Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13/09/2024, 06:42
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-13_2ca2230a8411540f6a5ac96c96b929fb_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-13_2ca2230a8411540f6a5ac96c96b929fb_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-13_2ca2230a8411540f6a5ac96c96b929fb_mafia.exe
-
Size
520KB
-
MD5
2ca2230a8411540f6a5ac96c96b929fb
-
SHA1
35a527a113918c1801734c3d37b3e659764c2f71
-
SHA256
b513506d26f45d6398f12ee9aa87330ad6b9487fbe99461613a4d1e7794a7921
-
SHA512
4c025a99ce59b5e26aaf93026ed0853ad77fe6c5b61b95fa4994531f45446938f31b7a36adc76ec73e7d8a449a194c0fe7f5c115863cc7ed5f5fabe12ffc52ae
-
SSDEEP
12288:gj8fuxR21t5i8fbg6A7RgXeRYwI6F5yQ36W8j/aNZO:gj8fuK1GYbPAN6wI25U/aNI
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1600 5541.tmp 2608 55AE.tmp 2768 562B.tmp 2736 5689.tmp 2620 56F6.tmp 2560 5773.tmp 2572 57D0.tmp 2472 583E.tmp 2628 589B.tmp 272 5918.tmp 1988 5976.tmp 444 59C4.tmp 1420 5A31.tmp 1416 5A9E.tmp 2640 5B0B.tmp 2828 5B78.tmp 2052 5BE6.tmp 1948 5C53.tmp 2364 5CB0.tmp 1720 5D1E.tmp 1624 5D7B.tmp 2692 5DD9.tmp 2636 5E36.tmp 1460 5E84.tmp 1908 5ED2.tmp 1864 5F11.tmp 2068 5F4F.tmp 2308 5F9D.tmp 2120 5FDC.tmp 348 601A.tmp 2196 6058.tmp 2340 6097.tmp 2424 60D5.tmp 2148 6114.tmp 944 6152.tmp 2140 6190.tmp 1112 61CF.tmp 2076 620D.tmp 2028 625B.tmp 1084 629A.tmp 1556 62E8.tmp 1708 6326.tmp 2136 6374.tmp 2440 63B3.tmp 940 63F1.tmp 1272 642F.tmp 2008 647D.tmp 2012 64CB.tmp 2544 650A.tmp 1172 6548.tmp 888 6587.tmp 2836 65C5.tmp 1328 6603.tmp 616 6642.tmp 1596 6680.tmp 1544 66BF.tmp 2080 66FD.tmp 2568 673B.tmp 1600 677A.tmp 2856 67B8.tmp 2612 67F7.tmp 2768 6845.tmp 2660 6883.tmp 2104 68D1.tmp -
Loads dropped DLL 64 IoCs
pid Process 2656 2024-09-13_2ca2230a8411540f6a5ac96c96b929fb_mafia.exe 1600 5541.tmp 2608 55AE.tmp 2768 562B.tmp 2736 5689.tmp 2620 56F6.tmp 2560 5773.tmp 2572 57D0.tmp 2472 583E.tmp 2628 589B.tmp 272 5918.tmp 1988 5976.tmp 444 59C4.tmp 1420 5A31.tmp 1416 5A9E.tmp 2640 5B0B.tmp 2828 5B78.tmp 2052 5BE6.tmp 1948 5C53.tmp 2364 5CB0.tmp 1720 5D1E.tmp 1624 5D7B.tmp 2692 5DD9.tmp 2636 5E36.tmp 1460 5E84.tmp 1908 5ED2.tmp 1864 5F11.tmp 2068 5F4F.tmp 2308 5F9D.tmp 2120 5FDC.tmp 348 601A.tmp 2196 6058.tmp 2340 6097.tmp 2424 60D5.tmp 2148 6114.tmp 944 6152.tmp 2140 6190.tmp 1112 61CF.tmp 2076 620D.tmp 2028 625B.tmp 1084 629A.tmp 1556 62E8.tmp 1708 6326.tmp 2136 6374.tmp 2440 63B3.tmp 940 63F1.tmp 1272 642F.tmp 2008 647D.tmp 2012 64CB.tmp 2544 650A.tmp 1172 6548.tmp 888 6587.tmp 2836 65C5.tmp 1328 6603.tmp 616 6642.tmp 1596 6680.tmp 1544 66BF.tmp 2080 66FD.tmp 2568 673B.tmp 1600 677A.tmp 2856 67B8.tmp 2612 67F7.tmp 2768 6845.tmp 2660 6883.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 625B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB61.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 473D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 337F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D76B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B903.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4AA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8150.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 510.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DC1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B07.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 196A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C36.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5052.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 566A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2656 wrote to memory of 1600 2656 2024-09-13_2ca2230a8411540f6a5ac96c96b929fb_mafia.exe 28 PID 2656 wrote to memory of 1600 2656 2024-09-13_2ca2230a8411540f6a5ac96c96b929fb_mafia.exe 28 PID 2656 wrote to memory of 1600 2656 2024-09-13_2ca2230a8411540f6a5ac96c96b929fb_mafia.exe 28 PID 2656 wrote to memory of 1600 2656 2024-09-13_2ca2230a8411540f6a5ac96c96b929fb_mafia.exe 28 PID 1600 wrote to memory of 2608 1600 5541.tmp 29 PID 1600 wrote to memory of 2608 1600 5541.tmp 29 PID 1600 wrote to memory of 2608 1600 5541.tmp 29 PID 1600 wrote to memory of 2608 1600 5541.tmp 29 PID 2608 wrote to memory of 2768 2608 55AE.tmp 30 PID 2608 wrote to memory of 2768 2608 55AE.tmp 30 PID 2608 wrote to memory of 2768 2608 55AE.tmp 30 PID 2608 wrote to memory of 2768 2608 55AE.tmp 30 PID 2768 wrote to memory of 2736 2768 562B.tmp 31 PID 2768 wrote to memory of 2736 2768 562B.tmp 31 PID 2768 wrote to memory of 2736 2768 562B.tmp 31 PID 2768 wrote to memory of 2736 2768 562B.tmp 31 PID 2736 wrote to memory of 2620 2736 5689.tmp 32 PID 2736 wrote to memory of 2620 2736 5689.tmp 32 PID 2736 wrote to memory of 2620 2736 5689.tmp 32 PID 2736 wrote to memory of 2620 2736 5689.tmp 32 PID 2620 wrote to memory of 2560 2620 56F6.tmp 33 PID 2620 wrote to memory of 2560 2620 56F6.tmp 33 PID 2620 wrote to memory of 2560 2620 56F6.tmp 33 PID 2620 wrote to memory of 2560 2620 56F6.tmp 33 PID 2560 wrote to memory of 2572 2560 5773.tmp 34 PID 2560 wrote to memory of 2572 2560 5773.tmp 34 PID 2560 wrote to memory of 2572 2560 5773.tmp 34 PID 2560 wrote to memory of 2572 2560 5773.tmp 34 PID 2572 wrote to memory of 2472 2572 57D0.tmp 35 PID 2572 wrote to memory of 2472 2572 57D0.tmp 35 PID 2572 wrote to memory of 2472 2572 57D0.tmp 35 PID 2572 wrote to memory of 2472 2572 57D0.tmp 35 PID 2472 wrote to memory of 2628 2472 583E.tmp 36 PID 2472 wrote to memory of 2628 2472 583E.tmp 36 PID 2472 wrote to memory of 2628 2472 583E.tmp 36 PID 2472 wrote to memory of 2628 2472 583E.tmp 36 PID 2628 wrote to memory of 272 2628 589B.tmp 37 PID 2628 wrote to memory of 272 2628 589B.tmp 37 PID 2628 wrote to memory of 272 2628 589B.tmp 37 PID 2628 wrote to memory of 272 2628 589B.tmp 37 PID 272 wrote to memory of 1988 272 5918.tmp 38 PID 272 wrote to memory of 1988 272 5918.tmp 38 PID 272 wrote to memory of 1988 272 5918.tmp 38 PID 272 wrote to memory of 1988 272 5918.tmp 38 PID 1988 wrote to memory of 444 1988 5976.tmp 39 PID 1988 wrote to memory of 444 1988 5976.tmp 39 PID 1988 wrote to memory of 444 1988 5976.tmp 39 PID 1988 wrote to memory of 444 1988 5976.tmp 39 PID 444 wrote to memory of 1420 444 59C4.tmp 40 PID 444 wrote to memory of 1420 444 59C4.tmp 40 PID 444 wrote to memory of 1420 444 59C4.tmp 40 PID 444 wrote to memory of 1420 444 59C4.tmp 40 PID 1420 wrote to memory of 1416 1420 5A31.tmp 41 PID 1420 wrote to memory of 1416 1420 5A31.tmp 41 PID 1420 wrote to memory of 1416 1420 5A31.tmp 41 PID 1420 wrote to memory of 1416 1420 5A31.tmp 41 PID 1416 wrote to memory of 2640 1416 5A9E.tmp 42 PID 1416 wrote to memory of 2640 1416 5A9E.tmp 42 PID 1416 wrote to memory of 2640 1416 5A9E.tmp 42 PID 1416 wrote to memory of 2640 1416 5A9E.tmp 42 PID 2640 wrote to memory of 2828 2640 5B0B.tmp 43 PID 2640 wrote to memory of 2828 2640 5B0B.tmp 43 PID 2640 wrote to memory of 2828 2640 5B0B.tmp 43 PID 2640 wrote to memory of 2828 2640 5B0B.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_2ca2230a8411540f6a5ac96c96b929fb_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-13_2ca2230a8411540f6a5ac96c96b929fb_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\5541.tmp"C:\Users\Admin\AppData\Local\Temp\5541.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\55AE.tmp"C:\Users\Admin\AppData\Local\Temp\55AE.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\562B.tmp"C:\Users\Admin\AppData\Local\Temp\562B.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\5689.tmp"C:\Users\Admin\AppData\Local\Temp\5689.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\56F6.tmp"C:\Users\Admin\AppData\Local\Temp\56F6.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\5773.tmp"C:\Users\Admin\AppData\Local\Temp\5773.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\57D0.tmp"C:\Users\Admin\AppData\Local\Temp\57D0.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\583E.tmp"C:\Users\Admin\AppData\Local\Temp\583E.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\589B.tmp"C:\Users\Admin\AppData\Local\Temp\589B.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\5918.tmp"C:\Users\Admin\AppData\Local\Temp\5918.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:272 -
C:\Users\Admin\AppData\Local\Temp\5976.tmp"C:\Users\Admin\AppData\Local\Temp\5976.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\59C4.tmp"C:\Users\Admin\AppData\Local\Temp\59C4.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:444 -
C:\Users\Admin\AppData\Local\Temp\5A31.tmp"C:\Users\Admin\AppData\Local\Temp\5A31.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\5B0B.tmp"C:\Users\Admin\AppData\Local\Temp\5B0B.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\5B78.tmp"C:\Users\Admin\AppData\Local\Temp\5B78.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\5BE6.tmp"C:\Users\Admin\AppData\Local\Temp\5BE6.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\5C53.tmp"C:\Users\Admin\AppData\Local\Temp\5C53.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\5CB0.tmp"C:\Users\Admin\AppData\Local\Temp\5CB0.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\5D1E.tmp"C:\Users\Admin\AppData\Local\Temp\5D1E.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\5D7B.tmp"C:\Users\Admin\AppData\Local\Temp\5D7B.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\5DD9.tmp"C:\Users\Admin\AppData\Local\Temp\5DD9.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\5E36.tmp"C:\Users\Admin\AppData\Local\Temp\5E36.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\5E84.tmp"C:\Users\Admin\AppData\Local\Temp\5E84.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\5ED2.tmp"C:\Users\Admin\AppData\Local\Temp\5ED2.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\5F11.tmp"C:\Users\Admin\AppData\Local\Temp\5F11.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\5F4F.tmp"C:\Users\Admin\AppData\Local\Temp\5F4F.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\5F9D.tmp"C:\Users\Admin\AppData\Local\Temp\5F9D.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\5FDC.tmp"C:\Users\Admin\AppData\Local\Temp\5FDC.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\601A.tmp"C:\Users\Admin\AppData\Local\Temp\601A.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:348 -
C:\Users\Admin\AppData\Local\Temp\6058.tmp"C:\Users\Admin\AppData\Local\Temp\6058.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\6097.tmp"C:\Users\Admin\AppData\Local\Temp\6097.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\60D5.tmp"C:\Users\Admin\AppData\Local\Temp\60D5.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\6114.tmp"C:\Users\Admin\AppData\Local\Temp\6114.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\6152.tmp"C:\Users\Admin\AppData\Local\Temp\6152.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:944 -
C:\Users\Admin\AppData\Local\Temp\6190.tmp"C:\Users\Admin\AppData\Local\Temp\6190.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\61CF.tmp"C:\Users\Admin\AppData\Local\Temp\61CF.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\620D.tmp"C:\Users\Admin\AppData\Local\Temp\620D.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\625B.tmp"C:\Users\Admin\AppData\Local\Temp\625B.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\629A.tmp"C:\Users\Admin\AppData\Local\Temp\629A.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\62E8.tmp"C:\Users\Admin\AppData\Local\Temp\62E8.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\6326.tmp"C:\Users\Admin\AppData\Local\Temp\6326.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\6374.tmp"C:\Users\Admin\AppData\Local\Temp\6374.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\63B3.tmp"C:\Users\Admin\AppData\Local\Temp\63B3.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\63F1.tmp"C:\Users\Admin\AppData\Local\Temp\63F1.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:940 -
C:\Users\Admin\AppData\Local\Temp\642F.tmp"C:\Users\Admin\AppData\Local\Temp\642F.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\647D.tmp"C:\Users\Admin\AppData\Local\Temp\647D.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\64CB.tmp"C:\Users\Admin\AppData\Local\Temp\64CB.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\650A.tmp"C:\Users\Admin\AppData\Local\Temp\650A.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\6548.tmp"C:\Users\Admin\AppData\Local\Temp\6548.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\6587.tmp"C:\Users\Admin\AppData\Local\Temp\6587.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:888 -
C:\Users\Admin\AppData\Local\Temp\65C5.tmp"C:\Users\Admin\AppData\Local\Temp\65C5.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\6603.tmp"C:\Users\Admin\AppData\Local\Temp\6603.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\6642.tmp"C:\Users\Admin\AppData\Local\Temp\6642.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:616 -
C:\Users\Admin\AppData\Local\Temp\6680.tmp"C:\Users\Admin\AppData\Local\Temp\6680.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\66BF.tmp"C:\Users\Admin\AppData\Local\Temp\66BF.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\66FD.tmp"C:\Users\Admin\AppData\Local\Temp\66FD.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\673B.tmp"C:\Users\Admin\AppData\Local\Temp\673B.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\677A.tmp"C:\Users\Admin\AppData\Local\Temp\677A.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\67B8.tmp"C:\Users\Admin\AppData\Local\Temp\67B8.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\67F7.tmp"C:\Users\Admin\AppData\Local\Temp\67F7.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\6845.tmp"C:\Users\Admin\AppData\Local\Temp\6845.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\6883.tmp"C:\Users\Admin\AppData\Local\Temp\6883.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\68D1.tmp"C:\Users\Admin\AppData\Local\Temp\68D1.tmp"65⤵
- Executes dropped EXE
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\690F.tmp"C:\Users\Admin\AppData\Local\Temp\690F.tmp"66⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\694E.tmp"C:\Users\Admin\AppData\Local\Temp\694E.tmp"67⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\698C.tmp"C:\Users\Admin\AppData\Local\Temp\698C.tmp"68⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\69CB.tmp"C:\Users\Admin\AppData\Local\Temp\69CB.tmp"69⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\6A09.tmp"C:\Users\Admin\AppData\Local\Temp\6A09.tmp"70⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\6A47.tmp"C:\Users\Admin\AppData\Local\Temp\6A47.tmp"71⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\6A86.tmp"C:\Users\Admin\AppData\Local\Temp\6A86.tmp"72⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\6AC4.tmp"C:\Users\Admin\AppData\Local\Temp\6AC4.tmp"73⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\6B03.tmp"C:\Users\Admin\AppData\Local\Temp\6B03.tmp"74⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\6B41.tmp"C:\Users\Admin\AppData\Local\Temp\6B41.tmp"75⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\6B7F.tmp"C:\Users\Admin\AppData\Local\Temp\6B7F.tmp"76⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\6BBE.tmp"C:\Users\Admin\AppData\Local\Temp\6BBE.tmp"77⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\6BFC.tmp"C:\Users\Admin\AppData\Local\Temp\6BFC.tmp"78⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\6C3B.tmp"C:\Users\Admin\AppData\Local\Temp\6C3B.tmp"79⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\6C79.tmp"C:\Users\Admin\AppData\Local\Temp\6C79.tmp"80⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\6CC7.tmp"C:\Users\Admin\AppData\Local\Temp\6CC7.tmp"81⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\6D05.tmp"C:\Users\Admin\AppData\Local\Temp\6D05.tmp"82⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\6D44.tmp"C:\Users\Admin\AppData\Local\Temp\6D44.tmp"83⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\6D82.tmp"C:\Users\Admin\AppData\Local\Temp\6D82.tmp"84⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\6DC1.tmp"C:\Users\Admin\AppData\Local\Temp\6DC1.tmp"85⤵
- System Location Discovery: System Language Discovery
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\6DFF.tmp"C:\Users\Admin\AppData\Local\Temp\6DFF.tmp"86⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\6E3D.tmp"C:\Users\Admin\AppData\Local\Temp\6E3D.tmp"87⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\6E7C.tmp"C:\Users\Admin\AppData\Local\Temp\6E7C.tmp"88⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\6EBA.tmp"C:\Users\Admin\AppData\Local\Temp\6EBA.tmp"89⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\6EF9.tmp"C:\Users\Admin\AppData\Local\Temp\6EF9.tmp"90⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\6F37.tmp"C:\Users\Admin\AppData\Local\Temp\6F37.tmp"91⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\6F75.tmp"C:\Users\Admin\AppData\Local\Temp\6F75.tmp"92⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\6FB4.tmp"C:\Users\Admin\AppData\Local\Temp\6FB4.tmp"93⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\7002.tmp"C:\Users\Admin\AppData\Local\Temp\7002.tmp"94⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\7040.tmp"C:\Users\Admin\AppData\Local\Temp\7040.tmp"95⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\707F.tmp"C:\Users\Admin\AppData\Local\Temp\707F.tmp"96⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\70BD.tmp"C:\Users\Admin\AppData\Local\Temp\70BD.tmp"97⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\70FB.tmp"C:\Users\Admin\AppData\Local\Temp\70FB.tmp"98⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\713A.tmp"C:\Users\Admin\AppData\Local\Temp\713A.tmp"99⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\7178.tmp"C:\Users\Admin\AppData\Local\Temp\7178.tmp"100⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\71C6.tmp"C:\Users\Admin\AppData\Local\Temp\71C6.tmp"101⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\7214.tmp"C:\Users\Admin\AppData\Local\Temp\7214.tmp"102⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\7262.tmp"C:\Users\Admin\AppData\Local\Temp\7262.tmp"103⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\72A1.tmp"C:\Users\Admin\AppData\Local\Temp\72A1.tmp"104⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\72EF.tmp"C:\Users\Admin\AppData\Local\Temp\72EF.tmp"105⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\732D.tmp"C:\Users\Admin\AppData\Local\Temp\732D.tmp"106⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\736B.tmp"C:\Users\Admin\AppData\Local\Temp\736B.tmp"107⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\73AA.tmp"C:\Users\Admin\AppData\Local\Temp\73AA.tmp"108⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\73E8.tmp"C:\Users\Admin\AppData\Local\Temp\73E8.tmp"109⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\7427.tmp"C:\Users\Admin\AppData\Local\Temp\7427.tmp"110⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\7465.tmp"C:\Users\Admin\AppData\Local\Temp\7465.tmp"111⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\74A3.tmp"C:\Users\Admin\AppData\Local\Temp\74A3.tmp"112⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"113⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"114⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\755F.tmp"C:\Users\Admin\AppData\Local\Temp\755F.tmp"115⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\759D.tmp"C:\Users\Admin\AppData\Local\Temp\759D.tmp"116⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\75DB.tmp"C:\Users\Admin\AppData\Local\Temp\75DB.tmp"117⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"118⤵PID:340
-
C:\Users\Admin\AppData\Local\Temp\7658.tmp"C:\Users\Admin\AppData\Local\Temp\7658.tmp"119⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\76A6.tmp"C:\Users\Admin\AppData\Local\Temp\76A6.tmp"120⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\76E5.tmp"C:\Users\Admin\AppData\Local\Temp\76E5.tmp"121⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\7723.tmp"C:\Users\Admin\AppData\Local\Temp\7723.tmp"122⤵PID:2408
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-