Analysis
-
max time kernel
146s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
03/09/2024, 02:23
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-03_3496e4ea562e949d3aa637c7a66239e4_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-09-03_3496e4ea562e949d3aa637c7a66239e4_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-03_3496e4ea562e949d3aa637c7a66239e4_mafia.exe
-
Size
487KB
-
MD5
3496e4ea562e949d3aa637c7a66239e4
-
SHA1
b86a149fa060a51637774de1efc2c513af691db9
-
SHA256
a54338bc1d1e7835a8f054561733bb3cb3625bc6d145c3f0040164e839160c38
-
SHA512
e49a21fdaafb99cdf863e8c2a5ab94e5965b61248e6459cd2b9c6c3d3034e0503584b97a7ef7fa14235b042134eac1d1939a33df447995440e83e8e8df468459
-
SSDEEP
6144:qorf3lPvovsgZnqG2C7mOTeiL9DUaRX5+pNn/eUgCnq6pG5o+UA6j0ZbEzrO6Jxs:HU5rCOTeiJKpU8nhCTS0ZbEzrNxzmNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2140 EC0.tmp 2164 F7B.tmp 2812 10D2.tmp 2808 11CC.tmp 2408 12C6.tmp 2648 13FE.tmp 2636 1507.tmp 2724 15A3.tmp 2644 169C.tmp 2184 1786.tmp 2536 1870.tmp 1616 1999.tmp 1764 1A92.tmp 1240 1B5D.tmp 1972 1C47.tmp 2788 1D12.tmp 2972 1E0C.tmp 2712 1F15.tmp 960 201E.tmp 884 21C3.tmp 1668 22DC.tmp 1184 23A7.tmp 1884 2472.tmp 1124 24FE.tmp 2232 258A.tmp 1696 2607.tmp 2432 2694.tmp 1456 2720.tmp 2168 278D.tmp 1808 280A.tmp 2304 2887.tmp 2444 2904.tmp 1488 29AF.tmp 2244 2A3C.tmp 940 2AB8.tmp 2220 2B45.tmp 2588 2BE1.tmp 820 2C7D.tmp 1368 2CFA.tmp 1504 2DA5.tmp 880 2E32.tmp 3000 2E8F.tmp 992 2F1C.tmp 1256 2FA8.tmp 2080 3044.tmp 1916 30B1.tmp 1984 313E.tmp 2100 31BA.tmp 2000 3247.tmp 920 32D3.tmp 1724 3350.tmp 2556 33DC.tmp 2796 344A.tmp 1556 34C6.tmp 2404 3543.tmp 2140 36D9.tmp 2824 3756.tmp 3040 37E2.tmp 2812 386E.tmp 2856 38EB.tmp 2772 3978.tmp 2408 3A04.tmp 2864 3A71.tmp 2748 3AFE.tmp -
Loads dropped DLL 64 IoCs
pid Process 2524 2024-09-03_3496e4ea562e949d3aa637c7a66239e4_mafia.exe 2140 EC0.tmp 2164 F7B.tmp 2812 10D2.tmp 2808 11CC.tmp 2408 12C6.tmp 2648 13FE.tmp 2636 1507.tmp 2724 15A3.tmp 2644 169C.tmp 2184 1786.tmp 2536 1870.tmp 1616 1999.tmp 1764 1A92.tmp 1240 1B5D.tmp 1972 1C47.tmp 2788 1D12.tmp 2972 1E0C.tmp 2712 1F15.tmp 960 201E.tmp 884 21C3.tmp 1668 22DC.tmp 1184 23A7.tmp 1884 2472.tmp 1124 24FE.tmp 2232 258A.tmp 1696 2607.tmp 2432 2694.tmp 1456 2720.tmp 2168 278D.tmp 1808 280A.tmp 2304 2887.tmp 2444 2904.tmp 1488 29AF.tmp 2244 2A3C.tmp 940 2AB8.tmp 2220 2B45.tmp 2588 2BE1.tmp 820 2C7D.tmp 1368 2CFA.tmp 1504 2DA5.tmp 880 2E32.tmp 3000 2E8F.tmp 992 2F1C.tmp 1256 2FA8.tmp 2080 3044.tmp 1916 30B1.tmp 1984 313E.tmp 2100 31BA.tmp 2000 3247.tmp 920 32D3.tmp 1724 3350.tmp 2556 33DC.tmp 2796 344A.tmp 1556 34C6.tmp 2404 3543.tmp 2140 36D9.tmp 2824 3756.tmp 3040 37E2.tmp 2812 386E.tmp 2856 38EB.tmp 2772 3978.tmp 2408 3A04.tmp 2864 3A71.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D77B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D366.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 473D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3350.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A04.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A850.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B126.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8843.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 565A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D96E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F892.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8095.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D24D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E225.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 840E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ACD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E6C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A61F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 515B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D9BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1738.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B91.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9139.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F299.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2524 wrote to memory of 2140 2524 2024-09-03_3496e4ea562e949d3aa637c7a66239e4_mafia.exe 29 PID 2524 wrote to memory of 2140 2524 2024-09-03_3496e4ea562e949d3aa637c7a66239e4_mafia.exe 29 PID 2524 wrote to memory of 2140 2524 2024-09-03_3496e4ea562e949d3aa637c7a66239e4_mafia.exe 29 PID 2524 wrote to memory of 2140 2524 2024-09-03_3496e4ea562e949d3aa637c7a66239e4_mafia.exe 29 PID 2140 wrote to memory of 2164 2140 EC0.tmp 30 PID 2140 wrote to memory of 2164 2140 EC0.tmp 30 PID 2140 wrote to memory of 2164 2140 EC0.tmp 30 PID 2140 wrote to memory of 2164 2140 EC0.tmp 30 PID 2164 wrote to memory of 2812 2164 F7B.tmp 31 PID 2164 wrote to memory of 2812 2164 F7B.tmp 31 PID 2164 wrote to memory of 2812 2164 F7B.tmp 31 PID 2164 wrote to memory of 2812 2164 F7B.tmp 31 PID 2812 wrote to memory of 2808 2812 10D2.tmp 32 PID 2812 wrote to memory of 2808 2812 10D2.tmp 32 PID 2812 wrote to memory of 2808 2812 10D2.tmp 32 PID 2812 wrote to memory of 2808 2812 10D2.tmp 32 PID 2808 wrote to memory of 2408 2808 11CC.tmp 33 PID 2808 wrote to memory of 2408 2808 11CC.tmp 33 PID 2808 wrote to memory of 2408 2808 11CC.tmp 33 PID 2808 wrote to memory of 2408 2808 11CC.tmp 33 PID 2408 wrote to memory of 2648 2408 12C6.tmp 34 PID 2408 wrote to memory of 2648 2408 12C6.tmp 34 PID 2408 wrote to memory of 2648 2408 12C6.tmp 34 PID 2408 wrote to memory of 2648 2408 12C6.tmp 34 PID 2648 wrote to memory of 2636 2648 13FE.tmp 35 PID 2648 wrote to memory of 2636 2648 13FE.tmp 35 PID 2648 wrote to memory of 2636 2648 13FE.tmp 35 PID 2648 wrote to memory of 2636 2648 13FE.tmp 35 PID 2636 wrote to memory of 2724 2636 1507.tmp 36 PID 2636 wrote to memory of 2724 2636 1507.tmp 36 PID 2636 wrote to memory of 2724 2636 1507.tmp 36 PID 2636 wrote to memory of 2724 2636 1507.tmp 36 PID 2724 wrote to memory of 2644 2724 15A3.tmp 37 PID 2724 wrote to memory of 2644 2724 15A3.tmp 37 PID 2724 wrote to memory of 2644 2724 15A3.tmp 37 PID 2724 wrote to memory of 2644 2724 15A3.tmp 37 PID 2644 wrote to memory of 2184 2644 169C.tmp 38 PID 2644 wrote to memory of 2184 2644 169C.tmp 38 PID 2644 wrote to memory of 2184 2644 169C.tmp 38 PID 2644 wrote to memory of 2184 2644 169C.tmp 38 PID 2184 wrote to memory of 2536 2184 1786.tmp 39 PID 2184 wrote to memory of 2536 2184 1786.tmp 39 PID 2184 wrote to memory of 2536 2184 1786.tmp 39 PID 2184 wrote to memory of 2536 2184 1786.tmp 39 PID 2536 wrote to memory of 1616 2536 1870.tmp 40 PID 2536 wrote to memory of 1616 2536 1870.tmp 40 PID 2536 wrote to memory of 1616 2536 1870.tmp 40 PID 2536 wrote to memory of 1616 2536 1870.tmp 40 PID 1616 wrote to memory of 1764 1616 1999.tmp 41 PID 1616 wrote to memory of 1764 1616 1999.tmp 41 PID 1616 wrote to memory of 1764 1616 1999.tmp 41 PID 1616 wrote to memory of 1764 1616 1999.tmp 41 PID 1764 wrote to memory of 1240 1764 1A92.tmp 42 PID 1764 wrote to memory of 1240 1764 1A92.tmp 42 PID 1764 wrote to memory of 1240 1764 1A92.tmp 42 PID 1764 wrote to memory of 1240 1764 1A92.tmp 42 PID 1240 wrote to memory of 1972 1240 1B5D.tmp 43 PID 1240 wrote to memory of 1972 1240 1B5D.tmp 43 PID 1240 wrote to memory of 1972 1240 1B5D.tmp 43 PID 1240 wrote to memory of 1972 1240 1B5D.tmp 43 PID 1972 wrote to memory of 2788 1972 1C47.tmp 44 PID 1972 wrote to memory of 2788 1972 1C47.tmp 44 PID 1972 wrote to memory of 2788 1972 1C47.tmp 44 PID 1972 wrote to memory of 2788 1972 1C47.tmp 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-03_3496e4ea562e949d3aa637c7a66239e4_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-03_3496e4ea562e949d3aa637c7a66239e4_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\EC0.tmp"C:\Users\Admin\AppData\Local\Temp\EC0.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\F7B.tmp"C:\Users\Admin\AppData\Local\Temp\F7B.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\10D2.tmp"C:\Users\Admin\AppData\Local\Temp\10D2.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\11CC.tmp"C:\Users\Admin\AppData\Local\Temp\11CC.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\12C6.tmp"C:\Users\Admin\AppData\Local\Temp\12C6.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\13FE.tmp"C:\Users\Admin\AppData\Local\Temp\13FE.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\1507.tmp"C:\Users\Admin\AppData\Local\Temp\1507.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\15A3.tmp"C:\Users\Admin\AppData\Local\Temp\15A3.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\169C.tmp"C:\Users\Admin\AppData\Local\Temp\169C.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\1786.tmp"C:\Users\Admin\AppData\Local\Temp\1786.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\1870.tmp"C:\Users\Admin\AppData\Local\Temp\1870.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\1999.tmp"C:\Users\Admin\AppData\Local\Temp\1999.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\1A92.tmp"C:\Users\Admin\AppData\Local\Temp\1A92.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\1C47.tmp"C:\Users\Admin\AppData\Local\Temp\1C47.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\1D12.tmp"C:\Users\Admin\AppData\Local\Temp\1D12.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\1F15.tmp"C:\Users\Admin\AppData\Local\Temp\1F15.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\201E.tmp"C:\Users\Admin\AppData\Local\Temp\201E.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:960 -
C:\Users\Admin\AppData\Local\Temp\21C3.tmp"C:\Users\Admin\AppData\Local\Temp\21C3.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:884 -
C:\Users\Admin\AppData\Local\Temp\22DC.tmp"C:\Users\Admin\AppData\Local\Temp\22DC.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\23A7.tmp"C:\Users\Admin\AppData\Local\Temp\23A7.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\2472.tmp"C:\Users\Admin\AppData\Local\Temp\2472.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\24FE.tmp"C:\Users\Admin\AppData\Local\Temp\24FE.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\258A.tmp"C:\Users\Admin\AppData\Local\Temp\258A.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\2607.tmp"C:\Users\Admin\AppData\Local\Temp\2607.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\2694.tmp"C:\Users\Admin\AppData\Local\Temp\2694.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\2720.tmp"C:\Users\Admin\AppData\Local\Temp\2720.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\278D.tmp"C:\Users\Admin\AppData\Local\Temp\278D.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\2887.tmp"C:\Users\Admin\AppData\Local\Temp\2887.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\2904.tmp"C:\Users\Admin\AppData\Local\Temp\2904.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\29AF.tmp"C:\Users\Admin\AppData\Local\Temp\29AF.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:940 -
C:\Users\Admin\AppData\Local\Temp\2B45.tmp"C:\Users\Admin\AppData\Local\Temp\2B45.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\2BE1.tmp"C:\Users\Admin\AppData\Local\Temp\2BE1.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:820 -
C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\2E32.tmp"C:\Users\Admin\AppData\Local\Temp\2E32.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:880 -
C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\2F1C.tmp"C:\Users\Admin\AppData\Local\Temp\2F1C.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:992 -
C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\3044.tmp"C:\Users\Admin\AppData\Local\Temp\3044.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\30B1.tmp"C:\Users\Admin\AppData\Local\Temp\30B1.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\313E.tmp"C:\Users\Admin\AppData\Local\Temp\313E.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\31BA.tmp"C:\Users\Admin\AppData\Local\Temp\31BA.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\3247.tmp"C:\Users\Admin\AppData\Local\Temp\3247.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\32D3.tmp"C:\Users\Admin\AppData\Local\Temp\32D3.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:920 -
C:\Users\Admin\AppData\Local\Temp\3350.tmp"C:\Users\Admin\AppData\Local\Temp\3350.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\33DC.tmp"C:\Users\Admin\AppData\Local\Temp\33DC.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\344A.tmp"C:\Users\Admin\AppData\Local\Temp\344A.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\34C6.tmp"C:\Users\Admin\AppData\Local\Temp\34C6.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\3543.tmp"C:\Users\Admin\AppData\Local\Temp\3543.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\36D9.tmp"C:\Users\Admin\AppData\Local\Temp\36D9.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\3756.tmp"C:\Users\Admin\AppData\Local\Temp\3756.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\37E2.tmp"C:\Users\Admin\AppData\Local\Temp\37E2.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\386E.tmp"C:\Users\Admin\AppData\Local\Temp\386E.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\38EB.tmp"C:\Users\Admin\AppData\Local\Temp\38EB.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\3978.tmp"C:\Users\Admin\AppData\Local\Temp\3978.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\3A04.tmp"C:\Users\Admin\AppData\Local\Temp\3A04.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\3A71.tmp"C:\Users\Admin\AppData\Local\Temp\3A71.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\3AFE.tmp"C:\Users\Admin\AppData\Local\Temp\3AFE.tmp"65⤵
- Executes dropped EXE
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\3B8A.tmp"C:\Users\Admin\AppData\Local\Temp\3B8A.tmp"66⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\3C16.tmp"C:\Users\Admin\AppData\Local\Temp\3C16.tmp"67⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\3CB2.tmp"C:\Users\Admin\AppData\Local\Temp\3CB2.tmp"68⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\3D2F.tmp"C:\Users\Admin\AppData\Local\Temp\3D2F.tmp"69⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\3DBC.tmp"C:\Users\Admin\AppData\Local\Temp\3DBC.tmp"70⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\3E48.tmp"C:\Users\Admin\AppData\Local\Temp\3E48.tmp"71⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\3EC5.tmp"C:\Users\Admin\AppData\Local\Temp\3EC5.tmp"72⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\3F70.tmp"C:\Users\Admin\AppData\Local\Temp\3F70.tmp"73⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\400C.tmp"C:\Users\Admin\AppData\Local\Temp\400C.tmp"74⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\40A8.tmp"C:\Users\Admin\AppData\Local\Temp\40A8.tmp"75⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\4116.tmp"C:\Users\Admin\AppData\Local\Temp\4116.tmp"76⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\41A2.tmp"C:\Users\Admin\AppData\Local\Temp\41A2.tmp"77⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\421F.tmp"C:\Users\Admin\AppData\Local\Temp\421F.tmp"78⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\428C.tmp"C:\Users\Admin\AppData\Local\Temp\428C.tmp"79⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\4318.tmp"C:\Users\Admin\AppData\Local\Temp\4318.tmp"80⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\4395.tmp"C:\Users\Admin\AppData\Local\Temp\4395.tmp"81⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\4402.tmp"C:\Users\Admin\AppData\Local\Temp\4402.tmp"82⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\448F.tmp"C:\Users\Admin\AppData\Local\Temp\448F.tmp"83⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\452B.tmp"C:\Users\Admin\AppData\Local\Temp\452B.tmp"84⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\4598.tmp"C:\Users\Admin\AppData\Local\Temp\4598.tmp"85⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\4624.tmp"C:\Users\Admin\AppData\Local\Temp\4624.tmp"86⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\46A1.tmp"C:\Users\Admin\AppData\Local\Temp\46A1.tmp"87⤵PID:424
-
C:\Users\Admin\AppData\Local\Temp\473D.tmp"C:\Users\Admin\AppData\Local\Temp\473D.tmp"88⤵
- System Location Discovery: System Language Discovery
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\47BA.tmp"C:\Users\Admin\AppData\Local\Temp\47BA.tmp"89⤵
- System Location Discovery: System Language Discovery
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\4837.tmp"C:\Users\Admin\AppData\Local\Temp\4837.tmp"90⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\48B4.tmp"C:\Users\Admin\AppData\Local\Temp\48B4.tmp"91⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\4930.tmp"C:\Users\Admin\AppData\Local\Temp\4930.tmp"92⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\49AD.tmp"C:\Users\Admin\AppData\Local\Temp\49AD.tmp"93⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\4A3A.tmp"C:\Users\Admin\AppData\Local\Temp\4A3A.tmp"94⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\4AB6.tmp"C:\Users\Admin\AppData\Local\Temp\4AB6.tmp"95⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\4B53.tmp"C:\Users\Admin\AppData\Local\Temp\4B53.tmp"96⤵PID:524
-
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"97⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\4D75.tmp"C:\Users\Admin\AppData\Local\Temp\4D75.tmp"98⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"99⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"100⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"101⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"102⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"103⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"104⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"105⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\51A9.tmp"C:\Users\Admin\AppData\Local\Temp\51A9.tmp"106⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\5245.tmp"C:\Users\Admin\AppData\Local\Temp\5245.tmp"107⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\52B2.tmp"C:\Users\Admin\AppData\Local\Temp\52B2.tmp"108⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\532F.tmp"C:\Users\Admin\AppData\Local\Temp\532F.tmp"109⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\539C.tmp"C:\Users\Admin\AppData\Local\Temp\539C.tmp"110⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\5429.tmp"C:\Users\Admin\AppData\Local\Temp\5429.tmp"111⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\54B5.tmp"C:\Users\Admin\AppData\Local\Temp\54B5.tmp"112⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\5541.tmp"C:\Users\Admin\AppData\Local\Temp\5541.tmp"113⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\55ED.tmp"C:\Users\Admin\AppData\Local\Temp\55ED.tmp"114⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\5679.tmp"C:\Users\Admin\AppData\Local\Temp\5679.tmp"115⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\5706.tmp"C:\Users\Admin\AppData\Local\Temp\5706.tmp"116⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\5783.tmp"C:\Users\Admin\AppData\Local\Temp\5783.tmp"117⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\581F.tmp"C:\Users\Admin\AppData\Local\Temp\581F.tmp"118⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\58AB.tmp"C:\Users\Admin\AppData\Local\Temp\58AB.tmp"119⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\5947.tmp"C:\Users\Admin\AppData\Local\Temp\5947.tmp"120⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\59B4.tmp"C:\Users\Admin\AppData\Local\Temp\59B4.tmp"121⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\5A41.tmp"C:\Users\Admin\AppData\Local\Temp\5A41.tmp"122⤵PID:2760
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-