Analysis
-
max time kernel
150s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
14/08/2024, 15:05
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-14_e3c5771af7d02f371d2b75c1fe9e3c90_mafia.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-08-14_e3c5771af7d02f371d2b75c1fe9e3c90_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-14_e3c5771af7d02f371d2b75c1fe9e3c90_mafia.exe
-
Size
530KB
-
MD5
e3c5771af7d02f371d2b75c1fe9e3c90
-
SHA1
c71cc2f86b74b8a62a3bb26e29afbef5fc4eadf9
-
SHA256
4494ffb30d67b04741e25f187affd9a4de6d4ce409c16f2fe239715c7ee323da
-
SHA512
b6ae93e50384581aa2d7bb3d7c13f5adfc262ca74a3f1e95d7e81bebffa8abd6bdcf773d50c80731cc0ecb4ae4da5d6bc21e441ddb20f05e7a99d812785ed74c
-
SSDEEP
12288:AU5rCOTeiofns3W4GtdnBHE3iyeHNZulFVg0M1:AUQOJo94akNONclFV/M1
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1600 6068.tmp 1448 60D5.tmp 2924 6152.tmp 2920 61BF.tmp 2656 622D.tmp 2908 628A.tmp 2980 62F7.tmp 2696 6365.tmp 2664 63D2.tmp 2140 643F.tmp 1660 64AC.tmp 760 6519.tmp 1124 6587.tmp 2688 65F4.tmp 2148 6661.tmp 1172 66CE.tmp 2880 673B.tmp 1168 67C8.tmp 2132 6845.tmp 1696 68B2.tmp 2832 690F.tmp 1992 697D.tmp 2264 69DA.tmp 1064 6A19.tmp 956 6A57.tmp 3048 6AA5.tmp 1604 6AE3.tmp 2268 6B22.tmp 1984 6B60.tmp 2220 6B9F.tmp 2272 6BDD.tmp 2096 6C1B.tmp 2484 6C5A.tmp 2472 6C98.tmp 844 6CD7.tmp 2192 6D25.tmp 2144 6D63.tmp 2352 6DA1.tmp 952 6DE0.tmp 1908 6E1E.tmp 1528 6E5D.tmp 840 6E9B.tmp 2040 6ED9.tmp 940 6F27.tmp 1512 6F66.tmp 2408 6FA4.tmp 1964 6FE3.tmp 1788 7021.tmp 2596 705F.tmp 1240 709E.tmp 1700 70DC.tmp 2080 711B.tmp 1724 7159.tmp 1584 7197.tmp 2976 71D6.tmp 1600 7214.tmp 2316 7253.tmp 2952 7291.tmp 2948 72CF.tmp 2780 731D.tmp 3032 735C.tmp 2656 73B9.tmp 2844 73F8.tmp 2784 7436.tmp -
Loads dropped DLL 64 IoCs
pid Process 408 2024-08-14_e3c5771af7d02f371d2b75c1fe9e3c90_mafia.exe 1600 6068.tmp 1448 60D5.tmp 2924 6152.tmp 2920 61BF.tmp 2656 622D.tmp 2908 628A.tmp 2980 62F7.tmp 2696 6365.tmp 2664 63D2.tmp 2140 643F.tmp 1660 64AC.tmp 760 6519.tmp 1124 6587.tmp 2688 65F4.tmp 2148 6661.tmp 1172 66CE.tmp 2880 673B.tmp 1168 67C8.tmp 2132 6845.tmp 1696 68B2.tmp 2832 690F.tmp 1992 697D.tmp 2264 69DA.tmp 1064 6A19.tmp 956 6A57.tmp 3048 6AA5.tmp 1604 6AE3.tmp 2268 6B22.tmp 1984 6B60.tmp 2220 6B9F.tmp 2272 6BDD.tmp 2096 6C1B.tmp 2484 6C5A.tmp 2472 6C98.tmp 844 6CD7.tmp 2192 6D25.tmp 2144 6D63.tmp 2352 6DA1.tmp 952 6DE0.tmp 1908 6E1E.tmp 1528 6E5D.tmp 840 6E9B.tmp 2040 6ED9.tmp 940 6F27.tmp 1512 6F66.tmp 2408 6FA4.tmp 1964 6FE3.tmp 1788 7021.tmp 2596 705F.tmp 1240 709E.tmp 1700 70DC.tmp 2080 711B.tmp 1724 7159.tmp 1584 7197.tmp 2976 71D6.tmp 1600 7214.tmp 2316 7253.tmp 2952 7291.tmp 2948 72CF.tmp 2780 731D.tmp 3032 735C.tmp 2656 73B9.tmp 2844 73F8.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAEB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F8A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F93D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 957C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E7B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ACD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D00C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3063.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D98D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4921.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3025.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D910.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7916.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 408 wrote to memory of 1600 408 2024-08-14_e3c5771af7d02f371d2b75c1fe9e3c90_mafia.exe 29 PID 408 wrote to memory of 1600 408 2024-08-14_e3c5771af7d02f371d2b75c1fe9e3c90_mafia.exe 29 PID 408 wrote to memory of 1600 408 2024-08-14_e3c5771af7d02f371d2b75c1fe9e3c90_mafia.exe 29 PID 408 wrote to memory of 1600 408 2024-08-14_e3c5771af7d02f371d2b75c1fe9e3c90_mafia.exe 29 PID 1600 wrote to memory of 1448 1600 6068.tmp 30 PID 1600 wrote to memory of 1448 1600 6068.tmp 30 PID 1600 wrote to memory of 1448 1600 6068.tmp 30 PID 1600 wrote to memory of 1448 1600 6068.tmp 30 PID 1448 wrote to memory of 2924 1448 60D5.tmp 31 PID 1448 wrote to memory of 2924 1448 60D5.tmp 31 PID 1448 wrote to memory of 2924 1448 60D5.tmp 31 PID 1448 wrote to memory of 2924 1448 60D5.tmp 31 PID 2924 wrote to memory of 2920 2924 6152.tmp 32 PID 2924 wrote to memory of 2920 2924 6152.tmp 32 PID 2924 wrote to memory of 2920 2924 6152.tmp 32 PID 2924 wrote to memory of 2920 2924 6152.tmp 32 PID 2920 wrote to memory of 2656 2920 61BF.tmp 33 PID 2920 wrote to memory of 2656 2920 61BF.tmp 33 PID 2920 wrote to memory of 2656 2920 61BF.tmp 33 PID 2920 wrote to memory of 2656 2920 61BF.tmp 33 PID 2656 wrote to memory of 2908 2656 622D.tmp 34 PID 2656 wrote to memory of 2908 2656 622D.tmp 34 PID 2656 wrote to memory of 2908 2656 622D.tmp 34 PID 2656 wrote to memory of 2908 2656 622D.tmp 34 PID 2908 wrote to memory of 2980 2908 628A.tmp 35 PID 2908 wrote to memory of 2980 2908 628A.tmp 35 PID 2908 wrote to memory of 2980 2908 628A.tmp 35 PID 2908 wrote to memory of 2980 2908 628A.tmp 35 PID 2980 wrote to memory of 2696 2980 62F7.tmp 36 PID 2980 wrote to memory of 2696 2980 62F7.tmp 36 PID 2980 wrote to memory of 2696 2980 62F7.tmp 36 PID 2980 wrote to memory of 2696 2980 62F7.tmp 36 PID 2696 wrote to memory of 2664 2696 6365.tmp 37 PID 2696 wrote to memory of 2664 2696 6365.tmp 37 PID 2696 wrote to memory of 2664 2696 6365.tmp 37 PID 2696 wrote to memory of 2664 2696 6365.tmp 37 PID 2664 wrote to memory of 2140 2664 63D2.tmp 38 PID 2664 wrote to memory of 2140 2664 63D2.tmp 38 PID 2664 wrote to memory of 2140 2664 63D2.tmp 38 PID 2664 wrote to memory of 2140 2664 63D2.tmp 38 PID 2140 wrote to memory of 1660 2140 643F.tmp 39 PID 2140 wrote to memory of 1660 2140 643F.tmp 39 PID 2140 wrote to memory of 1660 2140 643F.tmp 39 PID 2140 wrote to memory of 1660 2140 643F.tmp 39 PID 1660 wrote to memory of 760 1660 64AC.tmp 40 PID 1660 wrote to memory of 760 1660 64AC.tmp 40 PID 1660 wrote to memory of 760 1660 64AC.tmp 40 PID 1660 wrote to memory of 760 1660 64AC.tmp 40 PID 760 wrote to memory of 1124 760 6519.tmp 41 PID 760 wrote to memory of 1124 760 6519.tmp 41 PID 760 wrote to memory of 1124 760 6519.tmp 41 PID 760 wrote to memory of 1124 760 6519.tmp 41 PID 1124 wrote to memory of 2688 1124 6587.tmp 42 PID 1124 wrote to memory of 2688 1124 6587.tmp 42 PID 1124 wrote to memory of 2688 1124 6587.tmp 42 PID 1124 wrote to memory of 2688 1124 6587.tmp 42 PID 2688 wrote to memory of 2148 2688 65F4.tmp 43 PID 2688 wrote to memory of 2148 2688 65F4.tmp 43 PID 2688 wrote to memory of 2148 2688 65F4.tmp 43 PID 2688 wrote to memory of 2148 2688 65F4.tmp 43 PID 2148 wrote to memory of 1172 2148 6661.tmp 44 PID 2148 wrote to memory of 1172 2148 6661.tmp 44 PID 2148 wrote to memory of 1172 2148 6661.tmp 44 PID 2148 wrote to memory of 1172 2148 6661.tmp 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-14_e3c5771af7d02f371d2b75c1fe9e3c90_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-14_e3c5771af7d02f371d2b75c1fe9e3c90_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Users\Admin\AppData\Local\Temp\6068.tmp"C:\Users\Admin\AppData\Local\Temp\6068.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\60D5.tmp"C:\Users\Admin\AppData\Local\Temp\60D5.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\6152.tmp"C:\Users\Admin\AppData\Local\Temp\6152.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\61BF.tmp"C:\Users\Admin\AppData\Local\Temp\61BF.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\622D.tmp"C:\Users\Admin\AppData\Local\Temp\622D.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\628A.tmp"C:\Users\Admin\AppData\Local\Temp\628A.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\62F7.tmp"C:\Users\Admin\AppData\Local\Temp\62F7.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\6365.tmp"C:\Users\Admin\AppData\Local\Temp\6365.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\63D2.tmp"C:\Users\Admin\AppData\Local\Temp\63D2.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\643F.tmp"C:\Users\Admin\AppData\Local\Temp\643F.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\64AC.tmp"C:\Users\Admin\AppData\Local\Temp\64AC.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\6519.tmp"C:\Users\Admin\AppData\Local\Temp\6519.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\6587.tmp"C:\Users\Admin\AppData\Local\Temp\6587.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\65F4.tmp"C:\Users\Admin\AppData\Local\Temp\65F4.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\6661.tmp"C:\Users\Admin\AppData\Local\Temp\6661.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\66CE.tmp"C:\Users\Admin\AppData\Local\Temp\66CE.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\673B.tmp"C:\Users\Admin\AppData\Local\Temp\673B.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\67C8.tmp"C:\Users\Admin\AppData\Local\Temp\67C8.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\6845.tmp"C:\Users\Admin\AppData\Local\Temp\6845.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\68B2.tmp"C:\Users\Admin\AppData\Local\Temp\68B2.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\690F.tmp"C:\Users\Admin\AppData\Local\Temp\690F.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\697D.tmp"C:\Users\Admin\AppData\Local\Temp\697D.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\69DA.tmp"C:\Users\Admin\AppData\Local\Temp\69DA.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\6A19.tmp"C:\Users\Admin\AppData\Local\Temp\6A19.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\6A57.tmp"C:\Users\Admin\AppData\Local\Temp\6A57.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:956 -
C:\Users\Admin\AppData\Local\Temp\6AA5.tmp"C:\Users\Admin\AppData\Local\Temp\6AA5.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\6AE3.tmp"C:\Users\Admin\AppData\Local\Temp\6AE3.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\6B22.tmp"C:\Users\Admin\AppData\Local\Temp\6B22.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\6B60.tmp"C:\Users\Admin\AppData\Local\Temp\6B60.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\6B9F.tmp"C:\Users\Admin\AppData\Local\Temp\6B9F.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\6BDD.tmp"C:\Users\Admin\AppData\Local\Temp\6BDD.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\6C1B.tmp"C:\Users\Admin\AppData\Local\Temp\6C1B.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\6C5A.tmp"C:\Users\Admin\AppData\Local\Temp\6C5A.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\6C98.tmp"C:\Users\Admin\AppData\Local\Temp\6C98.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\6CD7.tmp"C:\Users\Admin\AppData\Local\Temp\6CD7.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:844 -
C:\Users\Admin\AppData\Local\Temp\6D25.tmp"C:\Users\Admin\AppData\Local\Temp\6D25.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\6D63.tmp"C:\Users\Admin\AppData\Local\Temp\6D63.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\6DA1.tmp"C:\Users\Admin\AppData\Local\Temp\6DA1.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\6DE0.tmp"C:\Users\Admin\AppData\Local\Temp\6DE0.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:952 -
C:\Users\Admin\AppData\Local\Temp\6E1E.tmp"C:\Users\Admin\AppData\Local\Temp\6E1E.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\6E5D.tmp"C:\Users\Admin\AppData\Local\Temp\6E5D.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\6E9B.tmp"C:\Users\Admin\AppData\Local\Temp\6E9B.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:840 -
C:\Users\Admin\AppData\Local\Temp\6ED9.tmp"C:\Users\Admin\AppData\Local\Temp\6ED9.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\6F27.tmp"C:\Users\Admin\AppData\Local\Temp\6F27.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:940 -
C:\Users\Admin\AppData\Local\Temp\6F66.tmp"C:\Users\Admin\AppData\Local\Temp\6F66.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\6FA4.tmp"C:\Users\Admin\AppData\Local\Temp\6FA4.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\6FE3.tmp"C:\Users\Admin\AppData\Local\Temp\6FE3.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\7021.tmp"C:\Users\Admin\AppData\Local\Temp\7021.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\705F.tmp"C:\Users\Admin\AppData\Local\Temp\705F.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\709E.tmp"C:\Users\Admin\AppData\Local\Temp\709E.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\70DC.tmp"C:\Users\Admin\AppData\Local\Temp\70DC.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\711B.tmp"C:\Users\Admin\AppData\Local\Temp\711B.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\7159.tmp"C:\Users\Admin\AppData\Local\Temp\7159.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\7197.tmp"C:\Users\Admin\AppData\Local\Temp\7197.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\71D6.tmp"C:\Users\Admin\AppData\Local\Temp\71D6.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\7214.tmp"C:\Users\Admin\AppData\Local\Temp\7214.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\7253.tmp"C:\Users\Admin\AppData\Local\Temp\7253.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\7291.tmp"C:\Users\Admin\AppData\Local\Temp\7291.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\72CF.tmp"C:\Users\Admin\AppData\Local\Temp\72CF.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\735C.tmp"C:\Users\Admin\AppData\Local\Temp\735C.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\73B9.tmp"C:\Users\Admin\AppData\Local\Temp\73B9.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\73F8.tmp"C:\Users\Admin\AppData\Local\Temp\73F8.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\7436.tmp"C:\Users\Admin\AppData\Local\Temp\7436.tmp"65⤵
- Executes dropped EXE
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\7475.tmp"C:\Users\Admin\AppData\Local\Temp\7475.tmp"66⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"67⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\74F1.tmp"C:\Users\Admin\AppData\Local\Temp\74F1.tmp"68⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\7530.tmp"C:\Users\Admin\AppData\Local\Temp\7530.tmp"69⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"70⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\75AD.tmp"C:\Users\Admin\AppData\Local\Temp\75AD.tmp"71⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\75EB.tmp"C:\Users\Admin\AppData\Local\Temp\75EB.tmp"72⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\7629.tmp"C:\Users\Admin\AppData\Local\Temp\7629.tmp"73⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\7668.tmp"C:\Users\Admin\AppData\Local\Temp\7668.tmp"74⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\76A6.tmp"C:\Users\Admin\AppData\Local\Temp\76A6.tmp"75⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\76E5.tmp"C:\Users\Admin\AppData\Local\Temp\76E5.tmp"76⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\7723.tmp"C:\Users\Admin\AppData\Local\Temp\7723.tmp"77⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\7761.tmp"C:\Users\Admin\AppData\Local\Temp\7761.tmp"78⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\77A0.tmp"C:\Users\Admin\AppData\Local\Temp\77A0.tmp"79⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\77DE.tmp"C:\Users\Admin\AppData\Local\Temp\77DE.tmp"80⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\781D.tmp"C:\Users\Admin\AppData\Local\Temp\781D.tmp"81⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\785B.tmp"C:\Users\Admin\AppData\Local\Temp\785B.tmp"82⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\7899.tmp"C:\Users\Admin\AppData\Local\Temp\7899.tmp"83⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\78D8.tmp"C:\Users\Admin\AppData\Local\Temp\78D8.tmp"84⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\7916.tmp"C:\Users\Admin\AppData\Local\Temp\7916.tmp"85⤵
- System Location Discovery: System Language Discovery
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\7955.tmp"C:\Users\Admin\AppData\Local\Temp\7955.tmp"86⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\7993.tmp"C:\Users\Admin\AppData\Local\Temp\7993.tmp"87⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\79D1.tmp"C:\Users\Admin\AppData\Local\Temp\79D1.tmp"88⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\7A10.tmp"C:\Users\Admin\AppData\Local\Temp\7A10.tmp"89⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\7A4E.tmp"C:\Users\Admin\AppData\Local\Temp\7A4E.tmp"90⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\7A8D.tmp"C:\Users\Admin\AppData\Local\Temp\7A8D.tmp"91⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\7ACB.tmp"C:\Users\Admin\AppData\Local\Temp\7ACB.tmp"92⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\7B09.tmp"C:\Users\Admin\AppData\Local\Temp\7B09.tmp"93⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\7B48.tmp"C:\Users\Admin\AppData\Local\Temp\7B48.tmp"94⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\7B86.tmp"C:\Users\Admin\AppData\Local\Temp\7B86.tmp"95⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\7BC5.tmp"C:\Users\Admin\AppData\Local\Temp\7BC5.tmp"96⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\7C03.tmp"C:\Users\Admin\AppData\Local\Temp\7C03.tmp"97⤵
- System Location Discovery: System Language Discovery
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\7C41.tmp"C:\Users\Admin\AppData\Local\Temp\7C41.tmp"98⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\7C80.tmp"C:\Users\Admin\AppData\Local\Temp\7C80.tmp"99⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\7CBE.tmp"C:\Users\Admin\AppData\Local\Temp\7CBE.tmp"100⤵PID:304
-
C:\Users\Admin\AppData\Local\Temp\7CFD.tmp"C:\Users\Admin\AppData\Local\Temp\7CFD.tmp"101⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\7D3B.tmp"C:\Users\Admin\AppData\Local\Temp\7D3B.tmp"102⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\7D79.tmp"C:\Users\Admin\AppData\Local\Temp\7D79.tmp"103⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\7DB8.tmp"C:\Users\Admin\AppData\Local\Temp\7DB8.tmp"104⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\7DF6.tmp"C:\Users\Admin\AppData\Local\Temp\7DF6.tmp"105⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\7E35.tmp"C:\Users\Admin\AppData\Local\Temp\7E35.tmp"106⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\7E73.tmp"C:\Users\Admin\AppData\Local\Temp\7E73.tmp"107⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\7EB1.tmp"C:\Users\Admin\AppData\Local\Temp\7EB1.tmp"108⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\7EF0.tmp"C:\Users\Admin\AppData\Local\Temp\7EF0.tmp"109⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\7F2E.tmp"C:\Users\Admin\AppData\Local\Temp\7F2E.tmp"110⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\7F6D.tmp"C:\Users\Admin\AppData\Local\Temp\7F6D.tmp"111⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\7FAB.tmp"C:\Users\Admin\AppData\Local\Temp\7FAB.tmp"112⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\7FE9.tmp"C:\Users\Admin\AppData\Local\Temp\7FE9.tmp"113⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\8028.tmp"C:\Users\Admin\AppData\Local\Temp\8028.tmp"114⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\8066.tmp"C:\Users\Admin\AppData\Local\Temp\8066.tmp"115⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\80A5.tmp"C:\Users\Admin\AppData\Local\Temp\80A5.tmp"116⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\80E3.tmp"C:\Users\Admin\AppData\Local\Temp\80E3.tmp"117⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\8121.tmp"C:\Users\Admin\AppData\Local\Temp\8121.tmp"118⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\8160.tmp"C:\Users\Admin\AppData\Local\Temp\8160.tmp"119⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\819E.tmp"C:\Users\Admin\AppData\Local\Temp\819E.tmp"120⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\81DD.tmp"C:\Users\Admin\AppData\Local\Temp\81DD.tmp"121⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\821B.tmp"C:\Users\Admin\AppData\Local\Temp\821B.tmp"122⤵PID:1600
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-