admin\AppData\Local\Temp\114F.tmp"120⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\119D.tmp"C:\Users\Admin\AppData\Local\Temp\119D.tmp"121⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\11DC.tmp"C:\Users\Admin\AppData\Local\Temp\11DC.tmp"122⤵PID:2640
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-