Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/09/2024, 11:30
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-11_212e85d329a1fc040f1a939e941140de_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-11_212e85d329a1fc040f1a939e941140de_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-11_212e85d329a1fc040f1a939e941140de_mafia.exe
-
Size
486KB
-
MD5
212e85d329a1fc040f1a939e941140de
-
SHA1
7976877191a3fe8c319d49238e0bfebef1da27d8
-
SHA256
583e95fc248769ee2f6d7e14a87a8c0490f1b5d9ea76c4dd2546f74dcd6d83e1
-
SHA512
3b0515cb88c286ac072c1b62e2b3f55706776c0b35d713e50b23f34b2fc0493bbed8b89b2ed04418362bb2911ddd1b304ec972f88bb694bdad536f8bbaf27600
-
SSDEEP
12288:oU5rCOTeiDI7W6EujFtiJC+mWD6ukgMmMW+BINZ:oUQOJD8E+3sCYLkgMmMJBIN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2640 DDB2.tmp 1636 DE10.tmp 1040 DE9C.tmp 316 DF09.tmp 2708 DF76.tmp 2868 DFD4.tmp 2164 E032.tmp 2856 E09F.tmp 2584 E11C.tmp 2608 E179.tmp 2580 E1E6.tmp 3048 E244.tmp 3064 E2B1.tmp 1444 E30F.tmp 2004 E38C.tmp 772 E3F9.tmp 1128 E466.tmp 2744 E4E3.tmp 1392 E560.tmp 1516 E5CD.tmp 1912 E64A.tmp 2924 E6B7.tmp 2880 E714.tmp 2384 E762.tmp 2380 E7A1.tmp 1308 E7DF.tmp 1464 E81E.tmp 304 E85C.tmp 1856 E89A.tmp 2988 E8D9.tmp 2932 E917.tmp 2444 E956.tmp 956 E994.tmp 952 E9D2.tmp 1472 EA11.tmp 1052 EA4F.tmp 908 EA7E.tmp 1752 EABC.tmp 1776 EAFB.tmp 1860 EB39.tmp 1608 EB78.tmp 988 EBB6.tmp 2280 EBF4.tmp 2244 EC33.tmp 1004 EC81.tmp 1676 ECBF.tmp 2516 ECFE.tmp 676 ED3C.tmp 2472 ED7A.tmp 2964 EDB9.tmp 2644 EDF7.tmp 1588 EE36.tmp 1556 EE74.tmp 2344 EEB2.tmp 2012 EF00.tmp 2752 EF4E.tmp 1060 EF8D.tmp 2212 EFCB.tmp 316 F00A.tmp 2832 F048.tmp 2972 F086.tmp 2868 F0C5.tmp 2164 F103.tmp 2828 F142.tmp -
Loads dropped DLL 64 IoCs
pid Process 1484 2024-09-11_212e85d329a1fc040f1a939e941140de_mafia.exe 2640 DDB2.tmp 1636 DE10.tmp 1040 DE9C.tmp 316 DF09.tmp 2708 DF76.tmp 2868 DFD4.tmp 2164 E032.tmp 2856 E09F.tmp 2584 E11C.tmp 2608 E179.tmp 2580 E1E6.tmp 3048 E244.tmp 3064 E2B1.tmp 1444 E30F.tmp 2004 E38C.tmp 772 E3F9.tmp 1128 E466.tmp 2744 E4E3.tmp 1392 E560.tmp 1516 E5CD.tmp 1912 E64A.tmp 2924 E6B7.tmp 2880 E714.tmp 2384 E762.tmp 2380 E7A1.tmp 1308 E7DF.tmp 1464 E81E.tmp 304 E85C.tmp 1856 E89A.tmp 2988 E8D9.tmp 2932 E917.tmp 2444 E956.tmp 956 E994.tmp 952 E9D2.tmp 1472 EA11.tmp 1052 EA4F.tmp 908 EA7E.tmp 1752 EABC.tmp 1776 EAFB.tmp 1860 EB39.tmp 1608 EB78.tmp 988 EBB6.tmp 2280 EBF4.tmp 2244 EC33.tmp 1004 EC81.tmp 1676 ECBF.tmp 2516 ECFE.tmp 676 ED3C.tmp 2472 ED7A.tmp 2964 EDB9.tmp 2644 EDF7.tmp 1588 EE36.tmp 1556 EE74.tmp 2344 EEB2.tmp 2012 EF00.tmp 2752 EF4E.tmp 1060 EF8D.tmp 2212 EFCB.tmp 316 F00A.tmp 2832 F048.tmp 2972 F086.tmp 2868 F0C5.tmp 2164 F103.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2424.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 696.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A998.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4605.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1362.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BF5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F863.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE36.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9675.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B56A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F103.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 473D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CD8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6671.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 905D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 952E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E179.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 705F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1484 wrote to memory of 2640 1484 2024-09-11_212e85d329a1fc040f1a939e941140de_mafia.exe 31 PID 1484 wrote to memory of 2640 1484 2024-09-11_212e85d329a1fc040f1a939e941140de_mafia.exe 31 PID 1484 wrote to memory of 2640 1484 2024-09-11_212e85d329a1fc040f1a939e941140de_mafia.exe 31 PID 1484 wrote to memory of 2640 1484 2024-09-11_212e85d329a1fc040f1a939e941140de_mafia.exe 31 PID 2640 wrote to memory of 1636 2640 DDB2.tmp 32 PID 2640 wrote to memory of 1636 2640 DDB2.tmp 32 PID 2640 wrote to memory of 1636 2640 DDB2.tmp 32 PID 2640 wrote to memory of 1636 2640 DDB2.tmp 32 PID 1636 wrote to memory of 1040 1636 DE10.tmp 33 PID 1636 wrote to memory of 1040 1636 DE10.tmp 33 PID 1636 wrote to memory of 1040 1636 DE10.tmp 33 PID 1636 wrote to memory of 1040 1636 DE10.tmp 33 PID 1040 wrote to memory of 316 1040 DE9C.tmp 34 PID 1040 wrote to memory of 316 1040 DE9C.tmp 34 PID 1040 wrote to memory of 316 1040 DE9C.tmp 34 PID 1040 wrote to memory of 316 1040 DE9C.tmp 34 PID 316 wrote to memory of 2708 316 DF09.tmp 35 PID 316 wrote to memory of 2708 316 DF09.tmp 35 PID 316 wrote to memory of 2708 316 DF09.tmp 35 PID 316 wrote to memory of 2708 316 DF09.tmp 35 PID 2708 wrote to memory of 2868 2708 DF76.tmp 36 PID 2708 wrote to memory of 2868 2708 DF76.tmp 36 PID 2708 wrote to memory of 2868 2708 DF76.tmp 36 PID 2708 wrote to memory of 2868 2708 DF76.tmp 36 PID 2868 wrote to memory of 2164 2868 DFD4.tmp 37 PID 2868 wrote to memory of 2164 2868 DFD4.tmp 37 PID 2868 wrote to memory of 2164 2868 DFD4.tmp 37 PID 2868 wrote to memory of 2164 2868 DFD4.tmp 37 PID 2164 wrote to memory of 2856 2164 E032.tmp 38 PID 2164 wrote to memory of 2856 2164 E032.tmp 38 PID 2164 wrote to memory of 2856 2164 E032.tmp 38 PID 2164 wrote to memory of 2856 2164 E032.tmp 38 PID 2856 wrote to memory of 2584 2856 E09F.tmp 39 PID 2856 wrote to memory of 2584 2856 E09F.tmp 39 PID 2856 wrote to memory of 2584 2856 E09F.tmp 39 PID 2856 wrote to memory of 2584 2856 E09F.tmp 39 PID 2584 wrote to memory of 2608 2584 E11C.tmp 40 PID 2584 wrote to memory of 2608 2584 E11C.tmp 40 PID 2584 wrote to memory of 2608 2584 E11C.tmp 40 PID 2584 wrote to memory of 2608 2584 E11C.tmp 40 PID 2608 wrote to memory of 2580 2608 E179.tmp 41 PID 2608 wrote to memory of 2580 2608 E179.tmp 41 PID 2608 wrote to memory of 2580 2608 E179.tmp 41 PID 2608 wrote to memory of 2580 2608 E179.tmp 41 PID 2580 wrote to memory of 3048 2580 E1E6.tmp 42 PID 2580 wrote to memory of 3048 2580 E1E6.tmp 42 PID 2580 wrote to memory of 3048 2580 E1E6.tmp 42 PID 2580 wrote to memory of 3048 2580 E1E6.tmp 42 PID 3048 wrote to memory of 3064 3048 E244.tmp 43 PID 3048 wrote to memory of 3064 3048 E244.tmp 43 PID 3048 wrote to memory of 3064 3048 E244.tmp 43 PID 3048 wrote to memory of 3064 3048 E244.tmp 43 PID 3064 wrote to memory of 1444 3064 E2B1.tmp 44 PID 3064 wrote to memory of 1444 3064 E2B1.tmp 44 PID 3064 wrote to memory of 1444 3064 E2B1.tmp 44 PID 3064 wrote to memory of 1444 3064 E2B1.tmp 44 PID 1444 wrote to memory of 2004 1444 E30F.tmp 45 PID 1444 wrote to memory of 2004 1444 E30F.tmp 45 PID 1444 wrote to memory of 2004 1444 E30F.tmp 45 PID 1444 wrote to memory of 2004 1444 E30F.tmp 45 PID 2004 wrote to memory of 772 2004 E38C.tmp 46 PID 2004 wrote to memory of 772 2004 E38C.tmp 46 PID 2004 wrote to memory of 772 2004 E38C.tmp 46 PID 2004 wrote to memory of 772 2004 E38C.tmp 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-11_212e85d329a1fc040f1a939e941140de_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-11_212e85d329a1fc040f1a939e941140de_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\DDB2.tmp"C:\Users\Admin\AppData\Local\Temp\DDB2.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\DE10.tmp"C:\Users\Admin\AppData\Local\Temp\DE10.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\DE9C.tmp"C:\Users\Admin\AppData\Local\Temp\DE9C.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\DF09.tmp"C:\Users\Admin\AppData\Local\Temp\DF09.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Users\Admin\AppData\Local\Temp\DF76.tmp"C:\Users\Admin\AppData\Local\Temp\DF76.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\DFD4.tmp"C:\Users\Admin\AppData\Local\Temp\DFD4.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\E032.tmp"C:\Users\Admin\AppData\Local\Temp\E032.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\E09F.tmp"C:\Users\Admin\AppData\Local\Temp\E09F.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\E11C.tmp"C:\Users\Admin\AppData\Local\Temp\E11C.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\E179.tmp"C:\Users\Admin\AppData\Local\Temp\E179.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\E1E6.tmp"C:\Users\Admin\AppData\Local\Temp\E1E6.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\E244.tmp"C:\Users\Admin\AppData\Local\Temp\E244.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\E2B1.tmp"C:\Users\Admin\AppData\Local\Temp\E2B1.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\E30F.tmp"C:\Users\Admin\AppData\Local\Temp\E30F.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\E38C.tmp"C:\Users\Admin\AppData\Local\Temp\E38C.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\E3F9.tmp"C:\Users\Admin\AppData\Local\Temp\E3F9.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:772 -
C:\Users\Admin\AppData\Local\Temp\E466.tmp"C:\Users\Admin\AppData\Local\Temp\E466.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\E4E3.tmp"C:\Users\Admin\AppData\Local\Temp\E4E3.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\E560.tmp"C:\Users\Admin\AppData\Local\Temp\E560.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\E5CD.tmp"C:\Users\Admin\AppData\Local\Temp\E5CD.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\E64A.tmp"C:\Users\Admin\AppData\Local\Temp\E64A.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\E6B7.tmp"C:\Users\Admin\AppData\Local\Temp\E6B7.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\E714.tmp"C:\Users\Admin\AppData\Local\Temp\E714.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\E762.tmp"C:\Users\Admin\AppData\Local\Temp\E762.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\E7DF.tmp"C:\Users\Admin\AppData\Local\Temp\E7DF.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\E81E.tmp"C:\Users\Admin\AppData\Local\Temp\E81E.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\E85C.tmp"C:\Users\Admin\AppData\Local\Temp\E85C.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:304 -
C:\Users\Admin\AppData\Local\Temp\E89A.tmp"C:\Users\Admin\AppData\Local\Temp\E89A.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\E917.tmp"C:\Users\Admin\AppData\Local\Temp\E917.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\E956.tmp"C:\Users\Admin\AppData\Local\Temp\E956.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\E994.tmp"C:\Users\Admin\AppData\Local\Temp\E994.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:956 -
C:\Users\Admin\AppData\Local\Temp\E9D2.tmp"C:\Users\Admin\AppData\Local\Temp\E9D2.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:952 -
C:\Users\Admin\AppData\Local\Temp\EA11.tmp"C:\Users\Admin\AppData\Local\Temp\EA11.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\EA4F.tmp"C:\Users\Admin\AppData\Local\Temp\EA4F.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\EA7E.tmp"C:\Users\Admin\AppData\Local\Temp\EA7E.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:908 -
C:\Users\Admin\AppData\Local\Temp\EABC.tmp"C:\Users\Admin\AppData\Local\Temp\EABC.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\EAFB.tmp"C:\Users\Admin\AppData\Local\Temp\EAFB.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\EB39.tmp"C:\Users\Admin\AppData\Local\Temp\EB39.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\EB78.tmp"C:\Users\Admin\AppData\Local\Temp\EB78.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\EBB6.tmp"C:\Users\Admin\AppData\Local\Temp\EBB6.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:988 -
C:\Users\Admin\AppData\Local\Temp\EBF4.tmp"C:\Users\Admin\AppData\Local\Temp\EBF4.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\EC33.tmp"C:\Users\Admin\AppData\Local\Temp\EC33.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\EC81.tmp"C:\Users\Admin\AppData\Local\Temp\EC81.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\ECBF.tmp"C:\Users\Admin\AppData\Local\Temp\ECBF.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\ECFE.tmp"C:\Users\Admin\AppData\Local\Temp\ECFE.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\ED3C.tmp"C:\Users\Admin\AppData\Local\Temp\ED3C.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:676 -
C:\Users\Admin\AppData\Local\Temp\ED7A.tmp"C:\Users\Admin\AppData\Local\Temp\ED7A.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\EDB9.tmp"C:\Users\Admin\AppData\Local\Temp\EDB9.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\EDF7.tmp"C:\Users\Admin\AppData\Local\Temp\EDF7.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\EE36.tmp"C:\Users\Admin\AppData\Local\Temp\EE36.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\EE74.tmp"C:\Users\Admin\AppData\Local\Temp\EE74.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\EEB2.tmp"C:\Users\Admin\AppData\Local\Temp\EEB2.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\EF00.tmp"C:\Users\Admin\AppData\Local\Temp\EF00.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\EF4E.tmp"C:\Users\Admin\AppData\Local\Temp\EF4E.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\EF8D.tmp"C:\Users\Admin\AppData\Local\Temp\EF8D.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\EFCB.tmp"C:\Users\Admin\AppData\Local\Temp\EFCB.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\F00A.tmp"C:\Users\Admin\AppData\Local\Temp\F00A.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:316 -
C:\Users\Admin\AppData\Local\Temp\F048.tmp"C:\Users\Admin\AppData\Local\Temp\F048.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\F086.tmp"C:\Users\Admin\AppData\Local\Temp\F086.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\F0C5.tmp"C:\Users\Admin\AppData\Local\Temp\F0C5.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\F103.tmp"C:\Users\Admin\AppData\Local\Temp\F103.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\F142.tmp"C:\Users\Admin\AppData\Local\Temp\F142.tmp"65⤵
- Executes dropped EXE
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\F180.tmp"C:\Users\Admin\AppData\Local\Temp\F180.tmp"66⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\F1BE.tmp"C:\Users\Admin\AppData\Local\Temp\F1BE.tmp"67⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\F1FD.tmp"C:\Users\Admin\AppData\Local\Temp\F1FD.tmp"68⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\F23B.tmp"C:\Users\Admin\AppData\Local\Temp\F23B.tmp"69⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\F27A.tmp"C:\Users\Admin\AppData\Local\Temp\F27A.tmp"70⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\F2B8.tmp"C:\Users\Admin\AppData\Local\Temp\F2B8.tmp"71⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\F2F6.tmp"C:\Users\Admin\AppData\Local\Temp\F2F6.tmp"72⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\F335.tmp"C:\Users\Admin\AppData\Local\Temp\F335.tmp"73⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\F373.tmp"C:\Users\Admin\AppData\Local\Temp\F373.tmp"74⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\F3B2.tmp"C:\Users\Admin\AppData\Local\Temp\F3B2.tmp"75⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\F3F0.tmp"C:\Users\Admin\AppData\Local\Temp\F3F0.tmp"76⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\F42E.tmp"C:\Users\Admin\AppData\Local\Temp\F42E.tmp"77⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\F46D.tmp"C:\Users\Admin\AppData\Local\Temp\F46D.tmp"78⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\F4AB.tmp"C:\Users\Admin\AppData\Local\Temp\F4AB.tmp"79⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\F4EA.tmp"C:\Users\Admin\AppData\Local\Temp\F4EA.tmp"80⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\F528.tmp"C:\Users\Admin\AppData\Local\Temp\F528.tmp"81⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\F566.tmp"C:\Users\Admin\AppData\Local\Temp\F566.tmp"82⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\F5A5.tmp"C:\Users\Admin\AppData\Local\Temp\F5A5.tmp"83⤵PID:236
-
C:\Users\Admin\AppData\Local\Temp\F5E3.tmp"C:\Users\Admin\AppData\Local\Temp\F5E3.tmp"84⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\F622.tmp"C:\Users\Admin\AppData\Local\Temp\F622.tmp"85⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\F660.tmp"C:\Users\Admin\AppData\Local\Temp\F660.tmp"86⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\F69E.tmp"C:\Users\Admin\AppData\Local\Temp\F69E.tmp"87⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\F6DD.tmp"C:\Users\Admin\AppData\Local\Temp\F6DD.tmp"88⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\F72B.tmp"C:\Users\Admin\AppData\Local\Temp\F72B.tmp"89⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\F769.tmp"C:\Users\Admin\AppData\Local\Temp\F769.tmp"90⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\F7A8.tmp"C:\Users\Admin\AppData\Local\Temp\F7A8.tmp"91⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\F7E6.tmp"C:\Users\Admin\AppData\Local\Temp\F7E6.tmp"92⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\F824.tmp"C:\Users\Admin\AppData\Local\Temp\F824.tmp"93⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\F863.tmp"C:\Users\Admin\AppData\Local\Temp\F863.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\F8A1.tmp"C:\Users\Admin\AppData\Local\Temp\F8A1.tmp"95⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\F8E0.tmp"C:\Users\Admin\AppData\Local\Temp\F8E0.tmp"96⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\F91E.tmp"C:\Users\Admin\AppData\Local\Temp\F91E.tmp"97⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\F95C.tmp"C:\Users\Admin\AppData\Local\Temp\F95C.tmp"98⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\F99B.tmp"C:\Users\Admin\AppData\Local\Temp\F99B.tmp"99⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\F9D9.tmp"C:\Users\Admin\AppData\Local\Temp\F9D9.tmp"100⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\FA18.tmp"C:\Users\Admin\AppData\Local\Temp\FA18.tmp"101⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\FA56.tmp"C:\Users\Admin\AppData\Local\Temp\FA56.tmp"102⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\FA94.tmp"C:\Users\Admin\AppData\Local\Temp\FA94.tmp"103⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\FAD3.tmp"C:\Users\Admin\AppData\Local\Temp\FAD3.tmp"104⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\FB11.tmp"C:\Users\Admin\AppData\Local\Temp\FB11.tmp"105⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\FB50.tmp"C:\Users\Admin\AppData\Local\Temp\FB50.tmp"106⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\FB8E.tmp"C:\Users\Admin\AppData\Local\Temp\FB8E.tmp"107⤵PID:596
-
C:\Users\Admin\AppData\Local\Temp\FBCC.tmp"C:\Users\Admin\AppData\Local\Temp\FBCC.tmp"108⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\FC0B.tmp"C:\Users\Admin\AppData\Local\Temp\FC0B.tmp"109⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\FC49.tmp"C:\Users\Admin\AppData\Local\Temp\FC49.tmp"110⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\FC88.tmp"C:\Users\Admin\AppData\Local\Temp\FC88.tmp"111⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\FCC6.tmp"C:\Users\Admin\AppData\Local\Temp\FCC6.tmp"112⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\FD04.tmp"C:\Users\Admin\AppData\Local\Temp\FD04.tmp"113⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\FD43.tmp"C:\Users\Admin\AppData\Local\Temp\FD43.tmp"114⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\FD81.tmp"C:\Users\Admin\AppData\Local\Temp\FD81.tmp"115⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\FDC0.tmp"C:\Users\Admin\AppData\Local\Temp\FDC0.tmp"116⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\FDFE.tmp"C:\Users\Admin\AppData\Local\Temp\FDFE.tmp"117⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\FE3C.tmp"C:\Users\Admin\AppData\Local\Temp\FE3C.tmp"118⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\FE8A.tmp"C:\Users\Admin\AppData\Local\Temp\FE8A.tmp"119⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\FEC9.tmp"C:\Users\Admin\AppData\Local\Temp\FEC9.tmp"120⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\FF07.tmp"C:\Users\Admin\AppData\Local\Temp\FF07.tmp"121⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\FF46.tmp"C:\Users\Admin\AppData\Local\Temp\FF46.tmp"122⤵PID:2100
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-