Analysis
-
max time kernel
151s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
03/09/2024, 04:39
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-03_f1f722b4873b000114763afbc622202c_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-09-03_f1f722b4873b000114763afbc622202c_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-03_f1f722b4873b000114763afbc622202c_mafia.exe
-
Size
527KB
-
MD5
f1f722b4873b000114763afbc622202c
-
SHA1
1c9a33a74729caac94bca6cb00abd5614d278d89
-
SHA256
1324994a1ac9afb28c309dddcf82ce2d7437d2a4dd7bed11ad503b716524e42a
-
SHA512
615759c415a781a5126c48cac13aa0abab6e168de89826624a238251254d913528af001c2a7438b7cf0ce7faada907b4a4b53835c688fb8ab56f0f3c666bb0e1
-
SSDEEP
12288:fU5rCOTeido5/yMbzil3JxfI7tLjUiG9DZu:fUQOJdk/rnilP99Do
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2524 145B.tmp 2076 1545.tmp 1716 167D.tmp 2456 1796.tmp 2764 18BE.tmp 2156 197A.tmp 2748 1A73.tmp 2776 1B2E.tmp 3028 1BEA.tmp 2788 1CE3.tmp 2608 1E0C.tmp 2736 1F15.tmp 2408 1FFF.tmp 2984 20F8.tmp 2580 21D3.tmp 2972 22DC.tmp 2976 23E5.tmp 3016 24DF.tmp 2988 25D8.tmp 2684 26D2.tmp 2712 279D.tmp 1372 2858.tmp 960 2932.tmp 1368 29AF.tmp 1892 2A1C.tmp 2380 2AA9.tmp 2144 2B06.tmp 2216 2B74.tmp 2332 2BF0.tmp 984 2C5E.tmp 2392 2CEA.tmp 2152 2D57.tmp 1996 2DB5.tmp 2204 2E41.tmp 1988 2ECE.tmp 112 2F4A.tmp 2480 2FC7.tmp 1540 3044.tmp 1544 30C1.tmp 276 312E.tmp 1752 319B.tmp 2040 3218.tmp 2012 3285.tmp 2260 3302.tmp 584 336F.tmp 2544 33DC.tmp 320 3459.tmp 2308 34C6.tmp 2004 3553.tmp 1676 35D0.tmp 2180 362D.tmp 1120 36AA.tmp 1600 3727.tmp 556 37A4.tmp 2916 3968.tmp 912 3ABF.tmp 2528 3B2C.tmp 1716 3BA9.tmp 2832 3C26.tmp 2812 3CB2.tmp 2840 3D20.tmp 2156 3D9C.tmp 2732 3E19.tmp 948 3EA6.tmp -
Loads dropped DLL 64 IoCs
pid Process 2064 2024-09-03_f1f722b4873b000114763afbc622202c_mafia.exe 2524 145B.tmp 2076 1545.tmp 1716 167D.tmp 2456 1796.tmp 2764 18BE.tmp 2156 197A.tmp 2748 1A73.tmp 2776 1B2E.tmp 3028 1BEA.tmp 2788 1CE3.tmp 2608 1E0C.tmp 2736 1F15.tmp 2408 1FFF.tmp 2984 20F8.tmp 2580 21D3.tmp 2972 22DC.tmp 2976 23E5.tmp 3016 24DF.tmp 2988 25D8.tmp 2684 26D2.tmp 2712 279D.tmp 1372 2858.tmp 960 2932.tmp 1368 29AF.tmp 1892 2A1C.tmp 2380 2AA9.tmp 2144 2B06.tmp 2216 2B74.tmp 2332 2BF0.tmp 984 2C5E.tmp 2392 2CEA.tmp 2152 2D57.tmp 1996 2DB5.tmp 2204 2E41.tmp 1988 2ECE.tmp 112 2F4A.tmp 2480 2FC7.tmp 1540 3044.tmp 1544 30C1.tmp 276 312E.tmp 1752 319B.tmp 2040 3218.tmp 2012 3285.tmp 2260 3302.tmp 584 336F.tmp 2544 33DC.tmp 320 3459.tmp 2308 34C6.tmp 2004 3553.tmp 1676 35D0.tmp 2180 362D.tmp 1120 36AA.tmp 1600 3727.tmp 556 37A4.tmp 2916 3968.tmp 912 3ABF.tmp 2528 3B2C.tmp 1716 3BA9.tmp 2832 3C26.tmp 2812 3CB2.tmp 2840 3D20.tmp 2156 3D9C.tmp 2732 3E19.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2AA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6806.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B635.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8269.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D70.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2CAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6FB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D21E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D4B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D46F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDC8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 273F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 758D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7935.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFCD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F44.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADFB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FF6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9731.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A296.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B451.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 389D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB89.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDBB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C01.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ABE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 362E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4605.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A544.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5061.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C67A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6883.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2064 wrote to memory of 2524 2064 2024-09-03_f1f722b4873b000114763afbc622202c_mafia.exe 29 PID 2064 wrote to memory of 2524 2064 2024-09-03_f1f722b4873b000114763afbc622202c_mafia.exe 29 PID 2064 wrote to memory of 2524 2064 2024-09-03_f1f722b4873b000114763afbc622202c_mafia.exe 29 PID 2064 wrote to memory of 2524 2064 2024-09-03_f1f722b4873b000114763afbc622202c_mafia.exe 29 PID 2524 wrote to memory of 2076 2524 145B.tmp 30 PID 2524 wrote to memory of 2076 2524 145B.tmp 30 PID 2524 wrote to memory of 2076 2524 145B.tmp 30 PID 2524 wrote to memory of 2076 2524 145B.tmp 30 PID 2076 wrote to memory of 1716 2076 1545.tmp 31 PID 2076 wrote to memory of 1716 2076 1545.tmp 31 PID 2076 wrote to memory of 1716 2076 1545.tmp 31 PID 2076 wrote to memory of 1716 2076 1545.tmp 31 PID 1716 wrote to memory of 2456 1716 167D.tmp 32 PID 1716 wrote to memory of 2456 1716 167D.tmp 32 PID 1716 wrote to memory of 2456 1716 167D.tmp 32 PID 1716 wrote to memory of 2456 1716 167D.tmp 32 PID 2456 wrote to memory of 2764 2456 1796.tmp 33 PID 2456 wrote to memory of 2764 2456 1796.tmp 33 PID 2456 wrote to memory of 2764 2456 1796.tmp 33 PID 2456 wrote to memory of 2764 2456 1796.tmp 33 PID 2764 wrote to memory of 2156 2764 18BE.tmp 34 PID 2764 wrote to memory of 2156 2764 18BE.tmp 34 PID 2764 wrote to memory of 2156 2764 18BE.tmp 34 PID 2764 wrote to memory of 2156 2764 18BE.tmp 34 PID 2156 wrote to memory of 2748 2156 197A.tmp 35 PID 2156 wrote to memory of 2748 2156 197A.tmp 35 PID 2156 wrote to memory of 2748 2156 197A.tmp 35 PID 2156 wrote to memory of 2748 2156 197A.tmp 35 PID 2748 wrote to memory of 2776 2748 1A73.tmp 36 PID 2748 wrote to memory of 2776 2748 1A73.tmp 36 PID 2748 wrote to memory of 2776 2748 1A73.tmp 36 PID 2748 wrote to memory of 2776 2748 1A73.tmp 36 PID 2776 wrote to memory of 3028 2776 1B2E.tmp 37 PID 2776 wrote to memory of 3028 2776 1B2E.tmp 37 PID 2776 wrote to memory of 3028 2776 1B2E.tmp 37 PID 2776 wrote to memory of 3028 2776 1B2E.tmp 37 PID 3028 wrote to memory of 2788 3028 1BEA.tmp 38 PID 3028 wrote to memory of 2788 3028 1BEA.tmp 38 PID 3028 wrote to memory of 2788 3028 1BEA.tmp 38 PID 3028 wrote to memory of 2788 3028 1BEA.tmp 38 PID 2788 wrote to memory of 2608 2788 1CE3.tmp 39 PID 2788 wrote to memory of 2608 2788 1CE3.tmp 39 PID 2788 wrote to memory of 2608 2788 1CE3.tmp 39 PID 2788 wrote to memory of 2608 2788 1CE3.tmp 39 PID 2608 wrote to memory of 2736 2608 1E0C.tmp 40 PID 2608 wrote to memory of 2736 2608 1E0C.tmp 40 PID 2608 wrote to memory of 2736 2608 1E0C.tmp 40 PID 2608 wrote to memory of 2736 2608 1E0C.tmp 40 PID 2736 wrote to memory of 2408 2736 1F15.tmp 41 PID 2736 wrote to memory of 2408 2736 1F15.tmp 41 PID 2736 wrote to memory of 2408 2736 1F15.tmp 41 PID 2736 wrote to memory of 2408 2736 1F15.tmp 41 PID 2408 wrote to memory of 2984 2408 1FFF.tmp 42 PID 2408 wrote to memory of 2984 2408 1FFF.tmp 42 PID 2408 wrote to memory of 2984 2408 1FFF.tmp 42 PID 2408 wrote to memory of 2984 2408 1FFF.tmp 42 PID 2984 wrote to memory of 2580 2984 20F8.tmp 43 PID 2984 wrote to memory of 2580 2984 20F8.tmp 43 PID 2984 wrote to memory of 2580 2984 20F8.tmp 43 PID 2984 wrote to memory of 2580 2984 20F8.tmp 43 PID 2580 wrote to memory of 2972 2580 21D3.tmp 44 PID 2580 wrote to memory of 2972 2580 21D3.tmp 44 PID 2580 wrote to memory of 2972 2580 21D3.tmp 44 PID 2580 wrote to memory of 2972 2580 21D3.tmp 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-03_f1f722b4873b000114763afbc622202c_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-03_f1f722b4873b000114763afbc622202c_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\145B.tmp"C:\Users\Admin\AppData\Local\Temp\145B.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\1545.tmp"C:\Users\Admin\AppData\Local\Temp\1545.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\167D.tmp"C:\Users\Admin\AppData\Local\Temp\167D.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\1796.tmp"C:\Users\Admin\AppData\Local\Temp\1796.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\18BE.tmp"C:\Users\Admin\AppData\Local\Temp\18BE.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\197A.tmp"C:\Users\Admin\AppData\Local\Temp\197A.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\1A73.tmp"C:\Users\Admin\AppData\Local\Temp\1A73.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\1BEA.tmp"C:\Users\Admin\AppData\Local\Temp\1BEA.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\1F15.tmp"C:\Users\Admin\AppData\Local\Temp\1F15.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\20F8.tmp"C:\Users\Admin\AppData\Local\Temp\20F8.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\21D3.tmp"C:\Users\Admin\AppData\Local\Temp\21D3.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\22DC.tmp"C:\Users\Admin\AppData\Local\Temp\22DC.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\24DF.tmp"C:\Users\Admin\AppData\Local\Temp\24DF.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\25D8.tmp"C:\Users\Admin\AppData\Local\Temp\25D8.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\26D2.tmp"C:\Users\Admin\AppData\Local\Temp\26D2.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\279D.tmp"C:\Users\Admin\AppData\Local\Temp\279D.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\2858.tmp"C:\Users\Admin\AppData\Local\Temp\2858.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\2932.tmp"C:\Users\Admin\AppData\Local\Temp\2932.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:960 -
C:\Users\Admin\AppData\Local\Temp\29AF.tmp"C:\Users\Admin\AppData\Local\Temp\29AF.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\2B06.tmp"C:\Users\Admin\AppData\Local\Temp\2B06.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\2B74.tmp"C:\Users\Admin\AppData\Local\Temp\2B74.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:984 -
C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\2D57.tmp"C:\Users\Admin\AppData\Local\Temp\2D57.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\2E41.tmp"C:\Users\Admin\AppData\Local\Temp\2E41.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:112 -
C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\3044.tmp"C:\Users\Admin\AppData\Local\Temp\3044.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\30C1.tmp"C:\Users\Admin\AppData\Local\Temp\30C1.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\312E.tmp"C:\Users\Admin\AppData\Local\Temp\312E.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:276 -
C:\Users\Admin\AppData\Local\Temp\319B.tmp"C:\Users\Admin\AppData\Local\Temp\319B.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\3218.tmp"C:\Users\Admin\AppData\Local\Temp\3218.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\3285.tmp"C:\Users\Admin\AppData\Local\Temp\3285.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\3302.tmp"C:\Users\Admin\AppData\Local\Temp\3302.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\336F.tmp"C:\Users\Admin\AppData\Local\Temp\336F.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:584 -
C:\Users\Admin\AppData\Local\Temp\33DC.tmp"C:\Users\Admin\AppData\Local\Temp\33DC.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\3459.tmp"C:\Users\Admin\AppData\Local\Temp\3459.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:320 -
C:\Users\Admin\AppData\Local\Temp\34C6.tmp"C:\Users\Admin\AppData\Local\Temp\34C6.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\3553.tmp"C:\Users\Admin\AppData\Local\Temp\3553.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\35D0.tmp"C:\Users\Admin\AppData\Local\Temp\35D0.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\362D.tmp"C:\Users\Admin\AppData\Local\Temp\362D.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\36AA.tmp"C:\Users\Admin\AppData\Local\Temp\36AA.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\3727.tmp"C:\Users\Admin\AppData\Local\Temp\3727.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\37A4.tmp"C:\Users\Admin\AppData\Local\Temp\37A4.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:556 -
C:\Users\Admin\AppData\Local\Temp\3968.tmp"C:\Users\Admin\AppData\Local\Temp\3968.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\3ABF.tmp"C:\Users\Admin\AppData\Local\Temp\3ABF.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:912 -
C:\Users\Admin\AppData\Local\Temp\3B2C.tmp"C:\Users\Admin\AppData\Local\Temp\3B2C.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\3BA9.tmp"C:\Users\Admin\AppData\Local\Temp\3BA9.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\3C26.tmp"C:\Users\Admin\AppData\Local\Temp\3C26.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\3CB2.tmp"C:\Users\Admin\AppData\Local\Temp\3CB2.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\3D20.tmp"C:\Users\Admin\AppData\Local\Temp\3D20.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\3E19.tmp"C:\Users\Admin\AppData\Local\Temp\3E19.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\3EA6.tmp"C:\Users\Admin\AppData\Local\Temp\3EA6.tmp"65⤵
- Executes dropped EXE
PID:948 -
C:\Users\Admin\AppData\Local\Temp\3F13.tmp"C:\Users\Admin\AppData\Local\Temp\3F13.tmp"66⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\3F80.tmp"C:\Users\Admin\AppData\Local\Temp\3F80.tmp"67⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\3FFD.tmp"C:\Users\Admin\AppData\Local\Temp\3FFD.tmp"68⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\4089.tmp"C:\Users\Admin\AppData\Local\Temp\4089.tmp"69⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\4106.tmp"C:\Users\Admin\AppData\Local\Temp\4106.tmp"70⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\4173.tmp"C:\Users\Admin\AppData\Local\Temp\4173.tmp"71⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\4200.tmp"C:\Users\Admin\AppData\Local\Temp\4200.tmp"72⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\428C.tmp"C:\Users\Admin\AppData\Local\Temp\428C.tmp"73⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\42F9.tmp"C:\Users\Admin\AppData\Local\Temp\42F9.tmp"74⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\4366.tmp"C:\Users\Admin\AppData\Local\Temp\4366.tmp"75⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\43E3.tmp"C:\Users\Admin\AppData\Local\Temp\43E3.tmp"76⤵
- System Location Discovery: System Language Discovery
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\4470.tmp"C:\Users\Admin\AppData\Local\Temp\4470.tmp"77⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\44EC.tmp"C:\Users\Admin\AppData\Local\Temp\44EC.tmp"78⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\455A.tmp"C:\Users\Admin\AppData\Local\Temp\455A.tmp"79⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\45C7.tmp"C:\Users\Admin\AppData\Local\Temp\45C7.tmp"80⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\4644.tmp"C:\Users\Admin\AppData\Local\Temp\4644.tmp"81⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\46C0.tmp"C:\Users\Admin\AppData\Local\Temp\46C0.tmp"82⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\472E.tmp"C:\Users\Admin\AppData\Local\Temp\472E.tmp"83⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\47AA.tmp"C:\Users\Admin\AppData\Local\Temp\47AA.tmp"84⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\4827.tmp"C:\Users\Admin\AppData\Local\Temp\4827.tmp"85⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\4894.tmp"C:\Users\Admin\AppData\Local\Temp\4894.tmp"86⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\4911.tmp"C:\Users\Admin\AppData\Local\Temp\4911.tmp"87⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\496F.tmp"C:\Users\Admin\AppData\Local\Temp\496F.tmp"88⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\49EC.tmp"C:\Users\Admin\AppData\Local\Temp\49EC.tmp"89⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\4A68.tmp"C:\Users\Admin\AppData\Local\Temp\4A68.tmp"90⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\4AD6.tmp"C:\Users\Admin\AppData\Local\Temp\4AD6.tmp"91⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\4B43.tmp"C:\Users\Admin\AppData\Local\Temp\4B43.tmp"92⤵
- System Location Discovery: System Language Discovery
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\4BC0.tmp"C:\Users\Admin\AppData\Local\Temp\4BC0.tmp"93⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\4C2D.tmp"C:\Users\Admin\AppData\Local\Temp\4C2D.tmp"94⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\4C9A.tmp"C:\Users\Admin\AppData\Local\Temp\4C9A.tmp"95⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"96⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\4D94.tmp"C:\Users\Admin\AppData\Local\Temp\4D94.tmp"97⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"98⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"99⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"100⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\5061.tmp"C:\Users\Admin\AppData\Local\Temp\5061.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"102⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\513C.tmp"C:\Users\Admin\AppData\Local\Temp\513C.tmp"103⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\5199.tmp"C:\Users\Admin\AppData\Local\Temp\5199.tmp"104⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\5216.tmp"C:\Users\Admin\AppData\Local\Temp\5216.tmp"105⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\5293.tmp"C:\Users\Admin\AppData\Local\Temp\5293.tmp"106⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\5310.tmp"C:\Users\Admin\AppData\Local\Temp\5310.tmp"107⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\537D.tmp"C:\Users\Admin\AppData\Local\Temp\537D.tmp"108⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\53FA.tmp"C:\Users\Admin\AppData\Local\Temp\53FA.tmp"109⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\5467.tmp"C:\Users\Admin\AppData\Local\Temp\5467.tmp"110⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\54E4.tmp"C:\Users\Admin\AppData\Local\Temp\54E4.tmp"111⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\5551.tmp"C:\Users\Admin\AppData\Local\Temp\5551.tmp"112⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\55CE.tmp"C:\Users\Admin\AppData\Local\Temp\55CE.tmp"113⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\564B.tmp"C:\Users\Admin\AppData\Local\Temp\564B.tmp"114⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\56C7.tmp"C:\Users\Admin\AppData\Local\Temp\56C7.tmp"115⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\5744.tmp"C:\Users\Admin\AppData\Local\Temp\5744.tmp"116⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\57D1.tmp"C:\Users\Admin\AppData\Local\Temp\57D1.tmp"117⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\584D.tmp"C:\Users\Admin\AppData\Local\Temp\584D.tmp"118⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\58CA.tmp"C:\Users\Admin\AppData\Local\Temp\58CA.tmp"119⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\5947.tmp"C:\Users\Admin\AppData\Local\Temp\5947.tmp"120⤵PID:296
-
C:\Users\Admin\AppData\Local\Temp\59B4.tmp"C:\Users\Admin\AppData\Local\Temp\59B4.tmp"121⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\5A31.tmp"C:\Users\Admin\AppData\Local\Temp\5A31.tmp"122⤵PID:2744
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-