Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
24-08-2024 13:22
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-24_5df11def4eeadc5ac1e39781f5e8c241_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-08-24_5df11def4eeadc5ac1e39781f5e8c241_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-24_5df11def4eeadc5ac1e39781f5e8c241_mafia.exe
-
Size
487KB
-
MD5
5df11def4eeadc5ac1e39781f5e8c241
-
SHA1
691852bbc3dcc41e99518afaaf42b6d0e512a663
-
SHA256
11c0688d3e686281aafd2f6fb61f53c892c15083e85196f8788fd56f48152cf5
-
SHA512
900709d1f662e81c466ad9d168684c29e6ad3387d611e76a2c4196a95266df5d014beb4efede75b68fb04d4923e6ab32bfb39be1704bed94d20ade15c0cc117a
-
SSDEEP
6144:zorf3lPvovsgZnqG2C7mOTeiLxDx3L/pI7YEfg9S5t3EKTPy309Q0MnL83yJhKLb:yU5rCOTeiNhpI7YEf5tdg0W0ROqJbZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1800 E022.tmp 632 E080.tmp 2828 E0FC.tmp 2384 E15A.tmp 2696 E1B8.tmp 2816 E225.tmp 2212 E292.tmp 2808 E2FF.tmp 2796 E36C.tmp 2592 E3CA.tmp 2560 E428.tmp 2352 E495.tmp 2192 E4E3.tmp 1028 E540.tmp 2616 E59E.tmp 1792 E60B.tmp 1624 E669.tmp 1316 E6D6.tmp 2036 E734.tmp 1672 E7A1.tmp 848 E80E.tmp 1228 E87B.tmp 2956 E8D9.tmp 2372 E917.tmp 2132 E956.tmp 624 E994.tmp 2432 E9D2.tmp 1468 EA20.tmp 1080 EA5F.tmp 2896 EA9D.tmp 1540 EADC.tmp 1356 EB2A.tmp 1648 EB68.tmp 2316 EBA6.tmp 1700 EBE5.tmp 752 EC23.tmp 832 EC62.tmp 2008 ECB0.tmp 580 ECEE.tmp 2420 ED2C.tmp 764 ED6B.tmp 1852 EDA9.tmp 2052 EDE8.tmp 1716 EE26.tmp 2056 EE64.tmp 1940 EEA3.tmp 1000 EEE1.tmp 2988 EF20.tmp 308 EF5E.tmp 2032 EF9C.tmp 3020 EFDB.tmp 1688 F019.tmp 2100 F058.tmp 2068 F096.tmp 2200 F0D4.tmp 1600 F113.tmp 2732 F151.tmp 2864 F190.tmp 3036 F1CE.tmp 2752 F20C.tmp 2744 F24B.tmp 2884 F289.tmp 2876 F2C8.tmp 2212 F306.tmp -
Loads dropped DLL 64 IoCs
pid Process 2460 2024-08-24_5df11def4eeadc5ac1e39781f5e8c241_mafia.exe 1800 E022.tmp 632 E080.tmp 2828 E0FC.tmp 2384 E15A.tmp 2696 E1B8.tmp 2816 E225.tmp 2212 E292.tmp 2808 E2FF.tmp 2796 E36C.tmp 2592 E3CA.tmp 2560 E428.tmp 2352 E495.tmp 2192 E4E3.tmp 1028 E540.tmp 2616 E59E.tmp 1792 E60B.tmp 1624 E669.tmp 1316 E6D6.tmp 2036 E734.tmp 1672 E7A1.tmp 848 E80E.tmp 1228 E87B.tmp 2956 E8D9.tmp 2372 E917.tmp 2132 E956.tmp 624 E994.tmp 2432 E9D2.tmp 1468 EA20.tmp 1080 EA5F.tmp 2896 EA9D.tmp 1540 EADC.tmp 1356 EB2A.tmp 1648 EB68.tmp 2316 EBA6.tmp 1700 EBE5.tmp 752 EC23.tmp 832 EC62.tmp 2008 ECB0.tmp 580 ECEE.tmp 2420 ED2C.tmp 764 ED6B.tmp 1852 EDA9.tmp 2052 EDE8.tmp 1716 EE26.tmp 2056 EE64.tmp 1940 EEA3.tmp 1000 EEE1.tmp 2988 EF20.tmp 308 EF5E.tmp 2032 EF9C.tmp 3020 EFDB.tmp 1688 F019.tmp 2100 F058.tmp 2068 F096.tmp 2200 F0D4.tmp 1600 F113.tmp 2732 F151.tmp 2864 F190.tmp 3036 F1CE.tmp 2752 F20C.tmp 2744 F24B.tmp 2884 F289.tmp 2876 F2C8.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E080.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A13F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B136.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2175.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A045.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C062.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD8C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 404B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B96.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF2A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 339E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2460 wrote to memory of 1800 2460 2024-08-24_5df11def4eeadc5ac1e39781f5e8c241_mafia.exe 31 PID 2460 wrote to memory of 1800 2460 2024-08-24_5df11def4eeadc5ac1e39781f5e8c241_mafia.exe 31 PID 2460 wrote to memory of 1800 2460 2024-08-24_5df11def4eeadc5ac1e39781f5e8c241_mafia.exe 31 PID 2460 wrote to memory of 1800 2460 2024-08-24_5df11def4eeadc5ac1e39781f5e8c241_mafia.exe 31 PID 1800 wrote to memory of 632 1800 E022.tmp 32 PID 1800 wrote to memory of 632 1800 E022.tmp 32 PID 1800 wrote to memory of 632 1800 E022.tmp 32 PID 1800 wrote to memory of 632 1800 E022.tmp 32 PID 632 wrote to memory of 2828 632 E080.tmp 33 PID 632 wrote to memory of 2828 632 E080.tmp 33 PID 632 wrote to memory of 2828 632 E080.tmp 33 PID 632 wrote to memory of 2828 632 E080.tmp 33 PID 2828 wrote to memory of 2384 2828 E0FC.tmp 34 PID 2828 wrote to memory of 2384 2828 E0FC.tmp 34 PID 2828 wrote to memory of 2384 2828 E0FC.tmp 34 PID 2828 wrote to memory of 2384 2828 E0FC.tmp 34 PID 2384 wrote to memory of 2696 2384 E15A.tmp 35 PID 2384 wrote to memory of 2696 2384 E15A.tmp 35 PID 2384 wrote to memory of 2696 2384 E15A.tmp 35 PID 2384 wrote to memory of 2696 2384 E15A.tmp 35 PID 2696 wrote to memory of 2816 2696 E1B8.tmp 36 PID 2696 wrote to memory of 2816 2696 E1B8.tmp 36 PID 2696 wrote to memory of 2816 2696 E1B8.tmp 36 PID 2696 wrote to memory of 2816 2696 E1B8.tmp 36 PID 2816 wrote to memory of 2212 2816 E225.tmp 37 PID 2816 wrote to memory of 2212 2816 E225.tmp 37 PID 2816 wrote to memory of 2212 2816 E225.tmp 37 PID 2816 wrote to memory of 2212 2816 E225.tmp 37 PID 2212 wrote to memory of 2808 2212 E292.tmp 38 PID 2212 wrote to memory of 2808 2212 E292.tmp 38 PID 2212 wrote to memory of 2808 2212 E292.tmp 38 PID 2212 wrote to memory of 2808 2212 E292.tmp 38 PID 2808 wrote to memory of 2796 2808 E2FF.tmp 39 PID 2808 wrote to memory of 2796 2808 E2FF.tmp 39 PID 2808 wrote to memory of 2796 2808 E2FF.tmp 39 PID 2808 wrote to memory of 2796 2808 E2FF.tmp 39 PID 2796 wrote to memory of 2592 2796 E36C.tmp 40 PID 2796 wrote to memory of 2592 2796 E36C.tmp 40 PID 2796 wrote to memory of 2592 2796 E36C.tmp 40 PID 2796 wrote to memory of 2592 2796 E36C.tmp 40 PID 2592 wrote to memory of 2560 2592 E3CA.tmp 41 PID 2592 wrote to memory of 2560 2592 E3CA.tmp 41 PID 2592 wrote to memory of 2560 2592 E3CA.tmp 41 PID 2592 wrote to memory of 2560 2592 E3CA.tmp 41 PID 2560 wrote to memory of 2352 2560 E428.tmp 42 PID 2560 wrote to memory of 2352 2560 E428.tmp 42 PID 2560 wrote to memory of 2352 2560 E428.tmp 42 PID 2560 wrote to memory of 2352 2560 E428.tmp 42 PID 2352 wrote to memory of 2192 2352 E495.tmp 43 PID 2352 wrote to memory of 2192 2352 E495.tmp 43 PID 2352 wrote to memory of 2192 2352 E495.tmp 43 PID 2352 wrote to memory of 2192 2352 E495.tmp 43 PID 2192 wrote to memory of 1028 2192 E4E3.tmp 44 PID 2192 wrote to memory of 1028 2192 E4E3.tmp 44 PID 2192 wrote to memory of 1028 2192 E4E3.tmp 44 PID 2192 wrote to memory of 1028 2192 E4E3.tmp 44 PID 1028 wrote to memory of 2616 1028 E540.tmp 45 PID 1028 wrote to memory of 2616 1028 E540.tmp 45 PID 1028 wrote to memory of 2616 1028 E540.tmp 45 PID 1028 wrote to memory of 2616 1028 E540.tmp 45 PID 2616 wrote to memory of 1792 2616 E59E.tmp 46 PID 2616 wrote to memory of 1792 2616 E59E.tmp 46 PID 2616 wrote to memory of 1792 2616 E59E.tmp 46 PID 2616 wrote to memory of 1792 2616 E59E.tmp 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-24_5df11def4eeadc5ac1e39781f5e8c241_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-24_5df11def4eeadc5ac1e39781f5e8c241_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\E022.tmp"C:\Users\Admin\AppData\Local\Temp\E022.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\E080.tmp"C:\Users\Admin\AppData\Local\Temp\E080.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Users\Admin\AppData\Local\Temp\E0FC.tmp"C:\Users\Admin\AppData\Local\Temp\E0FC.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\E15A.tmp"C:\Users\Admin\AppData\Local\Temp\E15A.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\E1B8.tmp"C:\Users\Admin\AppData\Local\Temp\E1B8.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\E225.tmp"C:\Users\Admin\AppData\Local\Temp\E225.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\E292.tmp"C:\Users\Admin\AppData\Local\Temp\E292.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\E2FF.tmp"C:\Users\Admin\AppData\Local\Temp\E2FF.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\E36C.tmp"C:\Users\Admin\AppData\Local\Temp\E36C.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\E3CA.tmp"C:\Users\Admin\AppData\Local\Temp\E3CA.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\E428.tmp"C:\Users\Admin\AppData\Local\Temp\E428.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\E495.tmp"C:\Users\Admin\AppData\Local\Temp\E495.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\E4E3.tmp"C:\Users\Admin\AppData\Local\Temp\E4E3.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\E540.tmp"C:\Users\Admin\AppData\Local\Temp\E540.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\E59E.tmp"C:\Users\Admin\AppData\Local\Temp\E59E.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\E60B.tmp"C:\Users\Admin\AppData\Local\Temp\E60B.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\E669.tmp"C:\Users\Admin\AppData\Local\Temp\E669.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\E6D6.tmp"C:\Users\Admin\AppData\Local\Temp\E6D6.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\E734.tmp"C:\Users\Admin\AppData\Local\Temp\E734.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\E80E.tmp"C:\Users\Admin\AppData\Local\Temp\E80E.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:848 -
C:\Users\Admin\AppData\Local\Temp\E87B.tmp"C:\Users\Admin\AppData\Local\Temp\E87B.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\E917.tmp"C:\Users\Admin\AppData\Local\Temp\E917.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\E956.tmp"C:\Users\Admin\AppData\Local\Temp\E956.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\E994.tmp"C:\Users\Admin\AppData\Local\Temp\E994.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:624 -
C:\Users\Admin\AppData\Local\Temp\E9D2.tmp"C:\Users\Admin\AppData\Local\Temp\E9D2.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\EA20.tmp"C:\Users\Admin\AppData\Local\Temp\EA20.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\EA5F.tmp"C:\Users\Admin\AppData\Local\Temp\EA5F.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\EA9D.tmp"C:\Users\Admin\AppData\Local\Temp\EA9D.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\EADC.tmp"C:\Users\Admin\AppData\Local\Temp\EADC.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\EB2A.tmp"C:\Users\Admin\AppData\Local\Temp\EB2A.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\EB68.tmp"C:\Users\Admin\AppData\Local\Temp\EB68.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\EBA6.tmp"C:\Users\Admin\AppData\Local\Temp\EBA6.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\EBE5.tmp"C:\Users\Admin\AppData\Local\Temp\EBE5.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\EC23.tmp"C:\Users\Admin\AppData\Local\Temp\EC23.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:752 -
C:\Users\Admin\AppData\Local\Temp\EC62.tmp"C:\Users\Admin\AppData\Local\Temp\EC62.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:832 -
C:\Users\Admin\AppData\Local\Temp\ECB0.tmp"C:\Users\Admin\AppData\Local\Temp\ECB0.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\ECEE.tmp"C:\Users\Admin\AppData\Local\Temp\ECEE.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:580 -
C:\Users\Admin\AppData\Local\Temp\ED2C.tmp"C:\Users\Admin\AppData\Local\Temp\ED2C.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\ED6B.tmp"C:\Users\Admin\AppData\Local\Temp\ED6B.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:764 -
C:\Users\Admin\AppData\Local\Temp\EDA9.tmp"C:\Users\Admin\AppData\Local\Temp\EDA9.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\EDE8.tmp"C:\Users\Admin\AppData\Local\Temp\EDE8.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\EE26.tmp"C:\Users\Admin\AppData\Local\Temp\EE26.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\EE64.tmp"C:\Users\Admin\AppData\Local\Temp\EE64.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\EEA3.tmp"C:\Users\Admin\AppData\Local\Temp\EEA3.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\EEE1.tmp"C:\Users\Admin\AppData\Local\Temp\EEE1.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\EF20.tmp"C:\Users\Admin\AppData\Local\Temp\EF20.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\EF5E.tmp"C:\Users\Admin\AppData\Local\Temp\EF5E.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:308 -
C:\Users\Admin\AppData\Local\Temp\EF9C.tmp"C:\Users\Admin\AppData\Local\Temp\EF9C.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\EFDB.tmp"C:\Users\Admin\AppData\Local\Temp\EFDB.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\F019.tmp"C:\Users\Admin\AppData\Local\Temp\F019.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\F058.tmp"C:\Users\Admin\AppData\Local\Temp\F058.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\F096.tmp"C:\Users\Admin\AppData\Local\Temp\F096.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\F0D4.tmp"C:\Users\Admin\AppData\Local\Temp\F0D4.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\F113.tmp"C:\Users\Admin\AppData\Local\Temp\F113.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\F151.tmp"C:\Users\Admin\AppData\Local\Temp\F151.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\F190.tmp"C:\Users\Admin\AppData\Local\Temp\F190.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\F1CE.tmp"C:\Users\Admin\AppData\Local\Temp\F1CE.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\F20C.tmp"C:\Users\Admin\AppData\Local\Temp\F20C.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\F24B.tmp"C:\Users\Admin\AppData\Local\Temp\F24B.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\F289.tmp"C:\Users\Admin\AppData\Local\Temp\F289.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\F2C8.tmp"C:\Users\Admin\AppData\Local\Temp\F2C8.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\F306.tmp"C:\Users\Admin\AppData\Local\Temp\F306.tmp"65⤵
- Executes dropped EXE
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\F364.tmp"C:\Users\Admin\AppData\Local\Temp\F364.tmp"66⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\F3A2.tmp"C:\Users\Admin\AppData\Local\Temp\F3A2.tmp"67⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\F3E0.tmp"C:\Users\Admin\AppData\Local\Temp\F3E0.tmp"68⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\F41F.tmp"C:\Users\Admin\AppData\Local\Temp\F41F.tmp"69⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\F45D.tmp"C:\Users\Admin\AppData\Local\Temp\F45D.tmp"70⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\F49C.tmp"C:\Users\Admin\AppData\Local\Temp\F49C.tmp"71⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\F4DA.tmp"C:\Users\Admin\AppData\Local\Temp\F4DA.tmp"72⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\F518.tmp"C:\Users\Admin\AppData\Local\Temp\F518.tmp"73⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\F557.tmp"C:\Users\Admin\AppData\Local\Temp\F557.tmp"74⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\F595.tmp"C:\Users\Admin\AppData\Local\Temp\F595.tmp"75⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\F5D4.tmp"C:\Users\Admin\AppData\Local\Temp\F5D4.tmp"76⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\F612.tmp"C:\Users\Admin\AppData\Local\Temp\F612.tmp"77⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\F650.tmp"C:\Users\Admin\AppData\Local\Temp\F650.tmp"78⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\F68F.tmp"C:\Users\Admin\AppData\Local\Temp\F68F.tmp"79⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\F6CD.tmp"C:\Users\Admin\AppData\Local\Temp\F6CD.tmp"80⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\F70C.tmp"C:\Users\Admin\AppData\Local\Temp\F70C.tmp"81⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\F74A.tmp"C:\Users\Admin\AppData\Local\Temp\F74A.tmp"82⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\F788.tmp"C:\Users\Admin\AppData\Local\Temp\F788.tmp"83⤵PID:296
-
C:\Users\Admin\AppData\Local\Temp\F7C7.tmp"C:\Users\Admin\AppData\Local\Temp\F7C7.tmp"84⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\F805.tmp"C:\Users\Admin\AppData\Local\Temp\F805.tmp"85⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\F844.tmp"C:\Users\Admin\AppData\Local\Temp\F844.tmp"86⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\F882.tmp"C:\Users\Admin\AppData\Local\Temp\F882.tmp"87⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\F8C0.tmp"C:\Users\Admin\AppData\Local\Temp\F8C0.tmp"88⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\F8FF.tmp"C:\Users\Admin\AppData\Local\Temp\F8FF.tmp"89⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\F93D.tmp"C:\Users\Admin\AppData\Local\Temp\F93D.tmp"90⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\F97C.tmp"C:\Users\Admin\AppData\Local\Temp\F97C.tmp"91⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\F9BA.tmp"C:\Users\Admin\AppData\Local\Temp\F9BA.tmp"92⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\F9F8.tmp"C:\Users\Admin\AppData\Local\Temp\F9F8.tmp"93⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\FA46.tmp"C:\Users\Admin\AppData\Local\Temp\FA46.tmp"94⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\FA85.tmp"C:\Users\Admin\AppData\Local\Temp\FA85.tmp"95⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\FAC3.tmp"C:\Users\Admin\AppData\Local\Temp\FAC3.tmp"96⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\FB02.tmp"C:\Users\Admin\AppData\Local\Temp\FB02.tmp"97⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\FB40.tmp"C:\Users\Admin\AppData\Local\Temp\FB40.tmp"98⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\FB7E.tmp"C:\Users\Admin\AppData\Local\Temp\FB7E.tmp"99⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\FBCC.tmp"C:\Users\Admin\AppData\Local\Temp\FBCC.tmp"100⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\FC0B.tmp"C:\Users\Admin\AppData\Local\Temp\FC0B.tmp"101⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\FC49.tmp"C:\Users\Admin\AppData\Local\Temp\FC49.tmp"102⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\FC88.tmp"C:\Users\Admin\AppData\Local\Temp\FC88.tmp"103⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\FCC6.tmp"C:\Users\Admin\AppData\Local\Temp\FCC6.tmp"104⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\FD04.tmp"C:\Users\Admin\AppData\Local\Temp\FD04.tmp"105⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\FD43.tmp"C:\Users\Admin\AppData\Local\Temp\FD43.tmp"106⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\FD81.tmp"C:\Users\Admin\AppData\Local\Temp\FD81.tmp"107⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\FDC0.tmp"C:\Users\Admin\AppData\Local\Temp\FDC0.tmp"108⤵PID:604
-
C:\Users\Admin\AppData\Local\Temp\FDFE.tmp"C:\Users\Admin\AppData\Local\Temp\FDFE.tmp"109⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\FE3C.tmp"C:\Users\Admin\AppData\Local\Temp\FE3C.tmp"110⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\FE7B.tmp"C:\Users\Admin\AppData\Local\Temp\FE7B.tmp"111⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\FEB9.tmp"C:\Users\Admin\AppData\Local\Temp\FEB9.tmp"112⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\FEF8.tmp"C:\Users\Admin\AppData\Local\Temp\FEF8.tmp"113⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\FF36.tmp"C:\Users\Admin\AppData\Local\Temp\FF36.tmp"114⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\FF74.tmp"C:\Users\Admin\AppData\Local\Temp\FF74.tmp"115⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\FFB3.tmp"C:\Users\Admin\AppData\Local\Temp\FFB3.tmp"116⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\FFF1.tmp"C:\Users\Admin\AppData\Local\Temp\FFF1.tmp"117⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\30.tmp"C:\Users\Admin\AppData\Local\Temp\30.tmp"118⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\6E.tmp"C:\Users\Admin\AppData\Local\Temp\6E.tmp"119⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\AC.tmp"C:\Users\Admin\AppData\Local\Temp\AC.tmp"120⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\EB.tmp"C:\Users\Admin\AppData\Local\Temp\EB.tmp"121⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\129.tmp"C:\Users\Admin\AppData\Local\Temp\129.tmp"122⤵PID:2232
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-