Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09-10-2024 07:14
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-09_f2944f7f1a1c1804c5f8fe6a5d9a7c0e_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-09_f2944f7f1a1c1804c5f8fe6a5d9a7c0e_mafia.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-09_f2944f7f1a1c1804c5f8fe6a5d9a7c0e_mafia.exe
-
Size
520KB
-
MD5
f2944f7f1a1c1804c5f8fe6a5d9a7c0e
-
SHA1
55e453ee5d815c470add3c351563bb4b214c1e4a
-
SHA256
b945d15c2e662e187fd0d3abf29f9bbb4fe1b30b772664521cc1a2f086bbee6f
-
SHA512
5f71a5fdca6c03b23707074ef0e633c0d0f1764afcd5e383bc3dcb92793a4bf4e5ad684ddafc21394a4dbecd9c6d270f008fcfd2d7c9c974f9e159783ff3198c
-
SSDEEP
12288:gj8fuxR21t5i8fOaRLzSY3R1tDsBE4SyhWgNS0HD6kt06fotDmH44NZ:gj8fuK1GYLNmiKBE4th1NpmLe44N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2700 7EFF.tmp 2716 7F4D.tmp 2884 7FCA.tmp 2732 8028.tmp 2900 8095.tmp 2976 80F3.tmp 2772 8160.tmp 1872 81BD.tmp 2664 821B.tmp 2160 8279.tmp 1940 82E6.tmp 2676 8334.tmp 2304 83A1.tmp 2144 840E.tmp 2956 847B.tmp 1396 84D9.tmp 2840 8546.tmp 2420 85B3.tmp 2132 8621.tmp 1268 868E.tmp 3048 86EB.tmp 620 8759.tmp 356 87A7.tmp 1788 87F5.tmp 1628 8833.tmp 1480 8871.tmp 1948 88B0.tmp 2492 88EE.tmp 2480 892D.tmp 2904 896B.tmp 1324 89B9.tmp 3012 89F7.tmp 288 8A36.tmp 1132 8A74.tmp 2496 8AB3.tmp 1612 8AF1.tmp 1048 8B2F.tmp 1688 8B6E.tmp 2300 8BBC.tmp 1540 8C0A.tmp 2528 8C48.tmp 1752 8C87.tmp 1164 8CC5.tmp 3044 8D03.tmp 2392 8D42.tmp 1252 8D80.tmp 2540 8DBF.tmp 692 8E0D.tmp 2692 8E4B.tmp 1692 8E89.tmp 1000 8EC8.tmp 2416 8F06.tmp 2312 8F45.tmp 2112 8F83.tmp 1140 8FC1.tmp 2432 9000.tmp 2868 904E.tmp 2888 908C.tmp 2764 90CB.tmp 2724 9109.tmp 2732 9147.tmp 2944 9186.tmp 2744 91C4.tmp 2780 9212.tmp -
Loads dropped DLL 64 IoCs
pid Process 2136 2024-10-09_f2944f7f1a1c1804c5f8fe6a5d9a7c0e_mafia.exe 2700 7EFF.tmp 2716 7F4D.tmp 2884 7FCA.tmp 2732 8028.tmp 2900 8095.tmp 2976 80F3.tmp 2772 8160.tmp 1872 81BD.tmp 2664 821B.tmp 2160 8279.tmp 1940 82E6.tmp 2676 8334.tmp 2304 83A1.tmp 2144 840E.tmp 2956 847B.tmp 1396 84D9.tmp 2840 8546.tmp 2420 85B3.tmp 2132 8621.tmp 1268 868E.tmp 3048 86EB.tmp 620 8759.tmp 356 87A7.tmp 1788 87F5.tmp 1628 8833.tmp 1480 8871.tmp 1948 88B0.tmp 2492 88EE.tmp 2480 892D.tmp 2904 896B.tmp 1324 89B9.tmp 3012 89F7.tmp 288 8A36.tmp 1132 8A74.tmp 2496 8AB3.tmp 1612 8AF1.tmp 1048 8B2F.tmp 1688 8B6E.tmp 2300 8BBC.tmp 1540 8C0A.tmp 2528 8C48.tmp 1752 8C87.tmp 1164 8CC5.tmp 3044 8D03.tmp 2392 8D42.tmp 1252 8D80.tmp 2540 8DBF.tmp 692 8E0D.tmp 2692 8E4B.tmp 1692 8E89.tmp 1000 8EC8.tmp 2416 8F06.tmp 2312 8F45.tmp 2112 8F83.tmp 1140 8FC1.tmp 2432 9000.tmp 2868 904E.tmp 2888 908C.tmp 2764 90CB.tmp 2724 9109.tmp 2732 9147.tmp 2944 9186.tmp 2744 91C4.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D633.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 435.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBD0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D02B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2904.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2491.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F79.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6567.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A41C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E225.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5763.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D9EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7974.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A45A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD56.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D671.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7FCA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBE7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 116E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A322.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C63C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54A5.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2136 wrote to memory of 2700 2136 2024-10-09_f2944f7f1a1c1804c5f8fe6a5d9a7c0e_mafia.exe 30 PID 2136 wrote to memory of 2700 2136 2024-10-09_f2944f7f1a1c1804c5f8fe6a5d9a7c0e_mafia.exe 30 PID 2136 wrote to memory of 2700 2136 2024-10-09_f2944f7f1a1c1804c5f8fe6a5d9a7c0e_mafia.exe 30 PID 2136 wrote to memory of 2700 2136 2024-10-09_f2944f7f1a1c1804c5f8fe6a5d9a7c0e_mafia.exe 30 PID 2700 wrote to memory of 2716 2700 7EFF.tmp 31 PID 2700 wrote to memory of 2716 2700 7EFF.tmp 31 PID 2700 wrote to memory of 2716 2700 7EFF.tmp 31 PID 2700 wrote to memory of 2716 2700 7EFF.tmp 31 PID 2716 wrote to memory of 2884 2716 7F4D.tmp 32 PID 2716 wrote to memory of 2884 2716 7F4D.tmp 32 PID 2716 wrote to memory of 2884 2716 7F4D.tmp 32 PID 2716 wrote to memory of 2884 2716 7F4D.tmp 32 PID 2884 wrote to memory of 2732 2884 7FCA.tmp 33 PID 2884 wrote to memory of 2732 2884 7FCA.tmp 33 PID 2884 wrote to memory of 2732 2884 7FCA.tmp 33 PID 2884 wrote to memory of 2732 2884 7FCA.tmp 33 PID 2732 wrote to memory of 2900 2732 8028.tmp 34 PID 2732 wrote to memory of 2900 2732 8028.tmp 34 PID 2732 wrote to memory of 2900 2732 8028.tmp 34 PID 2732 wrote to memory of 2900 2732 8028.tmp 34 PID 2900 wrote to memory of 2976 2900 8095.tmp 35 PID 2900 wrote to memory of 2976 2900 8095.tmp 35 PID 2900 wrote to memory of 2976 2900 8095.tmp 35 PID 2900 wrote to memory of 2976 2900 8095.tmp 35 PID 2976 wrote to memory of 2772 2976 80F3.tmp 36 PID 2976 wrote to memory of 2772 2976 80F3.tmp 36 PID 2976 wrote to memory of 2772 2976 80F3.tmp 36 PID 2976 wrote to memory of 2772 2976 80F3.tmp 36 PID 2772 wrote to memory of 1872 2772 8160.tmp 37 PID 2772 wrote to memory of 1872 2772 8160.tmp 37 PID 2772 wrote to memory of 1872 2772 8160.tmp 37 PID 2772 wrote to memory of 1872 2772 8160.tmp 37 PID 1872 wrote to memory of 2664 1872 81BD.tmp 38 PID 1872 wrote to memory of 2664 1872 81BD.tmp 38 PID 1872 wrote to memory of 2664 1872 81BD.tmp 38 PID 1872 wrote to memory of 2664 1872 81BD.tmp 38 PID 2664 wrote to memory of 2160 2664 821B.tmp 39 PID 2664 wrote to memory of 2160 2664 821B.tmp 39 PID 2664 wrote to memory of 2160 2664 821B.tmp 39 PID 2664 wrote to memory of 2160 2664 821B.tmp 39 PID 2160 wrote to memory of 1940 2160 8279.tmp 40 PID 2160 wrote to memory of 1940 2160 8279.tmp 40 PID 2160 wrote to memory of 1940 2160 8279.tmp 40 PID 2160 wrote to memory of 1940 2160 8279.tmp 40 PID 1940 wrote to memory of 2676 1940 82E6.tmp 41 PID 1940 wrote to memory of 2676 1940 82E6.tmp 41 PID 1940 wrote to memory of 2676 1940 82E6.tmp 41 PID 1940 wrote to memory of 2676 1940 82E6.tmp 41 PID 2676 wrote to memory of 2304 2676 8334.tmp 42 PID 2676 wrote to memory of 2304 2676 8334.tmp 42 PID 2676 wrote to memory of 2304 2676 8334.tmp 42 PID 2676 wrote to memory of 2304 2676 8334.tmp 42 PID 2304 wrote to memory of 2144 2304 83A1.tmp 43 PID 2304 wrote to memory of 2144 2304 83A1.tmp 43 PID 2304 wrote to memory of 2144 2304 83A1.tmp 43 PID 2304 wrote to memory of 2144 2304 83A1.tmp 43 PID 2144 wrote to memory of 2956 2144 840E.tmp 44 PID 2144 wrote to memory of 2956 2144 840E.tmp 44 PID 2144 wrote to memory of 2956 2144 840E.tmp 44 PID 2144 wrote to memory of 2956 2144 840E.tmp 44 PID 2956 wrote to memory of 1396 2956 847B.tmp 45 PID 2956 wrote to memory of 1396 2956 847B.tmp 45 PID 2956 wrote to memory of 1396 2956 847B.tmp 45 PID 2956 wrote to memory of 1396 2956 847B.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-09_f2944f7f1a1c1804c5f8fe6a5d9a7c0e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-09_f2944f7f1a1c1804c5f8fe6a5d9a7c0e_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\7EFF.tmp"C:\Users\Admin\AppData\Local\Temp\7EFF.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\7F4D.tmp"C:\Users\Admin\AppData\Local\Temp\7F4D.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\7FCA.tmp"C:\Users\Admin\AppData\Local\Temp\7FCA.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\8028.tmp"C:\Users\Admin\AppData\Local\Temp\8028.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\8095.tmp"C:\Users\Admin\AppData\Local\Temp\8095.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\80F3.tmp"C:\Users\Admin\AppData\Local\Temp\80F3.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\8160.tmp"C:\Users\Admin\AppData\Local\Temp\8160.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\81BD.tmp"C:\Users\Admin\AppData\Local\Temp\81BD.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\821B.tmp"C:\Users\Admin\AppData\Local\Temp\821B.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\8279.tmp"C:\Users\Admin\AppData\Local\Temp\8279.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\82E6.tmp"C:\Users\Admin\AppData\Local\Temp\82E6.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\8334.tmp"C:\Users\Admin\AppData\Local\Temp\8334.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\83A1.tmp"C:\Users\Admin\AppData\Local\Temp\83A1.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\840E.tmp"C:\Users\Admin\AppData\Local\Temp\840E.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\847B.tmp"C:\Users\Admin\AppData\Local\Temp\847B.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\84D9.tmp"C:\Users\Admin\AppData\Local\Temp\84D9.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\8546.tmp"C:\Users\Admin\AppData\Local\Temp\8546.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\85B3.tmp"C:\Users\Admin\AppData\Local\Temp\85B3.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\8621.tmp"C:\Users\Admin\AppData\Local\Temp\8621.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\868E.tmp"C:\Users\Admin\AppData\Local\Temp\868E.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\86EB.tmp"C:\Users\Admin\AppData\Local\Temp\86EB.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\8759.tmp"C:\Users\Admin\AppData\Local\Temp\8759.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:620 -
C:\Users\Admin\AppData\Local\Temp\87A7.tmp"C:\Users\Admin\AppData\Local\Temp\87A7.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:356 -
C:\Users\Admin\AppData\Local\Temp\87F5.tmp"C:\Users\Admin\AppData\Local\Temp\87F5.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\8833.tmp"C:\Users\Admin\AppData\Local\Temp\8833.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\8871.tmp"C:\Users\Admin\AppData\Local\Temp\8871.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\88B0.tmp"C:\Users\Admin\AppData\Local\Temp\88B0.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\88EE.tmp"C:\Users\Admin\AppData\Local\Temp\88EE.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\892D.tmp"C:\Users\Admin\AppData\Local\Temp\892D.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\896B.tmp"C:\Users\Admin\AppData\Local\Temp\896B.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\89B9.tmp"C:\Users\Admin\AppData\Local\Temp\89B9.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\89F7.tmp"C:\Users\Admin\AppData\Local\Temp\89F7.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\8A36.tmp"C:\Users\Admin\AppData\Local\Temp\8A36.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:288 -
C:\Users\Admin\AppData\Local\Temp\8A74.tmp"C:\Users\Admin\AppData\Local\Temp\8A74.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\8AB3.tmp"C:\Users\Admin\AppData\Local\Temp\8AB3.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\8AF1.tmp"C:\Users\Admin\AppData\Local\Temp\8AF1.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\8B2F.tmp"C:\Users\Admin\AppData\Local\Temp\8B2F.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\8B6E.tmp"C:\Users\Admin\AppData\Local\Temp\8B6E.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\8BBC.tmp"C:\Users\Admin\AppData\Local\Temp\8BBC.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\8C0A.tmp"C:\Users\Admin\AppData\Local\Temp\8C0A.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\8C48.tmp"C:\Users\Admin\AppData\Local\Temp\8C48.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\8C87.tmp"C:\Users\Admin\AppData\Local\Temp\8C87.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\8CC5.tmp"C:\Users\Admin\AppData\Local\Temp\8CC5.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\8D03.tmp"C:\Users\Admin\AppData\Local\Temp\8D03.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\8D42.tmp"C:\Users\Admin\AppData\Local\Temp\8D42.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\8D80.tmp"C:\Users\Admin\AppData\Local\Temp\8D80.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\8DBF.tmp"C:\Users\Admin\AppData\Local\Temp\8DBF.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:692 -
C:\Users\Admin\AppData\Local\Temp\8E4B.tmp"C:\Users\Admin\AppData\Local\Temp\8E4B.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\8E89.tmp"C:\Users\Admin\AppData\Local\Temp\8E89.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\8EC8.tmp"C:\Users\Admin\AppData\Local\Temp\8EC8.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\8F06.tmp"C:\Users\Admin\AppData\Local\Temp\8F06.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\8F45.tmp"C:\Users\Admin\AppData\Local\Temp\8F45.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\8F83.tmp"C:\Users\Admin\AppData\Local\Temp\8F83.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\8FC1.tmp"C:\Users\Admin\AppData\Local\Temp\8FC1.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\9000.tmp"C:\Users\Admin\AppData\Local\Temp\9000.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\904E.tmp"C:\Users\Admin\AppData\Local\Temp\904E.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\908C.tmp"C:\Users\Admin\AppData\Local\Temp\908C.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\90CB.tmp"C:\Users\Admin\AppData\Local\Temp\90CB.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\9109.tmp"C:\Users\Admin\AppData\Local\Temp\9109.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\9147.tmp"C:\Users\Admin\AppData\Local\Temp\9147.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\9186.tmp"C:\Users\Admin\AppData\Local\Temp\9186.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\91C4.tmp"C:\Users\Admin\AppData\Local\Temp\91C4.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\9212.tmp"C:\Users\Admin\AppData\Local\Temp\9212.tmp"65⤵
- Executes dropped EXE
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\9251.tmp"C:\Users\Admin\AppData\Local\Temp\9251.tmp"66⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\928F.tmp"C:\Users\Admin\AppData\Local\Temp\928F.tmp"67⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\92DD.tmp"C:\Users\Admin\AppData\Local\Temp\92DD.tmp"68⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\931B.tmp"C:\Users\Admin\AppData\Local\Temp\931B.tmp"69⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\935A.tmp"C:\Users\Admin\AppData\Local\Temp\935A.tmp"70⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\9398.tmp"C:\Users\Admin\AppData\Local\Temp\9398.tmp"71⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\93D7.tmp"C:\Users\Admin\AppData\Local\Temp\93D7.tmp"72⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\9415.tmp"C:\Users\Admin\AppData\Local\Temp\9415.tmp"73⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\9463.tmp"C:\Users\Admin\AppData\Local\Temp\9463.tmp"74⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\94A1.tmp"C:\Users\Admin\AppData\Local\Temp\94A1.tmp"75⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\94E0.tmp"C:\Users\Admin\AppData\Local\Temp\94E0.tmp"76⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\951E.tmp"C:\Users\Admin\AppData\Local\Temp\951E.tmp"77⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\955D.tmp"C:\Users\Admin\AppData\Local\Temp\955D.tmp"78⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\95AB.tmp"C:\Users\Admin\AppData\Local\Temp\95AB.tmp"79⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\95E9.tmp"C:\Users\Admin\AppData\Local\Temp\95E9.tmp"80⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\9627.tmp"C:\Users\Admin\AppData\Local\Temp\9627.tmp"81⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\9675.tmp"C:\Users\Admin\AppData\Local\Temp\9675.tmp"82⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\96C3.tmp"C:\Users\Admin\AppData\Local\Temp\96C3.tmp"83⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\9702.tmp"C:\Users\Admin\AppData\Local\Temp\9702.tmp"84⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\9740.tmp"C:\Users\Admin\AppData\Local\Temp\9740.tmp"85⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\977F.tmp"C:\Users\Admin\AppData\Local\Temp\977F.tmp"86⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\97BD.tmp"C:\Users\Admin\AppData\Local\Temp\97BD.tmp"87⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\97FB.tmp"C:\Users\Admin\AppData\Local\Temp\97FB.tmp"88⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\983A.tmp"C:\Users\Admin\AppData\Local\Temp\983A.tmp"89⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\9888.tmp"C:\Users\Admin\AppData\Local\Temp\9888.tmp"90⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\98C6.tmp"C:\Users\Admin\AppData\Local\Temp\98C6.tmp"91⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\9905.tmp"C:\Users\Admin\AppData\Local\Temp\9905.tmp"92⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\9953.tmp"C:\Users\Admin\AppData\Local\Temp\9953.tmp"93⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\99A1.tmp"C:\Users\Admin\AppData\Local\Temp\99A1.tmp"94⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\99EF.tmp"C:\Users\Admin\AppData\Local\Temp\99EF.tmp"95⤵
- System Location Discovery: System Language Discovery
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"96⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"97⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"98⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"99⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"100⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\9B75.tmp"C:\Users\Admin\AppData\Local\Temp\9B75.tmp"101⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"102⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\9C01.tmp"C:\Users\Admin\AppData\Local\Temp\9C01.tmp"103⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\9C3F.tmp"C:\Users\Admin\AppData\Local\Temp\9C3F.tmp"104⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"105⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"106⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\9D0A.tmp"C:\Users\Admin\AppData\Local\Temp\9D0A.tmp"107⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\9D49.tmp"C:\Users\Admin\AppData\Local\Temp\9D49.tmp"108⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\9D87.tmp"C:\Users\Admin\AppData\Local\Temp\9D87.tmp"109⤵PID:600
-
C:\Users\Admin\AppData\Local\Temp\9DC5.tmp"C:\Users\Admin\AppData\Local\Temp\9DC5.tmp"110⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\9E04.tmp"C:\Users\Admin\AppData\Local\Temp\9E04.tmp"111⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\9E42.tmp"C:\Users\Admin\AppData\Local\Temp\9E42.tmp"112⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\9E81.tmp"C:\Users\Admin\AppData\Local\Temp\9E81.tmp"113⤵PID:332
-
C:\Users\Admin\AppData\Local\Temp\9EBF.tmp"C:\Users\Admin\AppData\Local\Temp\9EBF.tmp"114⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\9F0D.tmp"C:\Users\Admin\AppData\Local\Temp\9F0D.tmp"115⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\9F4B.tmp"C:\Users\Admin\AppData\Local\Temp\9F4B.tmp"116⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\9F8A.tmp"C:\Users\Admin\AppData\Local\Temp\9F8A.tmp"117⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\9FC8.tmp"C:\Users\Admin\AppData\Local\Temp\9FC8.tmp"118⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\A007.tmp"C:\Users\Admin\AppData\Local\Temp\A007.tmp"119⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\A045.tmp"C:\Users\Admin\AppData\Local\Temp\A045.tmp"120⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\A093.tmp"C:\Users\Admin\AppData\Local\Temp\A093.tmp"121⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\A0D1.tmp"C:\Users\Admin\AppData\Local\Temp\A0D1.tmp"122⤵PID:2700
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-