Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13-10-2024 01:37
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-13_b58d943c26dc616b434518a5b1d4780f_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-13_b58d943c26dc616b434518a5b1d4780f_mafia.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-13_b58d943c26dc616b434518a5b1d4780f_mafia.exe
-
Size
765KB
-
MD5
b58d943c26dc616b434518a5b1d4780f
-
SHA1
f8c8ce0e3e699636c83b5eac2ec08ff2631f96ec
-
SHA256
b6a9583b6d215c27e3bcad45d22c3d5d4ed15b9c31da1f5c2101dae3aad96d4a
-
SHA512
5cdcd4a256cc3d81dcf59a266909868eec6487bfdc96d1c752bdcc899b2242a208bd9309861def1acaf79cb2918f6e09bd5c8dabb1b17a30ea953be6619cdea6
-
SSDEEP
12288:ZU5rCOTeiDmnJCdBvG7xzlo6D9r7RPC3ZF5rn5rLOa54U5w5A:ZUQOJDMAByrosPC3vh5Oa+UOS
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1180 EF4E.tmp 2652 EFBC.tmp 2756 F00A.tmp 2676 F096.tmp 2384 F113.tmp 2568 F180.tmp 2716 F1DE.tmp 2544 F25A.tmp 2620 F2C8.tmp 2592 F335.tmp 1592 F3C1.tmp 2864 F42E.tmp 2032 F4BB.tmp 2424 F547.tmp 700 F5D4.tmp 1332 F641.tmp 1664 F6BE.tmp 1656 F72B.tmp 1264 F779.tmp 288 F7F6.tmp 1716 F844.tmp 1152 F8D0.tmp 1644 F92E.tmp 2860 F96C.tmp 2104 F9AA.tmp 2900 F9E9.tmp 2224 FA27.tmp 2328 FA66.tmp 2140 FAA4.tmp 2240 FAE2.tmp 1132 FB40.tmp 632 FB7E.tmp 1308 FBCC.tmp 1868 FC2A.tmp 1684 FC88.tmp 1568 FCE5.tmp 1544 FD33.tmp 872 FD91.tmp 1520 FDDF.tmp 2148 FE1D.tmp 1280 FE5C.tmp 616 FEAA.tmp 1708 FEF8.tmp 1356 FF36.tmp 2096 FF74.tmp 2504 FFB3.tmp 2300 FFF1.tmp 1996 30.tmp 1984 6E.tmp 2444 AC.tmp 2472 FA.tmp 2184 139.tmp 1776 187.tmp 2648 1C5.tmp 2684 213.tmp 2892 252.tmp 2700 2A0.tmp 2696 2DE.tmp 2704 32C.tmp 2576 36A.tmp 2680 3B8.tmp 2808 3F7.tmp 2540 445.tmp 2780 483.tmp -
Loads dropped DLL 64 IoCs
pid Process 1560 2024-10-13_b58d943c26dc616b434518a5b1d4780f_mafia.exe 1180 EF4E.tmp 2652 EFBC.tmp 2756 F00A.tmp 2676 F096.tmp 2384 F113.tmp 2568 F180.tmp 2716 F1DE.tmp 2544 F25A.tmp 2620 F2C8.tmp 2592 F335.tmp 1592 F3C1.tmp 2864 F42E.tmp 2032 F4BB.tmp 2424 F547.tmp 700 F5D4.tmp 1332 F641.tmp 1664 F6BE.tmp 1656 F72B.tmp 1264 F779.tmp 288 F7F6.tmp 1716 F844.tmp 1152 F8D0.tmp 1644 F92E.tmp 2860 F96C.tmp 2104 F9AA.tmp 2900 F9E9.tmp 2224 FA27.tmp 2328 FA66.tmp 2140 FAA4.tmp 2240 FAE2.tmp 1132 FB40.tmp 632 FB7E.tmp 1308 FBCC.tmp 1868 FC2A.tmp 1684 FC88.tmp 1568 FCE5.tmp 1544 FD33.tmp 872 FD91.tmp 1520 FDDF.tmp 2148 FE1D.tmp 1280 FE5C.tmp 616 FEAA.tmp 1708 FEF8.tmp 1356 FF36.tmp 2096 FF74.tmp 2504 FFB3.tmp 2300 FFF1.tmp 1996 30.tmp 1984 6E.tmp 2444 AC.tmp 2472 FA.tmp 2184 139.tmp 1776 187.tmp 2648 1C5.tmp 2684 213.tmp 2892 252.tmp 2700 2A0.tmp 2696 2DE.tmp 2704 32C.tmp 2576 36A.tmp 2680 3B8.tmp 2808 3F7.tmp 2540 445.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6883.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7677.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B599.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD91.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A44B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA24.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D910.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 757E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF04.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3978.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C39D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1560 wrote to memory of 1180 1560 2024-10-13_b58d943c26dc616b434518a5b1d4780f_mafia.exe 31 PID 1560 wrote to memory of 1180 1560 2024-10-13_b58d943c26dc616b434518a5b1d4780f_mafia.exe 31 PID 1560 wrote to memory of 1180 1560 2024-10-13_b58d943c26dc616b434518a5b1d4780f_mafia.exe 31 PID 1560 wrote to memory of 1180 1560 2024-10-13_b58d943c26dc616b434518a5b1d4780f_mafia.exe 31 PID 1180 wrote to memory of 2652 1180 EF4E.tmp 32 PID 1180 wrote to memory of 2652 1180 EF4E.tmp 32 PID 1180 wrote to memory of 2652 1180 EF4E.tmp 32 PID 1180 wrote to memory of 2652 1180 EF4E.tmp 32 PID 2652 wrote to memory of 2756 2652 EFBC.tmp 33 PID 2652 wrote to memory of 2756 2652 EFBC.tmp 33 PID 2652 wrote to memory of 2756 2652 EFBC.tmp 33 PID 2652 wrote to memory of 2756 2652 EFBC.tmp 33 PID 2756 wrote to memory of 2676 2756 F00A.tmp 34 PID 2756 wrote to memory of 2676 2756 F00A.tmp 34 PID 2756 wrote to memory of 2676 2756 F00A.tmp 34 PID 2756 wrote to memory of 2676 2756 F00A.tmp 34 PID 2676 wrote to memory of 2384 2676 F096.tmp 35 PID 2676 wrote to memory of 2384 2676 F096.tmp 35 PID 2676 wrote to memory of 2384 2676 F096.tmp 35 PID 2676 wrote to memory of 2384 2676 F096.tmp 35 PID 2384 wrote to memory of 2568 2384 F113.tmp 36 PID 2384 wrote to memory of 2568 2384 F113.tmp 36 PID 2384 wrote to memory of 2568 2384 F113.tmp 36 PID 2384 wrote to memory of 2568 2384 F113.tmp 36 PID 2568 wrote to memory of 2716 2568 F180.tmp 37 PID 2568 wrote to memory of 2716 2568 F180.tmp 37 PID 2568 wrote to memory of 2716 2568 F180.tmp 37 PID 2568 wrote to memory of 2716 2568 F180.tmp 37 PID 2716 wrote to memory of 2544 2716 F1DE.tmp 38 PID 2716 wrote to memory of 2544 2716 F1DE.tmp 38 PID 2716 wrote to memory of 2544 2716 F1DE.tmp 38 PID 2716 wrote to memory of 2544 2716 F1DE.tmp 38 PID 2544 wrote to memory of 2620 2544 F25A.tmp 39 PID 2544 wrote to memory of 2620 2544 F25A.tmp 39 PID 2544 wrote to memory of 2620 2544 F25A.tmp 39 PID 2544 wrote to memory of 2620 2544 F25A.tmp 39 PID 2620 wrote to memory of 2592 2620 F2C8.tmp 40 PID 2620 wrote to memory of 2592 2620 F2C8.tmp 40 PID 2620 wrote to memory of 2592 2620 F2C8.tmp 40 PID 2620 wrote to memory of 2592 2620 F2C8.tmp 40 PID 2592 wrote to memory of 1592 2592 F335.tmp 41 PID 2592 wrote to memory of 1592 2592 F335.tmp 41 PID 2592 wrote to memory of 1592 2592 F335.tmp 41 PID 2592 wrote to memory of 1592 2592 F335.tmp 41 PID 1592 wrote to memory of 2864 1592 F3C1.tmp 42 PID 1592 wrote to memory of 2864 1592 F3C1.tmp 42 PID 1592 wrote to memory of 2864 1592 F3C1.tmp 42 PID 1592 wrote to memory of 2864 1592 F3C1.tmp 42 PID 2864 wrote to memory of 2032 2864 F42E.tmp 43 PID 2864 wrote to memory of 2032 2864 F42E.tmp 43 PID 2864 wrote to memory of 2032 2864 F42E.tmp 43 PID 2864 wrote to memory of 2032 2864 F42E.tmp 43 PID 2032 wrote to memory of 2424 2032 F4BB.tmp 44 PID 2032 wrote to memory of 2424 2032 F4BB.tmp 44 PID 2032 wrote to memory of 2424 2032 F4BB.tmp 44 PID 2032 wrote to memory of 2424 2032 F4BB.tmp 44 PID 2424 wrote to memory of 700 2424 F547.tmp 45 PID 2424 wrote to memory of 700 2424 F547.tmp 45 PID 2424 wrote to memory of 700 2424 F547.tmp 45 PID 2424 wrote to memory of 700 2424 F547.tmp 45 PID 700 wrote to memory of 1332 700 F5D4.tmp 46 PID 700 wrote to memory of 1332 700 F5D4.tmp 46 PID 700 wrote to memory of 1332 700 F5D4.tmp 46 PID 700 wrote to memory of 1332 700 F5D4.tmp 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-13_b58d943c26dc616b434518a5b1d4780f_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-13_b58d943c26dc616b434518a5b1d4780f_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\EF4E.tmp"C:\Users\Admin\AppData\Local\Temp\EF4E.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\EFBC.tmp"C:\Users\Admin\AppData\Local\Temp\EFBC.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\F00A.tmp"C:\Users\Admin\AppData\Local\Temp\F00A.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\F096.tmp"C:\Users\Admin\AppData\Local\Temp\F096.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\F113.tmp"C:\Users\Admin\AppData\Local\Temp\F113.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\F180.tmp"C:\Users\Admin\AppData\Local\Temp\F180.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\F1DE.tmp"C:\Users\Admin\AppData\Local\Temp\F1DE.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\F25A.tmp"C:\Users\Admin\AppData\Local\Temp\F25A.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\F2C8.tmp"C:\Users\Admin\AppData\Local\Temp\F2C8.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\F335.tmp"C:\Users\Admin\AppData\Local\Temp\F335.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\F3C1.tmp"C:\Users\Admin\AppData\Local\Temp\F3C1.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\F42E.tmp"C:\Users\Admin\AppData\Local\Temp\F42E.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\F4BB.tmp"C:\Users\Admin\AppData\Local\Temp\F4BB.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\F547.tmp"C:\Users\Admin\AppData\Local\Temp\F547.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\F5D4.tmp"C:\Users\Admin\AppData\Local\Temp\F5D4.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:700 -
C:\Users\Admin\AppData\Local\Temp\F641.tmp"C:\Users\Admin\AppData\Local\Temp\F641.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\F6BE.tmp"C:\Users\Admin\AppData\Local\Temp\F6BE.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\F72B.tmp"C:\Users\Admin\AppData\Local\Temp\F72B.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\F779.tmp"C:\Users\Admin\AppData\Local\Temp\F779.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\F7F6.tmp"C:\Users\Admin\AppData\Local\Temp\F7F6.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:288 -
C:\Users\Admin\AppData\Local\Temp\F844.tmp"C:\Users\Admin\AppData\Local\Temp\F844.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\F8D0.tmp"C:\Users\Admin\AppData\Local\Temp\F8D0.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\F92E.tmp"C:\Users\Admin\AppData\Local\Temp\F92E.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\F96C.tmp"C:\Users\Admin\AppData\Local\Temp\F96C.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\F9AA.tmp"C:\Users\Admin\AppData\Local\Temp\F9AA.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\F9E9.tmp"C:\Users\Admin\AppData\Local\Temp\F9E9.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\FA27.tmp"C:\Users\Admin\AppData\Local\Temp\FA27.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\FA66.tmp"C:\Users\Admin\AppData\Local\Temp\FA66.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\FAA4.tmp"C:\Users\Admin\AppData\Local\Temp\FAA4.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\FAE2.tmp"C:\Users\Admin\AppData\Local\Temp\FAE2.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\FB40.tmp"C:\Users\Admin\AppData\Local\Temp\FB40.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\FB7E.tmp"C:\Users\Admin\AppData\Local\Temp\FB7E.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:632 -
C:\Users\Admin\AppData\Local\Temp\FBCC.tmp"C:\Users\Admin\AppData\Local\Temp\FBCC.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\FC2A.tmp"C:\Users\Admin\AppData\Local\Temp\FC2A.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\FC88.tmp"C:\Users\Admin\AppData\Local\Temp\FC88.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\FCE5.tmp"C:\Users\Admin\AppData\Local\Temp\FCE5.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\FD33.tmp"C:\Users\Admin\AppData\Local\Temp\FD33.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\FD91.tmp"C:\Users\Admin\AppData\Local\Temp\FD91.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:872 -
C:\Users\Admin\AppData\Local\Temp\FDDF.tmp"C:\Users\Admin\AppData\Local\Temp\FDDF.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\FE1D.tmp"C:\Users\Admin\AppData\Local\Temp\FE1D.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\FE5C.tmp"C:\Users\Admin\AppData\Local\Temp\FE5C.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\FEAA.tmp"C:\Users\Admin\AppData\Local\Temp\FEAA.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:616 -
C:\Users\Admin\AppData\Local\Temp\FEF8.tmp"C:\Users\Admin\AppData\Local\Temp\FEF8.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\FF36.tmp"C:\Users\Admin\AppData\Local\Temp\FF36.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\FF74.tmp"C:\Users\Admin\AppData\Local\Temp\FF74.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\FFB3.tmp"C:\Users\Admin\AppData\Local\Temp\FFB3.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\FFF1.tmp"C:\Users\Admin\AppData\Local\Temp\FFF1.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\30.tmp"C:\Users\Admin\AppData\Local\Temp\30.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\6E.tmp"C:\Users\Admin\AppData\Local\Temp\6E.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\AC.tmp"C:\Users\Admin\AppData\Local\Temp\AC.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\FA.tmp"C:\Users\Admin\AppData\Local\Temp\FA.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\139.tmp"C:\Users\Admin\AppData\Local\Temp\139.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\187.tmp"C:\Users\Admin\AppData\Local\Temp\187.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\1C5.tmp"C:\Users\Admin\AppData\Local\Temp\1C5.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\213.tmp"C:\Users\Admin\AppData\Local\Temp\213.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\252.tmp"C:\Users\Admin\AppData\Local\Temp\252.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\2A0.tmp"C:\Users\Admin\AppData\Local\Temp\2A0.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\2DE.tmp"C:\Users\Admin\AppData\Local\Temp\2DE.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\32C.tmp"C:\Users\Admin\AppData\Local\Temp\32C.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\36A.tmp"C:\Users\Admin\AppData\Local\Temp\36A.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\3B8.tmp"C:\Users\Admin\AppData\Local\Temp\3B8.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\3F7.tmp"C:\Users\Admin\AppData\Local\Temp\3F7.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\445.tmp"C:\Users\Admin\AppData\Local\Temp\445.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\483.tmp"C:\Users\Admin\AppData\Local\Temp\483.tmp"65⤵
- Executes dropped EXE
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\4D1.tmp"C:\Users\Admin\AppData\Local\Temp\4D1.tmp"66⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\510.tmp"C:\Users\Admin\AppData\Local\Temp\510.tmp"67⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\55E.tmp"C:\Users\Admin\AppData\Local\Temp\55E.tmp"68⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\59C.tmp"C:\Users\Admin\AppData\Local\Temp\59C.tmp"69⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\5EA.tmp"C:\Users\Admin\AppData\Local\Temp\5EA.tmp"70⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\628.tmp"C:\Users\Admin\AppData\Local\Temp\628.tmp"71⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\667.tmp"C:\Users\Admin\AppData\Local\Temp\667.tmp"72⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\6A5.tmp"C:\Users\Admin\AppData\Local\Temp\6A5.tmp"73⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\6E4.tmp"C:\Users\Admin\AppData\Local\Temp\6E4.tmp"74⤵PID:484
-
C:\Users\Admin\AppData\Local\Temp\722.tmp"C:\Users\Admin\AppData\Local\Temp\722.tmp"75⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\770.tmp"C:\Users\Admin\AppData\Local\Temp\770.tmp"76⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\7AE.tmp"C:\Users\Admin\AppData\Local\Temp\7AE.tmp"77⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\7FC.tmp"C:\Users\Admin\AppData\Local\Temp\7FC.tmp"78⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\83B.tmp"C:\Users\Admin\AppData\Local\Temp\83B.tmp"79⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\879.tmp"C:\Users\Admin\AppData\Local\Temp\879.tmp"80⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\8B8.tmp"C:\Users\Admin\AppData\Local\Temp\8B8.tmp"81⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\8F6.tmp"C:\Users\Admin\AppData\Local\Temp\8F6.tmp"82⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\934.tmp"C:\Users\Admin\AppData\Local\Temp\934.tmp"83⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\982.tmp"C:\Users\Admin\AppData\Local\Temp\982.tmp"84⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\9C1.tmp"C:\Users\Admin\AppData\Local\Temp\9C1.tmp"85⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\9FF.tmp"C:\Users\Admin\AppData\Local\Temp\9FF.tmp"86⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\A3E.tmp"C:\Users\Admin\AppData\Local\Temp\A3E.tmp"87⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\A7C.tmp"C:\Users\Admin\AppData\Local\Temp\A7C.tmp"88⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\ACA.tmp"C:\Users\Admin\AppData\Local\Temp\ACA.tmp"89⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\B08.tmp"C:\Users\Admin\AppData\Local\Temp\B08.tmp"90⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\B47.tmp"C:\Users\Admin\AppData\Local\Temp\B47.tmp"91⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\B85.tmp"C:\Users\Admin\AppData\Local\Temp\B85.tmp"92⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\BC4.tmp"C:\Users\Admin\AppData\Local\Temp\BC4.tmp"93⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\C02.tmp"C:\Users\Admin\AppData\Local\Temp\C02.tmp"94⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\C50.tmp"C:\Users\Admin\AppData\Local\Temp\C50.tmp"95⤵
- System Location Discovery: System Language Discovery
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\C9E.tmp"C:\Users\Admin\AppData\Local\Temp\C9E.tmp"96⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\CDC.tmp"C:\Users\Admin\AppData\Local\Temp\CDC.tmp"97⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\D1B.tmp"C:\Users\Admin\AppData\Local\Temp\D1B.tmp"98⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\D59.tmp"C:\Users\Admin\AppData\Local\Temp\D59.tmp"99⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\D98.tmp"C:\Users\Admin\AppData\Local\Temp\D98.tmp"100⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\DD6.tmp"C:\Users\Admin\AppData\Local\Temp\DD6.tmp"101⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\E14.tmp"C:\Users\Admin\AppData\Local\Temp\E14.tmp"102⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\E53.tmp"C:\Users\Admin\AppData\Local\Temp\E53.tmp"103⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\E91.tmp"C:\Users\Admin\AppData\Local\Temp\E91.tmp"104⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\ED0.tmp"C:\Users\Admin\AppData\Local\Temp\ED0.tmp"105⤵
- System Location Discovery: System Language Discovery
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\F0E.tmp"C:\Users\Admin\AppData\Local\Temp\F0E.tmp"106⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\F4C.tmp"C:\Users\Admin\AppData\Local\Temp\F4C.tmp"107⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\F8B.tmp"C:\Users\Admin\AppData\Local\Temp\F8B.tmp"108⤵PID:588
-
C:\Users\Admin\AppData\Local\Temp\FC9.tmp"C:\Users\Admin\AppData\Local\Temp\FC9.tmp"109⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\1008.tmp"C:\Users\Admin\AppData\Local\Temp\1008.tmp"110⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\1046.tmp"C:\Users\Admin\AppData\Local\Temp\1046.tmp"111⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\1084.tmp"C:\Users\Admin\AppData\Local\Temp\1084.tmp"112⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\10C3.tmp"C:\Users\Admin\AppData\Local\Temp\10C3.tmp"113⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\1101.tmp"C:\Users\Admin\AppData\Local\Temp\1101.tmp"114⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\1140.tmp"C:\Users\Admin\AppData\Local\Temp\1140.tmp"115⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\117E.tmp"C:\Users\Admin\AppData\Local\Temp\117E.tmp"116⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\11BC.tmp"C:\Users\Admin\AppData\Local\Temp\11BC.tmp"117⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\11FB.tmp"C:\Users\Admin\AppData\Local\Temp\11FB.tmp"118⤵
- System Location Discovery: System Language Discovery
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\1239.tmp"C:\Users\Admin\AppData\Local\Temp\1239.tmp"119⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\1278.tmp"C:\Users\Admin\AppData\Local\Temp\1278.tmp"120⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\12B6.tmp"C:\Users\Admin\AppData\Local\Temp\12B6.tmp"121⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\12F4.tmp"C:\Users\Admin\AppData\Local\Temp\12F4.tmp"122⤵PID:2668
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-