Analysis
-
max time kernel
145s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06-09-2024 12:35
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-06_62fd63f233f5cd606962ef72f3ad72cc_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-06_62fd63f233f5cd606962ef72f3ad72cc_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-06_62fd63f233f5cd606962ef72f3ad72cc_mafia.exe
-
Size
486KB
-
MD5
62fd63f233f5cd606962ef72f3ad72cc
-
SHA1
222b9e06102a39f6e3353db6553d36fcf4b95bcc
-
SHA256
beedba414605d12470c57fff0d8b5866411cc8a335a8f96272288576a01c488d
-
SHA512
f05bcf9d3828d639fada4017b2733109a01a93027e8a52453d79e98046152b0c39fb75df4661ffe71fc32f25d846f101f81a17404f5a93d2ca2b9c1403a7d01a
-
SSDEEP
6144:Borf3lPvovsgZnqG2C7mOTeiLfD7AOs8gW9C4eS/rHTiHhC+SxkjGEsxqT1xusHT:oU5rCOTeiDAOoJ4e0MhC+Sxa2elNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2336 DCC8.tmp 1364 DD35.tmp 1368 DDB2.tmp 2228 DE00.tmp 2412 DE4E.tmp 2748 DEAC.tmp 2760 DF09.tmp 2960 DF48.tmp 2576 DF96.tmp 2704 DFD4.tmp 2544 E012.tmp 2612 E060.tmp 2828 E0BE.tmp 1424 E0FC.tmp 2788 E13B.tmp 1792 E1C7.tmp 2784 E206.tmp 2352 E254.tmp 1908 E292.tmp 1524 E2D0.tmp 2920 E31E.tmp 2864 E37C.tmp 2392 E3CA.tmp 2928 E408.tmp 2140 E447.tmp 3020 E485.tmp 840 E4C4.tmp 580 E502.tmp 1156 E540.tmp 1236 E58E.tmp 808 E5CD.tmp 832 E5FC.tmp 1268 E63A.tmp 1764 E678.tmp 1656 E6B7.tmp 1632 E6E6.tmp 700 E724.tmp 1092 E753.tmp 1448 E791.tmp 1724 E7D0.tmp 324 E80E.tmp 2396 E84C.tmp 2108 E88B.tmp 2384 E8BA.tmp 2432 E8E8.tmp 1408 E917.tmp 1008 E956.tmp 1788 E994.tmp 1672 E9D2.tmp 3016 EA11.tmp 2308 EA4F.tmp 1488 EA7E.tmp 1516 EAAD.tmp 2336 EAEB.tmp 2300 EB2A.tmp 1196 EB58.tmp 1708 EB97.tmp 2632 EBD5.tmp 2752 EC14.tmp 2688 EC52.tmp 2756 ECB0.tmp 2664 ECEE.tmp 2628 ED3C.tmp 2972 ED8A.tmp -
Loads dropped DLL 64 IoCs
pid Process 2024 2024-09-06_62fd63f233f5cd606962ef72f3ad72cc_mafia.exe 2336 DCC8.tmp 1364 DD35.tmp 1368 DDB2.tmp 2228 DE00.tmp 2412 DE4E.tmp 2748 DEAC.tmp 2760 DF09.tmp 2960 DF48.tmp 2576 DF96.tmp 2704 DFD4.tmp 2544 E012.tmp 2612 E060.tmp 2828 E0BE.tmp 1424 E0FC.tmp 2788 E13B.tmp 1792 E1C7.tmp 2784 E206.tmp 2352 E254.tmp 1908 E292.tmp 1524 E2D0.tmp 2920 E31E.tmp 2864 E37C.tmp 2392 E3CA.tmp 2928 E408.tmp 2140 E447.tmp 3020 E485.tmp 840 E4C4.tmp 580 E502.tmp 1156 E540.tmp 1236 E58E.tmp 808 E5CD.tmp 832 E5FC.tmp 1268 E63A.tmp 1764 E678.tmp 1656 E6B7.tmp 1632 E6E6.tmp 700 E724.tmp 1092 E753.tmp 1448 E791.tmp 1724 E7D0.tmp 324 E80E.tmp 2396 E84C.tmp 2108 E88B.tmp 2384 E8BA.tmp 2432 E8E8.tmp 1408 E917.tmp 1008 E956.tmp 1788 E994.tmp 1672 E9D2.tmp 3016 EA11.tmp 2308 EA4F.tmp 1488 EA7E.tmp 1516 EAAD.tmp 2336 EAEB.tmp 2300 EB2A.tmp 1196 EB58.tmp 1708 EB97.tmp 2632 EBD5.tmp 2752 EC14.tmp 2688 EC52.tmp 2756 ECB0.tmp 2664 ECEE.tmp 2628 ED3C.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1268.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C81F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B8C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 558F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E6B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EC1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F24B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E206.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CEB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C726.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6097.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 343A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 495F.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2024 wrote to memory of 2336 2024 2024-09-06_62fd63f233f5cd606962ef72f3ad72cc_mafia.exe 31 PID 2024 wrote to memory of 2336 2024 2024-09-06_62fd63f233f5cd606962ef72f3ad72cc_mafia.exe 31 PID 2024 wrote to memory of 2336 2024 2024-09-06_62fd63f233f5cd606962ef72f3ad72cc_mafia.exe 31 PID 2024 wrote to memory of 2336 2024 2024-09-06_62fd63f233f5cd606962ef72f3ad72cc_mafia.exe 31 PID 2336 wrote to memory of 1364 2336 DCC8.tmp 32 PID 2336 wrote to memory of 1364 2336 DCC8.tmp 32 PID 2336 wrote to memory of 1364 2336 DCC8.tmp 32 PID 2336 wrote to memory of 1364 2336 DCC8.tmp 32 PID 1364 wrote to memory of 1368 1364 DD35.tmp 33 PID 1364 wrote to memory of 1368 1364 DD35.tmp 33 PID 1364 wrote to memory of 1368 1364 DD35.tmp 33 PID 1364 wrote to memory of 1368 1364 DD35.tmp 33 PID 1368 wrote to memory of 2228 1368 DDB2.tmp 34 PID 1368 wrote to memory of 2228 1368 DDB2.tmp 34 PID 1368 wrote to memory of 2228 1368 DDB2.tmp 34 PID 1368 wrote to memory of 2228 1368 DDB2.tmp 34 PID 2228 wrote to memory of 2412 2228 DE00.tmp 35 PID 2228 wrote to memory of 2412 2228 DE00.tmp 35 PID 2228 wrote to memory of 2412 2228 DE00.tmp 35 PID 2228 wrote to memory of 2412 2228 DE00.tmp 35 PID 2412 wrote to memory of 2748 2412 DE4E.tmp 36 PID 2412 wrote to memory of 2748 2412 DE4E.tmp 36 PID 2412 wrote to memory of 2748 2412 DE4E.tmp 36 PID 2412 wrote to memory of 2748 2412 DE4E.tmp 36 PID 2748 wrote to memory of 2760 2748 DEAC.tmp 37 PID 2748 wrote to memory of 2760 2748 DEAC.tmp 37 PID 2748 wrote to memory of 2760 2748 DEAC.tmp 37 PID 2748 wrote to memory of 2760 2748 DEAC.tmp 37 PID 2760 wrote to memory of 2960 2760 DF09.tmp 38 PID 2760 wrote to memory of 2960 2760 DF09.tmp 38 PID 2760 wrote to memory of 2960 2760 DF09.tmp 38 PID 2760 wrote to memory of 2960 2760 DF09.tmp 38 PID 2960 wrote to memory of 2576 2960 DF48.tmp 39 PID 2960 wrote to memory of 2576 2960 DF48.tmp 39 PID 2960 wrote to memory of 2576 2960 DF48.tmp 39 PID 2960 wrote to memory of 2576 2960 DF48.tmp 39 PID 2576 wrote to memory of 2704 2576 DF96.tmp 40 PID 2576 wrote to memory of 2704 2576 DF96.tmp 40 PID 2576 wrote to memory of 2704 2576 DF96.tmp 40 PID 2576 wrote to memory of 2704 2576 DF96.tmp 40 PID 2704 wrote to memory of 2544 2704 DFD4.tmp 41 PID 2704 wrote to memory of 2544 2704 DFD4.tmp 41 PID 2704 wrote to memory of 2544 2704 DFD4.tmp 41 PID 2704 wrote to memory of 2544 2704 DFD4.tmp 41 PID 2544 wrote to memory of 2612 2544 E012.tmp 42 PID 2544 wrote to memory of 2612 2544 E012.tmp 42 PID 2544 wrote to memory of 2612 2544 E012.tmp 42 PID 2544 wrote to memory of 2612 2544 E012.tmp 42 PID 2612 wrote to memory of 2828 2612 E060.tmp 43 PID 2612 wrote to memory of 2828 2612 E060.tmp 43 PID 2612 wrote to memory of 2828 2612 E060.tmp 43 PID 2612 wrote to memory of 2828 2612 E060.tmp 43 PID 2828 wrote to memory of 1424 2828 E0BE.tmp 44 PID 2828 wrote to memory of 1424 2828 E0BE.tmp 44 PID 2828 wrote to memory of 1424 2828 E0BE.tmp 44 PID 2828 wrote to memory of 1424 2828 E0BE.tmp 44 PID 1424 wrote to memory of 2788 1424 E0FC.tmp 45 PID 1424 wrote to memory of 2788 1424 E0FC.tmp 45 PID 1424 wrote to memory of 2788 1424 E0FC.tmp 45 PID 1424 wrote to memory of 2788 1424 E0FC.tmp 45 PID 2788 wrote to memory of 1792 2788 E13B.tmp 46 PID 2788 wrote to memory of 1792 2788 E13B.tmp 46 PID 2788 wrote to memory of 1792 2788 E13B.tmp 46 PID 2788 wrote to memory of 1792 2788 E13B.tmp 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-06_62fd63f233f5cd606962ef72f3ad72cc_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-06_62fd63f233f5cd606962ef72f3ad72cc_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\DCC8.tmp"C:\Users\Admin\AppData\Local\Temp\DCC8.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\DD35.tmp"C:\Users\Admin\AppData\Local\Temp\DD35.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\DDB2.tmp"C:\Users\Admin\AppData\Local\Temp\DDB2.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\DE00.tmp"C:\Users\Admin\AppData\Local\Temp\DE00.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\DE4E.tmp"C:\Users\Admin\AppData\Local\Temp\DE4E.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\DEAC.tmp"C:\Users\Admin\AppData\Local\Temp\DEAC.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\DF09.tmp"C:\Users\Admin\AppData\Local\Temp\DF09.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\DF48.tmp"C:\Users\Admin\AppData\Local\Temp\DF48.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\DF96.tmp"C:\Users\Admin\AppData\Local\Temp\DF96.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\DFD4.tmp"C:\Users\Admin\AppData\Local\Temp\DFD4.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\E012.tmp"C:\Users\Admin\AppData\Local\Temp\E012.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\E060.tmp"C:\Users\Admin\AppData\Local\Temp\E060.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\E0BE.tmp"C:\Users\Admin\AppData\Local\Temp\E0BE.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\E0FC.tmp"C:\Users\Admin\AppData\Local\Temp\E0FC.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\E13B.tmp"C:\Users\Admin\AppData\Local\Temp\E13B.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\E1C7.tmp"C:\Users\Admin\AppData\Local\Temp\E1C7.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\E206.tmp"C:\Users\Admin\AppData\Local\Temp\E206.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\E254.tmp"C:\Users\Admin\AppData\Local\Temp\E254.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\E292.tmp"C:\Users\Admin\AppData\Local\Temp\E292.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\E2D0.tmp"C:\Users\Admin\AppData\Local\Temp\E2D0.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\E31E.tmp"C:\Users\Admin\AppData\Local\Temp\E31E.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\E37C.tmp"C:\Users\Admin\AppData\Local\Temp\E37C.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\E3CA.tmp"C:\Users\Admin\AppData\Local\Temp\E3CA.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\E408.tmp"C:\Users\Admin\AppData\Local\Temp\E408.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\E447.tmp"C:\Users\Admin\AppData\Local\Temp\E447.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\E485.tmp"C:\Users\Admin\AppData\Local\Temp\E485.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\E4C4.tmp"C:\Users\Admin\AppData\Local\Temp\E4C4.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:840 -
C:\Users\Admin\AppData\Local\Temp\E502.tmp"C:\Users\Admin\AppData\Local\Temp\E502.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:580 -
C:\Users\Admin\AppData\Local\Temp\E540.tmp"C:\Users\Admin\AppData\Local\Temp\E540.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\E58E.tmp"C:\Users\Admin\AppData\Local\Temp\E58E.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\E5CD.tmp"C:\Users\Admin\AppData\Local\Temp\E5CD.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:808 -
C:\Users\Admin\AppData\Local\Temp\E5FC.tmp"C:\Users\Admin\AppData\Local\Temp\E5FC.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:832 -
C:\Users\Admin\AppData\Local\Temp\E63A.tmp"C:\Users\Admin\AppData\Local\Temp\E63A.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\E678.tmp"C:\Users\Admin\AppData\Local\Temp\E678.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\E6B7.tmp"C:\Users\Admin\AppData\Local\Temp\E6B7.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\E6E6.tmp"C:\Users\Admin\AppData\Local\Temp\E6E6.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\E724.tmp"C:\Users\Admin\AppData\Local\Temp\E724.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:700 -
C:\Users\Admin\AppData\Local\Temp\E753.tmp"C:\Users\Admin\AppData\Local\Temp\E753.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\E791.tmp"C:\Users\Admin\AppData\Local\Temp\E791.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\E7D0.tmp"C:\Users\Admin\AppData\Local\Temp\E7D0.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\E80E.tmp"C:\Users\Admin\AppData\Local\Temp\E80E.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:324 -
C:\Users\Admin\AppData\Local\Temp\E84C.tmp"C:\Users\Admin\AppData\Local\Temp\E84C.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\E88B.tmp"C:\Users\Admin\AppData\Local\Temp\E88B.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\E8E8.tmp"C:\Users\Admin\AppData\Local\Temp\E8E8.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\E917.tmp"C:\Users\Admin\AppData\Local\Temp\E917.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\E956.tmp"C:\Users\Admin\AppData\Local\Temp\E956.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\E994.tmp"C:\Users\Admin\AppData\Local\Temp\E994.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\E9D2.tmp"C:\Users\Admin\AppData\Local\Temp\E9D2.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\EA11.tmp"C:\Users\Admin\AppData\Local\Temp\EA11.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\EA4F.tmp"C:\Users\Admin\AppData\Local\Temp\EA4F.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\EA7E.tmp"C:\Users\Admin\AppData\Local\Temp\EA7E.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\EAAD.tmp"C:\Users\Admin\AppData\Local\Temp\EAAD.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\EAEB.tmp"C:\Users\Admin\AppData\Local\Temp\EAEB.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\EB2A.tmp"C:\Users\Admin\AppData\Local\Temp\EB2A.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\EB58.tmp"C:\Users\Admin\AppData\Local\Temp\EB58.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\EB97.tmp"C:\Users\Admin\AppData\Local\Temp\EB97.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\EBD5.tmp"C:\Users\Admin\AppData\Local\Temp\EBD5.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\EC14.tmp"C:\Users\Admin\AppData\Local\Temp\EC14.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\EC52.tmp"C:\Users\Admin\AppData\Local\Temp\EC52.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\ECB0.tmp"C:\Users\Admin\AppData\Local\Temp\ECB0.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\ECEE.tmp"C:\Users\Admin\AppData\Local\Temp\ECEE.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\ED3C.tmp"C:\Users\Admin\AppData\Local\Temp\ED3C.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\ED8A.tmp"C:\Users\Admin\AppData\Local\Temp\ED8A.tmp"65⤵
- Executes dropped EXE
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\EDD8.tmp"C:\Users\Admin\AppData\Local\Temp\EDD8.tmp"66⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\EE16.tmp"C:\Users\Admin\AppData\Local\Temp\EE16.tmp"67⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\EE74.tmp"C:\Users\Admin\AppData\Local\Temp\EE74.tmp"68⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\EEC2.tmp"C:\Users\Admin\AppData\Local\Temp\EEC2.tmp"69⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\EF10.tmp"C:\Users\Admin\AppData\Local\Temp\EF10.tmp"70⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\EF4E.tmp"C:\Users\Admin\AppData\Local\Temp\EF4E.tmp"71⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\EFAC.tmp"C:\Users\Admin\AppData\Local\Temp\EFAC.tmp"72⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\F00A.tmp"C:\Users\Admin\AppData\Local\Temp\F00A.tmp"73⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\F067.tmp"C:\Users\Admin\AppData\Local\Temp\F067.tmp"74⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\F0D4.tmp"C:\Users\Admin\AppData\Local\Temp\F0D4.tmp"75⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\F113.tmp"C:\Users\Admin\AppData\Local\Temp\F113.tmp"76⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\F151.tmp"C:\Users\Admin\AppData\Local\Temp\F151.tmp"77⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\F190.tmp"C:\Users\Admin\AppData\Local\Temp\F190.tmp"78⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\F1CE.tmp"C:\Users\Admin\AppData\Local\Temp\F1CE.tmp"79⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\F20C.tmp"C:\Users\Admin\AppData\Local\Temp\F20C.tmp"80⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\F24B.tmp"C:\Users\Admin\AppData\Local\Temp\F24B.tmp"81⤵
- System Location Discovery: System Language Discovery
PID:756 -
C:\Users\Admin\AppData\Local\Temp\F289.tmp"C:\Users\Admin\AppData\Local\Temp\F289.tmp"82⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\F2C8.tmp"C:\Users\Admin\AppData\Local\Temp\F2C8.tmp"83⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\F306.tmp"C:\Users\Admin\AppData\Local\Temp\F306.tmp"84⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\F344.tmp"C:\Users\Admin\AppData\Local\Temp\F344.tmp"85⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\F383.tmp"C:\Users\Admin\AppData\Local\Temp\F383.tmp"86⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\F3C1.tmp"C:\Users\Admin\AppData\Local\Temp\F3C1.tmp"87⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\F400.tmp"C:\Users\Admin\AppData\Local\Temp\F400.tmp"88⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\F43E.tmp"C:\Users\Admin\AppData\Local\Temp\F43E.tmp"89⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\F47C.tmp"C:\Users\Admin\AppData\Local\Temp\F47C.tmp"90⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\F4BB.tmp"C:\Users\Admin\AppData\Local\Temp\F4BB.tmp"91⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\F4F9.tmp"C:\Users\Admin\AppData\Local\Temp\F4F9.tmp"92⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\F538.tmp"C:\Users\Admin\AppData\Local\Temp\F538.tmp"93⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\F576.tmp"C:\Users\Admin\AppData\Local\Temp\F576.tmp"94⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\F5B4.tmp"C:\Users\Admin\AppData\Local\Temp\F5B4.tmp"95⤵
- System Location Discovery: System Language Discovery
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\F5F3.tmp"C:\Users\Admin\AppData\Local\Temp\F5F3.tmp"96⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\F631.tmp"C:\Users\Admin\AppData\Local\Temp\F631.tmp"97⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\F670.tmp"C:\Users\Admin\AppData\Local\Temp\F670.tmp"98⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\F6AE.tmp"C:\Users\Admin\AppData\Local\Temp\F6AE.tmp"99⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\F6EC.tmp"C:\Users\Admin\AppData\Local\Temp\F6EC.tmp"100⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\F72B.tmp"C:\Users\Admin\AppData\Local\Temp\F72B.tmp"101⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\F769.tmp"C:\Users\Admin\AppData\Local\Temp\F769.tmp"102⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\F7A8.tmp"C:\Users\Admin\AppData\Local\Temp\F7A8.tmp"103⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\F7E6.tmp"C:\Users\Admin\AppData\Local\Temp\F7E6.tmp"104⤵
- System Location Discovery: System Language Discovery
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\F824.tmp"C:\Users\Admin\AppData\Local\Temp\F824.tmp"105⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\F863.tmp"C:\Users\Admin\AppData\Local\Temp\F863.tmp"106⤵PID:596
-
C:\Users\Admin\AppData\Local\Temp\F8A1.tmp"C:\Users\Admin\AppData\Local\Temp\F8A1.tmp"107⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\F8E0.tmp"C:\Users\Admin\AppData\Local\Temp\F8E0.tmp"108⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\F91E.tmp"C:\Users\Admin\AppData\Local\Temp\F91E.tmp"109⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\F96C.tmp"C:\Users\Admin\AppData\Local\Temp\F96C.tmp"110⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\F9AA.tmp"C:\Users\Admin\AppData\Local\Temp\F9AA.tmp"111⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\F9F8.tmp"C:\Users\Admin\AppData\Local\Temp\F9F8.tmp"112⤵
- System Location Discovery: System Language Discovery
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\FA37.tmp"C:\Users\Admin\AppData\Local\Temp\FA37.tmp"113⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\FA75.tmp"C:\Users\Admin\AppData\Local\Temp\FA75.tmp"114⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\FAB4.tmp"C:\Users\Admin\AppData\Local\Temp\FAB4.tmp"115⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\FAF2.tmp"C:\Users\Admin\AppData\Local\Temp\FAF2.tmp"116⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\FB30.tmp"C:\Users\Admin\AppData\Local\Temp\FB30.tmp"117⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\FB6F.tmp"C:\Users\Admin\AppData\Local\Temp\FB6F.tmp"118⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\FBAD.tmp"C:\Users\Admin\AppData\Local\Temp\FBAD.tmp"119⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\FBEC.tmp"C:\Users\Admin\AppData\Local\Temp\FBEC.tmp"120⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\FC2A.tmp"C:\Users\Admin\AppData\Local\Temp\FC2A.tmp"121⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\FC68.tmp"C:\Users\Admin\AppData\Local\Temp\FC68.tmp"122⤵PID:2228
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-