Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05-10-2024 15:01
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-05_5af703cd94fc2a866e43b3d36614f02b_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-05_5af703cd94fc2a866e43b3d36614f02b_mafia.exe
Resource
win10v2004-20240910-en
General
-
Target
2024-10-05_5af703cd94fc2a866e43b3d36614f02b_mafia.exe
-
Size
541KB
-
MD5
5af703cd94fc2a866e43b3d36614f02b
-
SHA1
3b973304756096e721e2b9555414650810ae79c2
-
SHA256
c432cbb71588430bb58f33d9c9c607a4c8a1c8493797ee5f548dd7c104a5bfab
-
SHA512
66fdfb605e69466fc88af96857ee8bfc9bbdb685be6d03883b326d11151a9303d2dc26e10b1683b58bd003760aa7cd3421068425597c033e2687967363184983
-
SSDEEP
12288:UU5rCOTeifDjKPYgvWmTLpRKXrZa73ctO:UUQOJfCXWmTVRKXrU73ctO
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1052 D8D2.tmp 2896 D93F.tmp 2460 D9AC.tmp 2952 DA0A.tmp 2380 DA67.tmp 2728 DAC5.tmp 2768 DB32.tmp 2760 DB9F.tmp 2812 DC0D.tmp 2564 DC7A.tmp 1912 DCD7.tmp 2600 DD35.tmp 2592 DDA2.tmp 1656 DE10.tmp 540 DE7D.tmp 2312 DEEA.tmp 708 DF48.tmp 1588 DFA5.tmp 1688 E003.tmp 2316 E070.tmp 768 E0ED.tmp 1524 E15A.tmp 1572 E1B8.tmp 1964 E1F6.tmp 1504 E234.tmp 2360 E273.tmp 2524 E2B1.tmp 3044 E2F0.tmp 1916 E32E.tmp 2344 E36C.tmp 1992 E3AB.tmp 964 E3E9.tmp 328 E428.tmp 1648 E466.tmp 1668 E4A4.tmp 932 E4F2.tmp 2864 E531.tmp 2868 E56F.tmp 1220 E5AE.tmp 788 E5EC.tmp 3052 E63A.tmp 1124 E678.tmp 2348 E6B7.tmp 2156 E6F5.tmp 2248 E734.tmp 1584 E772.tmp 1016 E7B0.tmp 1864 E7EF.tmp 1428 E82D.tmp 2176 E86C.tmp 1500 E8AA.tmp 1532 E8E8.tmp 2356 E927.tmp 2160 E965.tmp 2448 E9A4.tmp 2412 E9E2.tmp 2460 EA20.tmp 2984 EA5F.tmp 2652 EA9D.tmp 2776 EADC.tmp 2752 EB1A.tmp 2852 EB58.tmp 2672 EB97.tmp 2388 EBD5.tmp -
Loads dropped DLL 64 IoCs
pid Process 2356 2024-10-05_5af703cd94fc2a866e43b3d36614f02b_mafia.exe 1052 D8D2.tmp 2896 D93F.tmp 2460 D9AC.tmp 2952 DA0A.tmp 2380 DA67.tmp 2728 DAC5.tmp 2768 DB32.tmp 2760 DB9F.tmp 2812 DC0D.tmp 2564 DC7A.tmp 1912 DCD7.tmp 2600 DD35.tmp 2592 DDA2.tmp 1656 DE10.tmp 540 DE7D.tmp 2312 DEEA.tmp 708 DF48.tmp 1588 DFA5.tmp 1688 E003.tmp 2316 E070.tmp 768 E0ED.tmp 1524 E15A.tmp 1572 E1B8.tmp 1964 E1F6.tmp 1504 E234.tmp 2360 E273.tmp 2524 E2B1.tmp 3044 E2F0.tmp 1916 E32E.tmp 2344 E36C.tmp 1992 E3AB.tmp 964 E3E9.tmp 328 E428.tmp 1648 E466.tmp 1668 E4A4.tmp 932 E4F2.tmp 2864 E531.tmp 2868 E56F.tmp 1220 E5AE.tmp 788 E5EC.tmp 3052 E63A.tmp 1124 E678.tmp 2348 E6B7.tmp 2156 E6F5.tmp 2248 E734.tmp 1584 E772.tmp 1016 E7B0.tmp 1864 E7EF.tmp 1428 E82D.tmp 2176 E86C.tmp 1500 E8AA.tmp 1532 E8E8.tmp 2356 E927.tmp 2160 E965.tmp 2448 E9A4.tmp 2412 E9E2.tmp 2460 EA20.tmp 2984 EA5F.tmp 2652 EA9D.tmp 2776 EADC.tmp 2752 EB1A.tmp 2852 EB58.tmp 2672 EB97.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDA2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3514.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D44.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D633.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 732D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C072.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F161.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B635.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E22.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8076.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D578.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-05_5af703cd94fc2a866e43b3d36614f02b_mafia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7002.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F19F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC75.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C458.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2AF7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8517.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B847.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB44.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9EA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2356 wrote to memory of 1052 2356 2024-10-05_5af703cd94fc2a866e43b3d36614f02b_mafia.exe 31 PID 2356 wrote to memory of 1052 2356 2024-10-05_5af703cd94fc2a866e43b3d36614f02b_mafia.exe 31 PID 2356 wrote to memory of 1052 2356 2024-10-05_5af703cd94fc2a866e43b3d36614f02b_mafia.exe 31 PID 2356 wrote to memory of 1052 2356 2024-10-05_5af703cd94fc2a866e43b3d36614f02b_mafia.exe 31 PID 1052 wrote to memory of 2896 1052 D8D2.tmp 32 PID 1052 wrote to memory of 2896 1052 D8D2.tmp 32 PID 1052 wrote to memory of 2896 1052 D8D2.tmp 32 PID 1052 wrote to memory of 2896 1052 D8D2.tmp 32 PID 2896 wrote to memory of 2460 2896 D93F.tmp 33 PID 2896 wrote to memory of 2460 2896 D93F.tmp 33 PID 2896 wrote to memory of 2460 2896 D93F.tmp 33 PID 2896 wrote to memory of 2460 2896 D93F.tmp 33 PID 2460 wrote to memory of 2952 2460 D9AC.tmp 34 PID 2460 wrote to memory of 2952 2460 D9AC.tmp 34 PID 2460 wrote to memory of 2952 2460 D9AC.tmp 34 PID 2460 wrote to memory of 2952 2460 D9AC.tmp 34 PID 2952 wrote to memory of 2380 2952 DA0A.tmp 35 PID 2952 wrote to memory of 2380 2952 DA0A.tmp 35 PID 2952 wrote to memory of 2380 2952 DA0A.tmp 35 PID 2952 wrote to memory of 2380 2952 DA0A.tmp 35 PID 2380 wrote to memory of 2728 2380 DA67.tmp 36 PID 2380 wrote to memory of 2728 2380 DA67.tmp 36 PID 2380 wrote to memory of 2728 2380 DA67.tmp 36 PID 2380 wrote to memory of 2728 2380 DA67.tmp 36 PID 2728 wrote to memory of 2768 2728 DAC5.tmp 37 PID 2728 wrote to memory of 2768 2728 DAC5.tmp 37 PID 2728 wrote to memory of 2768 2728 DAC5.tmp 37 PID 2728 wrote to memory of 2768 2728 DAC5.tmp 37 PID 2768 wrote to memory of 2760 2768 DB32.tmp 38 PID 2768 wrote to memory of 2760 2768 DB32.tmp 38 PID 2768 wrote to memory of 2760 2768 DB32.tmp 38 PID 2768 wrote to memory of 2760 2768 DB32.tmp 38 PID 2760 wrote to memory of 2812 2760 DB9F.tmp 39 PID 2760 wrote to memory of 2812 2760 DB9F.tmp 39 PID 2760 wrote to memory of 2812 2760 DB9F.tmp 39 PID 2760 wrote to memory of 2812 2760 DB9F.tmp 39 PID 2812 wrote to memory of 2564 2812 DC0D.tmp 40 PID 2812 wrote to memory of 2564 2812 DC0D.tmp 40 PID 2812 wrote to memory of 2564 2812 DC0D.tmp 40 PID 2812 wrote to memory of 2564 2812 DC0D.tmp 40 PID 2564 wrote to memory of 1912 2564 DC7A.tmp 41 PID 2564 wrote to memory of 1912 2564 DC7A.tmp 41 PID 2564 wrote to memory of 1912 2564 DC7A.tmp 41 PID 2564 wrote to memory of 1912 2564 DC7A.tmp 41 PID 1912 wrote to memory of 2600 1912 DCD7.tmp 42 PID 1912 wrote to memory of 2600 1912 DCD7.tmp 42 PID 1912 wrote to memory of 2600 1912 DCD7.tmp 42 PID 1912 wrote to memory of 2600 1912 DCD7.tmp 42 PID 2600 wrote to memory of 2592 2600 DD35.tmp 43 PID 2600 wrote to memory of 2592 2600 DD35.tmp 43 PID 2600 wrote to memory of 2592 2600 DD35.tmp 43 PID 2600 wrote to memory of 2592 2600 DD35.tmp 43 PID 2592 wrote to memory of 1656 2592 DDA2.tmp 44 PID 2592 wrote to memory of 1656 2592 DDA2.tmp 44 PID 2592 wrote to memory of 1656 2592 DDA2.tmp 44 PID 2592 wrote to memory of 1656 2592 DDA2.tmp 44 PID 1656 wrote to memory of 540 1656 DE10.tmp 45 PID 1656 wrote to memory of 540 1656 DE10.tmp 45 PID 1656 wrote to memory of 540 1656 DE10.tmp 45 PID 1656 wrote to memory of 540 1656 DE10.tmp 45 PID 540 wrote to memory of 2312 540 DE7D.tmp 46 PID 540 wrote to memory of 2312 540 DE7D.tmp 46 PID 540 wrote to memory of 2312 540 DE7D.tmp 46 PID 540 wrote to memory of 2312 540 DE7D.tmp 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-05_5af703cd94fc2a866e43b3d36614f02b_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-05_5af703cd94fc2a866e43b3d36614f02b_mafia.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\D8D2.tmp"C:\Users\Admin\AppData\Local\Temp\D8D2.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\D93F.tmp"C:\Users\Admin\AppData\Local\Temp\D93F.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\D9AC.tmp"C:\Users\Admin\AppData\Local\Temp\D9AC.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\DA0A.tmp"C:\Users\Admin\AppData\Local\Temp\DA0A.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\DA67.tmp"C:\Users\Admin\AppData\Local\Temp\DA67.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\DAC5.tmp"C:\Users\Admin\AppData\Local\Temp\DAC5.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\DB32.tmp"C:\Users\Admin\AppData\Local\Temp\DB32.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\DB9F.tmp"C:\Users\Admin\AppData\Local\Temp\DB9F.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\DC0D.tmp"C:\Users\Admin\AppData\Local\Temp\DC0D.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\DC7A.tmp"C:\Users\Admin\AppData\Local\Temp\DC7A.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\DCD7.tmp"C:\Users\Admin\AppData\Local\Temp\DCD7.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\DD35.tmp"C:\Users\Admin\AppData\Local\Temp\DD35.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\DDA2.tmp"C:\Users\Admin\AppData\Local\Temp\DDA2.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\DE10.tmp"C:\Users\Admin\AppData\Local\Temp\DE10.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\DE7D.tmp"C:\Users\Admin\AppData\Local\Temp\DE7D.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\AppData\Local\Temp\DEEA.tmp"C:\Users\Admin\AppData\Local\Temp\DEEA.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\DF48.tmp"C:\Users\Admin\AppData\Local\Temp\DF48.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:708 -
C:\Users\Admin\AppData\Local\Temp\DFA5.tmp"C:\Users\Admin\AppData\Local\Temp\DFA5.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\E003.tmp"C:\Users\Admin\AppData\Local\Temp\E003.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\E070.tmp"C:\Users\Admin\AppData\Local\Temp\E070.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\E0ED.tmp"C:\Users\Admin\AppData\Local\Temp\E0ED.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:768 -
C:\Users\Admin\AppData\Local\Temp\E15A.tmp"C:\Users\Admin\AppData\Local\Temp\E15A.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\E1B8.tmp"C:\Users\Admin\AppData\Local\Temp\E1B8.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\E1F6.tmp"C:\Users\Admin\AppData\Local\Temp\E1F6.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\E234.tmp"C:\Users\Admin\AppData\Local\Temp\E234.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\E273.tmp"C:\Users\Admin\AppData\Local\Temp\E273.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\E2B1.tmp"C:\Users\Admin\AppData\Local\Temp\E2B1.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\E2F0.tmp"C:\Users\Admin\AppData\Local\Temp\E2F0.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\E32E.tmp"C:\Users\Admin\AppData\Local\Temp\E32E.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\E36C.tmp"C:\Users\Admin\AppData\Local\Temp\E36C.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\E3AB.tmp"C:\Users\Admin\AppData\Local\Temp\E3AB.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\E3E9.tmp"C:\Users\Admin\AppData\Local\Temp\E3E9.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:964 -
C:\Users\Admin\AppData\Local\Temp\E428.tmp"C:\Users\Admin\AppData\Local\Temp\E428.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:328 -
C:\Users\Admin\AppData\Local\Temp\E466.tmp"C:\Users\Admin\AppData\Local\Temp\E466.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\E4A4.tmp"C:\Users\Admin\AppData\Local\Temp\E4A4.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\E4F2.tmp"C:\Users\Admin\AppData\Local\Temp\E4F2.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:932 -
C:\Users\Admin\AppData\Local\Temp\E531.tmp"C:\Users\Admin\AppData\Local\Temp\E531.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\E56F.tmp"C:\Users\Admin\AppData\Local\Temp\E56F.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\E5AE.tmp"C:\Users\Admin\AppData\Local\Temp\E5AE.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\E5EC.tmp"C:\Users\Admin\AppData\Local\Temp\E5EC.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:788 -
C:\Users\Admin\AppData\Local\Temp\E63A.tmp"C:\Users\Admin\AppData\Local\Temp\E63A.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\E678.tmp"C:\Users\Admin\AppData\Local\Temp\E678.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\E6B7.tmp"C:\Users\Admin\AppData\Local\Temp\E6B7.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\E734.tmp"C:\Users\Admin\AppData\Local\Temp\E734.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\E772.tmp"C:\Users\Admin\AppData\Local\Temp\E772.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\E82D.tmp"C:\Users\Admin\AppData\Local\Temp\E82D.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\E86C.tmp"C:\Users\Admin\AppData\Local\Temp\E86C.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\E8AA.tmp"C:\Users\Admin\AppData\Local\Temp\E8AA.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\E8E8.tmp"C:\Users\Admin\AppData\Local\Temp\E8E8.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\E927.tmp"C:\Users\Admin\AppData\Local\Temp\E927.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\E965.tmp"C:\Users\Admin\AppData\Local\Temp\E965.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\E9A4.tmp"C:\Users\Admin\AppData\Local\Temp\E9A4.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\E9E2.tmp"C:\Users\Admin\AppData\Local\Temp\E9E2.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\EA20.tmp"C:\Users\Admin\AppData\Local\Temp\EA20.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\EA5F.tmp"C:\Users\Admin\AppData\Local\Temp\EA5F.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\EA9D.tmp"C:\Users\Admin\AppData\Local\Temp\EA9D.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\EADC.tmp"C:\Users\Admin\AppData\Local\Temp\EADC.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\EB1A.tmp"C:\Users\Admin\AppData\Local\Temp\EB1A.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\EB58.tmp"C:\Users\Admin\AppData\Local\Temp\EB58.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\EB97.tmp"C:\Users\Admin\AppData\Local\Temp\EB97.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\EBD5.tmp"C:\Users\Admin\AppData\Local\Temp\EBD5.tmp"65⤵
- Executes dropped EXE
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\EC14.tmp"C:\Users\Admin\AppData\Local\Temp\EC14.tmp"66⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\EC62.tmp"C:\Users\Admin\AppData\Local\Temp\EC62.tmp"67⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\ECB0.tmp"C:\Users\Admin\AppData\Local\Temp\ECB0.tmp"68⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\ECEE.tmp"C:\Users\Admin\AppData\Local\Temp\ECEE.tmp"69⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\ED2C.tmp"C:\Users\Admin\AppData\Local\Temp\ED2C.tmp"70⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\ED6B.tmp"C:\Users\Admin\AppData\Local\Temp\ED6B.tmp"71⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\EDA9.tmp"C:\Users\Admin\AppData\Local\Temp\EDA9.tmp"72⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\EDF7.tmp"C:\Users\Admin\AppData\Local\Temp\EDF7.tmp"73⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\EE36.tmp"C:\Users\Admin\AppData\Local\Temp\EE36.tmp"74⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\EE74.tmp"C:\Users\Admin\AppData\Local\Temp\EE74.tmp"75⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\EEB2.tmp"C:\Users\Admin\AppData\Local\Temp\EEB2.tmp"76⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\EEF1.tmp"C:\Users\Admin\AppData\Local\Temp\EEF1.tmp"77⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\EF2F.tmp"C:\Users\Admin\AppData\Local\Temp\EF2F.tmp"78⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\EF6E.tmp"C:\Users\Admin\AppData\Local\Temp\EF6E.tmp"79⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\EFAC.tmp"C:\Users\Admin\AppData\Local\Temp\EFAC.tmp"80⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\EFEA.tmp"C:\Users\Admin\AppData\Local\Temp\EFEA.tmp"81⤵
- System Location Discovery: System Language Discovery
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\F029.tmp"C:\Users\Admin\AppData\Local\Temp\F029.tmp"82⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\F067.tmp"C:\Users\Admin\AppData\Local\Temp\F067.tmp"83⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\F0A6.tmp"C:\Users\Admin\AppData\Local\Temp\F0A6.tmp"84⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\F0E4.tmp"C:\Users\Admin\AppData\Local\Temp\F0E4.tmp"85⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\F122.tmp"C:\Users\Admin\AppData\Local\Temp\F122.tmp"86⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\F161.tmp"C:\Users\Admin\AppData\Local\Temp\F161.tmp"87⤵
- System Location Discovery: System Language Discovery
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\F19F.tmp"C:\Users\Admin\AppData\Local\Temp\F19F.tmp"88⤵
- System Location Discovery: System Language Discovery
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\F1DE.tmp"C:\Users\Admin\AppData\Local\Temp\F1DE.tmp"89⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\F21C.tmp"C:\Users\Admin\AppData\Local\Temp\F21C.tmp"90⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\F25A.tmp"C:\Users\Admin\AppData\Local\Temp\F25A.tmp"91⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\F299.tmp"C:\Users\Admin\AppData\Local\Temp\F299.tmp"92⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\F2D7.tmp"C:\Users\Admin\AppData\Local\Temp\F2D7.tmp"93⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\F316.tmp"C:\Users\Admin\AppData\Local\Temp\F316.tmp"94⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\F364.tmp"C:\Users\Admin\AppData\Local\Temp\F364.tmp"95⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\F3A2.tmp"C:\Users\Admin\AppData\Local\Temp\F3A2.tmp"96⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\F3E0.tmp"C:\Users\Admin\AppData\Local\Temp\F3E0.tmp"97⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\F41F.tmp"C:\Users\Admin\AppData\Local\Temp\F41F.tmp"98⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\F45D.tmp"C:\Users\Admin\AppData\Local\Temp\F45D.tmp"99⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\F4AB.tmp"C:\Users\Admin\AppData\Local\Temp\F4AB.tmp"100⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\F4F9.tmp"C:\Users\Admin\AppData\Local\Temp\F4F9.tmp"101⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\F538.tmp"C:\Users\Admin\AppData\Local\Temp\F538.tmp"102⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\F576.tmp"C:\Users\Admin\AppData\Local\Temp\F576.tmp"103⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\F5B4.tmp"C:\Users\Admin\AppData\Local\Temp\F5B4.tmp"104⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\F5F3.tmp"C:\Users\Admin\AppData\Local\Temp\F5F3.tmp"105⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\F631.tmp"C:\Users\Admin\AppData\Local\Temp\F631.tmp"106⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\F670.tmp"C:\Users\Admin\AppData\Local\Temp\F670.tmp"107⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\F6AE.tmp"C:\Users\Admin\AppData\Local\Temp\F6AE.tmp"108⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\F6EC.tmp"C:\Users\Admin\AppData\Local\Temp\F6EC.tmp"109⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\F72B.tmp"C:\Users\Admin\AppData\Local\Temp\F72B.tmp"110⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\F769.tmp"C:\Users\Admin\AppData\Local\Temp\F769.tmp"111⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\F7A8.tmp"C:\Users\Admin\AppData\Local\Temp\F7A8.tmp"112⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\F7E6.tmp"C:\Users\Admin\AppData\Local\Temp\F7E6.tmp"113⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\F824.tmp"C:\Users\Admin\AppData\Local\Temp\F824.tmp"114⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\F863.tmp"C:\Users\Admin\AppData\Local\Temp\F863.tmp"115⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\F8A1.tmp"C:\Users\Admin\AppData\Local\Temp\F8A1.tmp"116⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\F8E0.tmp"C:\Users\Admin\AppData\Local\Temp\F8E0.tmp"117⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\F91E.tmp"C:\Users\Admin\AppData\Local\Temp\F91E.tmp"118⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\F95C.tmp"C:\Users\Admin\AppData\Local\Temp\F95C.tmp"119⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\F99B.tmp"C:\Users\Admin\AppData\Local\Temp\F99B.tmp"120⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\F9D9.tmp"C:\Users\Admin\AppData\Local\Temp\F9D9.tmp"121⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\FA18.tmp"C:\Users\Admin\AppData\Local\Temp\FA18.tmp"122⤵PID:2984
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-