Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
09-08-2024 22:41
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-09_ce16ddfe933cba38903664ce754051d7_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-08-09_ce16ddfe933cba38903664ce754051d7_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-09_ce16ddfe933cba38903664ce754051d7_mafia.exe
-
Size
520KB
-
MD5
ce16ddfe933cba38903664ce754051d7
-
SHA1
39b038441d32815a3a3905de9240f02b1f3f6b36
-
SHA256
88c43fbcea3a4bbf93ba9ffac19774ff8162d245aceb61da740be2cdc4b3e722
-
SHA512
e6f1a028bf0d6dbb113af3ecbd2ef7b49604c1174a14029a35b41d479d95ecb39f965143c40fb30387450d9845bbd1ac3d92857492503dd171024abf1742f863
-
SSDEEP
6144:lLvd/XzCjUIF1UuXLyQjmOH+JjLJGIvO6xTHMQyDv5vyWBKq/m8Fpk8doZwtRhQs:roRXOQjmOy5zjMToQxFpGC2Nkx9NZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1676 CCB1.tmp 2512 CD3E.tmp 1992 CDAB.tmp 1284 CE09.tmp 2280 CE76.tmp 2716 CEF3.tmp 1812 CF60.tmp 2884 CFBD.tmp 3036 D02B.tmp 2780 D088.tmp 2620 D105.tmp 2732 D172.tmp 2456 D1DF.tmp 2904 D23D.tmp 1628 D2BA.tmp 2596 D308.tmp 2932 D385.tmp 2984 D401.tmp 1624 D47E.tmp 2508 D4DC.tmp 616 D559.tmp 3068 D5A7.tmp 2792 D604.tmp 2648 D643.tmp 2128 D681.tmp 2124 D6BF.tmp 2492 D6FE.tmp 1512 D73C.tmp 2184 D77B.tmp 1124 D7B9.tmp 3020 D7F7.tmp 892 D836.tmp 1360 D874.tmp 2452 D8B3.tmp 1996 D8F1.tmp 1972 D92F.tmp 1320 D96E.tmp 880 D9AC.tmp 1160 D9EB.tmp 2208 DA29.tmp 768 DA67.tmp 2120 DAB5.tmp 2244 DAF4.tmp 1788 DB42.tmp 2268 DB80.tmp 2196 DBBF.tmp 1044 DBFD.tmp 324 DC3B.tmp 1732 DC7A.tmp 1048 DCB8.tmp 1780 DCF7.tmp 2892 DD35.tmp 1704 DD73.tmp 1676 DDB2.tmp 1944 DDF0.tmp 1588 DE2F.tmp 1984 DE6D.tmp 1620 DEAC.tmp 608 DEEA.tmp 2280 DF28.tmp 2616 DF76.tmp 2864 DFB5.tmp 2804 DFF3.tmp 2844 E032.tmp -
Loads dropped DLL 64 IoCs
pid Process 1288 2024-08-09_ce16ddfe933cba38903664ce754051d7_mafia.exe 1676 CCB1.tmp 2512 CD3E.tmp 1992 CDAB.tmp 1284 CE09.tmp 2280 CE76.tmp 2716 CEF3.tmp 1812 CF60.tmp 2884 CFBD.tmp 3036 D02B.tmp 2780 D088.tmp 2620 D105.tmp 2732 D172.tmp 2456 D1DF.tmp 2904 D23D.tmp 1628 D2BA.tmp 2596 D308.tmp 2932 D385.tmp 2984 D401.tmp 1624 D47E.tmp 2508 D4DC.tmp 616 D559.tmp 3068 D5A7.tmp 2792 D604.tmp 2648 D643.tmp 2128 D681.tmp 2124 D6BF.tmp 2492 D6FE.tmp 1512 D73C.tmp 2184 D77B.tmp 1124 D7B9.tmp 3020 D7F7.tmp 892 D836.tmp 1360 D874.tmp 2452 D8B3.tmp 1996 D8F1.tmp 1972 D92F.tmp 1320 D96E.tmp 880 D9AC.tmp 1160 D9EB.tmp 2208 DA29.tmp 768 DA67.tmp 2120 DAB5.tmp 2244 DAF4.tmp 1788 DB42.tmp 2268 DB80.tmp 2196 DBBF.tmp 1044 DBFD.tmp 324 DC3B.tmp 1732 DC7A.tmp 1048 DCB8.tmp 1780 DCF7.tmp 2892 DD35.tmp 1704 DD73.tmp 1676 DDB2.tmp 1944 DDF0.tmp 1588 DE2F.tmp 1984 DE6D.tmp 1620 DEAC.tmp 608 DEEA.tmp 2280 DF28.tmp 2616 DF76.tmp 2864 DFB5.tmp 2804 DFF3.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2202.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 280.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FD0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 515B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C67A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E89A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1AF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3006.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-08-09_ce16ddfe933cba38903664ce754051d7_mafia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 703.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C82F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ADD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 686.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D96.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3044.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 538C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D58.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B693.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9FD8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1288 wrote to memory of 1676 1288 2024-08-09_ce16ddfe933cba38903664ce754051d7_mafia.exe 30 PID 1288 wrote to memory of 1676 1288 2024-08-09_ce16ddfe933cba38903664ce754051d7_mafia.exe 30 PID 1288 wrote to memory of 1676 1288 2024-08-09_ce16ddfe933cba38903664ce754051d7_mafia.exe 30 PID 1288 wrote to memory of 1676 1288 2024-08-09_ce16ddfe933cba38903664ce754051d7_mafia.exe 30 PID 1676 wrote to memory of 2512 1676 CCB1.tmp 31 PID 1676 wrote to memory of 2512 1676 CCB1.tmp 31 PID 1676 wrote to memory of 2512 1676 CCB1.tmp 31 PID 1676 wrote to memory of 2512 1676 CCB1.tmp 31 PID 2512 wrote to memory of 1992 2512 CD3E.tmp 32 PID 2512 wrote to memory of 1992 2512 CD3E.tmp 32 PID 2512 wrote to memory of 1992 2512 CD3E.tmp 32 PID 2512 wrote to memory of 1992 2512 CD3E.tmp 32 PID 1992 wrote to memory of 1284 1992 CDAB.tmp 33 PID 1992 wrote to memory of 1284 1992 CDAB.tmp 33 PID 1992 wrote to memory of 1284 1992 CDAB.tmp 33 PID 1992 wrote to memory of 1284 1992 CDAB.tmp 33 PID 1284 wrote to memory of 2280 1284 CE09.tmp 34 PID 1284 wrote to memory of 2280 1284 CE09.tmp 34 PID 1284 wrote to memory of 2280 1284 CE09.tmp 34 PID 1284 wrote to memory of 2280 1284 CE09.tmp 34 PID 2280 wrote to memory of 2716 2280 CE76.tmp 35 PID 2280 wrote to memory of 2716 2280 CE76.tmp 35 PID 2280 wrote to memory of 2716 2280 CE76.tmp 35 PID 2280 wrote to memory of 2716 2280 CE76.tmp 35 PID 2716 wrote to memory of 1812 2716 CEF3.tmp 37 PID 2716 wrote to memory of 1812 2716 CEF3.tmp 37 PID 2716 wrote to memory of 1812 2716 CEF3.tmp 37 PID 2716 wrote to memory of 1812 2716 CEF3.tmp 37 PID 1812 wrote to memory of 2884 1812 CF60.tmp 38 PID 1812 wrote to memory of 2884 1812 CF60.tmp 38 PID 1812 wrote to memory of 2884 1812 CF60.tmp 38 PID 1812 wrote to memory of 2884 1812 CF60.tmp 38 PID 2884 wrote to memory of 3036 2884 CFBD.tmp 39 PID 2884 wrote to memory of 3036 2884 CFBD.tmp 39 PID 2884 wrote to memory of 3036 2884 CFBD.tmp 39 PID 2884 wrote to memory of 3036 2884 CFBD.tmp 39 PID 3036 wrote to memory of 2780 3036 D02B.tmp 40 PID 3036 wrote to memory of 2780 3036 D02B.tmp 40 PID 3036 wrote to memory of 2780 3036 D02B.tmp 40 PID 3036 wrote to memory of 2780 3036 D02B.tmp 40 PID 2780 wrote to memory of 2620 2780 D088.tmp 41 PID 2780 wrote to memory of 2620 2780 D088.tmp 41 PID 2780 wrote to memory of 2620 2780 D088.tmp 41 PID 2780 wrote to memory of 2620 2780 D088.tmp 41 PID 2620 wrote to memory of 2732 2620 D105.tmp 42 PID 2620 wrote to memory of 2732 2620 D105.tmp 42 PID 2620 wrote to memory of 2732 2620 D105.tmp 42 PID 2620 wrote to memory of 2732 2620 D105.tmp 42 PID 2732 wrote to memory of 2456 2732 D172.tmp 43 PID 2732 wrote to memory of 2456 2732 D172.tmp 43 PID 2732 wrote to memory of 2456 2732 D172.tmp 43 PID 2732 wrote to memory of 2456 2732 D172.tmp 43 PID 2456 wrote to memory of 2904 2456 D1DF.tmp 44 PID 2456 wrote to memory of 2904 2456 D1DF.tmp 44 PID 2456 wrote to memory of 2904 2456 D1DF.tmp 44 PID 2456 wrote to memory of 2904 2456 D1DF.tmp 44 PID 2904 wrote to memory of 1628 2904 D23D.tmp 45 PID 2904 wrote to memory of 1628 2904 D23D.tmp 45 PID 2904 wrote to memory of 1628 2904 D23D.tmp 45 PID 2904 wrote to memory of 1628 2904 D23D.tmp 45 PID 1628 wrote to memory of 2596 1628 D2BA.tmp 46 PID 1628 wrote to memory of 2596 1628 D2BA.tmp 46 PID 1628 wrote to memory of 2596 1628 D2BA.tmp 46 PID 1628 wrote to memory of 2596 1628 D2BA.tmp 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-09_ce16ddfe933cba38903664ce754051d7_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-09_ce16ddfe933cba38903664ce754051d7_mafia.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\CCB1.tmp"C:\Users\Admin\AppData\Local\Temp\CCB1.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\CD3E.tmp"C:\Users\Admin\AppData\Local\Temp\CD3E.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\CDAB.tmp"C:\Users\Admin\AppData\Local\Temp\CDAB.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\CE09.tmp"C:\Users\Admin\AppData\Local\Temp\CE09.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\CE76.tmp"C:\Users\Admin\AppData\Local\Temp\CE76.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\CEF3.tmp"C:\Users\Admin\AppData\Local\Temp\CEF3.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\CF60.tmp"C:\Users\Admin\AppData\Local\Temp\CF60.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\CFBD.tmp"C:\Users\Admin\AppData\Local\Temp\CFBD.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\D02B.tmp"C:\Users\Admin\AppData\Local\Temp\D02B.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\D088.tmp"C:\Users\Admin\AppData\Local\Temp\D088.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\D105.tmp"C:\Users\Admin\AppData\Local\Temp\D105.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\D172.tmp"C:\Users\Admin\AppData\Local\Temp\D172.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\D1DF.tmp"C:\Users\Admin\AppData\Local\Temp\D1DF.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\D23D.tmp"C:\Users\Admin\AppData\Local\Temp\D23D.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\D2BA.tmp"C:\Users\Admin\AppData\Local\Temp\D2BA.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\D308.tmp"C:\Users\Admin\AppData\Local\Temp\D308.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\D385.tmp"C:\Users\Admin\AppData\Local\Temp\D385.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\D401.tmp"C:\Users\Admin\AppData\Local\Temp\D401.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\D47E.tmp"C:\Users\Admin\AppData\Local\Temp\D47E.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\D4DC.tmp"C:\Users\Admin\AppData\Local\Temp\D4DC.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\D559.tmp"C:\Users\Admin\AppData\Local\Temp\D559.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:616 -
C:\Users\Admin\AppData\Local\Temp\D5A7.tmp"C:\Users\Admin\AppData\Local\Temp\D5A7.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\D604.tmp"C:\Users\Admin\AppData\Local\Temp\D604.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\D643.tmp"C:\Users\Admin\AppData\Local\Temp\D643.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\D681.tmp"C:\Users\Admin\AppData\Local\Temp\D681.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\D6BF.tmp"C:\Users\Admin\AppData\Local\Temp\D6BF.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\D6FE.tmp"C:\Users\Admin\AppData\Local\Temp\D6FE.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\D73C.tmp"C:\Users\Admin\AppData\Local\Temp\D73C.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\D77B.tmp"C:\Users\Admin\AppData\Local\Temp\D77B.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\D7B9.tmp"C:\Users\Admin\AppData\Local\Temp\D7B9.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\D7F7.tmp"C:\Users\Admin\AppData\Local\Temp\D7F7.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\D836.tmp"C:\Users\Admin\AppData\Local\Temp\D836.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:892 -
C:\Users\Admin\AppData\Local\Temp\D874.tmp"C:\Users\Admin\AppData\Local\Temp\D874.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\D8B3.tmp"C:\Users\Admin\AppData\Local\Temp\D8B3.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\D8F1.tmp"C:\Users\Admin\AppData\Local\Temp\D8F1.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\D92F.tmp"C:\Users\Admin\AppData\Local\Temp\D92F.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\D96E.tmp"C:\Users\Admin\AppData\Local\Temp\D96E.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\D9AC.tmp"C:\Users\Admin\AppData\Local\Temp\D9AC.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:880 -
C:\Users\Admin\AppData\Local\Temp\D9EB.tmp"C:\Users\Admin\AppData\Local\Temp\D9EB.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\DA29.tmp"C:\Users\Admin\AppData\Local\Temp\DA29.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\DA67.tmp"C:\Users\Admin\AppData\Local\Temp\DA67.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:768 -
C:\Users\Admin\AppData\Local\Temp\DAB5.tmp"C:\Users\Admin\AppData\Local\Temp\DAB5.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\DAF4.tmp"C:\Users\Admin\AppData\Local\Temp\DAF4.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\DB42.tmp"C:\Users\Admin\AppData\Local\Temp\DB42.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\DB80.tmp"C:\Users\Admin\AppData\Local\Temp\DB80.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\DBBF.tmp"C:\Users\Admin\AppData\Local\Temp\DBBF.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\DBFD.tmp"C:\Users\Admin\AppData\Local\Temp\DBFD.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\DC3B.tmp"C:\Users\Admin\AppData\Local\Temp\DC3B.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:324 -
C:\Users\Admin\AppData\Local\Temp\DC7A.tmp"C:\Users\Admin\AppData\Local\Temp\DC7A.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\DCB8.tmp"C:\Users\Admin\AppData\Local\Temp\DCB8.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\DCF7.tmp"C:\Users\Admin\AppData\Local\Temp\DCF7.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\DD35.tmp"C:\Users\Admin\AppData\Local\Temp\DD35.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\DD73.tmp"C:\Users\Admin\AppData\Local\Temp\DD73.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\DDB2.tmp"C:\Users\Admin\AppData\Local\Temp\DDB2.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\DDF0.tmp"C:\Users\Admin\AppData\Local\Temp\DDF0.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\DE2F.tmp"C:\Users\Admin\AppData\Local\Temp\DE2F.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\DE6D.tmp"C:\Users\Admin\AppData\Local\Temp\DE6D.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\DEAC.tmp"C:\Users\Admin\AppData\Local\Temp\DEAC.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\DEEA.tmp"C:\Users\Admin\AppData\Local\Temp\DEEA.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:608 -
C:\Users\Admin\AppData\Local\Temp\DF28.tmp"C:\Users\Admin\AppData\Local\Temp\DF28.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\DF76.tmp"C:\Users\Admin\AppData\Local\Temp\DF76.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\DFB5.tmp"C:\Users\Admin\AppData\Local\Temp\DFB5.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\DFF3.tmp"C:\Users\Admin\AppData\Local\Temp\DFF3.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\E032.tmp"C:\Users\Admin\AppData\Local\Temp\E032.tmp"65⤵
- Executes dropped EXE
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\E070.tmp"C:\Users\Admin\AppData\Local\Temp\E070.tmp"66⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\E0AE.tmp"C:\Users\Admin\AppData\Local\Temp\E0AE.tmp"67⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\E0ED.tmp"C:\Users\Admin\AppData\Local\Temp\E0ED.tmp"68⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\E12B.tmp"C:\Users\Admin\AppData\Local\Temp\E12B.tmp"69⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\E16A.tmp"C:\Users\Admin\AppData\Local\Temp\E16A.tmp"70⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\E1A8.tmp"C:\Users\Admin\AppData\Local\Temp\E1A8.tmp"71⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\E1E6.tmp"C:\Users\Admin\AppData\Local\Temp\E1E6.tmp"72⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\E225.tmp"C:\Users\Admin\AppData\Local\Temp\E225.tmp"73⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\E263.tmp"C:\Users\Admin\AppData\Local\Temp\E263.tmp"74⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\E2A2.tmp"C:\Users\Admin\AppData\Local\Temp\E2A2.tmp"75⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\E2E0.tmp"C:\Users\Admin\AppData\Local\Temp\E2E0.tmp"76⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\E31E.tmp"C:\Users\Admin\AppData\Local\Temp\E31E.tmp"77⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\E35D.tmp"C:\Users\Admin\AppData\Local\Temp\E35D.tmp"78⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\E39B.tmp"C:\Users\Admin\AppData\Local\Temp\E39B.tmp"79⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\E3DA.tmp"C:\Users\Admin\AppData\Local\Temp\E3DA.tmp"80⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\E418.tmp"C:\Users\Admin\AppData\Local\Temp\E418.tmp"81⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\E456.tmp"C:\Users\Admin\AppData\Local\Temp\E456.tmp"82⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\E495.tmp"C:\Users\Admin\AppData\Local\Temp\E495.tmp"83⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\E4D3.tmp"C:\Users\Admin\AppData\Local\Temp\E4D3.tmp"84⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\E512.tmp"C:\Users\Admin\AppData\Local\Temp\E512.tmp"85⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\E550.tmp"C:\Users\Admin\AppData\Local\Temp\E550.tmp"86⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\E58E.tmp"C:\Users\Admin\AppData\Local\Temp\E58E.tmp"87⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\E5CD.tmp"C:\Users\Admin\AppData\Local\Temp\E5CD.tmp"88⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\E60B.tmp"C:\Users\Admin\AppData\Local\Temp\E60B.tmp"89⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\E64A.tmp"C:\Users\Admin\AppData\Local\Temp\E64A.tmp"90⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\E688.tmp"C:\Users\Admin\AppData\Local\Temp\E688.tmp"91⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\E6C6.tmp"C:\Users\Admin\AppData\Local\Temp\E6C6.tmp"92⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\E705.tmp"C:\Users\Admin\AppData\Local\Temp\E705.tmp"93⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\E743.tmp"C:\Users\Admin\AppData\Local\Temp\E743.tmp"94⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\E782.tmp"C:\Users\Admin\AppData\Local\Temp\E782.tmp"95⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\E7C0.tmp"C:\Users\Admin\AppData\Local\Temp\E7C0.tmp"96⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\E81E.tmp"C:\Users\Admin\AppData\Local\Temp\E81E.tmp"97⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\E85C.tmp"C:\Users\Admin\AppData\Local\Temp\E85C.tmp"98⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\E89A.tmp"C:\Users\Admin\AppData\Local\Temp\E89A.tmp"99⤵
- System Location Discovery: System Language Discovery
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\E8E8.tmp"C:\Users\Admin\AppData\Local\Temp\E8E8.tmp"100⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\E936.tmp"C:\Users\Admin\AppData\Local\Temp\E936.tmp"101⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\E975.tmp"C:\Users\Admin\AppData\Local\Temp\E975.tmp"102⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\E9C3.tmp"C:\Users\Admin\AppData\Local\Temp\E9C3.tmp"103⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\EA11.tmp"C:\Users\Admin\AppData\Local\Temp\EA11.tmp"104⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\EA4F.tmp"C:\Users\Admin\AppData\Local\Temp\EA4F.tmp"105⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\EA8E.tmp"C:\Users\Admin\AppData\Local\Temp\EA8E.tmp"106⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\EACC.tmp"C:\Users\Admin\AppData\Local\Temp\EACC.tmp"107⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\EB0A.tmp"C:\Users\Admin\AppData\Local\Temp\EB0A.tmp"108⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\EB49.tmp"C:\Users\Admin\AppData\Local\Temp\EB49.tmp"109⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\EB97.tmp"C:\Users\Admin\AppData\Local\Temp\EB97.tmp"110⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\EBD5.tmp"C:\Users\Admin\AppData\Local\Temp\EBD5.tmp"111⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\EC14.tmp"C:\Users\Admin\AppData\Local\Temp\EC14.tmp"112⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\EC52.tmp"C:\Users\Admin\AppData\Local\Temp\EC52.tmp"113⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\EC90.tmp"C:\Users\Admin\AppData\Local\Temp\EC90.tmp"114⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\ECCF.tmp"C:\Users\Admin\AppData\Local\Temp\ECCF.tmp"115⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\ED3C.tmp"C:\Users\Admin\AppData\Local\Temp\ED3C.tmp"116⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\ED7A.tmp"C:\Users\Admin\AppData\Local\Temp\ED7A.tmp"117⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\EDB9.tmp"C:\Users\Admin\AppData\Local\Temp\EDB9.tmp"118⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\EE07.tmp"C:\Users\Admin\AppData\Local\Temp\EE07.tmp"119⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\EE55.tmp"C:\Users\Admin\AppData\Local\Temp\EE55.tmp"120⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\EE93.tmp"C:\Users\Admin\AppData\Local\Temp\EE93.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\EED2.tmp"C:\Users\Admin\AppData\Local\Temp\EED2.tmp"122⤵PID:2888
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-