Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
21-08-2024 07:45
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-21_5577be6859f51e8dee9381bc07884c2a_mafia.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2024-08-21_5577be6859f51e8dee9381bc07884c2a_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-21_5577be6859f51e8dee9381bc07884c2a_mafia.exe
-
Size
488KB
-
MD5
5577be6859f51e8dee9381bc07884c2a
-
SHA1
006857e8c55e0bd28d30aec074e1e1b7c55212a0
-
SHA256
22c0bdc85da94d1d2f812a4e1135a952ac8d38707de7c99623d4610cc6c7757c
-
SHA512
f511c9d13413eeecc13d81d43b608ad793bcf7866425410639a84773c0b9d46b47fb780c9a661faf2fbbe667d7f5b16bf2375e536e6828b81c254354034b96cf
-
SSDEEP
12288:/U5rCOTeiDfmhCrlPh9XrcvhVMrSPdU/zBNZ:/UQOJD+4rl5BrcvfZPm/dN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2124 2491.tmp 2868 24DF.tmp 2020 256B.tmp 2836 25E8.tmp 2844 2655.tmp 2832 26C2.tmp 888 2710.tmp 2644 277E.tmp 1160 27DB.tmp 1676 2858.tmp 2400 28B6.tmp 2948 2932.tmp 2228 2980.tmp 3052 29EE.tmp 1672 2A4B.tmp 1004 2AA9.tmp 1928 2B06.tmp 316 2B74.tmp 1620 2BE1.tmp 2376 2C5E.tmp 1932 2CEA.tmp 796 2D67.tmp 1856 2DD4.tmp 2100 2E22.tmp 2224 2E60.tmp 2344 2E9F.tmp 2244 2EDD.tmp 3028 2F1C.tmp 2532 2F6A.tmp 1884 2FA8.tmp 1252 2FE6.tmp 768 3025.tmp 2040 3073.tmp 900 30B1.tmp 2028 30F0.tmp 1336 312E.tmp 1720 316C.tmp 1532 31AB.tmp 1740 31E9.tmp 2348 3228.tmp 1208 3266.tmp 2332 32B4.tmp 2328 3321.tmp 2464 3360.tmp 3048 33AE.tmp 1480 33EC.tmp 2444 343A.tmp 548 3478.tmp 2024 34B7.tmp 896 34F5.tmp 1704 3534.tmp 2432 3572.tmp 2672 35FE.tmp 2852 364C.tmp 2860 368B.tmp 3008 36C9.tmp 2276 3708.tmp 2888 3746.tmp 2836 3784.tmp 2744 37C3.tmp 2752 3801.tmp 2576 3840.tmp 2600 387E.tmp 2656 38BC.tmp -
Loads dropped DLL 64 IoCs
pid Process 2672 2024-08-21_5577be6859f51e8dee9381bc07884c2a_mafia.exe 2124 2491.tmp 2868 24DF.tmp 2020 256B.tmp 2836 25E8.tmp 2844 2655.tmp 2832 26C2.tmp 888 2710.tmp 2644 277E.tmp 1160 27DB.tmp 1676 2858.tmp 2400 28B6.tmp 2948 2932.tmp 2228 2980.tmp 3052 29EE.tmp 1672 2A4B.tmp 1004 2AA9.tmp 1928 2B06.tmp 316 2B74.tmp 1620 2BE1.tmp 2376 2C5E.tmp 1932 2CEA.tmp 796 2D67.tmp 1856 2DD4.tmp 2100 2E22.tmp 2224 2E60.tmp 2344 2E9F.tmp 2244 2EDD.tmp 3028 2F1C.tmp 2532 2F6A.tmp 1884 2FA8.tmp 1252 2FE6.tmp 768 3025.tmp 2040 3073.tmp 900 30B1.tmp 2028 30F0.tmp 1336 312E.tmp 1720 316C.tmp 1532 31AB.tmp 1740 31E9.tmp 2348 3228.tmp 1208 3266.tmp 2332 32B4.tmp 2328 3321.tmp 2464 3360.tmp 3048 33AE.tmp 1480 33EC.tmp 2444 343A.tmp 548 3478.tmp 2024 34B7.tmp 896 34F5.tmp 1704 3534.tmp 1716 35B0.tmp 2672 35FE.tmp 2852 364C.tmp 2860 368B.tmp 3008 36C9.tmp 2276 3708.tmp 2888 3746.tmp 2836 3784.tmp 2744 37C3.tmp 2752 3801.tmp 2576 3840.tmp 2600 387E.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E659.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1017.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 189F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C85E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 368B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CBC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3360.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A544.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D069.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A15E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD04.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABD9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F769.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DC1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A064.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D681.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 143C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CACE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C03.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2672 wrote to memory of 2124 2672 2024-08-21_5577be6859f51e8dee9381bc07884c2a_mafia.exe 30 PID 2672 wrote to memory of 2124 2672 2024-08-21_5577be6859f51e8dee9381bc07884c2a_mafia.exe 30 PID 2672 wrote to memory of 2124 2672 2024-08-21_5577be6859f51e8dee9381bc07884c2a_mafia.exe 30 PID 2672 wrote to memory of 2124 2672 2024-08-21_5577be6859f51e8dee9381bc07884c2a_mafia.exe 30 PID 2124 wrote to memory of 2868 2124 2491.tmp 31 PID 2124 wrote to memory of 2868 2124 2491.tmp 31 PID 2124 wrote to memory of 2868 2124 2491.tmp 31 PID 2124 wrote to memory of 2868 2124 2491.tmp 31 PID 2868 wrote to memory of 2020 2868 24DF.tmp 32 PID 2868 wrote to memory of 2020 2868 24DF.tmp 32 PID 2868 wrote to memory of 2020 2868 24DF.tmp 32 PID 2868 wrote to memory of 2020 2868 24DF.tmp 32 PID 2020 wrote to memory of 2836 2020 256B.tmp 33 PID 2020 wrote to memory of 2836 2020 256B.tmp 33 PID 2020 wrote to memory of 2836 2020 256B.tmp 33 PID 2020 wrote to memory of 2836 2020 256B.tmp 33 PID 2836 wrote to memory of 2844 2836 25E8.tmp 34 PID 2836 wrote to memory of 2844 2836 25E8.tmp 34 PID 2836 wrote to memory of 2844 2836 25E8.tmp 34 PID 2836 wrote to memory of 2844 2836 25E8.tmp 34 PID 2844 wrote to memory of 2832 2844 2655.tmp 35 PID 2844 wrote to memory of 2832 2844 2655.tmp 35 PID 2844 wrote to memory of 2832 2844 2655.tmp 35 PID 2844 wrote to memory of 2832 2844 2655.tmp 35 PID 2832 wrote to memory of 888 2832 26C2.tmp 36 PID 2832 wrote to memory of 888 2832 26C2.tmp 36 PID 2832 wrote to memory of 888 2832 26C2.tmp 36 PID 2832 wrote to memory of 888 2832 26C2.tmp 36 PID 888 wrote to memory of 2644 888 2710.tmp 37 PID 888 wrote to memory of 2644 888 2710.tmp 37 PID 888 wrote to memory of 2644 888 2710.tmp 37 PID 888 wrote to memory of 2644 888 2710.tmp 37 PID 2644 wrote to memory of 1160 2644 277E.tmp 38 PID 2644 wrote to memory of 1160 2644 277E.tmp 38 PID 2644 wrote to memory of 1160 2644 277E.tmp 38 PID 2644 wrote to memory of 1160 2644 277E.tmp 38 PID 1160 wrote to memory of 1676 1160 27DB.tmp 39 PID 1160 wrote to memory of 1676 1160 27DB.tmp 39 PID 1160 wrote to memory of 1676 1160 27DB.tmp 39 PID 1160 wrote to memory of 1676 1160 27DB.tmp 39 PID 1676 wrote to memory of 2400 1676 2858.tmp 40 PID 1676 wrote to memory of 2400 1676 2858.tmp 40 PID 1676 wrote to memory of 2400 1676 2858.tmp 40 PID 1676 wrote to memory of 2400 1676 2858.tmp 40 PID 2400 wrote to memory of 2948 2400 28B6.tmp 41 PID 2400 wrote to memory of 2948 2400 28B6.tmp 41 PID 2400 wrote to memory of 2948 2400 28B6.tmp 41 PID 2400 wrote to memory of 2948 2400 28B6.tmp 41 PID 2948 wrote to memory of 2228 2948 2932.tmp 42 PID 2948 wrote to memory of 2228 2948 2932.tmp 42 PID 2948 wrote to memory of 2228 2948 2932.tmp 42 PID 2948 wrote to memory of 2228 2948 2932.tmp 42 PID 2228 wrote to memory of 3052 2228 2980.tmp 43 PID 2228 wrote to memory of 3052 2228 2980.tmp 43 PID 2228 wrote to memory of 3052 2228 2980.tmp 43 PID 2228 wrote to memory of 3052 2228 2980.tmp 43 PID 3052 wrote to memory of 1672 3052 29EE.tmp 44 PID 3052 wrote to memory of 1672 3052 29EE.tmp 44 PID 3052 wrote to memory of 1672 3052 29EE.tmp 44 PID 3052 wrote to memory of 1672 3052 29EE.tmp 44 PID 1672 wrote to memory of 1004 1672 2A4B.tmp 45 PID 1672 wrote to memory of 1004 1672 2A4B.tmp 45 PID 1672 wrote to memory of 1004 1672 2A4B.tmp 45 PID 1672 wrote to memory of 1004 1672 2A4B.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-21_5577be6859f51e8dee9381bc07884c2a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-21_5577be6859f51e8dee9381bc07884c2a_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\2491.tmp"C:\Users\Admin\AppData\Local\Temp\2491.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\24DF.tmp"C:\Users\Admin\AppData\Local\Temp\24DF.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\256B.tmp"C:\Users\Admin\AppData\Local\Temp\256B.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\25E8.tmp"C:\Users\Admin\AppData\Local\Temp\25E8.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\2655.tmp"C:\Users\Admin\AppData\Local\Temp\2655.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\26C2.tmp"C:\Users\Admin\AppData\Local\Temp\26C2.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\2710.tmp"C:\Users\Admin\AppData\Local\Temp\2710.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Users\Admin\AppData\Local\Temp\277E.tmp"C:\Users\Admin\AppData\Local\Temp\277E.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\27DB.tmp"C:\Users\Admin\AppData\Local\Temp\27DB.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\2858.tmp"C:\Users\Admin\AppData\Local\Temp\2858.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\28B6.tmp"C:\Users\Admin\AppData\Local\Temp\28B6.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\2932.tmp"C:\Users\Admin\AppData\Local\Temp\2932.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\2980.tmp"C:\Users\Admin\AppData\Local\Temp\2980.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\29EE.tmp"C:\Users\Admin\AppData\Local\Temp\29EE.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\2B06.tmp"C:\Users\Admin\AppData\Local\Temp\2B06.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\2B74.tmp"C:\Users\Admin\AppData\Local\Temp\2B74.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:316 -
C:\Users\Admin\AppData\Local\Temp\2BE1.tmp"C:\Users\Admin\AppData\Local\Temp\2BE1.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\2D67.tmp"C:\Users\Admin\AppData\Local\Temp\2D67.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:796 -
C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\2E22.tmp"C:\Users\Admin\AppData\Local\Temp\2E22.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\2E60.tmp"C:\Users\Admin\AppData\Local\Temp\2E60.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\2E9F.tmp"C:\Users\Admin\AppData\Local\Temp\2E9F.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\2EDD.tmp"C:\Users\Admin\AppData\Local\Temp\2EDD.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\2F1C.tmp"C:\Users\Admin\AppData\Local\Temp\2F1C.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\2F6A.tmp"C:\Users\Admin\AppData\Local\Temp\2F6A.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\3025.tmp"C:\Users\Admin\AppData\Local\Temp\3025.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:768 -
C:\Users\Admin\AppData\Local\Temp\3073.tmp"C:\Users\Admin\AppData\Local\Temp\3073.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\30B1.tmp"C:\Users\Admin\AppData\Local\Temp\30B1.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:900 -
C:\Users\Admin\AppData\Local\Temp\30F0.tmp"C:\Users\Admin\AppData\Local\Temp\30F0.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\312E.tmp"C:\Users\Admin\AppData\Local\Temp\312E.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\316C.tmp"C:\Users\Admin\AppData\Local\Temp\316C.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\31AB.tmp"C:\Users\Admin\AppData\Local\Temp\31AB.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\31E9.tmp"C:\Users\Admin\AppData\Local\Temp\31E9.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\3228.tmp"C:\Users\Admin\AppData\Local\Temp\3228.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\3266.tmp"C:\Users\Admin\AppData\Local\Temp\3266.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\32B4.tmp"C:\Users\Admin\AppData\Local\Temp\32B4.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\3321.tmp"C:\Users\Admin\AppData\Local\Temp\3321.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\3360.tmp"C:\Users\Admin\AppData\Local\Temp\3360.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\33AE.tmp"C:\Users\Admin\AppData\Local\Temp\33AE.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\33EC.tmp"C:\Users\Admin\AppData\Local\Temp\33EC.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\343A.tmp"C:\Users\Admin\AppData\Local\Temp\343A.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\3478.tmp"C:\Users\Admin\AppData\Local\Temp\3478.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:548 -
C:\Users\Admin\AppData\Local\Temp\34B7.tmp"C:\Users\Admin\AppData\Local\Temp\34B7.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\34F5.tmp"C:\Users\Admin\AppData\Local\Temp\34F5.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:896 -
C:\Users\Admin\AppData\Local\Temp\3534.tmp"C:\Users\Admin\AppData\Local\Temp\3534.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\3572.tmp"C:\Users\Admin\AppData\Local\Temp\3572.tmp"53⤵
- Executes dropped EXE
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\35B0.tmp"C:\Users\Admin\AppData\Local\Temp\35B0.tmp"54⤵
- Loads dropped DLL
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\35FE.tmp"C:\Users\Admin\AppData\Local\Temp\35FE.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\364C.tmp"C:\Users\Admin\AppData\Local\Temp\364C.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\368B.tmp"C:\Users\Admin\AppData\Local\Temp\368B.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\36C9.tmp"C:\Users\Admin\AppData\Local\Temp\36C9.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\3708.tmp"C:\Users\Admin\AppData\Local\Temp\3708.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\3746.tmp"C:\Users\Admin\AppData\Local\Temp\3746.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\3784.tmp"C:\Users\Admin\AppData\Local\Temp\3784.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\37C3.tmp"C:\Users\Admin\AppData\Local\Temp\37C3.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\3801.tmp"C:\Users\Admin\AppData\Local\Temp\3801.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\3840.tmp"C:\Users\Admin\AppData\Local\Temp\3840.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\387E.tmp"C:\Users\Admin\AppData\Local\Temp\387E.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\38BC.tmp"C:\Users\Admin\AppData\Local\Temp\38BC.tmp"66⤵
- Executes dropped EXE
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\38FB.tmp"C:\Users\Admin\AppData\Local\Temp\38FB.tmp"67⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\3939.tmp"C:\Users\Admin\AppData\Local\Temp\3939.tmp"68⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\3978.tmp"C:\Users\Admin\AppData\Local\Temp\3978.tmp"69⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\39C6.tmp"C:\Users\Admin\AppData\Local\Temp\39C6.tmp"70⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\3A04.tmp"C:\Users\Admin\AppData\Local\Temp\3A04.tmp"71⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\3A42.tmp"C:\Users\Admin\AppData\Local\Temp\3A42.tmp"72⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\3A81.tmp"C:\Users\Admin\AppData\Local\Temp\3A81.tmp"73⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\3ABF.tmp"C:\Users\Admin\AppData\Local\Temp\3ABF.tmp"74⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\3AFE.tmp"C:\Users\Admin\AppData\Local\Temp\3AFE.tmp"75⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\3B3C.tmp"C:\Users\Admin\AppData\Local\Temp\3B3C.tmp"76⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\3B7A.tmp"C:\Users\Admin\AppData\Local\Temp\3B7A.tmp"77⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\3BB9.tmp"C:\Users\Admin\AppData\Local\Temp\3BB9.tmp"78⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\3BF7.tmp"C:\Users\Admin\AppData\Local\Temp\3BF7.tmp"79⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\3C36.tmp"C:\Users\Admin\AppData\Local\Temp\3C36.tmp"80⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\3C74.tmp"C:\Users\Admin\AppData\Local\Temp\3C74.tmp"81⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\3CB2.tmp"C:\Users\Admin\AppData\Local\Temp\3CB2.tmp"82⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\3CF1.tmp"C:\Users\Admin\AppData\Local\Temp\3CF1.tmp"83⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\3D2F.tmp"C:\Users\Admin\AppData\Local\Temp\3D2F.tmp"84⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\3D6E.tmp"C:\Users\Admin\AppData\Local\Temp\3D6E.tmp"85⤵PID:304
-
C:\Users\Admin\AppData\Local\Temp\3DAC.tmp"C:\Users\Admin\AppData\Local\Temp\3DAC.tmp"86⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\3DEA.tmp"C:\Users\Admin\AppData\Local\Temp\3DEA.tmp"87⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\3E29.tmp"C:\Users\Admin\AppData\Local\Temp\3E29.tmp"88⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\3E67.tmp"C:\Users\Admin\AppData\Local\Temp\3E67.tmp"89⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\3EA6.tmp"C:\Users\Admin\AppData\Local\Temp\3EA6.tmp"90⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\3EF4.tmp"C:\Users\Admin\AppData\Local\Temp\3EF4.tmp"91⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\3F32.tmp"C:\Users\Admin\AppData\Local\Temp\3F32.tmp"92⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\3F70.tmp"C:\Users\Admin\AppData\Local\Temp\3F70.tmp"93⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\3FAF.tmp"C:\Users\Admin\AppData\Local\Temp\3FAF.tmp"94⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\3FED.tmp"C:\Users\Admin\AppData\Local\Temp\3FED.tmp"95⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\402C.tmp"C:\Users\Admin\AppData\Local\Temp\402C.tmp"96⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\406A.tmp"C:\Users\Admin\AppData\Local\Temp\406A.tmp"97⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\40A8.tmp"C:\Users\Admin\AppData\Local\Temp\40A8.tmp"98⤵PID:352
-
C:\Users\Admin\AppData\Local\Temp\40E7.tmp"C:\Users\Admin\AppData\Local\Temp\40E7.tmp"99⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\4125.tmp"C:\Users\Admin\AppData\Local\Temp\4125.tmp"100⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\4164.tmp"C:\Users\Admin\AppData\Local\Temp\4164.tmp"101⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\41A2.tmp"C:\Users\Admin\AppData\Local\Temp\41A2.tmp"102⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\41E0.tmp"C:\Users\Admin\AppData\Local\Temp\41E0.tmp"103⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\421F.tmp"C:\Users\Admin\AppData\Local\Temp\421F.tmp"104⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\425D.tmp"C:\Users\Admin\AppData\Local\Temp\425D.tmp"105⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\429C.tmp"C:\Users\Admin\AppData\Local\Temp\429C.tmp"106⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\42DA.tmp"C:\Users\Admin\AppData\Local\Temp\42DA.tmp"107⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\4318.tmp"C:\Users\Admin\AppData\Local\Temp\4318.tmp"108⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\4357.tmp"C:\Users\Admin\AppData\Local\Temp\4357.tmp"109⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\4395.tmp"C:\Users\Admin\AppData\Local\Temp\4395.tmp"110⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\43D4.tmp"C:\Users\Admin\AppData\Local\Temp\43D4.tmp"111⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\4412.tmp"C:\Users\Admin\AppData\Local\Temp\4412.tmp"112⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\4450.tmp"C:\Users\Admin\AppData\Local\Temp\4450.tmp"113⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\448F.tmp"C:\Users\Admin\AppData\Local\Temp\448F.tmp"114⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\44CD.tmp"C:\Users\Admin\AppData\Local\Temp\44CD.tmp"115⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\450C.tmp"C:\Users\Admin\AppData\Local\Temp\450C.tmp"116⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\454A.tmp"C:\Users\Admin\AppData\Local\Temp\454A.tmp"117⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\4588.tmp"C:\Users\Admin\AppData\Local\Temp\4588.tmp"118⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\45C7.tmp"C:\Users\Admin\AppData\Local\Temp\45C7.tmp"119⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\4605.tmp"C:\Users\Admin\AppData\Local\Temp\4605.tmp"120⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\4644.tmp"C:\Users\Admin\AppData\Local\Temp\4644.tmp"121⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\4682.tmp"C:\Users\Admin\AppData\Local\Temp\4682.tmp"122⤵PID:2172
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-