Analysis
-
max time kernel
150s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
19/08/2024, 06:48
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-19_3d15babec5bca13972f3b2674aeec2da_mafia.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2024-08-19_3d15babec5bca13972f3b2674aeec2da_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-19_3d15babec5bca13972f3b2674aeec2da_mafia.exe
-
Size
536KB
-
MD5
3d15babec5bca13972f3b2674aeec2da
-
SHA1
72017a0995e20fb22cdbbc7455a734353ab5ff60
-
SHA256
00036c821301c4e76f3855d14cb2bf1d7e95369bbc3fa2385c8e25a0b2e5512a
-
SHA512
d127715027b77ffc915dd6f41501f18e81f0e8382801fb49867902cbddb597ccb2aabc9a77d33cbfbae54c7e5ca30844710672c14bada6df39ea4a18f2139ead
-
SSDEEP
12288:wU5rCOTeiUrijJ1458R/Nl3Pdcr2hIZxVJ0ZT9:wUQOJUreH458R/3bhIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 980 7742.tmp 1924 77DE.tmp 976 788A.tmp 2024 7907.tmp 1348 79A3.tmp 2316 7A3F.tmp 2732 7AEA.tmp 1044 7B86.tmp 2508 7C03.tmp 2616 7C70.tmp 2512 7D3B.tmp 1648 7DB8.tmp 1744 7E06.tmp 2456 7E44.tmp 2960 7E92.tmp 2824 7F9B.tmp 2936 8047.tmp 2588 80E3.tmp 2144 817F.tmp 752 820B.tmp 1672 8298.tmp 2056 8324.tmp 3008 83C0.tmp 2368 840E.tmp 2152 845C.tmp 704 84AA.tmp 2044 8517.tmp 1876 8575.tmp 1448 85D3.tmp 2036 864F.tmp 320 86AD.tmp 536 870B.tmp 1088 8787.tmp 1632 87E5.tmp 2020 8852.tmp 284 88B0.tmp 1576 88FE.tmp 3052 894C.tmp 2220 898A.tmp 612 89C9.tmp 332 8A17.tmp 2004 8A74.tmp 2988 8AC2.tmp 2592 8B01.tmp 2612 8B3F.tmp 2752 8B7D.tmp 3012 8BCB.tmp 2788 8C0A.tmp 2996 8C48.tmp 836 8CA6.tmp 2796 8CF4.tmp 852 8D42.tmp 2760 8D80.tmp 2840 8DCE.tmp 2980 8E1C.tmp 2456 8E5B.tmp 2200 8EA9.tmp 3068 8EF7.tmp 2900 8F35.tmp 2712 8F73.tmp 2936 8FB2.tmp 1420 9000.tmp 1796 903E.tmp 552 908C.tmp -
Loads dropped DLL 64 IoCs
pid Process 2244 2024-08-19_3d15babec5bca13972f3b2674aeec2da_mafia.exe 980 7742.tmp 1924 77DE.tmp 976 788A.tmp 2024 7907.tmp 1348 79A3.tmp 2316 7A3F.tmp 2732 7AEA.tmp 1044 7B86.tmp 2508 7C03.tmp 2616 7C70.tmp 2512 7D3B.tmp 1648 7DB8.tmp 1744 7E06.tmp 2456 7E44.tmp 2960 7E92.tmp 2824 7F9B.tmp 2936 8047.tmp 2588 80E3.tmp 2144 817F.tmp 752 820B.tmp 1672 8298.tmp 2056 8324.tmp 3008 83C0.tmp 2368 840E.tmp 2152 845C.tmp 704 84AA.tmp 2044 8517.tmp 1876 8575.tmp 1448 85D3.tmp 2036 864F.tmp 320 86AD.tmp 536 870B.tmp 1088 8787.tmp 1632 87E5.tmp 2020 8852.tmp 284 88B0.tmp 1576 88FE.tmp 3052 894C.tmp 2220 898A.tmp 612 89C9.tmp 332 8A17.tmp 2004 8A74.tmp 2988 8AC2.tmp 2592 8B01.tmp 2612 8B3F.tmp 2752 8B7D.tmp 3012 8BCB.tmp 2788 8C0A.tmp 2996 8C48.tmp 836 8CA6.tmp 2796 8CF4.tmp 852 8D42.tmp 2760 8D80.tmp 2840 8DCE.tmp 2980 8E1C.tmp 2456 8E5B.tmp 2200 8EA9.tmp 3068 8EF7.tmp 2900 8F35.tmp 2712 8F73.tmp 2936 8FB2.tmp 1420 9000.tmp 1796 903E.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6548.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4644.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B107.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C0A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A39F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1333.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C246.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDBB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7935.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F72B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2244 wrote to memory of 980 2244 2024-08-19_3d15babec5bca13972f3b2674aeec2da_mafia.exe 29 PID 2244 wrote to memory of 980 2244 2024-08-19_3d15babec5bca13972f3b2674aeec2da_mafia.exe 29 PID 2244 wrote to memory of 980 2244 2024-08-19_3d15babec5bca13972f3b2674aeec2da_mafia.exe 29 PID 2244 wrote to memory of 980 2244 2024-08-19_3d15babec5bca13972f3b2674aeec2da_mafia.exe 29 PID 980 wrote to memory of 1924 980 7742.tmp 30 PID 980 wrote to memory of 1924 980 7742.tmp 30 PID 980 wrote to memory of 1924 980 7742.tmp 30 PID 980 wrote to memory of 1924 980 7742.tmp 30 PID 1924 wrote to memory of 976 1924 77DE.tmp 31 PID 1924 wrote to memory of 976 1924 77DE.tmp 31 PID 1924 wrote to memory of 976 1924 77DE.tmp 31 PID 1924 wrote to memory of 976 1924 77DE.tmp 31 PID 976 wrote to memory of 2024 976 788A.tmp 32 PID 976 wrote to memory of 2024 976 788A.tmp 32 PID 976 wrote to memory of 2024 976 788A.tmp 32 PID 976 wrote to memory of 2024 976 788A.tmp 32 PID 2024 wrote to memory of 1348 2024 7907.tmp 33 PID 2024 wrote to memory of 1348 2024 7907.tmp 33 PID 2024 wrote to memory of 1348 2024 7907.tmp 33 PID 2024 wrote to memory of 1348 2024 7907.tmp 33 PID 1348 wrote to memory of 2316 1348 79A3.tmp 34 PID 1348 wrote to memory of 2316 1348 79A3.tmp 34 PID 1348 wrote to memory of 2316 1348 79A3.tmp 34 PID 1348 wrote to memory of 2316 1348 79A3.tmp 34 PID 2316 wrote to memory of 2732 2316 7A3F.tmp 35 PID 2316 wrote to memory of 2732 2316 7A3F.tmp 35 PID 2316 wrote to memory of 2732 2316 7A3F.tmp 35 PID 2316 wrote to memory of 2732 2316 7A3F.tmp 35 PID 2732 wrote to memory of 1044 2732 7AEA.tmp 36 PID 2732 wrote to memory of 1044 2732 7AEA.tmp 36 PID 2732 wrote to memory of 1044 2732 7AEA.tmp 36 PID 2732 wrote to memory of 1044 2732 7AEA.tmp 36 PID 1044 wrote to memory of 2508 1044 7B86.tmp 37 PID 1044 wrote to memory of 2508 1044 7B86.tmp 37 PID 1044 wrote to memory of 2508 1044 7B86.tmp 37 PID 1044 wrote to memory of 2508 1044 7B86.tmp 37 PID 2508 wrote to memory of 2616 2508 7C03.tmp 38 PID 2508 wrote to memory of 2616 2508 7C03.tmp 38 PID 2508 wrote to memory of 2616 2508 7C03.tmp 38 PID 2508 wrote to memory of 2616 2508 7C03.tmp 38 PID 2616 wrote to memory of 2512 2616 7C70.tmp 39 PID 2616 wrote to memory of 2512 2616 7C70.tmp 39 PID 2616 wrote to memory of 2512 2616 7C70.tmp 39 PID 2616 wrote to memory of 2512 2616 7C70.tmp 39 PID 2512 wrote to memory of 1648 2512 7D3B.tmp 40 PID 2512 wrote to memory of 1648 2512 7D3B.tmp 40 PID 2512 wrote to memory of 1648 2512 7D3B.tmp 40 PID 2512 wrote to memory of 1648 2512 7D3B.tmp 40 PID 1648 wrote to memory of 1744 1648 7DB8.tmp 41 PID 1648 wrote to memory of 1744 1648 7DB8.tmp 41 PID 1648 wrote to memory of 1744 1648 7DB8.tmp 41 PID 1648 wrote to memory of 1744 1648 7DB8.tmp 41 PID 1744 wrote to memory of 2456 1744 7E06.tmp 42 PID 1744 wrote to memory of 2456 1744 7E06.tmp 42 PID 1744 wrote to memory of 2456 1744 7E06.tmp 42 PID 1744 wrote to memory of 2456 1744 7E06.tmp 42 PID 2456 wrote to memory of 2960 2456 7E44.tmp 43 PID 2456 wrote to memory of 2960 2456 7E44.tmp 43 PID 2456 wrote to memory of 2960 2456 7E44.tmp 43 PID 2456 wrote to memory of 2960 2456 7E44.tmp 43 PID 2960 wrote to memory of 2824 2960 7E92.tmp 44 PID 2960 wrote to memory of 2824 2960 7E92.tmp 44 PID 2960 wrote to memory of 2824 2960 7E92.tmp 44 PID 2960 wrote to memory of 2824 2960 7E92.tmp 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-19_3d15babec5bca13972f3b2674aeec2da_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-19_3d15babec5bca13972f3b2674aeec2da_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\7742.tmp"C:\Users\Admin\AppData\Local\Temp\7742.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Users\Admin\AppData\Local\Temp\77DE.tmp"C:\Users\Admin\AppData\Local\Temp\77DE.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\788A.tmp"C:\Users\Admin\AppData\Local\Temp\788A.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Users\Admin\AppData\Local\Temp\7907.tmp"C:\Users\Admin\AppData\Local\Temp\7907.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\79A3.tmp"C:\Users\Admin\AppData\Local\Temp\79A3.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\7A3F.tmp"C:\Users\Admin\AppData\Local\Temp\7A3F.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\7AEA.tmp"C:\Users\Admin\AppData\Local\Temp\7AEA.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\7B86.tmp"C:\Users\Admin\AppData\Local\Temp\7B86.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\7C03.tmp"C:\Users\Admin\AppData\Local\Temp\7C03.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\7C70.tmp"C:\Users\Admin\AppData\Local\Temp\7C70.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\7D3B.tmp"C:\Users\Admin\AppData\Local\Temp\7D3B.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\7DB8.tmp"C:\Users\Admin\AppData\Local\Temp\7DB8.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\7E06.tmp"C:\Users\Admin\AppData\Local\Temp\7E06.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\7E44.tmp"C:\Users\Admin\AppData\Local\Temp\7E44.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\7E92.tmp"C:\Users\Admin\AppData\Local\Temp\7E92.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\7F9B.tmp"C:\Users\Admin\AppData\Local\Temp\7F9B.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\8047.tmp"C:\Users\Admin\AppData\Local\Temp\8047.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\80E3.tmp"C:\Users\Admin\AppData\Local\Temp\80E3.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\817F.tmp"C:\Users\Admin\AppData\Local\Temp\817F.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\820B.tmp"C:\Users\Admin\AppData\Local\Temp\820B.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:752 -
C:\Users\Admin\AppData\Local\Temp\8298.tmp"C:\Users\Admin\AppData\Local\Temp\8298.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\8324.tmp"C:\Users\Admin\AppData\Local\Temp\8324.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\83C0.tmp"C:\Users\Admin\AppData\Local\Temp\83C0.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\840E.tmp"C:\Users\Admin\AppData\Local\Temp\840E.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\845C.tmp"C:\Users\Admin\AppData\Local\Temp\845C.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\84AA.tmp"C:\Users\Admin\AppData\Local\Temp\84AA.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:704 -
C:\Users\Admin\AppData\Local\Temp\8517.tmp"C:\Users\Admin\AppData\Local\Temp\8517.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\8575.tmp"C:\Users\Admin\AppData\Local\Temp\8575.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\85D3.tmp"C:\Users\Admin\AppData\Local\Temp\85D3.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\864F.tmp"C:\Users\Admin\AppData\Local\Temp\864F.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\86AD.tmp"C:\Users\Admin\AppData\Local\Temp\86AD.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:320 -
C:\Users\Admin\AppData\Local\Temp\870B.tmp"C:\Users\Admin\AppData\Local\Temp\870B.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:536 -
C:\Users\Admin\AppData\Local\Temp\8787.tmp"C:\Users\Admin\AppData\Local\Temp\8787.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\87E5.tmp"C:\Users\Admin\AppData\Local\Temp\87E5.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\8852.tmp"C:\Users\Admin\AppData\Local\Temp\8852.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\88B0.tmp"C:\Users\Admin\AppData\Local\Temp\88B0.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:284 -
C:\Users\Admin\AppData\Local\Temp\88FE.tmp"C:\Users\Admin\AppData\Local\Temp\88FE.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\894C.tmp"C:\Users\Admin\AppData\Local\Temp\894C.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\898A.tmp"C:\Users\Admin\AppData\Local\Temp\898A.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\89C9.tmp"C:\Users\Admin\AppData\Local\Temp\89C9.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:612 -
C:\Users\Admin\AppData\Local\Temp\8A17.tmp"C:\Users\Admin\AppData\Local\Temp\8A17.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:332 -
C:\Users\Admin\AppData\Local\Temp\8A74.tmp"C:\Users\Admin\AppData\Local\Temp\8A74.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\8AC2.tmp"C:\Users\Admin\AppData\Local\Temp\8AC2.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\8B01.tmp"C:\Users\Admin\AppData\Local\Temp\8B01.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\8B3F.tmp"C:\Users\Admin\AppData\Local\Temp\8B3F.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\8BCB.tmp"C:\Users\Admin\AppData\Local\Temp\8BCB.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\8C0A.tmp"C:\Users\Admin\AppData\Local\Temp\8C0A.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\8C48.tmp"C:\Users\Admin\AppData\Local\Temp\8C48.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\8CA6.tmp"C:\Users\Admin\AppData\Local\Temp\8CA6.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:836 -
C:\Users\Admin\AppData\Local\Temp\8CF4.tmp"C:\Users\Admin\AppData\Local\Temp\8CF4.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\8D42.tmp"C:\Users\Admin\AppData\Local\Temp\8D42.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:852 -
C:\Users\Admin\AppData\Local\Temp\8D80.tmp"C:\Users\Admin\AppData\Local\Temp\8D80.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\8DCE.tmp"C:\Users\Admin\AppData\Local\Temp\8DCE.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\8E1C.tmp"C:\Users\Admin\AppData\Local\Temp\8E1C.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\8E5B.tmp"C:\Users\Admin\AppData\Local\Temp\8E5B.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\8EA9.tmp"C:\Users\Admin\AppData\Local\Temp\8EA9.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\8EF7.tmp"C:\Users\Admin\AppData\Local\Temp\8EF7.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\8F35.tmp"C:\Users\Admin\AppData\Local\Temp\8F35.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\8F73.tmp"C:\Users\Admin\AppData\Local\Temp\8F73.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\8FB2.tmp"C:\Users\Admin\AppData\Local\Temp\8FB2.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\9000.tmp"C:\Users\Admin\AppData\Local\Temp\9000.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\903E.tmp"C:\Users\Admin\AppData\Local\Temp\903E.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\908C.tmp"C:\Users\Admin\AppData\Local\Temp\908C.tmp"65⤵
- Executes dropped EXE
PID:552 -
C:\Users\Admin\AppData\Local\Temp\90CB.tmp"C:\Users\Admin\AppData\Local\Temp\90CB.tmp"66⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\9119.tmp"C:\Users\Admin\AppData\Local\Temp\9119.tmp"67⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\9157.tmp"C:\Users\Admin\AppData\Local\Temp\9157.tmp"68⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\9195.tmp"C:\Users\Admin\AppData\Local\Temp\9195.tmp"69⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\91E3.tmp"C:\Users\Admin\AppData\Local\Temp\91E3.tmp"70⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\9231.tmp"C:\Users\Admin\AppData\Local\Temp\9231.tmp"71⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\9270.tmp"C:\Users\Admin\AppData\Local\Temp\9270.tmp"72⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\92AE.tmp"C:\Users\Admin\AppData\Local\Temp\92AE.tmp"73⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\92ED.tmp"C:\Users\Admin\AppData\Local\Temp\92ED.tmp"74⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\932B.tmp"C:\Users\Admin\AppData\Local\Temp\932B.tmp"75⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\9379.tmp"C:\Users\Admin\AppData\Local\Temp\9379.tmp"76⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\93C7.tmp"C:\Users\Admin\AppData\Local\Temp\93C7.tmp"77⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\9405.tmp"C:\Users\Admin\AppData\Local\Temp\9405.tmp"78⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\9453.tmp"C:\Users\Admin\AppData\Local\Temp\9453.tmp"79⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\94B1.tmp"C:\Users\Admin\AppData\Local\Temp\94B1.tmp"80⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\94EF.tmp"C:\Users\Admin\AppData\Local\Temp\94EF.tmp"81⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\952E.tmp"C:\Users\Admin\AppData\Local\Temp\952E.tmp"82⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\956C.tmp"C:\Users\Admin\AppData\Local\Temp\956C.tmp"83⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\95AB.tmp"C:\Users\Admin\AppData\Local\Temp\95AB.tmp"84⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\95E9.tmp"C:\Users\Admin\AppData\Local\Temp\95E9.tmp"85⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\9627.tmp"C:\Users\Admin\AppData\Local\Temp\9627.tmp"86⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\9675.tmp"C:\Users\Admin\AppData\Local\Temp\9675.tmp"87⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\96B4.tmp"C:\Users\Admin\AppData\Local\Temp\96B4.tmp"88⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\9702.tmp"C:\Users\Admin\AppData\Local\Temp\9702.tmp"89⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\9740.tmp"C:\Users\Admin\AppData\Local\Temp\9740.tmp"90⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\977F.tmp"C:\Users\Admin\AppData\Local\Temp\977F.tmp"91⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\97BD.tmp"C:\Users\Admin\AppData\Local\Temp\97BD.tmp"92⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\980B.tmp"C:\Users\Admin\AppData\Local\Temp\980B.tmp"93⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\9859.tmp"C:\Users\Admin\AppData\Local\Temp\9859.tmp"94⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\9897.tmp"C:\Users\Admin\AppData\Local\Temp\9897.tmp"95⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\98E5.tmp"C:\Users\Admin\AppData\Local\Temp\98E5.tmp"96⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\9924.tmp"C:\Users\Admin\AppData\Local\Temp\9924.tmp"97⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\9962.tmp"C:\Users\Admin\AppData\Local\Temp\9962.tmp"98⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\99A1.tmp"C:\Users\Admin\AppData\Local\Temp\99A1.tmp"99⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\99EF.tmp"C:\Users\Admin\AppData\Local\Temp\99EF.tmp"100⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\9A3D.tmp"C:\Users\Admin\AppData\Local\Temp\9A3D.tmp"101⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"102⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"103⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"104⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"105⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"106⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"107⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\9C01.tmp"C:\Users\Admin\AppData\Local\Temp\9C01.tmp"108⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\9C3F.tmp"C:\Users\Admin\AppData\Local\Temp\9C3F.tmp"109⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"110⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\9CBC.tmp"C:\Users\Admin\AppData\Local\Temp\9CBC.tmp"111⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"112⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\9D39.tmp"C:\Users\Admin\AppData\Local\Temp\9D39.tmp"113⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\9D77.tmp"C:\Users\Admin\AppData\Local\Temp\9D77.tmp"114⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\9DB6.tmp"C:\Users\Admin\AppData\Local\Temp\9DB6.tmp"115⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\9DF4.tmp"C:\Users\Admin\AppData\Local\Temp\9DF4.tmp"116⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\9E61.tmp"C:\Users\Admin\AppData\Local\Temp\9E61.tmp"117⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\9EA0.tmp"C:\Users\Admin\AppData\Local\Temp\9EA0.tmp"118⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\9EDE.tmp"C:\Users\Admin\AppData\Local\Temp\9EDE.tmp"119⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\9F1D.tmp"C:\Users\Admin\AppData\Local\Temp\9F1D.tmp"120⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\9F5B.tmp"C:\Users\Admin\AppData\Local\Temp\9F5B.tmp"121⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\9FA9.tmp"C:\Users\Admin\AppData\Local\Temp\9FA9.tmp"122⤵PID:3008
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-