Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
23-08-2024 03:58
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-23_93ab840b16c1b9fe5fa87f3184e96429_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-08-23_93ab840b16c1b9fe5fa87f3184e96429_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-23_93ab840b16c1b9fe5fa87f3184e96429_mafia.exe
-
Size
712KB
-
MD5
93ab840b16c1b9fe5fa87f3184e96429
-
SHA1
b5acd3bda93293ba44461881c56db107eb53b6f1
-
SHA256
d9594461253c1f5b0758f59e99c5a834c150a65439b972b1133442c284eec6c8
-
SHA512
797ff0e2a5f1a54c8e682fe224da68c3cc11a7bccfc2e82e2a0b6138ff9b53d3e54f5aecf3a365b34a2ae6f2862154df4881365e8a926c3cf4ffa81300972a45
-
SSDEEP
12288:FU5rCOTeiDIzNyNioykBI/Ko5guYjbKLRj4sQNZdCvq5TJLCvY90D8/LVBlVk730:FUQOJDIzNyM/KduWKt8fNnCvq5TJLCvc
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1100 4183.tmp 968 423E.tmp 1688 42AB.tmp 2992 4431.tmp 2472 453A.tmp 3008 4653.tmp 3020 474D.tmp 2104 4837.tmp 1408 495F.tmp 2652 4A59.tmp 392 4B62.tmp 2640 4C7B.tmp 1368 4D65.tmp 2216 4E3F.tmp 2512 4F29.tmp 2804 5004.tmp 588 516B.tmp 1684 5255.tmp 2044 537D.tmp 2056 561C.tmp 2984 5715.tmp 2516 582E.tmp 1544 58E9.tmp 1744 5976.tmp 1752 5A02.tmp 2068 5A7F.tmp 1372 5B0B.tmp 1536 5B79.tmp 3028 5BF5.tmp 2260 5C82.tmp 3024 5CFF.tmp 604 5D7B.tmp 532 5E08.tmp 2528 5E94.tmp 2180 5F11.tmp 2188 5F8E.tmp 964 600B.tmp 952 6087.tmp 2348 6114.tmp 1340 61B0.tmp 1976 622D.tmp 1308 62B9.tmp 1404 6345.tmp 1824 63F1.tmp 1668 647D.tmp 2088 64EB.tmp 2392 6558.tmp 2268 65F4.tmp 2280 6680.tmp 872 670D.tmp 3000 67B8.tmp 2556 6835.tmp 1728 68C1.tmp 2564 6AD4.tmp 2908 6B60.tmp 848 6BDD.tmp 1724 6C5A.tmp 2240 6CD7.tmp 2324 6D53.tmp 2428 6DD0.tmp 2848 6E2E.tmp 2876 6EAB.tmp 2780 6F27.tmp 2896 6FB4.tmp -
Loads dropped DLL 64 IoCs
pid Process 2172 2024-08-23_93ab840b16c1b9fe5fa87f3184e96429_mafia.exe 1100 4183.tmp 968 423E.tmp 1688 42AB.tmp 2992 4431.tmp 2472 453A.tmp 3008 4653.tmp 3020 474D.tmp 2104 4837.tmp 1408 495F.tmp 2652 4A59.tmp 392 4B62.tmp 2640 4C7B.tmp 1368 4D65.tmp 2216 4E3F.tmp 2512 4F29.tmp 2804 5004.tmp 588 516B.tmp 1684 5255.tmp 2044 537D.tmp 2056 561C.tmp 2984 5715.tmp 2516 582E.tmp 1544 58E9.tmp 1744 5976.tmp 1752 5A02.tmp 2068 5A7F.tmp 1372 5B0B.tmp 1536 5B79.tmp 3028 5BF5.tmp 2260 5C82.tmp 3024 5CFF.tmp 604 5D7B.tmp 532 5E08.tmp 2528 5E94.tmp 2180 5F11.tmp 2188 5F8E.tmp 964 600B.tmp 952 6087.tmp 2348 6114.tmp 1340 61B0.tmp 1976 622D.tmp 1308 62B9.tmp 1404 6345.tmp 1824 63F1.tmp 1668 647D.tmp 2088 64EB.tmp 2392 6558.tmp 2268 65F4.tmp 2280 6680.tmp 872 670D.tmp 3000 67B8.tmp 2556 6835.tmp 1728 68C1.tmp 2564 6AD4.tmp 2908 6B60.tmp 848 6BDD.tmp 1724 6C5A.tmp 2240 6CD7.tmp 2324 6D53.tmp 2428 6DD0.tmp 2848 6E2E.tmp 2876 6EAB.tmp 2780 6F27.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 963.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D49E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 400D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B442.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C081.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8305.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 840E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 981B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9425.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 624C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8095.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 871A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F71B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 163F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9FA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E09F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F70C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 386F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C5BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3958.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8CA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 931B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BF5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36F8.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2172 wrote to memory of 1100 2172 2024-08-23_93ab840b16c1b9fe5fa87f3184e96429_mafia.exe 29 PID 2172 wrote to memory of 1100 2172 2024-08-23_93ab840b16c1b9fe5fa87f3184e96429_mafia.exe 29 PID 2172 wrote to memory of 1100 2172 2024-08-23_93ab840b16c1b9fe5fa87f3184e96429_mafia.exe 29 PID 2172 wrote to memory of 1100 2172 2024-08-23_93ab840b16c1b9fe5fa87f3184e96429_mafia.exe 29 PID 1100 wrote to memory of 968 1100 4183.tmp 30 PID 1100 wrote to memory of 968 1100 4183.tmp 30 PID 1100 wrote to memory of 968 1100 4183.tmp 30 PID 1100 wrote to memory of 968 1100 4183.tmp 30 PID 968 wrote to memory of 1688 968 423E.tmp 31 PID 968 wrote to memory of 1688 968 423E.tmp 31 PID 968 wrote to memory of 1688 968 423E.tmp 31 PID 968 wrote to memory of 1688 968 423E.tmp 31 PID 1688 wrote to memory of 2992 1688 42AB.tmp 32 PID 1688 wrote to memory of 2992 1688 42AB.tmp 32 PID 1688 wrote to memory of 2992 1688 42AB.tmp 32 PID 1688 wrote to memory of 2992 1688 42AB.tmp 32 PID 2992 wrote to memory of 2472 2992 4431.tmp 33 PID 2992 wrote to memory of 2472 2992 4431.tmp 33 PID 2992 wrote to memory of 2472 2992 4431.tmp 33 PID 2992 wrote to memory of 2472 2992 4431.tmp 33 PID 2472 wrote to memory of 3008 2472 453A.tmp 34 PID 2472 wrote to memory of 3008 2472 453A.tmp 34 PID 2472 wrote to memory of 3008 2472 453A.tmp 34 PID 2472 wrote to memory of 3008 2472 453A.tmp 34 PID 3008 wrote to memory of 3020 3008 4653.tmp 35 PID 3008 wrote to memory of 3020 3008 4653.tmp 35 PID 3008 wrote to memory of 3020 3008 4653.tmp 35 PID 3008 wrote to memory of 3020 3008 4653.tmp 35 PID 3020 wrote to memory of 2104 3020 474D.tmp 36 PID 3020 wrote to memory of 2104 3020 474D.tmp 36 PID 3020 wrote to memory of 2104 3020 474D.tmp 36 PID 3020 wrote to memory of 2104 3020 474D.tmp 36 PID 2104 wrote to memory of 1408 2104 4837.tmp 37 PID 2104 wrote to memory of 1408 2104 4837.tmp 37 PID 2104 wrote to memory of 1408 2104 4837.tmp 37 PID 2104 wrote to memory of 1408 2104 4837.tmp 37 PID 1408 wrote to memory of 2652 1408 495F.tmp 38 PID 1408 wrote to memory of 2652 1408 495F.tmp 38 PID 1408 wrote to memory of 2652 1408 495F.tmp 38 PID 1408 wrote to memory of 2652 1408 495F.tmp 38 PID 2652 wrote to memory of 392 2652 4A59.tmp 39 PID 2652 wrote to memory of 392 2652 4A59.tmp 39 PID 2652 wrote to memory of 392 2652 4A59.tmp 39 PID 2652 wrote to memory of 392 2652 4A59.tmp 39 PID 392 wrote to memory of 2640 392 4B62.tmp 40 PID 392 wrote to memory of 2640 392 4B62.tmp 40 PID 392 wrote to memory of 2640 392 4B62.tmp 40 PID 392 wrote to memory of 2640 392 4B62.tmp 40 PID 2640 wrote to memory of 1368 2640 4C7B.tmp 41 PID 2640 wrote to memory of 1368 2640 4C7B.tmp 41 PID 2640 wrote to memory of 1368 2640 4C7B.tmp 41 PID 2640 wrote to memory of 1368 2640 4C7B.tmp 41 PID 1368 wrote to memory of 2216 1368 4D65.tmp 42 PID 1368 wrote to memory of 2216 1368 4D65.tmp 42 PID 1368 wrote to memory of 2216 1368 4D65.tmp 42 PID 1368 wrote to memory of 2216 1368 4D65.tmp 42 PID 2216 wrote to memory of 2512 2216 4E3F.tmp 43 PID 2216 wrote to memory of 2512 2216 4E3F.tmp 43 PID 2216 wrote to memory of 2512 2216 4E3F.tmp 43 PID 2216 wrote to memory of 2512 2216 4E3F.tmp 43 PID 2512 wrote to memory of 2804 2512 4F29.tmp 44 PID 2512 wrote to memory of 2804 2512 4F29.tmp 44 PID 2512 wrote to memory of 2804 2512 4F29.tmp 44 PID 2512 wrote to memory of 2804 2512 4F29.tmp 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-23_93ab840b16c1b9fe5fa87f3184e96429_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-23_93ab840b16c1b9fe5fa87f3184e96429_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\4183.tmp"C:\Users\Admin\AppData\Local\Temp\4183.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\423E.tmp"C:\Users\Admin\AppData\Local\Temp\423E.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Users\Admin\AppData\Local\Temp\42AB.tmp"C:\Users\Admin\AppData\Local\Temp\42AB.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\4431.tmp"C:\Users\Admin\AppData\Local\Temp\4431.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\453A.tmp"C:\Users\Admin\AppData\Local\Temp\453A.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\4653.tmp"C:\Users\Admin\AppData\Local\Temp\4653.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\474D.tmp"C:\Users\Admin\AppData\Local\Temp\474D.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\4837.tmp"C:\Users\Admin\AppData\Local\Temp\4837.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\495F.tmp"C:\Users\Admin\AppData\Local\Temp\495F.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\4A59.tmp"C:\Users\Admin\AppData\Local\Temp\4A59.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\4B62.tmp"C:\Users\Admin\AppData\Local\Temp\4B62.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Users\Admin\AppData\Local\Temp\4C7B.tmp"C:\Users\Admin\AppData\Local\Temp\4C7B.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\4D65.tmp"C:\Users\Admin\AppData\Local\Temp\4D65.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\516B.tmp"C:\Users\Admin\AppData\Local\Temp\516B.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:588 -
C:\Users\Admin\AppData\Local\Temp\5255.tmp"C:\Users\Admin\AppData\Local\Temp\5255.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\537D.tmp"C:\Users\Admin\AppData\Local\Temp\537D.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\561C.tmp"C:\Users\Admin\AppData\Local\Temp\561C.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\5715.tmp"C:\Users\Admin\AppData\Local\Temp\5715.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\582E.tmp"C:\Users\Admin\AppData\Local\Temp\582E.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\58E9.tmp"C:\Users\Admin\AppData\Local\Temp\58E9.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\5976.tmp"C:\Users\Admin\AppData\Local\Temp\5976.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\5A02.tmp"C:\Users\Admin\AppData\Local\Temp\5A02.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\5A7F.tmp"C:\Users\Admin\AppData\Local\Temp\5A7F.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\5B0B.tmp"C:\Users\Admin\AppData\Local\Temp\5B0B.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\5B79.tmp"C:\Users\Admin\AppData\Local\Temp\5B79.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\5BF5.tmp"C:\Users\Admin\AppData\Local\Temp\5BF5.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\5C82.tmp"C:\Users\Admin\AppData\Local\Temp\5C82.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\5CFF.tmp"C:\Users\Admin\AppData\Local\Temp\5CFF.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\5D7B.tmp"C:\Users\Admin\AppData\Local\Temp\5D7B.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:604 -
C:\Users\Admin\AppData\Local\Temp\5E08.tmp"C:\Users\Admin\AppData\Local\Temp\5E08.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:532 -
C:\Users\Admin\AppData\Local\Temp\5E94.tmp"C:\Users\Admin\AppData\Local\Temp\5E94.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\5F11.tmp"C:\Users\Admin\AppData\Local\Temp\5F11.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\5F8E.tmp"C:\Users\Admin\AppData\Local\Temp\5F8E.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\600B.tmp"C:\Users\Admin\AppData\Local\Temp\600B.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:964 -
C:\Users\Admin\AppData\Local\Temp\6087.tmp"C:\Users\Admin\AppData\Local\Temp\6087.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:952 -
C:\Users\Admin\AppData\Local\Temp\6114.tmp"C:\Users\Admin\AppData\Local\Temp\6114.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\61B0.tmp"C:\Users\Admin\AppData\Local\Temp\61B0.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\622D.tmp"C:\Users\Admin\AppData\Local\Temp\622D.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\62B9.tmp"C:\Users\Admin\AppData\Local\Temp\62B9.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\6345.tmp"C:\Users\Admin\AppData\Local\Temp\6345.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\63F1.tmp"C:\Users\Admin\AppData\Local\Temp\63F1.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\647D.tmp"C:\Users\Admin\AppData\Local\Temp\647D.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\64EB.tmp"C:\Users\Admin\AppData\Local\Temp\64EB.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\6558.tmp"C:\Users\Admin\AppData\Local\Temp\6558.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\65F4.tmp"C:\Users\Admin\AppData\Local\Temp\65F4.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\6680.tmp"C:\Users\Admin\AppData\Local\Temp\6680.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\670D.tmp"C:\Users\Admin\AppData\Local\Temp\670D.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:872 -
C:\Users\Admin\AppData\Local\Temp\67B8.tmp"C:\Users\Admin\AppData\Local\Temp\67B8.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\6835.tmp"C:\Users\Admin\AppData\Local\Temp\6835.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\68C1.tmp"C:\Users\Admin\AppData\Local\Temp\68C1.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\6AD4.tmp"C:\Users\Admin\AppData\Local\Temp\6AD4.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\6B60.tmp"C:\Users\Admin\AppData\Local\Temp\6B60.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\6BDD.tmp"C:\Users\Admin\AppData\Local\Temp\6BDD.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:848 -
C:\Users\Admin\AppData\Local\Temp\6C5A.tmp"C:\Users\Admin\AppData\Local\Temp\6C5A.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\6CD7.tmp"C:\Users\Admin\AppData\Local\Temp\6CD7.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\6D53.tmp"C:\Users\Admin\AppData\Local\Temp\6D53.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\6DD0.tmp"C:\Users\Admin\AppData\Local\Temp\6DD0.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\6E2E.tmp"C:\Users\Admin\AppData\Local\Temp\6E2E.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\6EAB.tmp"C:\Users\Admin\AppData\Local\Temp\6EAB.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\6F27.tmp"C:\Users\Admin\AppData\Local\Temp\6F27.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\6FB4.tmp"C:\Users\Admin\AppData\Local\Temp\6FB4.tmp"65⤵
- Executes dropped EXE
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\7031.tmp"C:\Users\Admin\AppData\Local\Temp\7031.tmp"66⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\70AD.tmp"C:\Users\Admin\AppData\Local\Temp\70AD.tmp"67⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\711B.tmp"C:\Users\Admin\AppData\Local\Temp\711B.tmp"68⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\7197.tmp"C:\Users\Admin\AppData\Local\Temp\7197.tmp"69⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\7233.tmp"C:\Users\Admin\AppData\Local\Temp\7233.tmp"70⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\72B0.tmp"C:\Users\Admin\AppData\Local\Temp\72B0.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\732D.tmp"C:\Users\Admin\AppData\Local\Temp\732D.tmp"72⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\73AA.tmp"C:\Users\Admin\AppData\Local\Temp\73AA.tmp"73⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\7446.tmp"C:\Users\Admin\AppData\Local\Temp\7446.tmp"74⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"75⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\757E.tmp"C:\Users\Admin\AppData\Local\Temp\757E.tmp"76⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\75DB.tmp"C:\Users\Admin\AppData\Local\Temp\75DB.tmp"77⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\7668.tmp"C:\Users\Admin\AppData\Local\Temp\7668.tmp"78⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\76F4.tmp"C:\Users\Admin\AppData\Local\Temp\76F4.tmp"79⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\7790.tmp"C:\Users\Admin\AppData\Local\Temp\7790.tmp"80⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\77FD.tmp"C:\Users\Admin\AppData\Local\Temp\77FD.tmp"81⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\7899.tmp"C:\Users\Admin\AppData\Local\Temp\7899.tmp"82⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\7916.tmp"C:\Users\Admin\AppData\Local\Temp\7916.tmp"83⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\7993.tmp"C:\Users\Admin\AppData\Local\Temp\7993.tmp"84⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\7A00.tmp"C:\Users\Admin\AppData\Local\Temp\7A00.tmp"85⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\7A7D.tmp"C:\Users\Admin\AppData\Local\Temp\7A7D.tmp"86⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\7B29.tmp"C:\Users\Admin\AppData\Local\Temp\7B29.tmp"87⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\7B96.tmp"C:\Users\Admin\AppData\Local\Temp\7B96.tmp"88⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\7C22.tmp"C:\Users\Admin\AppData\Local\Temp\7C22.tmp"89⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\7CAF.tmp"C:\Users\Admin\AppData\Local\Temp\7CAF.tmp"90⤵
- System Location Discovery: System Language Discovery
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\7D2B.tmp"C:\Users\Admin\AppData\Local\Temp\7D2B.tmp"91⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\7D99.tmp"C:\Users\Admin\AppData\Local\Temp\7D99.tmp"92⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\7E35.tmp"C:\Users\Admin\AppData\Local\Temp\7E35.tmp"93⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\7EC1.tmp"C:\Users\Admin\AppData\Local\Temp\7EC1.tmp"94⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\80E3.tmp"C:\Users\Admin\AppData\Local\Temp\80E3.tmp"95⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\81CD.tmp"C:\Users\Admin\AppData\Local\Temp\81CD.tmp"96⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\8259.tmp"C:\Users\Admin\AppData\Local\Temp\8259.tmp"97⤵PID:604
-
C:\Users\Admin\AppData\Local\Temp\82D6.tmp"C:\Users\Admin\AppData\Local\Temp\82D6.tmp"98⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\8334.tmp"C:\Users\Admin\AppData\Local\Temp\8334.tmp"99⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\83D0.tmp"C:\Users\Admin\AppData\Local\Temp\83D0.tmp"100⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\842D.tmp"C:\Users\Admin\AppData\Local\Temp\842D.tmp"101⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\84AA.tmp"C:\Users\Admin\AppData\Local\Temp\84AA.tmp"102⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\8517.tmp"C:\Users\Admin\AppData\Local\Temp\8517.tmp"103⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\85A4.tmp"C:\Users\Admin\AppData\Local\Temp\85A4.tmp"104⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\8611.tmp"C:\Users\Admin\AppData\Local\Temp\8611.tmp"105⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\869D.tmp"C:\Users\Admin\AppData\Local\Temp\869D.tmp"106⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\872A.tmp"C:\Users\Admin\AppData\Local\Temp\872A.tmp"107⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\87A7.tmp"C:\Users\Admin\AppData\Local\Temp\87A7.tmp"108⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\8823.tmp"C:\Users\Admin\AppData\Local\Temp\8823.tmp"109⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\88A0.tmp"C:\Users\Admin\AppData\Local\Temp\88A0.tmp"110⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\891D.tmp"C:\Users\Admin\AppData\Local\Temp\891D.tmp"111⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\89B9.tmp"C:\Users\Admin\AppData\Local\Temp\89B9.tmp"112⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\8A55.tmp"C:\Users\Admin\AppData\Local\Temp\8A55.tmp"113⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\8AF1.tmp"C:\Users\Admin\AppData\Local\Temp\8AF1.tmp"114⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\8B5E.tmp"C:\Users\Admin\AppData\Local\Temp\8B5E.tmp"115⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\8BDB.tmp"C:\Users\Admin\AppData\Local\Temp\8BDB.tmp"116⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\8C58.tmp"C:\Users\Admin\AppData\Local\Temp\8C58.tmp"117⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\8CC5.tmp"C:\Users\Admin\AppData\Local\Temp\8CC5.tmp"118⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\8D42.tmp"C:\Users\Admin\AppData\Local\Temp\8D42.tmp"119⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\8DDE.tmp"C:\Users\Admin\AppData\Local\Temp\8DDE.tmp"120⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\8E5B.tmp"C:\Users\Admin\AppData\Local\Temp\8E5B.tmp"121⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\8ED7.tmp"C:\Users\Admin\AppData\Local\Temp\8ED7.tmp"122⤵PID:2720
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-