Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21/09/2024, 11:02
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-21_963df7874b1ffb093f7741111a7501da_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-21_963df7874b1ffb093f7741111a7501da_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-21_963df7874b1ffb093f7741111a7501da_mafia.exe
-
Size
536KB
-
MD5
963df7874b1ffb093f7741111a7501da
-
SHA1
b5d0798b8b624b98e4161e17e52171d3e0503502
-
SHA256
d3e4f744816f7ff5884b2de85447d2210f291d68ffb947d80e815b2e13b1be8b
-
SHA512
e981d4c7ab56cbebdd766523d37a351e4a72a5e05601f8c607a3964b2f12c659f9ce07804f7d6310f844afdc660eb1210fcd229f16ead45a68309813cf3d0160
-
SSDEEP
12288:wU5rCOTeiUvl/RJHi5OiMRw1Z6kTV7rIZxVJ0ZT9:wUQOJU93HEOTS1Z62IRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2668 F132.tmp 2752 F1CE.tmp 2652 F25A.tmp 2780 F2C8.tmp 2744 F354.tmp 2532 F3B2.tmp 2984 F43E.tmp 2000 F49C.tmp 3004 F557.tmp 2160 F5C4.tmp 2060 F660.tmp 2212 F6DD.tmp 2256 F769.tmp 2580 F805.tmp 2008 F853.tmp 1636 F8FF.tmp 1696 F99B.tmp 696 FA27.tmp 1456 FAC3.tmp 2740 FB30.tmp 1096 FB7E.tmp 2340 FC1A.tmp 268 FCB6.tmp 700 FD24.tmp 564 FD72.tmp 1376 FDCF.tmp 3028 FE3C.tmp 2072 FE8A.tmp 776 FF07.tmp 1656 FF55.tmp 2140 FFD2.tmp 1492 20.tmp 2056 9D.tmp 1700 DB.tmp 2076 148.tmp 1964 1A6.tmp 1640 223.tmp 2632 261.tmp 2728 2A0.tmp 2784 2EE.tmp 2776 32C.tmp 2700 36A.tmp 2556 3A9.tmp 2744 3E7.tmp 1296 426.tmp 2088 464.tmp 2976 4B2.tmp 3016 500.tmp 2196 53E.tmp 2152 57D.tmp 2828 5CB.tmp 1980 609.tmp 2856 648.tmp 1684 696.tmp 2832 6D4.tmp 272 712.tmp 2864 751.tmp 1816 79F.tmp 492 7DD.tmp 2900 81C.tmp 1872 85A.tmp 1484 898.tmp 2476 8D7.tmp 448 915.tmp -
Loads dropped DLL 64 IoCs
pid Process 2616 2024-09-21_963df7874b1ffb093f7741111a7501da_mafia.exe 2668 F132.tmp 2752 F1CE.tmp 2652 F25A.tmp 2780 F2C8.tmp 2744 F354.tmp 2532 F3B2.tmp 2984 F43E.tmp 2000 F49C.tmp 3004 F557.tmp 2160 F5C4.tmp 2060 F660.tmp 2212 F6DD.tmp 2256 F769.tmp 2580 F805.tmp 2008 F853.tmp 1636 F8FF.tmp 1696 F99B.tmp 696 FA27.tmp 1456 FAC3.tmp 2740 FB30.tmp 1096 FB7E.tmp 2340 FC1A.tmp 268 FCB6.tmp 700 FD24.tmp 564 FD72.tmp 1376 FDCF.tmp 3028 FE3C.tmp 2072 FE8A.tmp 776 FF07.tmp 1656 FF55.tmp 2140 FFD2.tmp 1492 20.tmp 2056 9D.tmp 1700 DB.tmp 2076 148.tmp 1964 1A6.tmp 1640 223.tmp 2632 261.tmp 2728 2A0.tmp 2784 2EE.tmp 2776 32C.tmp 2700 36A.tmp 2556 3A9.tmp 2744 3E7.tmp 1296 426.tmp 2088 464.tmp 2976 4B2.tmp 3016 500.tmp 2196 53E.tmp 2152 57D.tmp 2828 5CB.tmp 1980 609.tmp 2856 648.tmp 1684 696.tmp 2832 6D4.tmp 272 712.tmp 2864 751.tmp 1816 79F.tmp 492 7DD.tmp 2900 81C.tmp 1872 85A.tmp 1484 898.tmp 2476 8D7.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 898.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2CAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1526.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A757.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C504.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D95E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCB6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A17D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 531F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F92.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A506.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A91B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8343.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9695.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E5D.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2616 wrote to memory of 2668 2616 2024-09-21_963df7874b1ffb093f7741111a7501da_mafia.exe 30 PID 2616 wrote to memory of 2668 2616 2024-09-21_963df7874b1ffb093f7741111a7501da_mafia.exe 30 PID 2616 wrote to memory of 2668 2616 2024-09-21_963df7874b1ffb093f7741111a7501da_mafia.exe 30 PID 2616 wrote to memory of 2668 2616 2024-09-21_963df7874b1ffb093f7741111a7501da_mafia.exe 30 PID 2668 wrote to memory of 2752 2668 F132.tmp 31 PID 2668 wrote to memory of 2752 2668 F132.tmp 31 PID 2668 wrote to memory of 2752 2668 F132.tmp 31 PID 2668 wrote to memory of 2752 2668 F132.tmp 31 PID 2752 wrote to memory of 2652 2752 F1CE.tmp 32 PID 2752 wrote to memory of 2652 2752 F1CE.tmp 32 PID 2752 wrote to memory of 2652 2752 F1CE.tmp 32 PID 2752 wrote to memory of 2652 2752 F1CE.tmp 32 PID 2652 wrote to memory of 2780 2652 F25A.tmp 33 PID 2652 wrote to memory of 2780 2652 F25A.tmp 33 PID 2652 wrote to memory of 2780 2652 F25A.tmp 33 PID 2652 wrote to memory of 2780 2652 F25A.tmp 33 PID 2780 wrote to memory of 2744 2780 F2C8.tmp 34 PID 2780 wrote to memory of 2744 2780 F2C8.tmp 34 PID 2780 wrote to memory of 2744 2780 F2C8.tmp 34 PID 2780 wrote to memory of 2744 2780 F2C8.tmp 34 PID 2744 wrote to memory of 2532 2744 F354.tmp 35 PID 2744 wrote to memory of 2532 2744 F354.tmp 35 PID 2744 wrote to memory of 2532 2744 F354.tmp 35 PID 2744 wrote to memory of 2532 2744 F354.tmp 35 PID 2532 wrote to memory of 2984 2532 F3B2.tmp 36 PID 2532 wrote to memory of 2984 2532 F3B2.tmp 36 PID 2532 wrote to memory of 2984 2532 F3B2.tmp 36 PID 2532 wrote to memory of 2984 2532 F3B2.tmp 36 PID 2984 wrote to memory of 2000 2984 F43E.tmp 37 PID 2984 wrote to memory of 2000 2984 F43E.tmp 37 PID 2984 wrote to memory of 2000 2984 F43E.tmp 37 PID 2984 wrote to memory of 2000 2984 F43E.tmp 37 PID 2000 wrote to memory of 3004 2000 F49C.tmp 38 PID 2000 wrote to memory of 3004 2000 F49C.tmp 38 PID 2000 wrote to memory of 3004 2000 F49C.tmp 38 PID 2000 wrote to memory of 3004 2000 F49C.tmp 38 PID 3004 wrote to memory of 2160 3004 F557.tmp 39 PID 3004 wrote to memory of 2160 3004 F557.tmp 39 PID 3004 wrote to memory of 2160 3004 F557.tmp 39 PID 3004 wrote to memory of 2160 3004 F557.tmp 39 PID 2160 wrote to memory of 2060 2160 F5C4.tmp 40 PID 2160 wrote to memory of 2060 2160 F5C4.tmp 40 PID 2160 wrote to memory of 2060 2160 F5C4.tmp 40 PID 2160 wrote to memory of 2060 2160 F5C4.tmp 40 PID 2060 wrote to memory of 2212 2060 F660.tmp 41 PID 2060 wrote to memory of 2212 2060 F660.tmp 41 PID 2060 wrote to memory of 2212 2060 F660.tmp 41 PID 2060 wrote to memory of 2212 2060 F660.tmp 41 PID 2212 wrote to memory of 2256 2212 F6DD.tmp 42 PID 2212 wrote to memory of 2256 2212 F6DD.tmp 42 PID 2212 wrote to memory of 2256 2212 F6DD.tmp 42 PID 2212 wrote to memory of 2256 2212 F6DD.tmp 42 PID 2256 wrote to memory of 2580 2256 F769.tmp 43 PID 2256 wrote to memory of 2580 2256 F769.tmp 43 PID 2256 wrote to memory of 2580 2256 F769.tmp 43 PID 2256 wrote to memory of 2580 2256 F769.tmp 43 PID 2580 wrote to memory of 2008 2580 F805.tmp 44 PID 2580 wrote to memory of 2008 2580 F805.tmp 44 PID 2580 wrote to memory of 2008 2580 F805.tmp 44 PID 2580 wrote to memory of 2008 2580 F805.tmp 44 PID 2008 wrote to memory of 1636 2008 F853.tmp 45 PID 2008 wrote to memory of 1636 2008 F853.tmp 45 PID 2008 wrote to memory of 1636 2008 F853.tmp 45 PID 2008 wrote to memory of 1636 2008 F853.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-21_963df7874b1ffb093f7741111a7501da_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-21_963df7874b1ffb093f7741111a7501da_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\F132.tmp"C:\Users\Admin\AppData\Local\Temp\F132.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\F1CE.tmp"C:\Users\Admin\AppData\Local\Temp\F1CE.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\F25A.tmp"C:\Users\Admin\AppData\Local\Temp\F25A.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\F2C8.tmp"C:\Users\Admin\AppData\Local\Temp\F2C8.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\F354.tmp"C:\Users\Admin\AppData\Local\Temp\F354.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\F3B2.tmp"C:\Users\Admin\AppData\Local\Temp\F3B2.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\F43E.tmp"C:\Users\Admin\AppData\Local\Temp\F43E.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\F49C.tmp"C:\Users\Admin\AppData\Local\Temp\F49C.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\F557.tmp"C:\Users\Admin\AppData\Local\Temp\F557.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\F5C4.tmp"C:\Users\Admin\AppData\Local\Temp\F5C4.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\F660.tmp"C:\Users\Admin\AppData\Local\Temp\F660.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\F6DD.tmp"C:\Users\Admin\AppData\Local\Temp\F6DD.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\F769.tmp"C:\Users\Admin\AppData\Local\Temp\F769.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\F805.tmp"C:\Users\Admin\AppData\Local\Temp\F805.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\F853.tmp"C:\Users\Admin\AppData\Local\Temp\F853.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\F8FF.tmp"C:\Users\Admin\AppData\Local\Temp\F8FF.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\F99B.tmp"C:\Users\Admin\AppData\Local\Temp\F99B.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\FA27.tmp"C:\Users\Admin\AppData\Local\Temp\FA27.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:696 -
C:\Users\Admin\AppData\Local\Temp\FAC3.tmp"C:\Users\Admin\AppData\Local\Temp\FAC3.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\FB30.tmp"C:\Users\Admin\AppData\Local\Temp\FB30.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\FB7E.tmp"C:\Users\Admin\AppData\Local\Temp\FB7E.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\FC1A.tmp"C:\Users\Admin\AppData\Local\Temp\FC1A.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\FCB6.tmp"C:\Users\Admin\AppData\Local\Temp\FCB6.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:268 -
C:\Users\Admin\AppData\Local\Temp\FD24.tmp"C:\Users\Admin\AppData\Local\Temp\FD24.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:700 -
C:\Users\Admin\AppData\Local\Temp\FD72.tmp"C:\Users\Admin\AppData\Local\Temp\FD72.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:564 -
C:\Users\Admin\AppData\Local\Temp\FDCF.tmp"C:\Users\Admin\AppData\Local\Temp\FDCF.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\FE3C.tmp"C:\Users\Admin\AppData\Local\Temp\FE3C.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\FE8A.tmp"C:\Users\Admin\AppData\Local\Temp\FE8A.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\FF07.tmp"C:\Users\Admin\AppData\Local\Temp\FF07.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:776 -
C:\Users\Admin\AppData\Local\Temp\FF55.tmp"C:\Users\Admin\AppData\Local\Temp\FF55.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\FFD2.tmp"C:\Users\Admin\AppData\Local\Temp\FFD2.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\20.tmp"C:\Users\Admin\AppData\Local\Temp\20.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\9D.tmp"C:\Users\Admin\AppData\Local\Temp\9D.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\DB.tmp"C:\Users\Admin\AppData\Local\Temp\DB.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\148.tmp"C:\Users\Admin\AppData\Local\Temp\148.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\1A6.tmp"C:\Users\Admin\AppData\Local\Temp\1A6.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\223.tmp"C:\Users\Admin\AppData\Local\Temp\223.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\261.tmp"C:\Users\Admin\AppData\Local\Temp\261.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\2A0.tmp"C:\Users\Admin\AppData\Local\Temp\2A0.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\2EE.tmp"C:\Users\Admin\AppData\Local\Temp\2EE.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\32C.tmp"C:\Users\Admin\AppData\Local\Temp\32C.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\36A.tmp"C:\Users\Admin\AppData\Local\Temp\36A.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\3A9.tmp"C:\Users\Admin\AppData\Local\Temp\3A9.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\3E7.tmp"C:\Users\Admin\AppData\Local\Temp\3E7.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\426.tmp"C:\Users\Admin\AppData\Local\Temp\426.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\464.tmp"C:\Users\Admin\AppData\Local\Temp\464.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\4B2.tmp"C:\Users\Admin\AppData\Local\Temp\4B2.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\500.tmp"C:\Users\Admin\AppData\Local\Temp\500.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\53E.tmp"C:\Users\Admin\AppData\Local\Temp\53E.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\57D.tmp"C:\Users\Admin\AppData\Local\Temp\57D.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\5CB.tmp"C:\Users\Admin\AppData\Local\Temp\5CB.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\609.tmp"C:\Users\Admin\AppData\Local\Temp\609.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\648.tmp"C:\Users\Admin\AppData\Local\Temp\648.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\696.tmp"C:\Users\Admin\AppData\Local\Temp\696.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\6D4.tmp"C:\Users\Admin\AppData\Local\Temp\6D4.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\712.tmp"C:\Users\Admin\AppData\Local\Temp\712.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:272 -
C:\Users\Admin\AppData\Local\Temp\751.tmp"C:\Users\Admin\AppData\Local\Temp\751.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\79F.tmp"C:\Users\Admin\AppData\Local\Temp\79F.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\7DD.tmp"C:\Users\Admin\AppData\Local\Temp\7DD.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:492 -
C:\Users\Admin\AppData\Local\Temp\81C.tmp"C:\Users\Admin\AppData\Local\Temp\81C.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\85A.tmp"C:\Users\Admin\AppData\Local\Temp\85A.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\898.tmp"C:\Users\Admin\AppData\Local\Temp\898.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\8D7.tmp"C:\Users\Admin\AppData\Local\Temp\8D7.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\915.tmp"C:\Users\Admin\AppData\Local\Temp\915.tmp"65⤵
- Executes dropped EXE
PID:448 -
C:\Users\Admin\AppData\Local\Temp\954.tmp"C:\Users\Admin\AppData\Local\Temp\954.tmp"66⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\992.tmp"C:\Users\Admin\AppData\Local\Temp\992.tmp"67⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\9F0.tmp"C:\Users\Admin\AppData\Local\Temp\9F0.tmp"68⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\A2E.tmp"C:\Users\Admin\AppData\Local\Temp\A2E.tmp"69⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\A6C.tmp"C:\Users\Admin\AppData\Local\Temp\A6C.tmp"70⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\AAB.tmp"C:\Users\Admin\AppData\Local\Temp\AAB.tmp"71⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\AE9.tmp"C:\Users\Admin\AppData\Local\Temp\AE9.tmp"72⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\B28.tmp"C:\Users\Admin\AppData\Local\Temp\B28.tmp"73⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\B66.tmp"C:\Users\Admin\AppData\Local\Temp\B66.tmp"74⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\BB4.tmp"C:\Users\Admin\AppData\Local\Temp\BB4.tmp"75⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\BF2.tmp"C:\Users\Admin\AppData\Local\Temp\BF2.tmp"76⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\C31.tmp"C:\Users\Admin\AppData\Local\Temp\C31.tmp"77⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\C6F.tmp"C:\Users\Admin\AppData\Local\Temp\C6F.tmp"78⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\CAE.tmp"C:\Users\Admin\AppData\Local\Temp\CAE.tmp"79⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\CEC.tmp"C:\Users\Admin\AppData\Local\Temp\CEC.tmp"80⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\D2A.tmp"C:\Users\Admin\AppData\Local\Temp\D2A.tmp"81⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\D69.tmp"C:\Users\Admin\AppData\Local\Temp\D69.tmp"82⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\DB7.tmp"C:\Users\Admin\AppData\Local\Temp\DB7.tmp"83⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\DF5.tmp"C:\Users\Admin\AppData\Local\Temp\DF5.tmp"84⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\E34.tmp"C:\Users\Admin\AppData\Local\Temp\E34.tmp"85⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\E72.tmp"C:\Users\Admin\AppData\Local\Temp\E72.tmp"86⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\EC0.tmp"C:\Users\Admin\AppData\Local\Temp\EC0.tmp"87⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\EFE.tmp"C:\Users\Admin\AppData\Local\Temp\EFE.tmp"88⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\F3D.tmp"C:\Users\Admin\AppData\Local\Temp\F3D.tmp"89⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\F7B.tmp"C:\Users\Admin\AppData\Local\Temp\F7B.tmp"90⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\FBA.tmp"C:\Users\Admin\AppData\Local\Temp\FBA.tmp"91⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\1008.tmp"C:\Users\Admin\AppData\Local\Temp\1008.tmp"92⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\1046.tmp"C:\Users\Admin\AppData\Local\Temp\1046.tmp"93⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\1084.tmp"C:\Users\Admin\AppData\Local\Temp\1084.tmp"94⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\10C3.tmp"C:\Users\Admin\AppData\Local\Temp\10C3.tmp"95⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\1101.tmp"C:\Users\Admin\AppData\Local\Temp\1101.tmp"96⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\1140.tmp"C:\Users\Admin\AppData\Local\Temp\1140.tmp"97⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\117E.tmp"C:\Users\Admin\AppData\Local\Temp\117E.tmp"98⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\11DC.tmp"C:\Users\Admin\AppData\Local\Temp\11DC.tmp"99⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\121A.tmp"C:\Users\Admin\AppData\Local\Temp\121A.tmp"100⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\1268.tmp"C:\Users\Admin\AppData\Local\Temp\1268.tmp"101⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\12A6.tmp"C:\Users\Admin\AppData\Local\Temp\12A6.tmp"102⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\12E5.tmp"C:\Users\Admin\AppData\Local\Temp\12E5.tmp"103⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\1323.tmp"C:\Users\Admin\AppData\Local\Temp\1323.tmp"104⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\1362.tmp"C:\Users\Admin\AppData\Local\Temp\1362.tmp"105⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\13A0.tmp"C:\Users\Admin\AppData\Local\Temp\13A0.tmp"106⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\13DE.tmp"C:\Users\Admin\AppData\Local\Temp\13DE.tmp"107⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\142C.tmp"C:\Users\Admin\AppData\Local\Temp\142C.tmp"108⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\146B.tmp"C:\Users\Admin\AppData\Local\Temp\146B.tmp"109⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\14A9.tmp"C:\Users\Admin\AppData\Local\Temp\14A9.tmp"110⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\14E8.tmp"C:\Users\Admin\AppData\Local\Temp\14E8.tmp"111⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\1526.tmp"C:\Users\Admin\AppData\Local\Temp\1526.tmp"112⤵
- System Location Discovery: System Language Discovery
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\1574.tmp"C:\Users\Admin\AppData\Local\Temp\1574.tmp"113⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\15B2.tmp"C:\Users\Admin\AppData\Local\Temp\15B2.tmp"114⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\15F1.tmp"C:\Users\Admin\AppData\Local\Temp\15F1.tmp"115⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\162F.tmp"C:\Users\Admin\AppData\Local\Temp\162F.tmp"116⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\166E.tmp"C:\Users\Admin\AppData\Local\Temp\166E.tmp"117⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\16AC.tmp"C:\Users\Admin\AppData\Local\Temp\16AC.tmp"118⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\16EA.tmp"C:\Users\Admin\AppData\Local\Temp\16EA.tmp"119⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\1729.tmp"C:\Users\Admin\AppData\Local\Temp\1729.tmp"120⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\1767.tmp"C:\Users\Admin\AppData\Local\Temp\1767.tmp"121⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\17A6.tmp"C:\Users\Admin\AppData\Local\Temp\17A6.tmp"122⤵PID:1620
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-