Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/09/2024, 09:14
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-04_8e117ae18234ac4712a7fdb64c37c341_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-04_8e117ae18234ac4712a7fdb64c37c341_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-04_8e117ae18234ac4712a7fdb64c37c341_mafia.exe
-
Size
536KB
-
MD5
8e117ae18234ac4712a7fdb64c37c341
-
SHA1
a0196093f851de82a0fe9a9c12146d840c04a02c
-
SHA256
114d55c54b0f3d5a7d1f309da43f6fec1e52509e2cbeed77a51bf45e719461ba
-
SHA512
024e6bb4d18b228c76d084c49988f53ff74c0afe7ad6aece7e246c63129acbb0aa3396ddea080a049817cc120399c4c3b5d33354bc6cfbab7ca302f7ce05b37a
-
SSDEEP
12288:wU5rCOTeiUtVA09C7sH2mMljvup6rCJdsxzCIPNBmDmIZxVJ0ZT9:wUQOJUtVs7CXkrCJdmIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2684 5448.tmp 2764 5496.tmp 2832 5532.tmp 2660 5580.tmp 2024 564A.tmp 2544 5725.tmp 2664 5792.tmp 2112 585D.tmp 776 58DA.tmp 3012 5966.tmp 2264 59F2.tmp 1976 5A9E.tmp 808 5B3A.tmp 2876 5BC6.tmp 1844 5C53.tmp 1780 5CFE.tmp 2904 5D8B.tmp 1424 5E17.tmp 2960 5EB3.tmp 2788 5F4F.tmp 2512 5FCC.tmp 2124 6078.tmp 632 60F4.tmp 1852 6171.tmp 408 61BF.tmp 1896 624C.tmp 1732 629A.tmp 824 6307.tmp 1356 6355.tmp 2380 63C2.tmp 1304 6401.tmp 1564 648D.tmp 2284 64DB.tmp 2520 6539.tmp 1952 6587.tmp 1728 65F4.tmp 2304 6642.tmp 1588 66AF.tmp 1924 66ED.tmp 2752 675B.tmp 2696 6799.tmp 2648 67F7.tmp 2828 6835.tmp 2796 6883.tmp 2708 68C1.tmp 2556 6900.tmp 2560 693E.tmp 2392 698C.tmp 2396 69CB.tmp 588 6A09.tmp 640 6A47.tmp 2152 6A86.tmp 3012 6AC4.tmp 2228 6B03.tmp 2872 6B41.tmp 2792 6B7F.tmp 2908 6BBE.tmp 1736 6C0C.tmp 1916 6C4A.tmp 3016 6C89.tmp 2076 6CC7.tmp 1788 6D15.tmp 848 6D53.tmp 2316 6D92.tmp -
Loads dropped DLL 64 IoCs
pid Process 2636 2024-09-04_8e117ae18234ac4712a7fdb64c37c341_mafia.exe 2684 5448.tmp 2764 5496.tmp 2832 5532.tmp 2660 5580.tmp 2024 564A.tmp 2544 5725.tmp 2664 5792.tmp 2112 585D.tmp 776 58DA.tmp 3012 5966.tmp 2264 59F2.tmp 1976 5A9E.tmp 808 5B3A.tmp 2876 5BC6.tmp 1844 5C53.tmp 1780 5CFE.tmp 2904 5D8B.tmp 1424 5E17.tmp 2960 5EB3.tmp 2788 5F4F.tmp 2512 5FCC.tmp 2124 6078.tmp 632 60F4.tmp 1852 6171.tmp 408 61BF.tmp 1896 624C.tmp 1732 629A.tmp 824 6307.tmp 1356 6355.tmp 2380 63C2.tmp 1304 6401.tmp 1564 648D.tmp 2284 64DB.tmp 2520 6539.tmp 1952 6587.tmp 1728 65F4.tmp 2304 6642.tmp 1588 66AF.tmp 1924 66ED.tmp 2752 675B.tmp 2696 6799.tmp 2648 67F7.tmp 2828 6835.tmp 2796 6883.tmp 2708 68C1.tmp 2556 6900.tmp 2560 693E.tmp 2392 698C.tmp 2396 69CB.tmp 588 6A09.tmp 640 6A47.tmp 2152 6A86.tmp 3012 6AC4.tmp 2228 6B03.tmp 2872 6B41.tmp 2792 6B7F.tmp 2908 6BBE.tmp 1736 6C0C.tmp 1916 6C4A.tmp 3016 6C89.tmp 2076 6CC7.tmp 1788 6D15.tmp 848 6D53.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7050.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 310F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9231.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF88.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C10E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9270.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBAD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 761A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 712A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 897B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FED8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2877.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5947.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA29.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E975.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E4D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 903E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D79.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAF6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 385F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6883.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 731D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2636 wrote to memory of 2684 2636 2024-09-04_8e117ae18234ac4712a7fdb64c37c341_mafia.exe 30 PID 2636 wrote to memory of 2684 2636 2024-09-04_8e117ae18234ac4712a7fdb64c37c341_mafia.exe 30 PID 2636 wrote to memory of 2684 2636 2024-09-04_8e117ae18234ac4712a7fdb64c37c341_mafia.exe 30 PID 2636 wrote to memory of 2684 2636 2024-09-04_8e117ae18234ac4712a7fdb64c37c341_mafia.exe 30 PID 2684 wrote to memory of 2764 2684 5448.tmp 31 PID 2684 wrote to memory of 2764 2684 5448.tmp 31 PID 2684 wrote to memory of 2764 2684 5448.tmp 31 PID 2684 wrote to memory of 2764 2684 5448.tmp 31 PID 2764 wrote to memory of 2832 2764 5496.tmp 32 PID 2764 wrote to memory of 2832 2764 5496.tmp 32 PID 2764 wrote to memory of 2832 2764 5496.tmp 32 PID 2764 wrote to memory of 2832 2764 5496.tmp 32 PID 2832 wrote to memory of 2660 2832 5532.tmp 33 PID 2832 wrote to memory of 2660 2832 5532.tmp 33 PID 2832 wrote to memory of 2660 2832 5532.tmp 33 PID 2832 wrote to memory of 2660 2832 5532.tmp 33 PID 2660 wrote to memory of 2024 2660 5580.tmp 34 PID 2660 wrote to memory of 2024 2660 5580.tmp 34 PID 2660 wrote to memory of 2024 2660 5580.tmp 34 PID 2660 wrote to memory of 2024 2660 5580.tmp 34 PID 2024 wrote to memory of 2544 2024 564A.tmp 35 PID 2024 wrote to memory of 2544 2024 564A.tmp 35 PID 2024 wrote to memory of 2544 2024 564A.tmp 35 PID 2024 wrote to memory of 2544 2024 564A.tmp 35 PID 2544 wrote to memory of 2664 2544 5725.tmp 36 PID 2544 wrote to memory of 2664 2544 5725.tmp 36 PID 2544 wrote to memory of 2664 2544 5725.tmp 36 PID 2544 wrote to memory of 2664 2544 5725.tmp 36 PID 2664 wrote to memory of 2112 2664 5792.tmp 37 PID 2664 wrote to memory of 2112 2664 5792.tmp 37 PID 2664 wrote to memory of 2112 2664 5792.tmp 37 PID 2664 wrote to memory of 2112 2664 5792.tmp 37 PID 2112 wrote to memory of 776 2112 585D.tmp 38 PID 2112 wrote to memory of 776 2112 585D.tmp 38 PID 2112 wrote to memory of 776 2112 585D.tmp 38 PID 2112 wrote to memory of 776 2112 585D.tmp 38 PID 776 wrote to memory of 3012 776 58DA.tmp 39 PID 776 wrote to memory of 3012 776 58DA.tmp 39 PID 776 wrote to memory of 3012 776 58DA.tmp 39 PID 776 wrote to memory of 3012 776 58DA.tmp 39 PID 3012 wrote to memory of 2264 3012 5966.tmp 40 PID 3012 wrote to memory of 2264 3012 5966.tmp 40 PID 3012 wrote to memory of 2264 3012 5966.tmp 40 PID 3012 wrote to memory of 2264 3012 5966.tmp 40 PID 2264 wrote to memory of 1976 2264 59F2.tmp 41 PID 2264 wrote to memory of 1976 2264 59F2.tmp 41 PID 2264 wrote to memory of 1976 2264 59F2.tmp 41 PID 2264 wrote to memory of 1976 2264 59F2.tmp 41 PID 1976 wrote to memory of 808 1976 5A9E.tmp 42 PID 1976 wrote to memory of 808 1976 5A9E.tmp 42 PID 1976 wrote to memory of 808 1976 5A9E.tmp 42 PID 1976 wrote to memory of 808 1976 5A9E.tmp 42 PID 808 wrote to memory of 2876 808 5B3A.tmp 43 PID 808 wrote to memory of 2876 808 5B3A.tmp 43 PID 808 wrote to memory of 2876 808 5B3A.tmp 43 PID 808 wrote to memory of 2876 808 5B3A.tmp 43 PID 2876 wrote to memory of 1844 2876 5BC6.tmp 44 PID 2876 wrote to memory of 1844 2876 5BC6.tmp 44 PID 2876 wrote to memory of 1844 2876 5BC6.tmp 44 PID 2876 wrote to memory of 1844 2876 5BC6.tmp 44 PID 1844 wrote to memory of 1780 1844 5C53.tmp 45 PID 1844 wrote to memory of 1780 1844 5C53.tmp 45 PID 1844 wrote to memory of 1780 1844 5C53.tmp 45 PID 1844 wrote to memory of 1780 1844 5C53.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-04_8e117ae18234ac4712a7fdb64c37c341_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-04_8e117ae18234ac4712a7fdb64c37c341_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\5448.tmp"C:\Users\Admin\AppData\Local\Temp\5448.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\5496.tmp"C:\Users\Admin\AppData\Local\Temp\5496.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\5532.tmp"C:\Users\Admin\AppData\Local\Temp\5532.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\5580.tmp"C:\Users\Admin\AppData\Local\Temp\5580.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\564A.tmp"C:\Users\Admin\AppData\Local\Temp\564A.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\5725.tmp"C:\Users\Admin\AppData\Local\Temp\5725.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\5792.tmp"C:\Users\Admin\AppData\Local\Temp\5792.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\585D.tmp"C:\Users\Admin\AppData\Local\Temp\585D.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\58DA.tmp"C:\Users\Admin\AppData\Local\Temp\58DA.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Users\Admin\AppData\Local\Temp\5966.tmp"C:\Users\Admin\AppData\Local\Temp\5966.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\59F2.tmp"C:\Users\Admin\AppData\Local\Temp\59F2.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\5B3A.tmp"C:\Users\Admin\AppData\Local\Temp\5B3A.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Users\Admin\AppData\Local\Temp\5BC6.tmp"C:\Users\Admin\AppData\Local\Temp\5BC6.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\5C53.tmp"C:\Users\Admin\AppData\Local\Temp\5C53.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\5CFE.tmp"C:\Users\Admin\AppData\Local\Temp\5CFE.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\5D8B.tmp"C:\Users\Admin\AppData\Local\Temp\5D8B.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\5E17.tmp"C:\Users\Admin\AppData\Local\Temp\5E17.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\5EB3.tmp"C:\Users\Admin\AppData\Local\Temp\5EB3.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\5F4F.tmp"C:\Users\Admin\AppData\Local\Temp\5F4F.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\5FCC.tmp"C:\Users\Admin\AppData\Local\Temp\5FCC.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\6078.tmp"C:\Users\Admin\AppData\Local\Temp\6078.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\60F4.tmp"C:\Users\Admin\AppData\Local\Temp\60F4.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:632 -
C:\Users\Admin\AppData\Local\Temp\6171.tmp"C:\Users\Admin\AppData\Local\Temp\6171.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\61BF.tmp"C:\Users\Admin\AppData\Local\Temp\61BF.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:408 -
C:\Users\Admin\AppData\Local\Temp\624C.tmp"C:\Users\Admin\AppData\Local\Temp\624C.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\629A.tmp"C:\Users\Admin\AppData\Local\Temp\629A.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\6307.tmp"C:\Users\Admin\AppData\Local\Temp\6307.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:824 -
C:\Users\Admin\AppData\Local\Temp\6355.tmp"C:\Users\Admin\AppData\Local\Temp\6355.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\63C2.tmp"C:\Users\Admin\AppData\Local\Temp\63C2.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\6401.tmp"C:\Users\Admin\AppData\Local\Temp\6401.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\648D.tmp"C:\Users\Admin\AppData\Local\Temp\648D.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\64DB.tmp"C:\Users\Admin\AppData\Local\Temp\64DB.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\6539.tmp"C:\Users\Admin\AppData\Local\Temp\6539.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\6587.tmp"C:\Users\Admin\AppData\Local\Temp\6587.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\65F4.tmp"C:\Users\Admin\AppData\Local\Temp\65F4.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\6642.tmp"C:\Users\Admin\AppData\Local\Temp\6642.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\66AF.tmp"C:\Users\Admin\AppData\Local\Temp\66AF.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\66ED.tmp"C:\Users\Admin\AppData\Local\Temp\66ED.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\675B.tmp"C:\Users\Admin\AppData\Local\Temp\675B.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\6799.tmp"C:\Users\Admin\AppData\Local\Temp\6799.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\67F7.tmp"C:\Users\Admin\AppData\Local\Temp\67F7.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\6835.tmp"C:\Users\Admin\AppData\Local\Temp\6835.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\6883.tmp"C:\Users\Admin\AppData\Local\Temp\6883.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\68C1.tmp"C:\Users\Admin\AppData\Local\Temp\68C1.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\6900.tmp"C:\Users\Admin\AppData\Local\Temp\6900.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\693E.tmp"C:\Users\Admin\AppData\Local\Temp\693E.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\698C.tmp"C:\Users\Admin\AppData\Local\Temp\698C.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\69CB.tmp"C:\Users\Admin\AppData\Local\Temp\69CB.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\6A09.tmp"C:\Users\Admin\AppData\Local\Temp\6A09.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:588 -
C:\Users\Admin\AppData\Local\Temp\6A47.tmp"C:\Users\Admin\AppData\Local\Temp\6A47.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:640 -
C:\Users\Admin\AppData\Local\Temp\6A86.tmp"C:\Users\Admin\AppData\Local\Temp\6A86.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\6AC4.tmp"C:\Users\Admin\AppData\Local\Temp\6AC4.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\6B03.tmp"C:\Users\Admin\AppData\Local\Temp\6B03.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\6B41.tmp"C:\Users\Admin\AppData\Local\Temp\6B41.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\6B7F.tmp"C:\Users\Admin\AppData\Local\Temp\6B7F.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\6BBE.tmp"C:\Users\Admin\AppData\Local\Temp\6BBE.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\6C0C.tmp"C:\Users\Admin\AppData\Local\Temp\6C0C.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\6C4A.tmp"C:\Users\Admin\AppData\Local\Temp\6C4A.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\6C89.tmp"C:\Users\Admin\AppData\Local\Temp\6C89.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\6CC7.tmp"C:\Users\Admin\AppData\Local\Temp\6CC7.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\6D15.tmp"C:\Users\Admin\AppData\Local\Temp\6D15.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\6D53.tmp"C:\Users\Admin\AppData\Local\Temp\6D53.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:848 -
C:\Users\Admin\AppData\Local\Temp\6D92.tmp"C:\Users\Admin\AppData\Local\Temp\6D92.tmp"65⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\6DD0.tmp"C:\Users\Admin\AppData\Local\Temp\6DD0.tmp"66⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\6E0F.tmp"C:\Users\Admin\AppData\Local\Temp\6E0F.tmp"67⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\6E4D.tmp"C:\Users\Admin\AppData\Local\Temp\6E4D.tmp"68⤵
- System Location Discovery: System Language Discovery
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\6E8B.tmp"C:\Users\Admin\AppData\Local\Temp\6E8B.tmp"69⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\6ECA.tmp"C:\Users\Admin\AppData\Local\Temp\6ECA.tmp"70⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\6F08.tmp"C:\Users\Admin\AppData\Local\Temp\6F08.tmp"71⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\6F47.tmp"C:\Users\Admin\AppData\Local\Temp\6F47.tmp"72⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\6F85.tmp"C:\Users\Admin\AppData\Local\Temp\6F85.tmp"73⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\6FD3.tmp"C:\Users\Admin\AppData\Local\Temp\6FD3.tmp"74⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\7011.tmp"C:\Users\Admin\AppData\Local\Temp\7011.tmp"75⤵PID:292
-
C:\Users\Admin\AppData\Local\Temp\7050.tmp"C:\Users\Admin\AppData\Local\Temp\7050.tmp"76⤵
- System Location Discovery: System Language Discovery
PID:888 -
C:\Users\Admin\AppData\Local\Temp\709E.tmp"C:\Users\Admin\AppData\Local\Temp\709E.tmp"77⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\70DC.tmp"C:\Users\Admin\AppData\Local\Temp\70DC.tmp"78⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\712A.tmp"C:\Users\Admin\AppData\Local\Temp\712A.tmp"79⤵
- System Location Discovery: System Language Discovery
PID:356 -
C:\Users\Admin\AppData\Local\Temp\7169.tmp"C:\Users\Admin\AppData\Local\Temp\7169.tmp"80⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\71A7.tmp"C:\Users\Admin\AppData\Local\Temp\71A7.tmp"81⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\71E5.tmp"C:\Users\Admin\AppData\Local\Temp\71E5.tmp"82⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\7224.tmp"C:\Users\Admin\AppData\Local\Temp\7224.tmp"83⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\7262.tmp"C:\Users\Admin\AppData\Local\Temp\7262.tmp"84⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\72A1.tmp"C:\Users\Admin\AppData\Local\Temp\72A1.tmp"85⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\72DF.tmp"C:\Users\Admin\AppData\Local\Temp\72DF.tmp"86⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"87⤵
- System Location Discovery: System Language Discovery
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\735C.tmp"C:\Users\Admin\AppData\Local\Temp\735C.tmp"88⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\739A.tmp"C:\Users\Admin\AppData\Local\Temp\739A.tmp"89⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\73D9.tmp"C:\Users\Admin\AppData\Local\Temp\73D9.tmp"90⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"91⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\7465.tmp"C:\Users\Admin\AppData\Local\Temp\7465.tmp"92⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\74A3.tmp"C:\Users\Admin\AppData\Local\Temp\74A3.tmp"93⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"94⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"95⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\755F.tmp"C:\Users\Admin\AppData\Local\Temp\755F.tmp"96⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\759D.tmp"C:\Users\Admin\AppData\Local\Temp\759D.tmp"97⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\75DB.tmp"C:\Users\Admin\AppData\Local\Temp\75DB.tmp"98⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"99⤵
- System Location Discovery: System Language Discovery
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\7658.tmp"C:\Users\Admin\AppData\Local\Temp\7658.tmp"100⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\7697.tmp"C:\Users\Admin\AppData\Local\Temp\7697.tmp"101⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\76D5.tmp"C:\Users\Admin\AppData\Local\Temp\76D5.tmp"102⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\7713.tmp"C:\Users\Admin\AppData\Local\Temp\7713.tmp"103⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\7752.tmp"C:\Users\Admin\AppData\Local\Temp\7752.tmp"104⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\7790.tmp"C:\Users\Admin\AppData\Local\Temp\7790.tmp"105⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\77CF.tmp"C:\Users\Admin\AppData\Local\Temp\77CF.tmp"106⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\780D.tmp"C:\Users\Admin\AppData\Local\Temp\780D.tmp"107⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\784B.tmp"C:\Users\Admin\AppData\Local\Temp\784B.tmp"108⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\788A.tmp"C:\Users\Admin\AppData\Local\Temp\788A.tmp"109⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\78C8.tmp"C:\Users\Admin\AppData\Local\Temp\78C8.tmp"110⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\7907.tmp"C:\Users\Admin\AppData\Local\Temp\7907.tmp"111⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\7945.tmp"C:\Users\Admin\AppData\Local\Temp\7945.tmp"112⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\7983.tmp"C:\Users\Admin\AppData\Local\Temp\7983.tmp"113⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\79C2.tmp"C:\Users\Admin\AppData\Local\Temp\79C2.tmp"114⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\7A00.tmp"C:\Users\Admin\AppData\Local\Temp\7A00.tmp"115⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\7A3F.tmp"C:\Users\Admin\AppData\Local\Temp\7A3F.tmp"116⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\7A7D.tmp"C:\Users\Admin\AppData\Local\Temp\7A7D.tmp"117⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\7ACB.tmp"C:\Users\Admin\AppData\Local\Temp\7ACB.tmp"118⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\7B09.tmp"C:\Users\Admin\AppData\Local\Temp\7B09.tmp"119⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\7B48.tmp"C:\Users\Admin\AppData\Local\Temp\7B48.tmp"120⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\7B86.tmp"C:\Users\Admin\AppData\Local\Temp\7B86.tmp"121⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\7BC5.tmp"C:\Users\Admin\AppData\Local\Temp\7BC5.tmp"122⤵PID:1556
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-