Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05-09-2024 22:02
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-05_fe3ab1595389de95c7a5a403297fc90d_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-05_fe3ab1595389de95c7a5a403297fc90d_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-05_fe3ab1595389de95c7a5a403297fc90d_mafia.exe
-
Size
520KB
-
MD5
fe3ab1595389de95c7a5a403297fc90d
-
SHA1
8b1a87615355a78c7055d854aeafd175f72c828f
-
SHA256
8a2cc39081c9a659dd63496f95402c41e1b6e9b11f346fcba4f34bdb08c34817
-
SHA512
c988d49c23488aed204c45e06c2a5bf4340a0d5f367b2281e3a375a6276363e5a04e98c9e52bb10d06979268219764d5fb61000149b176acb384588b8314c9a0
-
SSDEEP
6144:lLvd/XzCjUIF1UuXLyQjmOH+JjLY+ND1YPe6tFTfY+xgbljhH0A2sb8/K6cs071v:roRXOQjmOyI+NDKPe67AnHPh8RcXNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2772 F4BB.tmp 2712 F557.tmp 2852 F5E3.tmp 2756 F670.tmp 2724 F6DD.tmp 2560 F75A.tmp 2636 F7C7.tmp 2620 F824.tmp 1620 F892.tmp 1292 F91E.tmp 2660 F99B.tmp 3036 FA18.tmp 1900 FA85.tmp 2440 FB02.tmp 992 FB8E.tmp 2804 FBFB.tmp 2280 FC78.tmp 2884 FCE5.tmp 1196 FD62.tmp 2176 FDCF.tmp 1760 FE4C.tmp 1296 FED8.tmp 2168 FF46.tmp 2204 FF94.tmp 1880 FFE2.tmp 2164 30.tmp 1628 7E.tmp 788 CC.tmp 2364 10A.tmp 700 158.tmp 1316 1A6.tmp 1920 1F4.tmp 1820 242.tmp 792 290.tmp 1668 2DE.tmp 1692 31C.tmp 1556 35B.tmp 2656 3A9.tmp 1720 3E7.tmp 916 435.tmp 2064 483.tmp 2352 4D1.tmp 3044 510.tmp 1756 55E.tmp 3012 5AC.tmp 2196 5FA.tmp 1796 648.tmp 1092 696.tmp 1520 6E4.tmp 2860 732.tmp 1596 780.tmp 2764 7CE.tmp 2784 81C.tmp 2772 889.tmp 2836 8C7.tmp 2848 915.tmp 2852 963.tmp 2932 9A2.tmp 2828 9E0.tmp 2724 A1E.tmp 2728 A6C.tmp 3056 ABA.tmp 2636 B08.tmp 1588 B56.tmp -
Loads dropped DLL 64 IoCs
pid Process 2704 2024-09-05_fe3ab1595389de95c7a5a403297fc90d_mafia.exe 2772 F4BB.tmp 2712 F557.tmp 2852 F5E3.tmp 2756 F670.tmp 2724 F6DD.tmp 2560 F75A.tmp 2636 F7C7.tmp 2620 F824.tmp 1620 F892.tmp 1292 F91E.tmp 2660 F99B.tmp 3036 FA18.tmp 1900 FA85.tmp 2440 FB02.tmp 992 FB8E.tmp 2804 FBFB.tmp 2280 FC78.tmp 2884 FCE5.tmp 1196 FD62.tmp 2176 FDCF.tmp 1760 FE4C.tmp 1296 FED8.tmp 2168 FF46.tmp 2204 FF94.tmp 1880 FFE2.tmp 2164 30.tmp 1628 7E.tmp 788 CC.tmp 2364 10A.tmp 700 158.tmp 1316 1A6.tmp 1920 1F4.tmp 1820 242.tmp 792 290.tmp 1668 2DE.tmp 1692 31C.tmp 1556 35B.tmp 2656 3A9.tmp 1720 3E7.tmp 916 435.tmp 2064 483.tmp 2352 4D1.tmp 3044 510.tmp 1756 55E.tmp 3012 5AC.tmp 2196 5FA.tmp 1796 648.tmp 1092 696.tmp 1520 6E4.tmp 2860 732.tmp 1596 780.tmp 2764 7CE.tmp 2784 81C.tmp 2772 889.tmp 2836 8C7.tmp 2848 915.tmp 2852 963.tmp 2932 9A2.tmp 2828 9E0.tmp 2724 A1E.tmp 2728 A6C.tmp 3056 ABA.tmp 2636 B08.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4692.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E61.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C35F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E965.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9702.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C12D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3247.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 849B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A093.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C0E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 696.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A341.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CD8.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2704 wrote to memory of 2772 2704 2024-09-05_fe3ab1595389de95c7a5a403297fc90d_mafia.exe 31 PID 2704 wrote to memory of 2772 2704 2024-09-05_fe3ab1595389de95c7a5a403297fc90d_mafia.exe 31 PID 2704 wrote to memory of 2772 2704 2024-09-05_fe3ab1595389de95c7a5a403297fc90d_mafia.exe 31 PID 2704 wrote to memory of 2772 2704 2024-09-05_fe3ab1595389de95c7a5a403297fc90d_mafia.exe 31 PID 2772 wrote to memory of 2712 2772 F4BB.tmp 32 PID 2772 wrote to memory of 2712 2772 F4BB.tmp 32 PID 2772 wrote to memory of 2712 2772 F4BB.tmp 32 PID 2772 wrote to memory of 2712 2772 F4BB.tmp 32 PID 2712 wrote to memory of 2852 2712 F557.tmp 33 PID 2712 wrote to memory of 2852 2712 F557.tmp 33 PID 2712 wrote to memory of 2852 2712 F557.tmp 33 PID 2712 wrote to memory of 2852 2712 F557.tmp 33 PID 2852 wrote to memory of 2756 2852 F5E3.tmp 34 PID 2852 wrote to memory of 2756 2852 F5E3.tmp 34 PID 2852 wrote to memory of 2756 2852 F5E3.tmp 34 PID 2852 wrote to memory of 2756 2852 F5E3.tmp 34 PID 2756 wrote to memory of 2724 2756 F670.tmp 35 PID 2756 wrote to memory of 2724 2756 F670.tmp 35 PID 2756 wrote to memory of 2724 2756 F670.tmp 35 PID 2756 wrote to memory of 2724 2756 F670.tmp 35 PID 2724 wrote to memory of 2560 2724 F6DD.tmp 36 PID 2724 wrote to memory of 2560 2724 F6DD.tmp 36 PID 2724 wrote to memory of 2560 2724 F6DD.tmp 36 PID 2724 wrote to memory of 2560 2724 F6DD.tmp 36 PID 2560 wrote to memory of 2636 2560 F75A.tmp 37 PID 2560 wrote to memory of 2636 2560 F75A.tmp 37 PID 2560 wrote to memory of 2636 2560 F75A.tmp 37 PID 2560 wrote to memory of 2636 2560 F75A.tmp 37 PID 2636 wrote to memory of 2620 2636 F7C7.tmp 38 PID 2636 wrote to memory of 2620 2636 F7C7.tmp 38 PID 2636 wrote to memory of 2620 2636 F7C7.tmp 38 PID 2636 wrote to memory of 2620 2636 F7C7.tmp 38 PID 2620 wrote to memory of 1620 2620 F824.tmp 39 PID 2620 wrote to memory of 1620 2620 F824.tmp 39 PID 2620 wrote to memory of 1620 2620 F824.tmp 39 PID 2620 wrote to memory of 1620 2620 F824.tmp 39 PID 1620 wrote to memory of 1292 1620 F892.tmp 40 PID 1620 wrote to memory of 1292 1620 F892.tmp 40 PID 1620 wrote to memory of 1292 1620 F892.tmp 40 PID 1620 wrote to memory of 1292 1620 F892.tmp 40 PID 1292 wrote to memory of 2660 1292 F91E.tmp 41 PID 1292 wrote to memory of 2660 1292 F91E.tmp 41 PID 1292 wrote to memory of 2660 1292 F91E.tmp 41 PID 1292 wrote to memory of 2660 1292 F91E.tmp 41 PID 2660 wrote to memory of 3036 2660 F99B.tmp 42 PID 2660 wrote to memory of 3036 2660 F99B.tmp 42 PID 2660 wrote to memory of 3036 2660 F99B.tmp 42 PID 2660 wrote to memory of 3036 2660 F99B.tmp 42 PID 3036 wrote to memory of 1900 3036 FA18.tmp 43 PID 3036 wrote to memory of 1900 3036 FA18.tmp 43 PID 3036 wrote to memory of 1900 3036 FA18.tmp 43 PID 3036 wrote to memory of 1900 3036 FA18.tmp 43 PID 1900 wrote to memory of 2440 1900 FA85.tmp 44 PID 1900 wrote to memory of 2440 1900 FA85.tmp 44 PID 1900 wrote to memory of 2440 1900 FA85.tmp 44 PID 1900 wrote to memory of 2440 1900 FA85.tmp 44 PID 2440 wrote to memory of 992 2440 FB02.tmp 45 PID 2440 wrote to memory of 992 2440 FB02.tmp 45 PID 2440 wrote to memory of 992 2440 FB02.tmp 45 PID 2440 wrote to memory of 992 2440 FB02.tmp 45 PID 992 wrote to memory of 2804 992 FB8E.tmp 46 PID 992 wrote to memory of 2804 992 FB8E.tmp 46 PID 992 wrote to memory of 2804 992 FB8E.tmp 46 PID 992 wrote to memory of 2804 992 FB8E.tmp 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-05_fe3ab1595389de95c7a5a403297fc90d_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-05_fe3ab1595389de95c7a5a403297fc90d_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\F4BB.tmp"C:\Users\Admin\AppData\Local\Temp\F4BB.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\F557.tmp"C:\Users\Admin\AppData\Local\Temp\F557.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\F5E3.tmp"C:\Users\Admin\AppData\Local\Temp\F5E3.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\F670.tmp"C:\Users\Admin\AppData\Local\Temp\F670.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\F6DD.tmp"C:\Users\Admin\AppData\Local\Temp\F6DD.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\F75A.tmp"C:\Users\Admin\AppData\Local\Temp\F75A.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\F7C7.tmp"C:\Users\Admin\AppData\Local\Temp\F7C7.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\F824.tmp"C:\Users\Admin\AppData\Local\Temp\F824.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\F892.tmp"C:\Users\Admin\AppData\Local\Temp\F892.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\F91E.tmp"C:\Users\Admin\AppData\Local\Temp\F91E.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\F99B.tmp"C:\Users\Admin\AppData\Local\Temp\F99B.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\FA18.tmp"C:\Users\Admin\AppData\Local\Temp\FA18.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\FA85.tmp"C:\Users\Admin\AppData\Local\Temp\FA85.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\FB02.tmp"C:\Users\Admin\AppData\Local\Temp\FB02.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\FB8E.tmp"C:\Users\Admin\AppData\Local\Temp\FB8E.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\AppData\Local\Temp\FBFB.tmp"C:\Users\Admin\AppData\Local\Temp\FBFB.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\FC78.tmp"C:\Users\Admin\AppData\Local\Temp\FC78.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\FCE5.tmp"C:\Users\Admin\AppData\Local\Temp\FCE5.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\FD62.tmp"C:\Users\Admin\AppData\Local\Temp\FD62.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\FDCF.tmp"C:\Users\Admin\AppData\Local\Temp\FDCF.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\FE4C.tmp"C:\Users\Admin\AppData\Local\Temp\FE4C.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\FED8.tmp"C:\Users\Admin\AppData\Local\Temp\FED8.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\FF46.tmp"C:\Users\Admin\AppData\Local\Temp\FF46.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\FF94.tmp"C:\Users\Admin\AppData\Local\Temp\FF94.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\FFE2.tmp"C:\Users\Admin\AppData\Local\Temp\FFE2.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\30.tmp"C:\Users\Admin\AppData\Local\Temp\30.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\7E.tmp"C:\Users\Admin\AppData\Local\Temp\7E.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\CC.tmp"C:\Users\Admin\AppData\Local\Temp\CC.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:788 -
C:\Users\Admin\AppData\Local\Temp\10A.tmp"C:\Users\Admin\AppData\Local\Temp\10A.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\158.tmp"C:\Users\Admin\AppData\Local\Temp\158.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:700 -
C:\Users\Admin\AppData\Local\Temp\1A6.tmp"C:\Users\Admin\AppData\Local\Temp\1A6.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\1F4.tmp"C:\Users\Admin\AppData\Local\Temp\1F4.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\242.tmp"C:\Users\Admin\AppData\Local\Temp\242.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\290.tmp"C:\Users\Admin\AppData\Local\Temp\290.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:792 -
C:\Users\Admin\AppData\Local\Temp\2DE.tmp"C:\Users\Admin\AppData\Local\Temp\2DE.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\31C.tmp"C:\Users\Admin\AppData\Local\Temp\31C.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\35B.tmp"C:\Users\Admin\AppData\Local\Temp\35B.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\3A9.tmp"C:\Users\Admin\AppData\Local\Temp\3A9.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\3E7.tmp"C:\Users\Admin\AppData\Local\Temp\3E7.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\435.tmp"C:\Users\Admin\AppData\Local\Temp\435.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:916 -
C:\Users\Admin\AppData\Local\Temp\483.tmp"C:\Users\Admin\AppData\Local\Temp\483.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\4D1.tmp"C:\Users\Admin\AppData\Local\Temp\4D1.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\510.tmp"C:\Users\Admin\AppData\Local\Temp\510.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\55E.tmp"C:\Users\Admin\AppData\Local\Temp\55E.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\5AC.tmp"C:\Users\Admin\AppData\Local\Temp\5AC.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\5FA.tmp"C:\Users\Admin\AppData\Local\Temp\5FA.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\648.tmp"C:\Users\Admin\AppData\Local\Temp\648.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\696.tmp"C:\Users\Admin\AppData\Local\Temp\696.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\6E4.tmp"C:\Users\Admin\AppData\Local\Temp\6E4.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\732.tmp"C:\Users\Admin\AppData\Local\Temp\732.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\780.tmp"C:\Users\Admin\AppData\Local\Temp\780.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\7CE.tmp"C:\Users\Admin\AppData\Local\Temp\7CE.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\81C.tmp"C:\Users\Admin\AppData\Local\Temp\81C.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\889.tmp"C:\Users\Admin\AppData\Local\Temp\889.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\8C7.tmp"C:\Users\Admin\AppData\Local\Temp\8C7.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\915.tmp"C:\Users\Admin\AppData\Local\Temp\915.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\963.tmp"C:\Users\Admin\AppData\Local\Temp\963.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\9A2.tmp"C:\Users\Admin\AppData\Local\Temp\9A2.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\9E0.tmp"C:\Users\Admin\AppData\Local\Temp\9E0.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\A1E.tmp"C:\Users\Admin\AppData\Local\Temp\A1E.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\A6C.tmp"C:\Users\Admin\AppData\Local\Temp\A6C.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\ABA.tmp"C:\Users\Admin\AppData\Local\Temp\ABA.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\B08.tmp"C:\Users\Admin\AppData\Local\Temp\B08.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\B56.tmp"C:\Users\Admin\AppData\Local\Temp\B56.tmp"65⤵
- Executes dropped EXE
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\BA4.tmp"C:\Users\Admin\AppData\Local\Temp\BA4.tmp"66⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\BF2.tmp"C:\Users\Admin\AppData\Local\Temp\BF2.tmp"67⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\C40.tmp"C:\Users\Admin\AppData\Local\Temp\C40.tmp"68⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\C8E.tmp"C:\Users\Admin\AppData\Local\Temp\C8E.tmp"69⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\CDC.tmp"C:\Users\Admin\AppData\Local\Temp\CDC.tmp"70⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\D2A.tmp"C:\Users\Admin\AppData\Local\Temp\D2A.tmp"71⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\D69.tmp"C:\Users\Admin\AppData\Local\Temp\D69.tmp"72⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\DA7.tmp"C:\Users\Admin\AppData\Local\Temp\DA7.tmp"73⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\DE6.tmp"C:\Users\Admin\AppData\Local\Temp\DE6.tmp"74⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\E34.tmp"C:\Users\Admin\AppData\Local\Temp\E34.tmp"75⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\E82.tmp"C:\Users\Admin\AppData\Local\Temp\E82.tmp"76⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\ED0.tmp"C:\Users\Admin\AppData\Local\Temp\ED0.tmp"77⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\F1E.tmp"C:\Users\Admin\AppData\Local\Temp\F1E.tmp"78⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\F5C.tmp"C:\Users\Admin\AppData\Local\Temp\F5C.tmp"79⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\FAA.tmp"C:\Users\Admin\AppData\Local\Temp\FAA.tmp"80⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\FF8.tmp"C:\Users\Admin\AppData\Local\Temp\FF8.tmp"81⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\1036.tmp"C:\Users\Admin\AppData\Local\Temp\1036.tmp"82⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\1084.tmp"C:\Users\Admin\AppData\Local\Temp\1084.tmp"83⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\10D2.tmp"C:\Users\Admin\AppData\Local\Temp\10D2.tmp"84⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\1120.tmp"C:\Users\Admin\AppData\Local\Temp\1120.tmp"85⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\116E.tmp"C:\Users\Admin\AppData\Local\Temp\116E.tmp"86⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\11BC.tmp"C:\Users\Admin\AppData\Local\Temp\11BC.tmp"87⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\11FB.tmp"C:\Users\Admin\AppData\Local\Temp\11FB.tmp"88⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\1249.tmp"C:\Users\Admin\AppData\Local\Temp\1249.tmp"89⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\1287.tmp"C:\Users\Admin\AppData\Local\Temp\1287.tmp"90⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\12D5.tmp"C:\Users\Admin\AppData\Local\Temp\12D5.tmp"91⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\1323.tmp"C:\Users\Admin\AppData\Local\Temp\1323.tmp"92⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\1371.tmp"C:\Users\Admin\AppData\Local\Temp\1371.tmp"93⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\13B0.tmp"C:\Users\Admin\AppData\Local\Temp\13B0.tmp"94⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\13FE.tmp"C:\Users\Admin\AppData\Local\Temp\13FE.tmp"95⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\144C.tmp"C:\Users\Admin\AppData\Local\Temp\144C.tmp"96⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\149A.tmp"C:\Users\Admin\AppData\Local\Temp\149A.tmp"97⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\14E8.tmp"C:\Users\Admin\AppData\Local\Temp\14E8.tmp"98⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\1526.tmp"C:\Users\Admin\AppData\Local\Temp\1526.tmp"99⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\1564.tmp"C:\Users\Admin\AppData\Local\Temp\1564.tmp"100⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\15B2.tmp"C:\Users\Admin\AppData\Local\Temp\15B2.tmp"101⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\1600.tmp"C:\Users\Admin\AppData\Local\Temp\1600.tmp"102⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\163F.tmp"C:\Users\Admin\AppData\Local\Temp\163F.tmp"103⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\168D.tmp"C:\Users\Admin\AppData\Local\Temp\168D.tmp"104⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\16CB.tmp"C:\Users\Admin\AppData\Local\Temp\16CB.tmp"105⤵
- System Location Discovery: System Language Discovery
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\1719.tmp"C:\Users\Admin\AppData\Local\Temp\1719.tmp"106⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\1758.tmp"C:\Users\Admin\AppData\Local\Temp\1758.tmp"107⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\17A6.tmp"C:\Users\Admin\AppData\Local\Temp\17A6.tmp"108⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\17F4.tmp"C:\Users\Admin\AppData\Local\Temp\17F4.tmp"109⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\1832.tmp"C:\Users\Admin\AppData\Local\Temp\1832.tmp"110⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\1880.tmp"C:\Users\Admin\AppData\Local\Temp\1880.tmp"111⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\18BE.tmp"C:\Users\Admin\AppData\Local\Temp\18BE.tmp"112⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\18FD.tmp"C:\Users\Admin\AppData\Local\Temp\18FD.tmp"113⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\193B.tmp"C:\Users\Admin\AppData\Local\Temp\193B.tmp"114⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\197A.tmp"C:\Users\Admin\AppData\Local\Temp\197A.tmp"115⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\19B8.tmp"C:\Users\Admin\AppData\Local\Temp\19B8.tmp"116⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\1A06.tmp"C:\Users\Admin\AppData\Local\Temp\1A06.tmp"117⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\1A44.tmp"C:\Users\Admin\AppData\Local\Temp\1A44.tmp"118⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\1A92.tmp"C:\Users\Admin\AppData\Local\Temp\1A92.tmp"119⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"120⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\1B0F.tmp"C:\Users\Admin\AppData\Local\Temp\1B0F.tmp"121⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"122⤵PID:2600
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-