Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
27/07/2024, 08:08
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-27_e5336da6c9fac3eb7e7a28eb2c92d4bd_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-07-27_e5336da6c9fac3eb7e7a28eb2c92d4bd_mafia.exe
Resource
win10v2004-20240704-en
General
-
Target
2024-07-27_e5336da6c9fac3eb7e7a28eb2c92d4bd_mafia.exe
-
Size
520KB
-
MD5
e5336da6c9fac3eb7e7a28eb2c92d4bd
-
SHA1
5d48b08e75c1b8c3b652e5acf01637f4d9dd8e94
-
SHA256
32995b691785f6be2fa57810e6f0b338a173ead98a279360a04eeffe6bdfccb9
-
SHA512
8801d42a67ceadd35cf5d4d49aad25ada8fda0a990241664e94e6ec45c5cad48e4329c3c508a29827c2f0546176a6f45df1ae02f75c40e8f8884374d15f1e104
-
SSDEEP
12288:roRXOQjmOyxGBBHWzEVbRwcDOa7OhKmJdNZ:rogQ9ygPZAMOcO9dN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2864 755F.tmp 2748 75CC.tmp 2876 7658.tmp 2900 7704.tmp 1332 77AF.tmp 2892 783C.tmp 2648 7899.tmp 2652 7926.tmp 1968 79B2.tmp 1484 7A4E.tmp 1784 7A8D.tmp 1788 7B09.tmp 2540 7BA5.tmp 2528 7C22.tmp 1672 7C61.tmp 2820 7CCE.tmp 2916 7D5A.tmp 2988 7E06.tmp 1688 7E54.tmp 1992 7EE0.tmp 2944 7F6D.tmp 760 7FE9.tmp 704 8066.tmp 1040 80A5.tmp 2984 8102.tmp 2092 8141.tmp 2196 818F.tmp 2172 81DD.tmp 2140 822B.tmp 1140 8279.tmp 2204 82C7.tmp 2260 8315.tmp 2068 8363.tmp 2384 83B1.tmp 2560 83FF.tmp 1376 843D.tmp 1052 847B.tmp 1812 84C9.tmp 1352 8517.tmp 1556 8565.tmp 1600 85A4.tmp 884 8601.tmp 1104 864F.tmp 1976 869D.tmp 1860 86EB.tmp 1608 872A.tmp 1632 8778.tmp 2236 87C6.tmp 1984 8814.tmp 880 8871.tmp 2108 88DF.tmp 1524 892D.tmp 2708 896B.tmp 2852 89B9.tmp 2856 8A07.tmp 2864 8A45.tmp 2428 8A93.tmp 2848 8AD2.tmp 2628 8B10.tmp 2624 8B5E.tmp 2836 8B9D.tmp 2596 8BEB.tmp 2892 8C39.tmp 496 8C87.tmp -
Loads dropped DLL 64 IoCs
pid Process 2708 2024-07-27_e5336da6c9fac3eb7e7a28eb2c92d4bd_mafia.exe 2864 755F.tmp 2748 75CC.tmp 2876 7658.tmp 2900 7704.tmp 1332 77AF.tmp 2892 783C.tmp 2648 7899.tmp 2652 7926.tmp 1968 79B2.tmp 1484 7A4E.tmp 1784 7A8D.tmp 1788 7B09.tmp 2540 7BA5.tmp 2528 7C22.tmp 1672 7C61.tmp 2820 7CCE.tmp 2916 7D5A.tmp 2988 7E06.tmp 1688 7E54.tmp 1992 7EE0.tmp 2944 7F6D.tmp 760 7FE9.tmp 704 8066.tmp 1040 80A5.tmp 2984 8102.tmp 2092 8141.tmp 2196 818F.tmp 2172 81DD.tmp 2140 822B.tmp 1140 8279.tmp 2204 82C7.tmp 2260 8315.tmp 2068 8363.tmp 2384 83B1.tmp 2560 83FF.tmp 1376 843D.tmp 1052 847B.tmp 1812 84C9.tmp 1352 8517.tmp 1556 8565.tmp 1600 85A4.tmp 884 8601.tmp 1104 864F.tmp 1976 869D.tmp 1860 86EB.tmp 1608 872A.tmp 1632 8778.tmp 2236 87C6.tmp 1984 8814.tmp 880 8871.tmp 2108 88DF.tmp 1524 892D.tmp 2708 896B.tmp 2852 89B9.tmp 2856 8A07.tmp 2864 8A45.tmp 2428 8A93.tmp 2848 8AD2.tmp 2628 8B10.tmp 2624 8B5E.tmp 2836 8B9D.tmp 2596 8BEB.tmp 2892 8C39.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E34D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E79.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C977.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 389D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE4E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3006.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CBE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 818F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 932B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3237.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8076.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 622D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 892E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 649D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E91.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4089.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F853.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1084.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2708 wrote to memory of 2864 2708 2024-07-27_e5336da6c9fac3eb7e7a28eb2c92d4bd_mafia.exe 30 PID 2708 wrote to memory of 2864 2708 2024-07-27_e5336da6c9fac3eb7e7a28eb2c92d4bd_mafia.exe 30 PID 2708 wrote to memory of 2864 2708 2024-07-27_e5336da6c9fac3eb7e7a28eb2c92d4bd_mafia.exe 30 PID 2708 wrote to memory of 2864 2708 2024-07-27_e5336da6c9fac3eb7e7a28eb2c92d4bd_mafia.exe 30 PID 2864 wrote to memory of 2748 2864 755F.tmp 31 PID 2864 wrote to memory of 2748 2864 755F.tmp 31 PID 2864 wrote to memory of 2748 2864 755F.tmp 31 PID 2864 wrote to memory of 2748 2864 755F.tmp 31 PID 2748 wrote to memory of 2876 2748 75CC.tmp 32 PID 2748 wrote to memory of 2876 2748 75CC.tmp 32 PID 2748 wrote to memory of 2876 2748 75CC.tmp 32 PID 2748 wrote to memory of 2876 2748 75CC.tmp 32 PID 2876 wrote to memory of 2900 2876 7658.tmp 33 PID 2876 wrote to memory of 2900 2876 7658.tmp 33 PID 2876 wrote to memory of 2900 2876 7658.tmp 33 PID 2876 wrote to memory of 2900 2876 7658.tmp 33 PID 2900 wrote to memory of 1332 2900 7704.tmp 34 PID 2900 wrote to memory of 1332 2900 7704.tmp 34 PID 2900 wrote to memory of 1332 2900 7704.tmp 34 PID 2900 wrote to memory of 1332 2900 7704.tmp 34 PID 1332 wrote to memory of 2892 1332 77AF.tmp 35 PID 1332 wrote to memory of 2892 1332 77AF.tmp 35 PID 1332 wrote to memory of 2892 1332 77AF.tmp 35 PID 1332 wrote to memory of 2892 1332 77AF.tmp 35 PID 2892 wrote to memory of 2648 2892 783C.tmp 36 PID 2892 wrote to memory of 2648 2892 783C.tmp 36 PID 2892 wrote to memory of 2648 2892 783C.tmp 36 PID 2892 wrote to memory of 2648 2892 783C.tmp 36 PID 2648 wrote to memory of 2652 2648 7899.tmp 37 PID 2648 wrote to memory of 2652 2648 7899.tmp 37 PID 2648 wrote to memory of 2652 2648 7899.tmp 37 PID 2648 wrote to memory of 2652 2648 7899.tmp 37 PID 2652 wrote to memory of 1968 2652 7926.tmp 38 PID 2652 wrote to memory of 1968 2652 7926.tmp 38 PID 2652 wrote to memory of 1968 2652 7926.tmp 38 PID 2652 wrote to memory of 1968 2652 7926.tmp 38 PID 1968 wrote to memory of 1484 1968 79B2.tmp 39 PID 1968 wrote to memory of 1484 1968 79B2.tmp 39 PID 1968 wrote to memory of 1484 1968 79B2.tmp 39 PID 1968 wrote to memory of 1484 1968 79B2.tmp 39 PID 1484 wrote to memory of 1784 1484 7A4E.tmp 40 PID 1484 wrote to memory of 1784 1484 7A4E.tmp 40 PID 1484 wrote to memory of 1784 1484 7A4E.tmp 40 PID 1484 wrote to memory of 1784 1484 7A4E.tmp 40 PID 1784 wrote to memory of 1788 1784 7A8D.tmp 41 PID 1784 wrote to memory of 1788 1784 7A8D.tmp 41 PID 1784 wrote to memory of 1788 1784 7A8D.tmp 41 PID 1784 wrote to memory of 1788 1784 7A8D.tmp 41 PID 1788 wrote to memory of 2540 1788 7B09.tmp 42 PID 1788 wrote to memory of 2540 1788 7B09.tmp 42 PID 1788 wrote to memory of 2540 1788 7B09.tmp 42 PID 1788 wrote to memory of 2540 1788 7B09.tmp 42 PID 2540 wrote to memory of 2528 2540 7BA5.tmp 43 PID 2540 wrote to memory of 2528 2540 7BA5.tmp 43 PID 2540 wrote to memory of 2528 2540 7BA5.tmp 43 PID 2540 wrote to memory of 2528 2540 7BA5.tmp 43 PID 2528 wrote to memory of 1672 2528 7C22.tmp 44 PID 2528 wrote to memory of 1672 2528 7C22.tmp 44 PID 2528 wrote to memory of 1672 2528 7C22.tmp 44 PID 2528 wrote to memory of 1672 2528 7C22.tmp 44 PID 1672 wrote to memory of 2820 1672 7C61.tmp 45 PID 1672 wrote to memory of 2820 1672 7C61.tmp 45 PID 1672 wrote to memory of 2820 1672 7C61.tmp 45 PID 1672 wrote to memory of 2820 1672 7C61.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-27_e5336da6c9fac3eb7e7a28eb2c92d4bd_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-27_e5336da6c9fac3eb7e7a28eb2c92d4bd_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\755F.tmp"C:\Users\Admin\AppData\Local\Temp\755F.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\75CC.tmp"C:\Users\Admin\AppData\Local\Temp\75CC.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\7658.tmp"C:\Users\Admin\AppData\Local\Temp\7658.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\7704.tmp"C:\Users\Admin\AppData\Local\Temp\7704.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\77AF.tmp"C:\Users\Admin\AppData\Local\Temp\77AF.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\783C.tmp"C:\Users\Admin\AppData\Local\Temp\783C.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\7899.tmp"C:\Users\Admin\AppData\Local\Temp\7899.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\7926.tmp"C:\Users\Admin\AppData\Local\Temp\7926.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\79B2.tmp"C:\Users\Admin\AppData\Local\Temp\79B2.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\7A4E.tmp"C:\Users\Admin\AppData\Local\Temp\7A4E.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\7A8D.tmp"C:\Users\Admin\AppData\Local\Temp\7A8D.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\7B09.tmp"C:\Users\Admin\AppData\Local\Temp\7B09.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\7BA5.tmp"C:\Users\Admin\AppData\Local\Temp\7BA5.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\7C22.tmp"C:\Users\Admin\AppData\Local\Temp\7C22.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\7C61.tmp"C:\Users\Admin\AppData\Local\Temp\7C61.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\7CCE.tmp"C:\Users\Admin\AppData\Local\Temp\7CCE.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\7D5A.tmp"C:\Users\Admin\AppData\Local\Temp\7D5A.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\7E06.tmp"C:\Users\Admin\AppData\Local\Temp\7E06.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\7E54.tmp"C:\Users\Admin\AppData\Local\Temp\7E54.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\7EE0.tmp"C:\Users\Admin\AppData\Local\Temp\7EE0.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\7F6D.tmp"C:\Users\Admin\AppData\Local\Temp\7F6D.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\7FE9.tmp"C:\Users\Admin\AppData\Local\Temp\7FE9.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:760 -
C:\Users\Admin\AppData\Local\Temp\8066.tmp"C:\Users\Admin\AppData\Local\Temp\8066.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:704 -
C:\Users\Admin\AppData\Local\Temp\80A5.tmp"C:\Users\Admin\AppData\Local\Temp\80A5.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\8102.tmp"C:\Users\Admin\AppData\Local\Temp\8102.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\8141.tmp"C:\Users\Admin\AppData\Local\Temp\8141.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\818F.tmp"C:\Users\Admin\AppData\Local\Temp\818F.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\81DD.tmp"C:\Users\Admin\AppData\Local\Temp\81DD.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\822B.tmp"C:\Users\Admin\AppData\Local\Temp\822B.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\8279.tmp"C:\Users\Admin\AppData\Local\Temp\8279.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\82C7.tmp"C:\Users\Admin\AppData\Local\Temp\82C7.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\8315.tmp"C:\Users\Admin\AppData\Local\Temp\8315.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\8363.tmp"C:\Users\Admin\AppData\Local\Temp\8363.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\83B1.tmp"C:\Users\Admin\AppData\Local\Temp\83B1.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\83FF.tmp"C:\Users\Admin\AppData\Local\Temp\83FF.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\843D.tmp"C:\Users\Admin\AppData\Local\Temp\843D.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\847B.tmp"C:\Users\Admin\AppData\Local\Temp\847B.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\84C9.tmp"C:\Users\Admin\AppData\Local\Temp\84C9.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\8517.tmp"C:\Users\Admin\AppData\Local\Temp\8517.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\8565.tmp"C:\Users\Admin\AppData\Local\Temp\8565.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\85A4.tmp"C:\Users\Admin\AppData\Local\Temp\85A4.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\8601.tmp"C:\Users\Admin\AppData\Local\Temp\8601.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:884 -
C:\Users\Admin\AppData\Local\Temp\864F.tmp"C:\Users\Admin\AppData\Local\Temp\864F.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\869D.tmp"C:\Users\Admin\AppData\Local\Temp\869D.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\86EB.tmp"C:\Users\Admin\AppData\Local\Temp\86EB.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\872A.tmp"C:\Users\Admin\AppData\Local\Temp\872A.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\8778.tmp"C:\Users\Admin\AppData\Local\Temp\8778.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\87C6.tmp"C:\Users\Admin\AppData\Local\Temp\87C6.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\8814.tmp"C:\Users\Admin\AppData\Local\Temp\8814.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\8871.tmp"C:\Users\Admin\AppData\Local\Temp\8871.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:880 -
C:\Users\Admin\AppData\Local\Temp\88DF.tmp"C:\Users\Admin\AppData\Local\Temp\88DF.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\892D.tmp"C:\Users\Admin\AppData\Local\Temp\892D.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\896B.tmp"C:\Users\Admin\AppData\Local\Temp\896B.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\89B9.tmp"C:\Users\Admin\AppData\Local\Temp\89B9.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\8A07.tmp"C:\Users\Admin\AppData\Local\Temp\8A07.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\8A45.tmp"C:\Users\Admin\AppData\Local\Temp\8A45.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\8A93.tmp"C:\Users\Admin\AppData\Local\Temp\8A93.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\8AD2.tmp"C:\Users\Admin\AppData\Local\Temp\8AD2.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\8B10.tmp"C:\Users\Admin\AppData\Local\Temp\8B10.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\8B5E.tmp"C:\Users\Admin\AppData\Local\Temp\8B5E.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\8B9D.tmp"C:\Users\Admin\AppData\Local\Temp\8B9D.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\8BEB.tmp"C:\Users\Admin\AppData\Local\Temp\8BEB.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\8C39.tmp"C:\Users\Admin\AppData\Local\Temp\8C39.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\8C87.tmp"C:\Users\Admin\AppData\Local\Temp\8C87.tmp"65⤵
- Executes dropped EXE
PID:496 -
C:\Users\Admin\AppData\Local\Temp\8CD5.tmp"C:\Users\Admin\AppData\Local\Temp\8CD5.tmp"66⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\8D23.tmp"C:\Users\Admin\AppData\Local\Temp\8D23.tmp"67⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\8D71.tmp"C:\Users\Admin\AppData\Local\Temp\8D71.tmp"68⤵PID:648
-
C:\Users\Admin\AppData\Local\Temp\8DAF.tmp"C:\Users\Admin\AppData\Local\Temp\8DAF.tmp"69⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\8DFD.tmp"C:\Users\Admin\AppData\Local\Temp\8DFD.tmp"70⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\8E3B.tmp"C:\Users\Admin\AppData\Local\Temp\8E3B.tmp"71⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\8E89.tmp"C:\Users\Admin\AppData\Local\Temp\8E89.tmp"72⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\8ED7.tmp"C:\Users\Admin\AppData\Local\Temp\8ED7.tmp"73⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\8F25.tmp"C:\Users\Admin\AppData\Local\Temp\8F25.tmp"74⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\8F73.tmp"C:\Users\Admin\AppData\Local\Temp\8F73.tmp"75⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\8FC1.tmp"C:\Users\Admin\AppData\Local\Temp\8FC1.tmp"76⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\9000.tmp"C:\Users\Admin\AppData\Local\Temp\9000.tmp"77⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\904E.tmp"C:\Users\Admin\AppData\Local\Temp\904E.tmp"78⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\908C.tmp"C:\Users\Admin\AppData\Local\Temp\908C.tmp"79⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\90DA.tmp"C:\Users\Admin\AppData\Local\Temp\90DA.tmp"80⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\9138.tmp"C:\Users\Admin\AppData\Local\Temp\9138.tmp"81⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\9186.tmp"C:\Users\Admin\AppData\Local\Temp\9186.tmp"82⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\91C4.tmp"C:\Users\Admin\AppData\Local\Temp\91C4.tmp"83⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\9212.tmp"C:\Users\Admin\AppData\Local\Temp\9212.tmp"84⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\9251.tmp"C:\Users\Admin\AppData\Local\Temp\9251.tmp"85⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\929F.tmp"C:\Users\Admin\AppData\Local\Temp\929F.tmp"86⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\92DD.tmp"C:\Users\Admin\AppData\Local\Temp\92DD.tmp"87⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\932B.tmp"C:\Users\Admin\AppData\Local\Temp\932B.tmp"88⤵
- System Location Discovery: System Language Discovery
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\9369.tmp"C:\Users\Admin\AppData\Local\Temp\9369.tmp"89⤵PID:484
-
C:\Users\Admin\AppData\Local\Temp\93B7.tmp"C:\Users\Admin\AppData\Local\Temp\93B7.tmp"90⤵
- System Location Discovery: System Language Discovery
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\9405.tmp"C:\Users\Admin\AppData\Local\Temp\9405.tmp"91⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\9453.tmp"C:\Users\Admin\AppData\Local\Temp\9453.tmp"92⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\94A1.tmp"C:\Users\Admin\AppData\Local\Temp\94A1.tmp"93⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\950F.tmp"C:\Users\Admin\AppData\Local\Temp\950F.tmp"94⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\954D.tmp"C:\Users\Admin\AppData\Local\Temp\954D.tmp"95⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\959B.tmp"C:\Users\Admin\AppData\Local\Temp\959B.tmp"96⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\95E9.tmp"C:\Users\Admin\AppData\Local\Temp\95E9.tmp"97⤵PID:304
-
C:\Users\Admin\AppData\Local\Temp\9637.tmp"C:\Users\Admin\AppData\Local\Temp\9637.tmp"98⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\9685.tmp"C:\Users\Admin\AppData\Local\Temp\9685.tmp"99⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\96D3.tmp"C:\Users\Admin\AppData\Local\Temp\96D3.tmp"100⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\9711.tmp"C:\Users\Admin\AppData\Local\Temp\9711.tmp"101⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\975F.tmp"C:\Users\Admin\AppData\Local\Temp\975F.tmp"102⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\979E.tmp"C:\Users\Admin\AppData\Local\Temp\979E.tmp"103⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\97EC.tmp"C:\Users\Admin\AppData\Local\Temp\97EC.tmp"104⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\982A.tmp"C:\Users\Admin\AppData\Local\Temp\982A.tmp"105⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\9878.tmp"C:\Users\Admin\AppData\Local\Temp\9878.tmp"106⤵PID:604
-
C:\Users\Admin\AppData\Local\Temp\98B7.tmp"C:\Users\Admin\AppData\Local\Temp\98B7.tmp"107⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\9905.tmp"C:\Users\Admin\AppData\Local\Temp\9905.tmp"108⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\9943.tmp"C:\Users\Admin\AppData\Local\Temp\9943.tmp"109⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\9991.tmp"C:\Users\Admin\AppData\Local\Temp\9991.tmp"110⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\99CF.tmp"C:\Users\Admin\AppData\Local\Temp\99CF.tmp"111⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"112⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\9A5C.tmp"C:\Users\Admin\AppData\Local\Temp\9A5C.tmp"113⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"114⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"115⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"116⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\9B75.tmp"C:\Users\Admin\AppData\Local\Temp\9B75.tmp"117⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"118⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\9C01.tmp"C:\Users\Admin\AppData\Local\Temp\9C01.tmp"119⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\9C3F.tmp"C:\Users\Admin\AppData\Local\Temp\9C3F.tmp"120⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"121⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"122⤵PID:2748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-