Analysis
-
max time kernel
150s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
22/08/2024, 05:59
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-22_addb3df53afa2ae54601565729d9ab96_mafia.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-08-22_addb3df53afa2ae54601565729d9ab96_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-22_addb3df53afa2ae54601565729d9ab96_mafia.exe
-
Size
488KB
-
MD5
addb3df53afa2ae54601565729d9ab96
-
SHA1
b71856d9c1e4a40d43da06991dee318b8cf96d6a
-
SHA256
10ee3c041958fc4862e7b12408e87e0d3b6580a34f16c670dc0ba05b41e211ee
-
SHA512
b35113d2d8ba33425f6cea8bb4ddd43131a571bc129abb8bdc279f308f0748a37f9ac970fdece7c517f11466d018738b5ae950ba2fd2c706da7ce3f5ff15b316
-
SSDEEP
12288:/U5rCOTeiDRc/5vI17kM37lChgjALANZ:/UQOJDqRQz3xN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2976 65A6.tmp 2756 6623.tmp 2936 669F.tmp 2792 671C.tmp 2904 6789.tmp 2684 67F7.tmp 2896 6854.tmp 1264 68C1.tmp 2712 693E.tmp 2692 69AB.tmp 2348 6A19.tmp 1920 6A95.tmp 1936 6AF3.tmp 2296 6B51.tmp 2544 6BAE.tmp 2120 6C0C.tmp 3060 6C69.tmp 2548 6CD7.tmp 1076 6D34.tmp 2708 6DB1.tmp 2840 6E1E.tmp 3016 6E8B.tmp 2852 6EE9.tmp 1256 6F37.tmp 1404 6F75.tmp 1576 6FC3.tmp 2452 7002.tmp 2300 7050.tmp 2436 708E.tmp 2428 70CD.tmp 1280 710B.tmp 2208 7149.tmp 2304 7197.tmp 2464 71E5.tmp 2440 7224.tmp 2332 7272.tmp 2556 72C0.tmp 108 72FE.tmp 536 733D.tmp 1000 737B.tmp 1772 73B9.tmp 2376 73F8.tmp 1040 7436.tmp 2608 7475.tmp 636 74C3.tmp 2424 7501.tmp 1352 753F.tmp 2596 758D.tmp 2408 75DB.tmp 688 7629.tmp 884 7668.tmp 2580 76B6.tmp 2732 76F4.tmp 1508 7742.tmp 2396 7781.tmp 2976 77CF.tmp 2924 780D.tmp 2952 784B.tmp 2936 78A9.tmp 2772 78E7.tmp 2808 7926.tmp 2904 7974.tmp 2980 79B2.tmp 2816 79F1.tmp -
Loads dropped DLL 64 IoCs
pid Process 2732 2024-08-22_addb3df53afa2ae54601565729d9ab96_mafia.exe 2976 65A6.tmp 2756 6623.tmp 2936 669F.tmp 2792 671C.tmp 2904 6789.tmp 2684 67F7.tmp 2896 6854.tmp 1264 68C1.tmp 2712 693E.tmp 2692 69AB.tmp 2348 6A19.tmp 1920 6A95.tmp 1936 6AF3.tmp 2296 6B51.tmp 2544 6BAE.tmp 2120 6C0C.tmp 3060 6C69.tmp 2548 6CD7.tmp 1076 6D34.tmp 2708 6DB1.tmp 2840 6E1E.tmp 3016 6E8B.tmp 2852 6EE9.tmp 1256 6F37.tmp 1404 6F75.tmp 1576 6FC3.tmp 2452 7002.tmp 2300 7050.tmp 2436 708E.tmp 2428 70CD.tmp 1280 710B.tmp 2208 7149.tmp 2304 7197.tmp 2464 71E5.tmp 2440 7224.tmp 2332 7272.tmp 2556 72C0.tmp 108 72FE.tmp 536 733D.tmp 1000 737B.tmp 1772 73B9.tmp 2376 73F8.tmp 1040 7436.tmp 2608 7475.tmp 636 74C3.tmp 2424 7501.tmp 1352 753F.tmp 2596 758D.tmp 2408 75DB.tmp 688 7629.tmp 884 7668.tmp 2580 76B6.tmp 2732 76F4.tmp 1508 7742.tmp 2396 7781.tmp 2976 77CF.tmp 2924 780D.tmp 2952 784B.tmp 2936 78A9.tmp 2772 78E7.tmp 2808 7926.tmp 2904 7974.tmp 2980 79B2.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E0A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1600.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 275E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1249.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C64C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D9EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EABC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8353.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D172.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 909C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A91B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2732 wrote to memory of 2976 2732 2024-08-22_addb3df53afa2ae54601565729d9ab96_mafia.exe 29 PID 2732 wrote to memory of 2976 2732 2024-08-22_addb3df53afa2ae54601565729d9ab96_mafia.exe 29 PID 2732 wrote to memory of 2976 2732 2024-08-22_addb3df53afa2ae54601565729d9ab96_mafia.exe 29 PID 2732 wrote to memory of 2976 2732 2024-08-22_addb3df53afa2ae54601565729d9ab96_mafia.exe 29 PID 2976 wrote to memory of 2756 2976 65A6.tmp 30 PID 2976 wrote to memory of 2756 2976 65A6.tmp 30 PID 2976 wrote to memory of 2756 2976 65A6.tmp 30 PID 2976 wrote to memory of 2756 2976 65A6.tmp 30 PID 2756 wrote to memory of 2936 2756 6623.tmp 31 PID 2756 wrote to memory of 2936 2756 6623.tmp 31 PID 2756 wrote to memory of 2936 2756 6623.tmp 31 PID 2756 wrote to memory of 2936 2756 6623.tmp 31 PID 2936 wrote to memory of 2792 2936 669F.tmp 32 PID 2936 wrote to memory of 2792 2936 669F.tmp 32 PID 2936 wrote to memory of 2792 2936 669F.tmp 32 PID 2936 wrote to memory of 2792 2936 669F.tmp 32 PID 2792 wrote to memory of 2904 2792 671C.tmp 33 PID 2792 wrote to memory of 2904 2792 671C.tmp 33 PID 2792 wrote to memory of 2904 2792 671C.tmp 33 PID 2792 wrote to memory of 2904 2792 671C.tmp 33 PID 2904 wrote to memory of 2684 2904 6789.tmp 34 PID 2904 wrote to memory of 2684 2904 6789.tmp 34 PID 2904 wrote to memory of 2684 2904 6789.tmp 34 PID 2904 wrote to memory of 2684 2904 6789.tmp 34 PID 2684 wrote to memory of 2896 2684 67F7.tmp 35 PID 2684 wrote to memory of 2896 2684 67F7.tmp 35 PID 2684 wrote to memory of 2896 2684 67F7.tmp 35 PID 2684 wrote to memory of 2896 2684 67F7.tmp 35 PID 2896 wrote to memory of 1264 2896 6854.tmp 36 PID 2896 wrote to memory of 1264 2896 6854.tmp 36 PID 2896 wrote to memory of 1264 2896 6854.tmp 36 PID 2896 wrote to memory of 1264 2896 6854.tmp 36 PID 1264 wrote to memory of 2712 1264 68C1.tmp 37 PID 1264 wrote to memory of 2712 1264 68C1.tmp 37 PID 1264 wrote to memory of 2712 1264 68C1.tmp 37 PID 1264 wrote to memory of 2712 1264 68C1.tmp 37 PID 2712 wrote to memory of 2692 2712 693E.tmp 38 PID 2712 wrote to memory of 2692 2712 693E.tmp 38 PID 2712 wrote to memory of 2692 2712 693E.tmp 38 PID 2712 wrote to memory of 2692 2712 693E.tmp 38 PID 2692 wrote to memory of 2348 2692 69AB.tmp 39 PID 2692 wrote to memory of 2348 2692 69AB.tmp 39 PID 2692 wrote to memory of 2348 2692 69AB.tmp 39 PID 2692 wrote to memory of 2348 2692 69AB.tmp 39 PID 2348 wrote to memory of 1920 2348 6A19.tmp 40 PID 2348 wrote to memory of 1920 2348 6A19.tmp 40 PID 2348 wrote to memory of 1920 2348 6A19.tmp 40 PID 2348 wrote to memory of 1920 2348 6A19.tmp 40 PID 1920 wrote to memory of 1936 1920 6A95.tmp 41 PID 1920 wrote to memory of 1936 1920 6A95.tmp 41 PID 1920 wrote to memory of 1936 1920 6A95.tmp 41 PID 1920 wrote to memory of 1936 1920 6A95.tmp 41 PID 1936 wrote to memory of 2296 1936 6AF3.tmp 42 PID 1936 wrote to memory of 2296 1936 6AF3.tmp 42 PID 1936 wrote to memory of 2296 1936 6AF3.tmp 42 PID 1936 wrote to memory of 2296 1936 6AF3.tmp 42 PID 2296 wrote to memory of 2544 2296 6B51.tmp 43 PID 2296 wrote to memory of 2544 2296 6B51.tmp 43 PID 2296 wrote to memory of 2544 2296 6B51.tmp 43 PID 2296 wrote to memory of 2544 2296 6B51.tmp 43 PID 2544 wrote to memory of 2120 2544 6BAE.tmp 44 PID 2544 wrote to memory of 2120 2544 6BAE.tmp 44 PID 2544 wrote to memory of 2120 2544 6BAE.tmp 44 PID 2544 wrote to memory of 2120 2544 6BAE.tmp 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-22_addb3df53afa2ae54601565729d9ab96_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-22_addb3df53afa2ae54601565729d9ab96_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\65A6.tmp"C:\Users\Admin\AppData\Local\Temp\65A6.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\6623.tmp"C:\Users\Admin\AppData\Local\Temp\6623.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\669F.tmp"C:\Users\Admin\AppData\Local\Temp\669F.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\671C.tmp"C:\Users\Admin\AppData\Local\Temp\671C.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\6789.tmp"C:\Users\Admin\AppData\Local\Temp\6789.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\67F7.tmp"C:\Users\Admin\AppData\Local\Temp\67F7.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\6854.tmp"C:\Users\Admin\AppData\Local\Temp\6854.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\68C1.tmp"C:\Users\Admin\AppData\Local\Temp\68C1.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\693E.tmp"C:\Users\Admin\AppData\Local\Temp\693E.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\69AB.tmp"C:\Users\Admin\AppData\Local\Temp\69AB.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\6A19.tmp"C:\Users\Admin\AppData\Local\Temp\6A19.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\6A95.tmp"C:\Users\Admin\AppData\Local\Temp\6A95.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\6AF3.tmp"C:\Users\Admin\AppData\Local\Temp\6AF3.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\6B51.tmp"C:\Users\Admin\AppData\Local\Temp\6B51.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\6BAE.tmp"C:\Users\Admin\AppData\Local\Temp\6BAE.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\6C0C.tmp"C:\Users\Admin\AppData\Local\Temp\6C0C.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\6C69.tmp"C:\Users\Admin\AppData\Local\Temp\6C69.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\6CD7.tmp"C:\Users\Admin\AppData\Local\Temp\6CD7.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\6D34.tmp"C:\Users\Admin\AppData\Local\Temp\6D34.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\6DB1.tmp"C:\Users\Admin\AppData\Local\Temp\6DB1.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\6E1E.tmp"C:\Users\Admin\AppData\Local\Temp\6E1E.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\6E8B.tmp"C:\Users\Admin\AppData\Local\Temp\6E8B.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\6EE9.tmp"C:\Users\Admin\AppData\Local\Temp\6EE9.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\6F37.tmp"C:\Users\Admin\AppData\Local\Temp\6F37.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\6F75.tmp"C:\Users\Admin\AppData\Local\Temp\6F75.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\6FC3.tmp"C:\Users\Admin\AppData\Local\Temp\6FC3.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\7002.tmp"C:\Users\Admin\AppData\Local\Temp\7002.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\7050.tmp"C:\Users\Admin\AppData\Local\Temp\7050.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\708E.tmp"C:\Users\Admin\AppData\Local\Temp\708E.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\70CD.tmp"C:\Users\Admin\AppData\Local\Temp\70CD.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\710B.tmp"C:\Users\Admin\AppData\Local\Temp\710B.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\7149.tmp"C:\Users\Admin\AppData\Local\Temp\7149.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\7197.tmp"C:\Users\Admin\AppData\Local\Temp\7197.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\71E5.tmp"C:\Users\Admin\AppData\Local\Temp\71E5.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\7224.tmp"C:\Users\Admin\AppData\Local\Temp\7224.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\7272.tmp"C:\Users\Admin\AppData\Local\Temp\7272.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\72C0.tmp"C:\Users\Admin\AppData\Local\Temp\72C0.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\72FE.tmp"C:\Users\Admin\AppData\Local\Temp\72FE.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:108 -
C:\Users\Admin\AppData\Local\Temp\733D.tmp"C:\Users\Admin\AppData\Local\Temp\733D.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:536 -
C:\Users\Admin\AppData\Local\Temp\737B.tmp"C:\Users\Admin\AppData\Local\Temp\737B.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\73B9.tmp"C:\Users\Admin\AppData\Local\Temp\73B9.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\73F8.tmp"C:\Users\Admin\AppData\Local\Temp\73F8.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\7436.tmp"C:\Users\Admin\AppData\Local\Temp\7436.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\7475.tmp"C:\Users\Admin\AppData\Local\Temp\7475.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\74C3.tmp"C:\Users\Admin\AppData\Local\Temp\74C3.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:636 -
C:\Users\Admin\AppData\Local\Temp\7501.tmp"C:\Users\Admin\AppData\Local\Temp\7501.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\753F.tmp"C:\Users\Admin\AppData\Local\Temp\753F.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\758D.tmp"C:\Users\Admin\AppData\Local\Temp\758D.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\75DB.tmp"C:\Users\Admin\AppData\Local\Temp\75DB.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\7629.tmp"C:\Users\Admin\AppData\Local\Temp\7629.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:688 -
C:\Users\Admin\AppData\Local\Temp\7668.tmp"C:\Users\Admin\AppData\Local\Temp\7668.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:884 -
C:\Users\Admin\AppData\Local\Temp\76B6.tmp"C:\Users\Admin\AppData\Local\Temp\76B6.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\76F4.tmp"C:\Users\Admin\AppData\Local\Temp\76F4.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\7742.tmp"C:\Users\Admin\AppData\Local\Temp\7742.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\7781.tmp"C:\Users\Admin\AppData\Local\Temp\7781.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\77CF.tmp"C:\Users\Admin\AppData\Local\Temp\77CF.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\780D.tmp"C:\Users\Admin\AppData\Local\Temp\780D.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\784B.tmp"C:\Users\Admin\AppData\Local\Temp\784B.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\78A9.tmp"C:\Users\Admin\AppData\Local\Temp\78A9.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\78E7.tmp"C:\Users\Admin\AppData\Local\Temp\78E7.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\7926.tmp"C:\Users\Admin\AppData\Local\Temp\7926.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\7974.tmp"C:\Users\Admin\AppData\Local\Temp\7974.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\79B2.tmp"C:\Users\Admin\AppData\Local\Temp\79B2.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\79F1.tmp"C:\Users\Admin\AppData\Local\Temp\79F1.tmp"65⤵
- Executes dropped EXE
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\7A2F.tmp"C:\Users\Admin\AppData\Local\Temp\7A2F.tmp"66⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\7A7D.tmp"C:\Users\Admin\AppData\Local\Temp\7A7D.tmp"67⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\7ACB.tmp"C:\Users\Admin\AppData\Local\Temp\7ACB.tmp"68⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\7B19.tmp"C:\Users\Admin\AppData\Local\Temp\7B19.tmp"69⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\7B57.tmp"C:\Users\Admin\AppData\Local\Temp\7B57.tmp"70⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\7B96.tmp"C:\Users\Admin\AppData\Local\Temp\7B96.tmp"71⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\7BD4.tmp"C:\Users\Admin\AppData\Local\Temp\7BD4.tmp"72⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\7C22.tmp"C:\Users\Admin\AppData\Local\Temp\7C22.tmp"73⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\7C70.tmp"C:\Users\Admin\AppData\Local\Temp\7C70.tmp"74⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\7CBE.tmp"C:\Users\Admin\AppData\Local\Temp\7CBE.tmp"75⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\7CFD.tmp"C:\Users\Admin\AppData\Local\Temp\7CFD.tmp"76⤵
- System Location Discovery: System Language Discovery
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\7D3B.tmp"C:\Users\Admin\AppData\Local\Temp\7D3B.tmp"77⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\7D79.tmp"C:\Users\Admin\AppData\Local\Temp\7D79.tmp"78⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\7DC7.tmp"C:\Users\Admin\AppData\Local\Temp\7DC7.tmp"79⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\7E06.tmp"C:\Users\Admin\AppData\Local\Temp\7E06.tmp"80⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\7E44.tmp"C:\Users\Admin\AppData\Local\Temp\7E44.tmp"81⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\7E83.tmp"C:\Users\Admin\AppData\Local\Temp\7E83.tmp"82⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\7ED1.tmp"C:\Users\Admin\AppData\Local\Temp\7ED1.tmp"83⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\7F0F.tmp"C:\Users\Admin\AppData\Local\Temp\7F0F.tmp"84⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\7F4D.tmp"C:\Users\Admin\AppData\Local\Temp\7F4D.tmp"85⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\7F8C.tmp"C:\Users\Admin\AppData\Local\Temp\7F8C.tmp"86⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\7FDA.tmp"C:\Users\Admin\AppData\Local\Temp\7FDA.tmp"87⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\8018.tmp"C:\Users\Admin\AppData\Local\Temp\8018.tmp"88⤵PID:496
-
C:\Users\Admin\AppData\Local\Temp\8057.tmp"C:\Users\Admin\AppData\Local\Temp\8057.tmp"89⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\8095.tmp"C:\Users\Admin\AppData\Local\Temp\8095.tmp"90⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\80E3.tmp"C:\Users\Admin\AppData\Local\Temp\80E3.tmp"91⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\8121.tmp"C:\Users\Admin\AppData\Local\Temp\8121.tmp"92⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\816F.tmp"C:\Users\Admin\AppData\Local\Temp\816F.tmp"93⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\81AE.tmp"C:\Users\Admin\AppData\Local\Temp\81AE.tmp"94⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\81FC.tmp"C:\Users\Admin\AppData\Local\Temp\81FC.tmp"95⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\823A.tmp"C:\Users\Admin\AppData\Local\Temp\823A.tmp"96⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\8288.tmp"C:\Users\Admin\AppData\Local\Temp\8288.tmp"97⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\82C7.tmp"C:\Users\Admin\AppData\Local\Temp\82C7.tmp"98⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\8315.tmp"C:\Users\Admin\AppData\Local\Temp\8315.tmp"99⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\8353.tmp"C:\Users\Admin\AppData\Local\Temp\8353.tmp"100⤵
- System Location Discovery: System Language Discovery
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\83A1.tmp"C:\Users\Admin\AppData\Local\Temp\83A1.tmp"101⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\83DF.tmp"C:\Users\Admin\AppData\Local\Temp\83DF.tmp"102⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\842D.tmp"C:\Users\Admin\AppData\Local\Temp\842D.tmp"103⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\846C.tmp"C:\Users\Admin\AppData\Local\Temp\846C.tmp"104⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\84AA.tmp"C:\Users\Admin\AppData\Local\Temp\84AA.tmp"105⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\84E9.tmp"C:\Users\Admin\AppData\Local\Temp\84E9.tmp"106⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\8527.tmp"C:\Users\Admin\AppData\Local\Temp\8527.tmp"107⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\8565.tmp"C:\Users\Admin\AppData\Local\Temp\8565.tmp"108⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\85A4.tmp"C:\Users\Admin\AppData\Local\Temp\85A4.tmp"109⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\85E2.tmp"C:\Users\Admin\AppData\Local\Temp\85E2.tmp"110⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\8621.tmp"C:\Users\Admin\AppData\Local\Temp\8621.tmp"111⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\865F.tmp"C:\Users\Admin\AppData\Local\Temp\865F.tmp"112⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\86AD.tmp"C:\Users\Admin\AppData\Local\Temp\86AD.tmp"113⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\86EB.tmp"C:\Users\Admin\AppData\Local\Temp\86EB.tmp"114⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\872A.tmp"C:\Users\Admin\AppData\Local\Temp\872A.tmp"115⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\8778.tmp"C:\Users\Admin\AppData\Local\Temp\8778.tmp"116⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\87C6.tmp"C:\Users\Admin\AppData\Local\Temp\87C6.tmp"117⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\8814.tmp"C:\Users\Admin\AppData\Local\Temp\8814.tmp"118⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\8862.tmp"C:\Users\Admin\AppData\Local\Temp\8862.tmp"119⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\88A0.tmp"C:\Users\Admin\AppData\Local\Temp\88A0.tmp"120⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\88EE.tmp"C:\Users\Admin\AppData\Local\Temp\88EE.tmp"121⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\892D.tmp"C:\Users\Admin\AppData\Local\Temp\892D.tmp"122⤵PID:2800
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-