Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 00:13
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-18_75c0ff35103c4344464a276624acb434_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-18_75c0ff35103c4344464a276624acb434_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-18_75c0ff35103c4344464a276624acb434_mafia.exe
-
Size
486KB
-
MD5
75c0ff35103c4344464a276624acb434
-
SHA1
f988324c68deedce6959b95510d01df27e96a05c
-
SHA256
6ec02338da5209eaa2ce823f9a2cc108b44b7468cf5eca29edda32d01e9d0dd9
-
SHA512
535211fbd51795019d1a943b567ee2538626c9710e25648e83dea9f2100bcc3a57d98963b551814b916129a34428cca2c5035a67a986ab51d201ea64f21d699f
-
SSDEEP
6144:Forf3lPvovsgZnqG2C7mOTeiLfD7gE37ukQ9BlxGmyfS9SZj+qnEchr+/l4qsH3j:UU5rCOTeiDgEdQ9IfKq/l3NZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2672 5E56.tmp 2688 5EA4.tmp 2872 5F01.tmp 2572 5F6E.tmp 2524 5FCC.tmp 2504 6049.tmp 1700 60A6.tmp 772 6123.tmp 1416 6181.tmp 1772 61EE.tmp 3004 624C.tmp 2388 62B9.tmp 644 6316.tmp 2420 6374.tmp 1448 63B3.tmp 2292 63F1.tmp 2012 644F.tmp 524 648D.tmp 2756 64EB.tmp 1924 6567.tmp 1736 65B5.tmp 2928 6603.tmp 2408 6651.tmp 2128 66AF.tmp 2228 66ED.tmp 1864 672C.tmp 2940 676A.tmp 868 67B8.tmp 236 67F7.tmp 764 6835.tmp 1264 6873.tmp 656 68B2.tmp 1660 68F0.tmp 2364 691F.tmp 1944 695D.tmp 1676 699C.tmp 956 69DA.tmp 1472 6A19.tmp 1456 6A57.tmp 1956 6AA5.tmp 892 6AF3.tmp 1092 6B41.tmp 2384 6B7F.tmp 1912 6BBE.tmp 1856 6BFC.tmp 3020 6C5A.tmp 1788 6CA8.tmp 2236 6CE6.tmp 1992 6D25.tmp 2712 6D63.tmp 2296 6DA1.tmp 2824 6DE0.tmp 1632 6E1E.tmp 2660 6E6C.tmp 2644 6EAB.tmp 2836 6EE9.tmp 2628 6F27.tmp 1260 6F66.tmp 2700 6FA4.tmp 2592 6FF2.tmp 2524 7031.tmp 796 707F.tmp 2996 70BD.tmp 1860 70FB.tmp -
Loads dropped DLL 64 IoCs
pid Process 2824 2024-09-18_75c0ff35103c4344464a276624acb434_mafia.exe 2672 5E56.tmp 2688 5EA4.tmp 2872 5F01.tmp 2572 5F6E.tmp 2524 5FCC.tmp 2504 6049.tmp 1700 60A6.tmp 772 6123.tmp 1416 6181.tmp 1772 61EE.tmp 3004 624C.tmp 2388 62B9.tmp 644 6316.tmp 2420 6374.tmp 1448 63B3.tmp 2292 63F1.tmp 2012 644F.tmp 524 648D.tmp 2756 64EB.tmp 1924 6567.tmp 1736 65B5.tmp 2928 6603.tmp 2408 6651.tmp 2128 66AF.tmp 2228 66ED.tmp 1864 672C.tmp 2940 676A.tmp 868 67B8.tmp 236 67F7.tmp 764 6835.tmp 1264 6873.tmp 656 68B2.tmp 1660 68F0.tmp 2364 691F.tmp 1944 695D.tmp 1676 699C.tmp 956 69DA.tmp 1472 6A19.tmp 1456 6A57.tmp 1956 6AA5.tmp 892 6AF3.tmp 1092 6B41.tmp 2384 6B7F.tmp 1912 6BBE.tmp 1856 6BFC.tmp 3020 6C5A.tmp 1788 6CA8.tmp 2236 6CE6.tmp 1992 6D25.tmp 2712 6D63.tmp 2296 6DA1.tmp 2824 6DE0.tmp 1632 6E1E.tmp 2660 6E6C.tmp 2644 6EAB.tmp 2836 6EE9.tmp 2628 6F27.tmp 1260 6F66.tmp 2700 6FA4.tmp 2592 6FF2.tmp 2524 7031.tmp 796 707F.tmp 2996 70BD.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D9DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6FF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE36.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFBF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C294.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9241.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C986.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A035.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-09-18_75c0ff35103c4344464a276624acb434_mafia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C745.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A238.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A87F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DECB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 676A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2185.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2824 wrote to memory of 2672 2824 2024-09-18_75c0ff35103c4344464a276624acb434_mafia.exe 30 PID 2824 wrote to memory of 2672 2824 2024-09-18_75c0ff35103c4344464a276624acb434_mafia.exe 30 PID 2824 wrote to memory of 2672 2824 2024-09-18_75c0ff35103c4344464a276624acb434_mafia.exe 30 PID 2824 wrote to memory of 2672 2824 2024-09-18_75c0ff35103c4344464a276624acb434_mafia.exe 30 PID 2672 wrote to memory of 2688 2672 5E56.tmp 31 PID 2672 wrote to memory of 2688 2672 5E56.tmp 31 PID 2672 wrote to memory of 2688 2672 5E56.tmp 31 PID 2672 wrote to memory of 2688 2672 5E56.tmp 31 PID 2688 wrote to memory of 2872 2688 5EA4.tmp 32 PID 2688 wrote to memory of 2872 2688 5EA4.tmp 32 PID 2688 wrote to memory of 2872 2688 5EA4.tmp 32 PID 2688 wrote to memory of 2872 2688 5EA4.tmp 32 PID 2872 wrote to memory of 2572 2872 5F01.tmp 33 PID 2872 wrote to memory of 2572 2872 5F01.tmp 33 PID 2872 wrote to memory of 2572 2872 5F01.tmp 33 PID 2872 wrote to memory of 2572 2872 5F01.tmp 33 PID 2572 wrote to memory of 2524 2572 5F6E.tmp 34 PID 2572 wrote to memory of 2524 2572 5F6E.tmp 34 PID 2572 wrote to memory of 2524 2572 5F6E.tmp 34 PID 2572 wrote to memory of 2524 2572 5F6E.tmp 34 PID 2524 wrote to memory of 2504 2524 5FCC.tmp 35 PID 2524 wrote to memory of 2504 2524 5FCC.tmp 35 PID 2524 wrote to memory of 2504 2524 5FCC.tmp 35 PID 2524 wrote to memory of 2504 2524 5FCC.tmp 35 PID 2504 wrote to memory of 1700 2504 6049.tmp 36 PID 2504 wrote to memory of 1700 2504 6049.tmp 36 PID 2504 wrote to memory of 1700 2504 6049.tmp 36 PID 2504 wrote to memory of 1700 2504 6049.tmp 36 PID 1700 wrote to memory of 772 1700 60A6.tmp 37 PID 1700 wrote to memory of 772 1700 60A6.tmp 37 PID 1700 wrote to memory of 772 1700 60A6.tmp 37 PID 1700 wrote to memory of 772 1700 60A6.tmp 37 PID 772 wrote to memory of 1416 772 6123.tmp 38 PID 772 wrote to memory of 1416 772 6123.tmp 38 PID 772 wrote to memory of 1416 772 6123.tmp 38 PID 772 wrote to memory of 1416 772 6123.tmp 38 PID 1416 wrote to memory of 1772 1416 6181.tmp 39 PID 1416 wrote to memory of 1772 1416 6181.tmp 39 PID 1416 wrote to memory of 1772 1416 6181.tmp 39 PID 1416 wrote to memory of 1772 1416 6181.tmp 39 PID 1772 wrote to memory of 3004 1772 61EE.tmp 40 PID 1772 wrote to memory of 3004 1772 61EE.tmp 40 PID 1772 wrote to memory of 3004 1772 61EE.tmp 40 PID 1772 wrote to memory of 3004 1772 61EE.tmp 40 PID 3004 wrote to memory of 2388 3004 624C.tmp 41 PID 3004 wrote to memory of 2388 3004 624C.tmp 41 PID 3004 wrote to memory of 2388 3004 624C.tmp 41 PID 3004 wrote to memory of 2388 3004 624C.tmp 41 PID 2388 wrote to memory of 644 2388 62B9.tmp 42 PID 2388 wrote to memory of 644 2388 62B9.tmp 42 PID 2388 wrote to memory of 644 2388 62B9.tmp 42 PID 2388 wrote to memory of 644 2388 62B9.tmp 42 PID 644 wrote to memory of 2420 644 6316.tmp 43 PID 644 wrote to memory of 2420 644 6316.tmp 43 PID 644 wrote to memory of 2420 644 6316.tmp 43 PID 644 wrote to memory of 2420 644 6316.tmp 43 PID 2420 wrote to memory of 1448 2420 6374.tmp 44 PID 2420 wrote to memory of 1448 2420 6374.tmp 44 PID 2420 wrote to memory of 1448 2420 6374.tmp 44 PID 2420 wrote to memory of 1448 2420 6374.tmp 44 PID 1448 wrote to memory of 2292 1448 63B3.tmp 45 PID 1448 wrote to memory of 2292 1448 63B3.tmp 45 PID 1448 wrote to memory of 2292 1448 63B3.tmp 45 PID 1448 wrote to memory of 2292 1448 63B3.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-18_75c0ff35103c4344464a276624acb434_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-18_75c0ff35103c4344464a276624acb434_mafia.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\5E56.tmp"C:\Users\Admin\AppData\Local\Temp\5E56.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\5EA4.tmp"C:\Users\Admin\AppData\Local\Temp\5EA4.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\5F01.tmp"C:\Users\Admin\AppData\Local\Temp\5F01.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\5F6E.tmp"C:\Users\Admin\AppData\Local\Temp\5F6E.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\5FCC.tmp"C:\Users\Admin\AppData\Local\Temp\5FCC.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\6049.tmp"C:\Users\Admin\AppData\Local\Temp\6049.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\60A6.tmp"C:\Users\Admin\AppData\Local\Temp\60A6.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\6123.tmp"C:\Users\Admin\AppData\Local\Temp\6123.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Users\Admin\AppData\Local\Temp\6181.tmp"C:\Users\Admin\AppData\Local\Temp\6181.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\61EE.tmp"C:\Users\Admin\AppData\Local\Temp\61EE.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\624C.tmp"C:\Users\Admin\AppData\Local\Temp\624C.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\62B9.tmp"C:\Users\Admin\AppData\Local\Temp\62B9.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\6316.tmp"C:\Users\Admin\AppData\Local\Temp\6316.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Users\Admin\AppData\Local\Temp\6374.tmp"C:\Users\Admin\AppData\Local\Temp\6374.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\63B3.tmp"C:\Users\Admin\AppData\Local\Temp\63B3.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\63F1.tmp"C:\Users\Admin\AppData\Local\Temp\63F1.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\644F.tmp"C:\Users\Admin\AppData\Local\Temp\644F.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\648D.tmp"C:\Users\Admin\AppData\Local\Temp\648D.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:524 -
C:\Users\Admin\AppData\Local\Temp\64EB.tmp"C:\Users\Admin\AppData\Local\Temp\64EB.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\6567.tmp"C:\Users\Admin\AppData\Local\Temp\6567.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\65B5.tmp"C:\Users\Admin\AppData\Local\Temp\65B5.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\6603.tmp"C:\Users\Admin\AppData\Local\Temp\6603.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\6651.tmp"C:\Users\Admin\AppData\Local\Temp\6651.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\66AF.tmp"C:\Users\Admin\AppData\Local\Temp\66AF.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\66ED.tmp"C:\Users\Admin\AppData\Local\Temp\66ED.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\672C.tmp"C:\Users\Admin\AppData\Local\Temp\672C.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\676A.tmp"C:\Users\Admin\AppData\Local\Temp\676A.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\67B8.tmp"C:\Users\Admin\AppData\Local\Temp\67B8.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:868 -
C:\Users\Admin\AppData\Local\Temp\67F7.tmp"C:\Users\Admin\AppData\Local\Temp\67F7.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:236 -
C:\Users\Admin\AppData\Local\Temp\6835.tmp"C:\Users\Admin\AppData\Local\Temp\6835.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:764 -
C:\Users\Admin\AppData\Local\Temp\6873.tmp"C:\Users\Admin\AppData\Local\Temp\6873.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\68B2.tmp"C:\Users\Admin\AppData\Local\Temp\68B2.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:656 -
C:\Users\Admin\AppData\Local\Temp\68F0.tmp"C:\Users\Admin\AppData\Local\Temp\68F0.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\691F.tmp"C:\Users\Admin\AppData\Local\Temp\691F.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\695D.tmp"C:\Users\Admin\AppData\Local\Temp\695D.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\699C.tmp"C:\Users\Admin\AppData\Local\Temp\699C.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\69DA.tmp"C:\Users\Admin\AppData\Local\Temp\69DA.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:956 -
C:\Users\Admin\AppData\Local\Temp\6A19.tmp"C:\Users\Admin\AppData\Local\Temp\6A19.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\6A57.tmp"C:\Users\Admin\AppData\Local\Temp\6A57.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\6AA5.tmp"C:\Users\Admin\AppData\Local\Temp\6AA5.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\6AF3.tmp"C:\Users\Admin\AppData\Local\Temp\6AF3.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:892 -
C:\Users\Admin\AppData\Local\Temp\6B41.tmp"C:\Users\Admin\AppData\Local\Temp\6B41.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\6B7F.tmp"C:\Users\Admin\AppData\Local\Temp\6B7F.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\6BBE.tmp"C:\Users\Admin\AppData\Local\Temp\6BBE.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\6BFC.tmp"C:\Users\Admin\AppData\Local\Temp\6BFC.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\6C5A.tmp"C:\Users\Admin\AppData\Local\Temp\6C5A.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\6CA8.tmp"C:\Users\Admin\AppData\Local\Temp\6CA8.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\6CE6.tmp"C:\Users\Admin\AppData\Local\Temp\6CE6.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\6D25.tmp"C:\Users\Admin\AppData\Local\Temp\6D25.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\6D63.tmp"C:\Users\Admin\AppData\Local\Temp\6D63.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\6DA1.tmp"C:\Users\Admin\AppData\Local\Temp\6DA1.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\6DE0.tmp"C:\Users\Admin\AppData\Local\Temp\6DE0.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\6E1E.tmp"C:\Users\Admin\AppData\Local\Temp\6E1E.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\6E6C.tmp"C:\Users\Admin\AppData\Local\Temp\6E6C.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\6EAB.tmp"C:\Users\Admin\AppData\Local\Temp\6EAB.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\6EE9.tmp"C:\Users\Admin\AppData\Local\Temp\6EE9.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\6F27.tmp"C:\Users\Admin\AppData\Local\Temp\6F27.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\6F66.tmp"C:\Users\Admin\AppData\Local\Temp\6F66.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\6FA4.tmp"C:\Users\Admin\AppData\Local\Temp\6FA4.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\6FF2.tmp"C:\Users\Admin\AppData\Local\Temp\6FF2.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\7031.tmp"C:\Users\Admin\AppData\Local\Temp\7031.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\707F.tmp"C:\Users\Admin\AppData\Local\Temp\707F.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:796 -
C:\Users\Admin\AppData\Local\Temp\70BD.tmp"C:\Users\Admin\AppData\Local\Temp\70BD.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\70FB.tmp"C:\Users\Admin\AppData\Local\Temp\70FB.tmp"65⤵
- Executes dropped EXE
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\713A.tmp"C:\Users\Admin\AppData\Local\Temp\713A.tmp"66⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\7188.tmp"C:\Users\Admin\AppData\Local\Temp\7188.tmp"67⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\71C6.tmp"C:\Users\Admin\AppData\Local\Temp\71C6.tmp"68⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\7205.tmp"C:\Users\Admin\AppData\Local\Temp\7205.tmp"69⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\7243.tmp"C:\Users\Admin\AppData\Local\Temp\7243.tmp"70⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\7281.tmp"C:\Users\Admin\AppData\Local\Temp\7281.tmp"71⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\72C0.tmp"C:\Users\Admin\AppData\Local\Temp\72C0.tmp"72⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\730E.tmp"C:\Users\Admin\AppData\Local\Temp\730E.tmp"73⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\734C.tmp"C:\Users\Admin\AppData\Local\Temp\734C.tmp"74⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\738B.tmp"C:\Users\Admin\AppData\Local\Temp\738B.tmp"75⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\73C9.tmp"C:\Users\Admin\AppData\Local\Temp\73C9.tmp"76⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"77⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\7446.tmp"C:\Users\Admin\AppData\Local\Temp\7446.tmp"78⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\7494.tmp"C:\Users\Admin\AppData\Local\Temp\7494.tmp"79⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"80⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"81⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\754F.tmp"C:\Users\Admin\AppData\Local\Temp\754F.tmp"82⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\758D.tmp"C:\Users\Admin\AppData\Local\Temp\758D.tmp"83⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\75CC.tmp"C:\Users\Admin\AppData\Local\Temp\75CC.tmp"84⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\760A.tmp"C:\Users\Admin\AppData\Local\Temp\760A.tmp"85⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\7649.tmp"C:\Users\Admin\AppData\Local\Temp\7649.tmp"86⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\7687.tmp"C:\Users\Admin\AppData\Local\Temp\7687.tmp"87⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\76C5.tmp"C:\Users\Admin\AppData\Local\Temp\76C5.tmp"88⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\7704.tmp"C:\Users\Admin\AppData\Local\Temp\7704.tmp"89⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\7742.tmp"C:\Users\Admin\AppData\Local\Temp\7742.tmp"90⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\7781.tmp"C:\Users\Admin\AppData\Local\Temp\7781.tmp"91⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\77BF.tmp"C:\Users\Admin\AppData\Local\Temp\77BF.tmp"92⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\77FD.tmp"C:\Users\Admin\AppData\Local\Temp\77FD.tmp"93⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\783C.tmp"C:\Users\Admin\AppData\Local\Temp\783C.tmp"94⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\788A.tmp"C:\Users\Admin\AppData\Local\Temp\788A.tmp"95⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\78C8.tmp"C:\Users\Admin\AppData\Local\Temp\78C8.tmp"96⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\7907.tmp"C:\Users\Admin\AppData\Local\Temp\7907.tmp"97⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\7945.tmp"C:\Users\Admin\AppData\Local\Temp\7945.tmp"98⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\7983.tmp"C:\Users\Admin\AppData\Local\Temp\7983.tmp"99⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\79C2.tmp"C:\Users\Admin\AppData\Local\Temp\79C2.tmp"100⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\7A10.tmp"C:\Users\Admin\AppData\Local\Temp\7A10.tmp"101⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\7A4E.tmp"C:\Users\Admin\AppData\Local\Temp\7A4E.tmp"102⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\7A8D.tmp"C:\Users\Admin\AppData\Local\Temp\7A8D.tmp"103⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\7ACB.tmp"C:\Users\Admin\AppData\Local\Temp\7ACB.tmp"104⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\7B09.tmp"C:\Users\Admin\AppData\Local\Temp\7B09.tmp"105⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\7B48.tmp"C:\Users\Admin\AppData\Local\Temp\7B48.tmp"106⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\7B86.tmp"C:\Users\Admin\AppData\Local\Temp\7B86.tmp"107⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\7BC5.tmp"C:\Users\Admin\AppData\Local\Temp\7BC5.tmp"108⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\7C03.tmp"C:\Users\Admin\AppData\Local\Temp\7C03.tmp"109⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\7C41.tmp"C:\Users\Admin\AppData\Local\Temp\7C41.tmp"110⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\7C80.tmp"C:\Users\Admin\AppData\Local\Temp\7C80.tmp"111⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\7CBE.tmp"C:\Users\Admin\AppData\Local\Temp\7CBE.tmp"112⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\7CFD.tmp"C:\Users\Admin\AppData\Local\Temp\7CFD.tmp"113⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\7D3B.tmp"C:\Users\Admin\AppData\Local\Temp\7D3B.tmp"114⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\7D79.tmp"C:\Users\Admin\AppData\Local\Temp\7D79.tmp"115⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\7DB8.tmp"C:\Users\Admin\AppData\Local\Temp\7DB8.tmp"116⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\7DF6.tmp"C:\Users\Admin\AppData\Local\Temp\7DF6.tmp"117⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\7E35.tmp"C:\Users\Admin\AppData\Local\Temp\7E35.tmp"118⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\7E73.tmp"C:\Users\Admin\AppData\Local\Temp\7E73.tmp"119⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\7EB1.tmp"C:\Users\Admin\AppData\Local\Temp\7EB1.tmp"120⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\7EF0.tmp"C:\Users\Admin\AppData\Local\Temp\7EF0.tmp"121⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\7F2E.tmp"C:\Users\Admin\AppData\Local\Temp\7F2E.tmp"122⤵PID:2628
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-