Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
10/10/2024, 06:59
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-10_84a85eff6c7da976b43025553acf39cb_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-10_84a85eff6c7da976b43025553acf39cb_mafia.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-10_84a85eff6c7da976b43025553acf39cb_mafia.exe
-
Size
488KB
-
MD5
84a85eff6c7da976b43025553acf39cb
-
SHA1
43cc89553779c52f1798ce3ab5100cf93cb0931f
-
SHA256
63b562fb608f1547c16fd5c28dad3f6a799dd18aeaabea60c1255aa3495c21e4
-
SHA512
73739459ed97fa8939a1a21290d03b31a3d5415eb5d835f8d00f06a10c998df1ecf539652b095757b00c8df9339dd460dffb63804584677287cd4d1f31a194cd
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7Va33KvWzmLXtEZXjG9PTQo9LG6YzcGHGqKga:/U5rCOTeiDVaAWzmiZXjwMCLlGmDpNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2744 753F.tmp 3028 759D.tmp 2728 761A.tmp 2908 7687.tmp 2980 76F4.tmp 2900 7761.tmp 2596 77CF.tmp 2664 783C.tmp 2640 78A9.tmp 1476 7916.tmp 1948 7974.tmp 2004 79D1.tmp 1300 7A2F.tmp 264 7A8D.tmp 2700 7AEA.tmp 2212 7B57.tmp 2864 7BB5.tmp 2852 7C13.tmp 2436 7C70.tmp 492 7CCE.tmp 1152 7D2B.tmp 1380 7D99.tmp 3036 7DF6.tmp 608 7E44.tmp 2444 7E83.tmp 2256 7ED1.tmp 2092 7F1F.tmp 2340 7F6D.tmp 2220 7FBB.tmp 1248 7FF9.tmp 1108 8037.tmp 2364 8085.tmp 2064 80C4.tmp 2556 8112.tmp 1396 8150.tmp 2452 819E.tmp 840 81DD.tmp 1344 821B.tmp 1612 8259.tmp 2396 82A7.tmp 896 82F5.tmp 640 8334.tmp 1520 8382.tmp 2000 83D0.tmp 2336 841E.tmp 2352 846C.tmp 2660 84AA.tmp 1968 84E9.tmp 1740 8527.tmp 1012 8575.tmp 2428 85B3.tmp 2740 85F2.tmp 1584 8630.tmp 2756 866F.tmp 2824 86AD.tmp 3040 86FB.tmp 2604 8739.tmp 2536 8778.tmp 2896 87B6.tmp 2620 87F5.tmp 2768 8843.tmp 2712 8891.tmp 2608 88CF.tmp 2720 890D.tmp -
Loads dropped DLL 64 IoCs
pid Process 2096 2024-10-10_84a85eff6c7da976b43025553acf39cb_mafia.exe 2744 753F.tmp 3028 759D.tmp 2728 761A.tmp 2908 7687.tmp 2980 76F4.tmp 2900 7761.tmp 2596 77CF.tmp 2664 783C.tmp 2640 78A9.tmp 1476 7916.tmp 1948 7974.tmp 2004 79D1.tmp 1300 7A2F.tmp 264 7A8D.tmp 2700 7AEA.tmp 2212 7B57.tmp 2864 7BB5.tmp 2852 7C13.tmp 2436 7C70.tmp 492 7CCE.tmp 1152 7D2B.tmp 1380 7D99.tmp 3036 7DF6.tmp 608 7E44.tmp 2444 7E83.tmp 2256 7ED1.tmp 2092 7F1F.tmp 2340 7F6D.tmp 2220 7FBB.tmp 1248 7FF9.tmp 1108 8037.tmp 2364 8085.tmp 2064 80C4.tmp 2556 8112.tmp 1396 8150.tmp 2452 819E.tmp 840 81DD.tmp 1344 821B.tmp 1612 8259.tmp 2396 82A7.tmp 896 82F5.tmp 640 8334.tmp 1520 8382.tmp 2000 83D0.tmp 2336 841E.tmp 2352 846C.tmp 2660 84AA.tmp 1968 84E9.tmp 1740 8527.tmp 1012 8575.tmp 2428 85B3.tmp 2740 85F2.tmp 1584 8630.tmp 2756 866F.tmp 2824 86AD.tmp 3040 86FB.tmp 2604 8739.tmp 2536 8778.tmp 2896 87B6.tmp 2620 87F5.tmp 2768 8843.tmp 2712 8891.tmp 2608 88CF.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A737.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B423.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B165.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D9CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A90B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E447.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5310.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 890D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD30.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5FFB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2096 wrote to memory of 2744 2096 2024-10-10_84a85eff6c7da976b43025553acf39cb_mafia.exe 30 PID 2096 wrote to memory of 2744 2096 2024-10-10_84a85eff6c7da976b43025553acf39cb_mafia.exe 30 PID 2096 wrote to memory of 2744 2096 2024-10-10_84a85eff6c7da976b43025553acf39cb_mafia.exe 30 PID 2096 wrote to memory of 2744 2096 2024-10-10_84a85eff6c7da976b43025553acf39cb_mafia.exe 30 PID 2744 wrote to memory of 3028 2744 753F.tmp 31 PID 2744 wrote to memory of 3028 2744 753F.tmp 31 PID 2744 wrote to memory of 3028 2744 753F.tmp 31 PID 2744 wrote to memory of 3028 2744 753F.tmp 31 PID 3028 wrote to memory of 2728 3028 759D.tmp 32 PID 3028 wrote to memory of 2728 3028 759D.tmp 32 PID 3028 wrote to memory of 2728 3028 759D.tmp 32 PID 3028 wrote to memory of 2728 3028 759D.tmp 32 PID 2728 wrote to memory of 2908 2728 761A.tmp 33 PID 2728 wrote to memory of 2908 2728 761A.tmp 33 PID 2728 wrote to memory of 2908 2728 761A.tmp 33 PID 2728 wrote to memory of 2908 2728 761A.tmp 33 PID 2908 wrote to memory of 2980 2908 7687.tmp 34 PID 2908 wrote to memory of 2980 2908 7687.tmp 34 PID 2908 wrote to memory of 2980 2908 7687.tmp 34 PID 2908 wrote to memory of 2980 2908 7687.tmp 34 PID 2980 wrote to memory of 2900 2980 76F4.tmp 35 PID 2980 wrote to memory of 2900 2980 76F4.tmp 35 PID 2980 wrote to memory of 2900 2980 76F4.tmp 35 PID 2980 wrote to memory of 2900 2980 76F4.tmp 35 PID 2900 wrote to memory of 2596 2900 7761.tmp 36 PID 2900 wrote to memory of 2596 2900 7761.tmp 36 PID 2900 wrote to memory of 2596 2900 7761.tmp 36 PID 2900 wrote to memory of 2596 2900 7761.tmp 36 PID 2596 wrote to memory of 2664 2596 77CF.tmp 37 PID 2596 wrote to memory of 2664 2596 77CF.tmp 37 PID 2596 wrote to memory of 2664 2596 77CF.tmp 37 PID 2596 wrote to memory of 2664 2596 77CF.tmp 37 PID 2664 wrote to memory of 2640 2664 783C.tmp 38 PID 2664 wrote to memory of 2640 2664 783C.tmp 38 PID 2664 wrote to memory of 2640 2664 783C.tmp 38 PID 2664 wrote to memory of 2640 2664 783C.tmp 38 PID 2640 wrote to memory of 1476 2640 78A9.tmp 39 PID 2640 wrote to memory of 1476 2640 78A9.tmp 39 PID 2640 wrote to memory of 1476 2640 78A9.tmp 39 PID 2640 wrote to memory of 1476 2640 78A9.tmp 39 PID 1476 wrote to memory of 1948 1476 7916.tmp 40 PID 1476 wrote to memory of 1948 1476 7916.tmp 40 PID 1476 wrote to memory of 1948 1476 7916.tmp 40 PID 1476 wrote to memory of 1948 1476 7916.tmp 40 PID 1948 wrote to memory of 2004 1948 7974.tmp 41 PID 1948 wrote to memory of 2004 1948 7974.tmp 41 PID 1948 wrote to memory of 2004 1948 7974.tmp 41 PID 1948 wrote to memory of 2004 1948 7974.tmp 41 PID 2004 wrote to memory of 1300 2004 79D1.tmp 42 PID 2004 wrote to memory of 1300 2004 79D1.tmp 42 PID 2004 wrote to memory of 1300 2004 79D1.tmp 42 PID 2004 wrote to memory of 1300 2004 79D1.tmp 42 PID 1300 wrote to memory of 264 1300 7A2F.tmp 43 PID 1300 wrote to memory of 264 1300 7A2F.tmp 43 PID 1300 wrote to memory of 264 1300 7A2F.tmp 43 PID 1300 wrote to memory of 264 1300 7A2F.tmp 43 PID 264 wrote to memory of 2700 264 7A8D.tmp 44 PID 264 wrote to memory of 2700 264 7A8D.tmp 44 PID 264 wrote to memory of 2700 264 7A8D.tmp 44 PID 264 wrote to memory of 2700 264 7A8D.tmp 44 PID 2700 wrote to memory of 2212 2700 7AEA.tmp 45 PID 2700 wrote to memory of 2212 2700 7AEA.tmp 45 PID 2700 wrote to memory of 2212 2700 7AEA.tmp 45 PID 2700 wrote to memory of 2212 2700 7AEA.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-10_84a85eff6c7da976b43025553acf39cb_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-10_84a85eff6c7da976b43025553acf39cb_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\753F.tmp"C:\Users\Admin\AppData\Local\Temp\753F.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\759D.tmp"C:\Users\Admin\AppData\Local\Temp\759D.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\7687.tmp"C:\Users\Admin\AppData\Local\Temp\7687.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\76F4.tmp"C:\Users\Admin\AppData\Local\Temp\76F4.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\7761.tmp"C:\Users\Admin\AppData\Local\Temp\7761.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\77CF.tmp"C:\Users\Admin\AppData\Local\Temp\77CF.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\783C.tmp"C:\Users\Admin\AppData\Local\Temp\783C.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\78A9.tmp"C:\Users\Admin\AppData\Local\Temp\78A9.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\7916.tmp"C:\Users\Admin\AppData\Local\Temp\7916.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\7974.tmp"C:\Users\Admin\AppData\Local\Temp\7974.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\79D1.tmp"C:\Users\Admin\AppData\Local\Temp\79D1.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\7A2F.tmp"C:\Users\Admin\AppData\Local\Temp\7A2F.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\7A8D.tmp"C:\Users\Admin\AppData\Local\Temp\7A8D.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Users\Admin\AppData\Local\Temp\7AEA.tmp"C:\Users\Admin\AppData\Local\Temp\7AEA.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\7B57.tmp"C:\Users\Admin\AppData\Local\Temp\7B57.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\7BB5.tmp"C:\Users\Admin\AppData\Local\Temp\7BB5.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\7C13.tmp"C:\Users\Admin\AppData\Local\Temp\7C13.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\7C70.tmp"C:\Users\Admin\AppData\Local\Temp\7C70.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\7CCE.tmp"C:\Users\Admin\AppData\Local\Temp\7CCE.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:492 -
C:\Users\Admin\AppData\Local\Temp\7D2B.tmp"C:\Users\Admin\AppData\Local\Temp\7D2B.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\7D99.tmp"C:\Users\Admin\AppData\Local\Temp\7D99.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\7DF6.tmp"C:\Users\Admin\AppData\Local\Temp\7DF6.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\7E44.tmp"C:\Users\Admin\AppData\Local\Temp\7E44.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:608 -
C:\Users\Admin\AppData\Local\Temp\7E83.tmp"C:\Users\Admin\AppData\Local\Temp\7E83.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\7ED1.tmp"C:\Users\Admin\AppData\Local\Temp\7ED1.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\7F1F.tmp"C:\Users\Admin\AppData\Local\Temp\7F1F.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\7F6D.tmp"C:\Users\Admin\AppData\Local\Temp\7F6D.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\7FBB.tmp"C:\Users\Admin\AppData\Local\Temp\7FBB.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\7FF9.tmp"C:\Users\Admin\AppData\Local\Temp\7FF9.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\8037.tmp"C:\Users\Admin\AppData\Local\Temp\8037.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\8085.tmp"C:\Users\Admin\AppData\Local\Temp\8085.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\80C4.tmp"C:\Users\Admin\AppData\Local\Temp\80C4.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\8112.tmp"C:\Users\Admin\AppData\Local\Temp\8112.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\8150.tmp"C:\Users\Admin\AppData\Local\Temp\8150.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\819E.tmp"C:\Users\Admin\AppData\Local\Temp\819E.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\81DD.tmp"C:\Users\Admin\AppData\Local\Temp\81DD.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:840 -
C:\Users\Admin\AppData\Local\Temp\821B.tmp"C:\Users\Admin\AppData\Local\Temp\821B.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\8259.tmp"C:\Users\Admin\AppData\Local\Temp\8259.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\82A7.tmp"C:\Users\Admin\AppData\Local\Temp\82A7.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\82F5.tmp"C:\Users\Admin\AppData\Local\Temp\82F5.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:896 -
C:\Users\Admin\AppData\Local\Temp\8334.tmp"C:\Users\Admin\AppData\Local\Temp\8334.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:640 -
C:\Users\Admin\AppData\Local\Temp\8382.tmp"C:\Users\Admin\AppData\Local\Temp\8382.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\83D0.tmp"C:\Users\Admin\AppData\Local\Temp\83D0.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\841E.tmp"C:\Users\Admin\AppData\Local\Temp\841E.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\846C.tmp"C:\Users\Admin\AppData\Local\Temp\846C.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\84AA.tmp"C:\Users\Admin\AppData\Local\Temp\84AA.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\84E9.tmp"C:\Users\Admin\AppData\Local\Temp\84E9.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\8527.tmp"C:\Users\Admin\AppData\Local\Temp\8527.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\8575.tmp"C:\Users\Admin\AppData\Local\Temp\8575.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\85B3.tmp"C:\Users\Admin\AppData\Local\Temp\85B3.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\85F2.tmp"C:\Users\Admin\AppData\Local\Temp\85F2.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\8630.tmp"C:\Users\Admin\AppData\Local\Temp\8630.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\866F.tmp"C:\Users\Admin\AppData\Local\Temp\866F.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\86AD.tmp"C:\Users\Admin\AppData\Local\Temp\86AD.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\86FB.tmp"C:\Users\Admin\AppData\Local\Temp\86FB.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\8739.tmp"C:\Users\Admin\AppData\Local\Temp\8739.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\8778.tmp"C:\Users\Admin\AppData\Local\Temp\8778.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\87B6.tmp"C:\Users\Admin\AppData\Local\Temp\87B6.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\87F5.tmp"C:\Users\Admin\AppData\Local\Temp\87F5.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\8843.tmp"C:\Users\Admin\AppData\Local\Temp\8843.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\8891.tmp"C:\Users\Admin\AppData\Local\Temp\8891.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\88CF.tmp"C:\Users\Admin\AppData\Local\Temp\88CF.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\890D.tmp"C:\Users\Admin\AppData\Local\Temp\890D.tmp"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\896B.tmp"C:\Users\Admin\AppData\Local\Temp\896B.tmp"66⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\89A9.tmp"C:\Users\Admin\AppData\Local\Temp\89A9.tmp"67⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\89E8.tmp"C:\Users\Admin\AppData\Local\Temp\89E8.tmp"68⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\8A26.tmp"C:\Users\Admin\AppData\Local\Temp\8A26.tmp"69⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\8A74.tmp"C:\Users\Admin\AppData\Local\Temp\8A74.tmp"70⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\8AB3.tmp"C:\Users\Admin\AppData\Local\Temp\8AB3.tmp"71⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\8AF1.tmp"C:\Users\Admin\AppData\Local\Temp\8AF1.tmp"72⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\8B2F.tmp"C:\Users\Admin\AppData\Local\Temp\8B2F.tmp"73⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"74⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\8BBC.tmp"C:\Users\Admin\AppData\Local\Temp\8BBC.tmp"75⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"76⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\8C39.tmp"C:\Users\Admin\AppData\Local\Temp\8C39.tmp"77⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\8C87.tmp"C:\Users\Admin\AppData\Local\Temp\8C87.tmp"78⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\8CC5.tmp"C:\Users\Admin\AppData\Local\Temp\8CC5.tmp"79⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\8D03.tmp"C:\Users\Admin\AppData\Local\Temp\8D03.tmp"80⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\8D42.tmp"C:\Users\Admin\AppData\Local\Temp\8D42.tmp"81⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\8D90.tmp"C:\Users\Admin\AppData\Local\Temp\8D90.tmp"82⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\8DCE.tmp"C:\Users\Admin\AppData\Local\Temp\8DCE.tmp"83⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"84⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\8E4B.tmp"C:\Users\Admin\AppData\Local\Temp\8E4B.tmp"85⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\8E99.tmp"C:\Users\Admin\AppData\Local\Temp\8E99.tmp"86⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\8ED7.tmp"C:\Users\Admin\AppData\Local\Temp\8ED7.tmp"87⤵PID:280
-
C:\Users\Admin\AppData\Local\Temp\8F16.tmp"C:\Users\Admin\AppData\Local\Temp\8F16.tmp"88⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\8F64.tmp"C:\Users\Admin\AppData\Local\Temp\8F64.tmp"89⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\8FB2.tmp"C:\Users\Admin\AppData\Local\Temp\8FB2.tmp"90⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\8FF0.tmp"C:\Users\Admin\AppData\Local\Temp\8FF0.tmp"91⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\902F.tmp"C:\Users\Admin\AppData\Local\Temp\902F.tmp"92⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\906D.tmp"C:\Users\Admin\AppData\Local\Temp\906D.tmp"93⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\90AB.tmp"C:\Users\Admin\AppData\Local\Temp\90AB.tmp"94⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\90EA.tmp"C:\Users\Admin\AppData\Local\Temp\90EA.tmp"95⤵PID:340
-
C:\Users\Admin\AppData\Local\Temp\9128.tmp"C:\Users\Admin\AppData\Local\Temp\9128.tmp"96⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\9167.tmp"C:\Users\Admin\AppData\Local\Temp\9167.tmp"97⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\91A5.tmp"C:\Users\Admin\AppData\Local\Temp\91A5.tmp"98⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\91E3.tmp"C:\Users\Admin\AppData\Local\Temp\91E3.tmp"99⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\9231.tmp"C:\Users\Admin\AppData\Local\Temp\9231.tmp"100⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\9270.tmp"C:\Users\Admin\AppData\Local\Temp\9270.tmp"101⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\92AE.tmp"C:\Users\Admin\AppData\Local\Temp\92AE.tmp"102⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\92FC.tmp"C:\Users\Admin\AppData\Local\Temp\92FC.tmp"103⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\934A.tmp"C:\Users\Admin\AppData\Local\Temp\934A.tmp"104⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\9398.tmp"C:\Users\Admin\AppData\Local\Temp\9398.tmp"105⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\93D7.tmp"C:\Users\Admin\AppData\Local\Temp\93D7.tmp"106⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\9415.tmp"C:\Users\Admin\AppData\Local\Temp\9415.tmp"107⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\9463.tmp"C:\Users\Admin\AppData\Local\Temp\9463.tmp"108⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\94A1.tmp"C:\Users\Admin\AppData\Local\Temp\94A1.tmp"109⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\94E0.tmp"C:\Users\Admin\AppData\Local\Temp\94E0.tmp"110⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\951E.tmp"C:\Users\Admin\AppData\Local\Temp\951E.tmp"111⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\955D.tmp"C:\Users\Admin\AppData\Local\Temp\955D.tmp"112⤵PID:332
-
C:\Users\Admin\AppData\Local\Temp\959B.tmp"C:\Users\Admin\AppData\Local\Temp\959B.tmp"113⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\95D9.tmp"C:\Users\Admin\AppData\Local\Temp\95D9.tmp"114⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\9618.tmp"C:\Users\Admin\AppData\Local\Temp\9618.tmp"115⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\9656.tmp"C:\Users\Admin\AppData\Local\Temp\9656.tmp"116⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\9695.tmp"C:\Users\Admin\AppData\Local\Temp\9695.tmp"117⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\96D3.tmp"C:\Users\Admin\AppData\Local\Temp\96D3.tmp"118⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\9711.tmp"C:\Users\Admin\AppData\Local\Temp\9711.tmp"119⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\9750.tmp"C:\Users\Admin\AppData\Local\Temp\9750.tmp"120⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\978E.tmp"C:\Users\Admin\AppData\Local\Temp\978E.tmp"121⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\97CD.tmp"C:\Users\Admin\AppData\Local\Temp\97CD.tmp"122⤵PID:2724
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-