Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/09/2024, 06:24
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-03_90d5cc89bc1999b19fb4ae6d9f83eb99_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-03_90d5cc89bc1999b19fb4ae6d9f83eb99_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-03_90d5cc89bc1999b19fb4ae6d9f83eb99_mafia.exe
-
Size
712KB
-
MD5
90d5cc89bc1999b19fb4ae6d9f83eb99
-
SHA1
e426fea85e8eac0650eb38c8c87c3564efdfd564
-
SHA256
93ab61fb2eafda164ce920ea4e505f6e60a4bd80110f04f156e120cea0808f36
-
SHA512
fc9a522d1ebb56829e09959c2f7dd01526ce8c66bba4a04c6db5e6cbdc0215a11a938e63b7d7c29d95369ef12e2fa5525421a58b09b71945b52a37f54a0b0a2b
-
SSDEEP
12288:FU5rCOTeiDe+rtjCPr/pN/e6eWgmAdFmNZdCvq5TJLCvY90D8/LVBlVk736Y79G5:FUQOJDTrQP7pNsAAdsNnCvq5TJLCvY93
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2372 CF12.tmp 2160 CF7F.tmp 2196 D00B.tmp 2204 D079.tmp 2744 D0F5.tmp 2668 D163.tmp 2788 D1DF.tmp 2712 D25C.tmp 2956 D2C9.tmp 2824 D346.tmp 2828 D3B3.tmp 2732 D421.tmp 2612 D48E.tmp 3064 D4EB.tmp 1808 D568.tmp 856 D5D5.tmp 2620 D643.tmp 1708 D6B0.tmp 1728 D72D.tmp 2548 D79A.tmp 1072 D807.tmp 1188 D874.tmp 496 D8C2.tmp 2920 D901.tmp 2908 D93F.tmp 2260 D98D.tmp 600 D9CB.tmp 2120 DA0A.tmp 3040 DA48.tmp 352 DA87.tmp 1140 DAC5.tmp 2916 DB03.tmp 552 DB42.tmp 2344 DB90.tmp 2040 DBDE.tmp 1956 DC1C.tmp 772 DC5B.tmp 1080 DCA9.tmp 1552 DCF7.tmp 1624 DD35.tmp 2236 DD73.tmp 756 DDB2.tmp 2388 DDF0.tmp 2484 DE2F.tmp 568 DE6D.tmp 2964 DEAC.tmp 1224 DEFA.tmp 2028 DF38.tmp 2052 DF76.tmp 1904 DFB5.tmp 1776 E003.tmp 1576 E09F.tmp 2192 E0ED.tmp 1152 E13B.tmp 1440 E179.tmp 2200 E1B8.tmp 2400 E215.tmp 2204 E273.tmp 860 E2B1.tmp 2688 E2FF.tmp 2132 E34D.tmp 2760 E38C.tmp 2692 E3CA.tmp 2676 E408.tmp -
Loads dropped DLL 64 IoCs
pid Process 2328 2024-09-03_90d5cc89bc1999b19fb4ae6d9f83eb99_mafia.exe 2372 CF12.tmp 2160 CF7F.tmp 2196 D00B.tmp 2204 D079.tmp 2744 D0F5.tmp 2668 D163.tmp 2788 D1DF.tmp 2712 D25C.tmp 2956 D2C9.tmp 2824 D346.tmp 2828 D3B3.tmp 2732 D421.tmp 2612 D48E.tmp 3064 D4EB.tmp 1808 D568.tmp 856 D5D5.tmp 2620 D643.tmp 1708 D6B0.tmp 1728 D72D.tmp 2548 D79A.tmp 1072 D807.tmp 1188 D874.tmp 496 D8C2.tmp 2920 D901.tmp 2908 D93F.tmp 2260 D98D.tmp 600 D9CB.tmp 2120 DA0A.tmp 3040 DA48.tmp 352 DA87.tmp 1140 DAC5.tmp 2916 DB03.tmp 552 DB42.tmp 2344 DB90.tmp 2040 DBDE.tmp 1956 DC1C.tmp 772 DC5B.tmp 1080 DCA9.tmp 1552 DCF7.tmp 1624 DD35.tmp 2236 DD73.tmp 756 DDB2.tmp 2388 DDF0.tmp 2484 DE2F.tmp 568 DE6D.tmp 2964 DEAC.tmp 1224 DEFA.tmp 2028 DF38.tmp 2052 DF76.tmp 1904 DFB5.tmp 1596 E041.tmp 1576 E09F.tmp 2192 E0ED.tmp 1152 E13B.tmp 1440 E179.tmp 2200 E1B8.tmp 2400 E215.tmp 2204 E273.tmp 860 E2B1.tmp 2688 E2FF.tmp 2132 E34D.tmp 2760 E38C.tmp 2692 E3CA.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 925.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C745.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E540.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 559F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A64D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3562.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 952E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D327.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B30A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F383.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F892.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 930C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 498E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2328 wrote to memory of 2372 2328 2024-09-03_90d5cc89bc1999b19fb4ae6d9f83eb99_mafia.exe 31 PID 2328 wrote to memory of 2372 2328 2024-09-03_90d5cc89bc1999b19fb4ae6d9f83eb99_mafia.exe 31 PID 2328 wrote to memory of 2372 2328 2024-09-03_90d5cc89bc1999b19fb4ae6d9f83eb99_mafia.exe 31 PID 2328 wrote to memory of 2372 2328 2024-09-03_90d5cc89bc1999b19fb4ae6d9f83eb99_mafia.exe 31 PID 2372 wrote to memory of 2160 2372 CF12.tmp 32 PID 2372 wrote to memory of 2160 2372 CF12.tmp 32 PID 2372 wrote to memory of 2160 2372 CF12.tmp 32 PID 2372 wrote to memory of 2160 2372 CF12.tmp 32 PID 2160 wrote to memory of 2196 2160 CF7F.tmp 33 PID 2160 wrote to memory of 2196 2160 CF7F.tmp 33 PID 2160 wrote to memory of 2196 2160 CF7F.tmp 33 PID 2160 wrote to memory of 2196 2160 CF7F.tmp 33 PID 2196 wrote to memory of 2204 2196 D00B.tmp 34 PID 2196 wrote to memory of 2204 2196 D00B.tmp 34 PID 2196 wrote to memory of 2204 2196 D00B.tmp 34 PID 2196 wrote to memory of 2204 2196 D00B.tmp 34 PID 2204 wrote to memory of 2744 2204 D079.tmp 35 PID 2204 wrote to memory of 2744 2204 D079.tmp 35 PID 2204 wrote to memory of 2744 2204 D079.tmp 35 PID 2204 wrote to memory of 2744 2204 D079.tmp 35 PID 2744 wrote to memory of 2668 2744 D0F5.tmp 36 PID 2744 wrote to memory of 2668 2744 D0F5.tmp 36 PID 2744 wrote to memory of 2668 2744 D0F5.tmp 36 PID 2744 wrote to memory of 2668 2744 D0F5.tmp 36 PID 2668 wrote to memory of 2788 2668 D163.tmp 37 PID 2668 wrote to memory of 2788 2668 D163.tmp 37 PID 2668 wrote to memory of 2788 2668 D163.tmp 37 PID 2668 wrote to memory of 2788 2668 D163.tmp 37 PID 2788 wrote to memory of 2712 2788 D1DF.tmp 38 PID 2788 wrote to memory of 2712 2788 D1DF.tmp 38 PID 2788 wrote to memory of 2712 2788 D1DF.tmp 38 PID 2788 wrote to memory of 2712 2788 D1DF.tmp 38 PID 2712 wrote to memory of 2956 2712 D25C.tmp 39 PID 2712 wrote to memory of 2956 2712 D25C.tmp 39 PID 2712 wrote to memory of 2956 2712 D25C.tmp 39 PID 2712 wrote to memory of 2956 2712 D25C.tmp 39 PID 2956 wrote to memory of 2824 2956 D2C9.tmp 40 PID 2956 wrote to memory of 2824 2956 D2C9.tmp 40 PID 2956 wrote to memory of 2824 2956 D2C9.tmp 40 PID 2956 wrote to memory of 2824 2956 D2C9.tmp 40 PID 2824 wrote to memory of 2828 2824 D346.tmp 41 PID 2824 wrote to memory of 2828 2824 D346.tmp 41 PID 2824 wrote to memory of 2828 2824 D346.tmp 41 PID 2824 wrote to memory of 2828 2824 D346.tmp 41 PID 2828 wrote to memory of 2732 2828 D3B3.tmp 42 PID 2828 wrote to memory of 2732 2828 D3B3.tmp 42 PID 2828 wrote to memory of 2732 2828 D3B3.tmp 42 PID 2828 wrote to memory of 2732 2828 D3B3.tmp 42 PID 2732 wrote to memory of 2612 2732 D421.tmp 43 PID 2732 wrote to memory of 2612 2732 D421.tmp 43 PID 2732 wrote to memory of 2612 2732 D421.tmp 43 PID 2732 wrote to memory of 2612 2732 D421.tmp 43 PID 2612 wrote to memory of 3064 2612 D48E.tmp 44 PID 2612 wrote to memory of 3064 2612 D48E.tmp 44 PID 2612 wrote to memory of 3064 2612 D48E.tmp 44 PID 2612 wrote to memory of 3064 2612 D48E.tmp 44 PID 3064 wrote to memory of 1808 3064 D4EB.tmp 45 PID 3064 wrote to memory of 1808 3064 D4EB.tmp 45 PID 3064 wrote to memory of 1808 3064 D4EB.tmp 45 PID 3064 wrote to memory of 1808 3064 D4EB.tmp 45 PID 1808 wrote to memory of 856 1808 D568.tmp 46 PID 1808 wrote to memory of 856 1808 D568.tmp 46 PID 1808 wrote to memory of 856 1808 D568.tmp 46 PID 1808 wrote to memory of 856 1808 D568.tmp 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-03_90d5cc89bc1999b19fb4ae6d9f83eb99_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-03_90d5cc89bc1999b19fb4ae6d9f83eb99_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\CF12.tmp"C:\Users\Admin\AppData\Local\Temp\CF12.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\CF7F.tmp"C:\Users\Admin\AppData\Local\Temp\CF7F.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\D00B.tmp"C:\Users\Admin\AppData\Local\Temp\D00B.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\D079.tmp"C:\Users\Admin\AppData\Local\Temp\D079.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\D0F5.tmp"C:\Users\Admin\AppData\Local\Temp\D0F5.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\D163.tmp"C:\Users\Admin\AppData\Local\Temp\D163.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\D1DF.tmp"C:\Users\Admin\AppData\Local\Temp\D1DF.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\D25C.tmp"C:\Users\Admin\AppData\Local\Temp\D25C.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\D2C9.tmp"C:\Users\Admin\AppData\Local\Temp\D2C9.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\D346.tmp"C:\Users\Admin\AppData\Local\Temp\D346.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\D3B3.tmp"C:\Users\Admin\AppData\Local\Temp\D3B3.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\D421.tmp"C:\Users\Admin\AppData\Local\Temp\D421.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\D48E.tmp"C:\Users\Admin\AppData\Local\Temp\D48E.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\D4EB.tmp"C:\Users\Admin\AppData\Local\Temp\D4EB.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\D568.tmp"C:\Users\Admin\AppData\Local\Temp\D568.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\D5D5.tmp"C:\Users\Admin\AppData\Local\Temp\D5D5.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:856 -
C:\Users\Admin\AppData\Local\Temp\D643.tmp"C:\Users\Admin\AppData\Local\Temp\D643.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\D6B0.tmp"C:\Users\Admin\AppData\Local\Temp\D6B0.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\D72D.tmp"C:\Users\Admin\AppData\Local\Temp\D72D.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\D79A.tmp"C:\Users\Admin\AppData\Local\Temp\D79A.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\D807.tmp"C:\Users\Admin\AppData\Local\Temp\D807.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\D874.tmp"C:\Users\Admin\AppData\Local\Temp\D874.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\D8C2.tmp"C:\Users\Admin\AppData\Local\Temp\D8C2.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:496 -
C:\Users\Admin\AppData\Local\Temp\D901.tmp"C:\Users\Admin\AppData\Local\Temp\D901.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\D93F.tmp"C:\Users\Admin\AppData\Local\Temp\D93F.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\D98D.tmp"C:\Users\Admin\AppData\Local\Temp\D98D.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\D9CB.tmp"C:\Users\Admin\AppData\Local\Temp\D9CB.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:600 -
C:\Users\Admin\AppData\Local\Temp\DA0A.tmp"C:\Users\Admin\AppData\Local\Temp\DA0A.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\DA48.tmp"C:\Users\Admin\AppData\Local\Temp\DA48.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\DA87.tmp"C:\Users\Admin\AppData\Local\Temp\DA87.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:352 -
C:\Users\Admin\AppData\Local\Temp\DAC5.tmp"C:\Users\Admin\AppData\Local\Temp\DAC5.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\DB03.tmp"C:\Users\Admin\AppData\Local\Temp\DB03.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\DB42.tmp"C:\Users\Admin\AppData\Local\Temp\DB42.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:552 -
C:\Users\Admin\AppData\Local\Temp\DB90.tmp"C:\Users\Admin\AppData\Local\Temp\DB90.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\DBDE.tmp"C:\Users\Admin\AppData\Local\Temp\DBDE.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\DC1C.tmp"C:\Users\Admin\AppData\Local\Temp\DC1C.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\DC5B.tmp"C:\Users\Admin\AppData\Local\Temp\DC5B.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:772 -
C:\Users\Admin\AppData\Local\Temp\DCA9.tmp"C:\Users\Admin\AppData\Local\Temp\DCA9.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\DCF7.tmp"C:\Users\Admin\AppData\Local\Temp\DCF7.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\DD35.tmp"C:\Users\Admin\AppData\Local\Temp\DD35.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\DD73.tmp"C:\Users\Admin\AppData\Local\Temp\DD73.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\DDB2.tmp"C:\Users\Admin\AppData\Local\Temp\DDB2.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:756 -
C:\Users\Admin\AppData\Local\Temp\DDF0.tmp"C:\Users\Admin\AppData\Local\Temp\DDF0.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\DE2F.tmp"C:\Users\Admin\AppData\Local\Temp\DE2F.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\DE6D.tmp"C:\Users\Admin\AppData\Local\Temp\DE6D.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:568 -
C:\Users\Admin\AppData\Local\Temp\DEAC.tmp"C:\Users\Admin\AppData\Local\Temp\DEAC.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\DEFA.tmp"C:\Users\Admin\AppData\Local\Temp\DEFA.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\DF38.tmp"C:\Users\Admin\AppData\Local\Temp\DF38.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\DF76.tmp"C:\Users\Admin\AppData\Local\Temp\DF76.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\DFB5.tmp"C:\Users\Admin\AppData\Local\Temp\DFB5.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\E003.tmp"C:\Users\Admin\AppData\Local\Temp\E003.tmp"52⤵
- Executes dropped EXE
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\E041.tmp"C:\Users\Admin\AppData\Local\Temp\E041.tmp"53⤵
- Loads dropped DLL
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\E09F.tmp"C:\Users\Admin\AppData\Local\Temp\E09F.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\E0ED.tmp"C:\Users\Admin\AppData\Local\Temp\E0ED.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\E13B.tmp"C:\Users\Admin\AppData\Local\Temp\E13B.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\E179.tmp"C:\Users\Admin\AppData\Local\Temp\E179.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\E1B8.tmp"C:\Users\Admin\AppData\Local\Temp\E1B8.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\E215.tmp"C:\Users\Admin\AppData\Local\Temp\E215.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\E273.tmp"C:\Users\Admin\AppData\Local\Temp\E273.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\E2B1.tmp"C:\Users\Admin\AppData\Local\Temp\E2B1.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:860 -
C:\Users\Admin\AppData\Local\Temp\E2FF.tmp"C:\Users\Admin\AppData\Local\Temp\E2FF.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\E34D.tmp"C:\Users\Admin\AppData\Local\Temp\E34D.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\E38C.tmp"C:\Users\Admin\AppData\Local\Temp\E38C.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\E3CA.tmp"C:\Users\Admin\AppData\Local\Temp\E3CA.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\E408.tmp"C:\Users\Admin\AppData\Local\Temp\E408.tmp"66⤵
- Executes dropped EXE
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\E447.tmp"C:\Users\Admin\AppData\Local\Temp\E447.tmp"67⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\E485.tmp"C:\Users\Admin\AppData\Local\Temp\E485.tmp"68⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\E4C4.tmp"C:\Users\Admin\AppData\Local\Temp\E4C4.tmp"69⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\E502.tmp"C:\Users\Admin\AppData\Local\Temp\E502.tmp"70⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\E540.tmp"C:\Users\Admin\AppData\Local\Temp\E540.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\E58E.tmp"C:\Users\Admin\AppData\Local\Temp\E58E.tmp"72⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\E5DC.tmp"C:\Users\Admin\AppData\Local\Temp\E5DC.tmp"73⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\E61B.tmp"C:\Users\Admin\AppData\Local\Temp\E61B.tmp"74⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\E659.tmp"C:\Users\Admin\AppData\Local\Temp\E659.tmp"75⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\E698.tmp"C:\Users\Admin\AppData\Local\Temp\E698.tmp"76⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\E6D6.tmp"C:\Users\Admin\AppData\Local\Temp\E6D6.tmp"77⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\E714.tmp"C:\Users\Admin\AppData\Local\Temp\E714.tmp"78⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\E753.tmp"C:\Users\Admin\AppData\Local\Temp\E753.tmp"79⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\E791.tmp"C:\Users\Admin\AppData\Local\Temp\E791.tmp"80⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\E7D0.tmp"C:\Users\Admin\AppData\Local\Temp\E7D0.tmp"81⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\E80E.tmp"C:\Users\Admin\AppData\Local\Temp\E80E.tmp"82⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\E84C.tmp"C:\Users\Admin\AppData\Local\Temp\E84C.tmp"83⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\E88B.tmp"C:\Users\Admin\AppData\Local\Temp\E88B.tmp"84⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\E8C9.tmp"C:\Users\Admin\AppData\Local\Temp\E8C9.tmp"85⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\E908.tmp"C:\Users\Admin\AppData\Local\Temp\E908.tmp"86⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\E946.tmp"C:\Users\Admin\AppData\Local\Temp\E946.tmp"87⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\E994.tmp"C:\Users\Admin\AppData\Local\Temp\E994.tmp"88⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\E9D2.tmp"C:\Users\Admin\AppData\Local\Temp\E9D2.tmp"89⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\EA11.tmp"C:\Users\Admin\AppData\Local\Temp\EA11.tmp"90⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\EA4F.tmp"C:\Users\Admin\AppData\Local\Temp\EA4F.tmp"91⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\EA8E.tmp"C:\Users\Admin\AppData\Local\Temp\EA8E.tmp"92⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\EACC.tmp"C:\Users\Admin\AppData\Local\Temp\EACC.tmp"93⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\EB1A.tmp"C:\Users\Admin\AppData\Local\Temp\EB1A.tmp"94⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\EB58.tmp"C:\Users\Admin\AppData\Local\Temp\EB58.tmp"95⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\EB97.tmp"C:\Users\Admin\AppData\Local\Temp\EB97.tmp"96⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\EBD5.tmp"C:\Users\Admin\AppData\Local\Temp\EBD5.tmp"97⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\EC14.tmp"C:\Users\Admin\AppData\Local\Temp\EC14.tmp"98⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\EC52.tmp"C:\Users\Admin\AppData\Local\Temp\EC52.tmp"99⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\EC90.tmp"C:\Users\Admin\AppData\Local\Temp\EC90.tmp"100⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\ECCF.tmp"C:\Users\Admin\AppData\Local\Temp\ECCF.tmp"101⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\ED0D.tmp"C:\Users\Admin\AppData\Local\Temp\ED0D.tmp"102⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\ED4C.tmp"C:\Users\Admin\AppData\Local\Temp\ED4C.tmp"103⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\ED8A.tmp"C:\Users\Admin\AppData\Local\Temp\ED8A.tmp"104⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\EDC8.tmp"C:\Users\Admin\AppData\Local\Temp\EDC8.tmp"105⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\EE07.tmp"C:\Users\Admin\AppData\Local\Temp\EE07.tmp"106⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\EE45.tmp"C:\Users\Admin\AppData\Local\Temp\EE45.tmp"107⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\EE84.tmp"C:\Users\Admin\AppData\Local\Temp\EE84.tmp"108⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\EEC2.tmp"C:\Users\Admin\AppData\Local\Temp\EEC2.tmp"109⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\EF00.tmp"C:\Users\Admin\AppData\Local\Temp\EF00.tmp"110⤵PID:332
-
C:\Users\Admin\AppData\Local\Temp\EF3F.tmp"C:\Users\Admin\AppData\Local\Temp\EF3F.tmp"111⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\EF7D.tmp"C:\Users\Admin\AppData\Local\Temp\EF7D.tmp"112⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\EFBC.tmp"C:\Users\Admin\AppData\Local\Temp\EFBC.tmp"113⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\EFFA.tmp"C:\Users\Admin\AppData\Local\Temp\EFFA.tmp"114⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\F038.tmp"C:\Users\Admin\AppData\Local\Temp\F038.tmp"115⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\F077.tmp"C:\Users\Admin\AppData\Local\Temp\F077.tmp"116⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\F0B5.tmp"C:\Users\Admin\AppData\Local\Temp\F0B5.tmp"117⤵
- System Location Discovery: System Language Discovery
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\F0F4.tmp"C:\Users\Admin\AppData\Local\Temp\F0F4.tmp"118⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\F142.tmp"C:\Users\Admin\AppData\Local\Temp\F142.tmp"119⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\F180.tmp"C:\Users\Admin\AppData\Local\Temp\F180.tmp"120⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\F1BE.tmp"C:\Users\Admin\AppData\Local\Temp\F1BE.tmp"121⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\F1FD.tmp"C:\Users\Admin\AppData\Local\Temp\F1FD.tmp"122⤵PID:2840
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-