Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
29/08/2024, 12:29
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-29_8e8609c501c245acd5981d5d65e984a8_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-08-29_8e8609c501c245acd5981d5d65e984a8_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-29_8e8609c501c245acd5981d5d65e984a8_mafia.exe
-
Size
488KB
-
MD5
8e8609c501c245acd5981d5d65e984a8
-
SHA1
26d89414093f6477cc3b2d2990d9b9cd7e6c83aa
-
SHA256
9ddf0b2f6f8954ceac3423fdba2bbce16642aa6912363b8fc2ae9f22bc517ab2
-
SHA512
17356868127d2d85a489eb66f252c277cc9b24fa7c578d3038b65c7b3813076310457743367685a5790d3538bbf7f63743c73fcd04342f92e939558f6a823182
-
SSDEEP
12288:/U5rCOTeiDeDFqTnrpMShyOij0XXJslee0TJ6NZ:/UQOJDWqDry/OigXXJ2bYJ6N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2396 C10E.tmp 1624 C15C.tmp 2296 C1D9.tmp 1160 C217.tmp 2720 C265.tmp 2684 C2C3.tmp 2820 C301.tmp 2716 C34F.tmp 2916 C39D.tmp 2888 C3FB.tmp 2824 C477.tmp 2580 C4C5.tmp 2652 C504.tmp 3000 C542.tmp 304 C5A0.tmp 1356 C5DE.tmp 1776 C64B.tmp 2320 C68A.tmp 1952 C6C8.tmp 1124 C707.tmp 684 C764.tmp 1928 C7A3.tmp 1216 C7E1.tmp 1796 C81F.tmp 2980 C85E.tmp 2892 C89C.tmp 2252 C8CB.tmp 2028 C909.tmp 2272 C948.tmp 2280 C977.tmp 1560 C9B5.tmp 2936 C9F3.tmp 824 CA32.tmp 1716 CA70.tmp 1500 CA9F.tmp 1848 CADD.tmp 1832 CB1C.tmp 1980 CB5A.tmp 1320 CB99.tmp 744 CBD7.tmp 1660 CC15.tmp 2184 CC44.tmp 2180 CC73.tmp 2924 CCB1.tmp 1628 CCF0.tmp 2060 CD4D.tmp 2032 CD8C.tmp 316 CDCA.tmp 1780 CE09.tmp 2468 CE47.tmp 2960 CE85.tmp 1676 CEE3.tmp 1736 CF31.tmp 2152 CF6F.tmp 2376 CFBD.tmp 1624 D00B.tmp 2304 D059.tmp 2668 D0B7.tmp 628 D0F5.tmp 2704 D143.tmp 2928 D182.tmp 2316 D1C0.tmp 2584 D1FF.tmp 2852 D23D.tmp -
Loads dropped DLL 64 IoCs
pid Process 1676 2024-08-29_8e8609c501c245acd5981d5d65e984a8_mafia.exe 2396 C10E.tmp 1624 C15C.tmp 2296 C1D9.tmp 1160 C217.tmp 2720 C265.tmp 2684 C2C3.tmp 2820 C301.tmp 2716 C34F.tmp 2916 C39D.tmp 2888 C3FB.tmp 2824 C477.tmp 2580 C4C5.tmp 2652 C504.tmp 3000 C542.tmp 304 C5A0.tmp 1356 C5DE.tmp 1776 C64B.tmp 2320 C68A.tmp 1952 C6C8.tmp 1124 C707.tmp 684 C764.tmp 1928 C7A3.tmp 1216 C7E1.tmp 1796 C81F.tmp 2980 C85E.tmp 2892 C89C.tmp 2252 C8CB.tmp 2028 C909.tmp 2272 C948.tmp 2280 C977.tmp 1560 C9B5.tmp 2936 C9F3.tmp 824 CA32.tmp 1716 CA70.tmp 1500 CA9F.tmp 1848 CADD.tmp 1832 CB1C.tmp 1980 CB5A.tmp 1320 CB99.tmp 744 CBD7.tmp 1660 CC15.tmp 2184 CC44.tmp 2180 CC73.tmp 2924 CCB1.tmp 1628 CCF0.tmp 2060 CD4D.tmp 2032 CD8C.tmp 316 CDCA.tmp 1780 CE09.tmp 2468 CE47.tmp 2960 CE85.tmp 1676 CEE3.tmp 1736 CF31.tmp 2152 CF6F.tmp 2376 CFBD.tmp 1624 D00B.tmp 2304 D059.tmp 2668 D0B7.tmp 628 D0F5.tmp 2704 D143.tmp 2928 D182.tmp 2316 D1C0.tmp 2584 D1FF.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8066.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFBF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A14E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF48.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E206.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3015.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 165E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A515.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F824.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B70.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1758.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D9FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DCB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A2A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6365.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E041.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1676 wrote to memory of 2396 1676 2024-08-29_8e8609c501c245acd5981d5d65e984a8_mafia.exe 30 PID 1676 wrote to memory of 2396 1676 2024-08-29_8e8609c501c245acd5981d5d65e984a8_mafia.exe 30 PID 1676 wrote to memory of 2396 1676 2024-08-29_8e8609c501c245acd5981d5d65e984a8_mafia.exe 30 PID 1676 wrote to memory of 2396 1676 2024-08-29_8e8609c501c245acd5981d5d65e984a8_mafia.exe 30 PID 2396 wrote to memory of 1624 2396 C10E.tmp 31 PID 2396 wrote to memory of 1624 2396 C10E.tmp 31 PID 2396 wrote to memory of 1624 2396 C10E.tmp 31 PID 2396 wrote to memory of 1624 2396 C10E.tmp 31 PID 1624 wrote to memory of 2296 1624 C15C.tmp 32 PID 1624 wrote to memory of 2296 1624 C15C.tmp 32 PID 1624 wrote to memory of 2296 1624 C15C.tmp 32 PID 1624 wrote to memory of 2296 1624 C15C.tmp 32 PID 2296 wrote to memory of 1160 2296 C1D9.tmp 33 PID 2296 wrote to memory of 1160 2296 C1D9.tmp 33 PID 2296 wrote to memory of 1160 2296 C1D9.tmp 33 PID 2296 wrote to memory of 1160 2296 C1D9.tmp 33 PID 1160 wrote to memory of 2720 1160 C217.tmp 34 PID 1160 wrote to memory of 2720 1160 C217.tmp 34 PID 1160 wrote to memory of 2720 1160 C217.tmp 34 PID 1160 wrote to memory of 2720 1160 C217.tmp 34 PID 2720 wrote to memory of 2684 2720 C265.tmp 35 PID 2720 wrote to memory of 2684 2720 C265.tmp 35 PID 2720 wrote to memory of 2684 2720 C265.tmp 35 PID 2720 wrote to memory of 2684 2720 C265.tmp 35 PID 2684 wrote to memory of 2820 2684 C2C3.tmp 36 PID 2684 wrote to memory of 2820 2684 C2C3.tmp 36 PID 2684 wrote to memory of 2820 2684 C2C3.tmp 36 PID 2684 wrote to memory of 2820 2684 C2C3.tmp 36 PID 2820 wrote to memory of 2716 2820 C301.tmp 37 PID 2820 wrote to memory of 2716 2820 C301.tmp 37 PID 2820 wrote to memory of 2716 2820 C301.tmp 37 PID 2820 wrote to memory of 2716 2820 C301.tmp 37 PID 2716 wrote to memory of 2916 2716 C34F.tmp 38 PID 2716 wrote to memory of 2916 2716 C34F.tmp 38 PID 2716 wrote to memory of 2916 2716 C34F.tmp 38 PID 2716 wrote to memory of 2916 2716 C34F.tmp 38 PID 2916 wrote to memory of 2888 2916 C39D.tmp 39 PID 2916 wrote to memory of 2888 2916 C39D.tmp 39 PID 2916 wrote to memory of 2888 2916 C39D.tmp 39 PID 2916 wrote to memory of 2888 2916 C39D.tmp 39 PID 2888 wrote to memory of 2824 2888 C3FB.tmp 40 PID 2888 wrote to memory of 2824 2888 C3FB.tmp 40 PID 2888 wrote to memory of 2824 2888 C3FB.tmp 40 PID 2888 wrote to memory of 2824 2888 C3FB.tmp 40 PID 2824 wrote to memory of 2580 2824 C477.tmp 41 PID 2824 wrote to memory of 2580 2824 C477.tmp 41 PID 2824 wrote to memory of 2580 2824 C477.tmp 41 PID 2824 wrote to memory of 2580 2824 C477.tmp 41 PID 2580 wrote to memory of 2652 2580 C4C5.tmp 42 PID 2580 wrote to memory of 2652 2580 C4C5.tmp 42 PID 2580 wrote to memory of 2652 2580 C4C5.tmp 42 PID 2580 wrote to memory of 2652 2580 C4C5.tmp 42 PID 2652 wrote to memory of 3000 2652 C504.tmp 43 PID 2652 wrote to memory of 3000 2652 C504.tmp 43 PID 2652 wrote to memory of 3000 2652 C504.tmp 43 PID 2652 wrote to memory of 3000 2652 C504.tmp 43 PID 3000 wrote to memory of 304 3000 C542.tmp 44 PID 3000 wrote to memory of 304 3000 C542.tmp 44 PID 3000 wrote to memory of 304 3000 C542.tmp 44 PID 3000 wrote to memory of 304 3000 C542.tmp 44 PID 304 wrote to memory of 1356 304 C5A0.tmp 45 PID 304 wrote to memory of 1356 304 C5A0.tmp 45 PID 304 wrote to memory of 1356 304 C5A0.tmp 45 PID 304 wrote to memory of 1356 304 C5A0.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-29_8e8609c501c245acd5981d5d65e984a8_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-29_8e8609c501c245acd5981d5d65e984a8_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\C10E.tmp"C:\Users\Admin\AppData\Local\Temp\C10E.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\C15C.tmp"C:\Users\Admin\AppData\Local\Temp\C15C.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\C217.tmp"C:\Users\Admin\AppData\Local\Temp\C217.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\C265.tmp"C:\Users\Admin\AppData\Local\Temp\C265.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\C301.tmp"C:\Users\Admin\AppData\Local\Temp\C301.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\C34F.tmp"C:\Users\Admin\AppData\Local\Temp\C34F.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\C39D.tmp"C:\Users\Admin\AppData\Local\Temp\C39D.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\C3FB.tmp"C:\Users\Admin\AppData\Local\Temp\C3FB.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\C477.tmp"C:\Users\Admin\AppData\Local\Temp\C477.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\C4C5.tmp"C:\Users\Admin\AppData\Local\Temp\C4C5.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\C504.tmp"C:\Users\Admin\AppData\Local\Temp\C504.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\C542.tmp"C:\Users\Admin\AppData\Local\Temp\C542.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\C5A0.tmp"C:\Users\Admin\AppData\Local\Temp\C5A0.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:304 -
C:\Users\Admin\AppData\Local\Temp\C5DE.tmp"C:\Users\Admin\AppData\Local\Temp\C5DE.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\C64B.tmp"C:\Users\Admin\AppData\Local\Temp\C64B.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\C68A.tmp"C:\Users\Admin\AppData\Local\Temp\C68A.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\C6C8.tmp"C:\Users\Admin\AppData\Local\Temp\C6C8.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\C707.tmp"C:\Users\Admin\AppData\Local\Temp\C707.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\C764.tmp"C:\Users\Admin\AppData\Local\Temp\C764.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:684 -
C:\Users\Admin\AppData\Local\Temp\C7A3.tmp"C:\Users\Admin\AppData\Local\Temp\C7A3.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\C7E1.tmp"C:\Users\Admin\AppData\Local\Temp\C7E1.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\C81F.tmp"C:\Users\Admin\AppData\Local\Temp\C81F.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\C85E.tmp"C:\Users\Admin\AppData\Local\Temp\C85E.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\C89C.tmp"C:\Users\Admin\AppData\Local\Temp\C89C.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\C8CB.tmp"C:\Users\Admin\AppData\Local\Temp\C8CB.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\C909.tmp"C:\Users\Admin\AppData\Local\Temp\C909.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\C948.tmp"C:\Users\Admin\AppData\Local\Temp\C948.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\C977.tmp"C:\Users\Admin\AppData\Local\Temp\C977.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\C9B5.tmp"C:\Users\Admin\AppData\Local\Temp\C9B5.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\C9F3.tmp"C:\Users\Admin\AppData\Local\Temp\C9F3.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\CA32.tmp"C:\Users\Admin\AppData\Local\Temp\CA32.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:824 -
C:\Users\Admin\AppData\Local\Temp\CA70.tmp"C:\Users\Admin\AppData\Local\Temp\CA70.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\CA9F.tmp"C:\Users\Admin\AppData\Local\Temp\CA9F.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\CADD.tmp"C:\Users\Admin\AppData\Local\Temp\CADD.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\CB1C.tmp"C:\Users\Admin\AppData\Local\Temp\CB1C.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\CB5A.tmp"C:\Users\Admin\AppData\Local\Temp\CB5A.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\CB99.tmp"C:\Users\Admin\AppData\Local\Temp\CB99.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\CBD7.tmp"C:\Users\Admin\AppData\Local\Temp\CBD7.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:744 -
C:\Users\Admin\AppData\Local\Temp\CC15.tmp"C:\Users\Admin\AppData\Local\Temp\CC15.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\CC44.tmp"C:\Users\Admin\AppData\Local\Temp\CC44.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\CC73.tmp"C:\Users\Admin\AppData\Local\Temp\CC73.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\CCB1.tmp"C:\Users\Admin\AppData\Local\Temp\CCB1.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\CCF0.tmp"C:\Users\Admin\AppData\Local\Temp\CCF0.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\CD4D.tmp"C:\Users\Admin\AppData\Local\Temp\CD4D.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\CD8C.tmp"C:\Users\Admin\AppData\Local\Temp\CD8C.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\CDCA.tmp"C:\Users\Admin\AppData\Local\Temp\CDCA.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:316 -
C:\Users\Admin\AppData\Local\Temp\CE09.tmp"C:\Users\Admin\AppData\Local\Temp\CE09.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\CE47.tmp"C:\Users\Admin\AppData\Local\Temp\CE47.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\CE85.tmp"C:\Users\Admin\AppData\Local\Temp\CE85.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\CEE3.tmp"C:\Users\Admin\AppData\Local\Temp\CEE3.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\CF31.tmp"C:\Users\Admin\AppData\Local\Temp\CF31.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\CF6F.tmp"C:\Users\Admin\AppData\Local\Temp\CF6F.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\CFBD.tmp"C:\Users\Admin\AppData\Local\Temp\CFBD.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\D00B.tmp"C:\Users\Admin\AppData\Local\Temp\D00B.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\D059.tmp"C:\Users\Admin\AppData\Local\Temp\D059.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\D0B7.tmp"C:\Users\Admin\AppData\Local\Temp\D0B7.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\D0F5.tmp"C:\Users\Admin\AppData\Local\Temp\D0F5.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:628 -
C:\Users\Admin\AppData\Local\Temp\D143.tmp"C:\Users\Admin\AppData\Local\Temp\D143.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\D182.tmp"C:\Users\Admin\AppData\Local\Temp\D182.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\D1C0.tmp"C:\Users\Admin\AppData\Local\Temp\D1C0.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\D1FF.tmp"C:\Users\Admin\AppData\Local\Temp\D1FF.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\D23D.tmp"C:\Users\Admin\AppData\Local\Temp\D23D.tmp"65⤵
- Executes dropped EXE
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\D27B.tmp"C:\Users\Admin\AppData\Local\Temp\D27B.tmp"66⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\D2BA.tmp"C:\Users\Admin\AppData\Local\Temp\D2BA.tmp"67⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\D308.tmp"C:\Users\Admin\AppData\Local\Temp\D308.tmp"68⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\D346.tmp"C:\Users\Admin\AppData\Local\Temp\D346.tmp"69⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\D385.tmp"C:\Users\Admin\AppData\Local\Temp\D385.tmp"70⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\D3C3.tmp"C:\Users\Admin\AppData\Local\Temp\D3C3.tmp"71⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\D411.tmp"C:\Users\Admin\AppData\Local\Temp\D411.tmp"72⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\D44F.tmp"C:\Users\Admin\AppData\Local\Temp\D44F.tmp"73⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\D48E.tmp"C:\Users\Admin\AppData\Local\Temp\D48E.tmp"74⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\D4DC.tmp"C:\Users\Admin\AppData\Local\Temp\D4DC.tmp"75⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\D51A.tmp"C:\Users\Admin\AppData\Local\Temp\D51A.tmp"76⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\D559.tmp"C:\Users\Admin\AppData\Local\Temp\D559.tmp"77⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\D597.tmp"C:\Users\Admin\AppData\Local\Temp\D597.tmp"78⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\D5D5.tmp"C:\Users\Admin\AppData\Local\Temp\D5D5.tmp"79⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\D614.tmp"C:\Users\Admin\AppData\Local\Temp\D614.tmp"80⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\D652.tmp"C:\Users\Admin\AppData\Local\Temp\D652.tmp"81⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\D691.tmp"C:\Users\Admin\AppData\Local\Temp\D691.tmp"82⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\D6CF.tmp"C:\Users\Admin\AppData\Local\Temp\D6CF.tmp"83⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\D70D.tmp"C:\Users\Admin\AppData\Local\Temp\D70D.tmp"84⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\D75B.tmp"C:\Users\Admin\AppData\Local\Temp\D75B.tmp"85⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\D79A.tmp"C:\Users\Admin\AppData\Local\Temp\D79A.tmp"86⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\D7D8.tmp"C:\Users\Admin\AppData\Local\Temp\D7D8.tmp"87⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\D817.tmp"C:\Users\Admin\AppData\Local\Temp\D817.tmp"88⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\D855.tmp"C:\Users\Admin\AppData\Local\Temp\D855.tmp"89⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\D893.tmp"C:\Users\Admin\AppData\Local\Temp\D893.tmp"90⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\D8D2.tmp"C:\Users\Admin\AppData\Local\Temp\D8D2.tmp"91⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\D910.tmp"C:\Users\Admin\AppData\Local\Temp\D910.tmp"92⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\D94F.tmp"C:\Users\Admin\AppData\Local\Temp\D94F.tmp"93⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\D98D.tmp"C:\Users\Admin\AppData\Local\Temp\D98D.tmp"94⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\D9BC.tmp"C:\Users\Admin\AppData\Local\Temp\D9BC.tmp"95⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\D9FA.tmp"C:\Users\Admin\AppData\Local\Temp\D9FA.tmp"96⤵
- System Location Discovery: System Language Discovery
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\DA39.tmp"C:\Users\Admin\AppData\Local\Temp\DA39.tmp"97⤵
- System Location Discovery: System Language Discovery
PID:284 -
C:\Users\Admin\AppData\Local\Temp\DA77.tmp"C:\Users\Admin\AppData\Local\Temp\DA77.tmp"98⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\DAB5.tmp"C:\Users\Admin\AppData\Local\Temp\DAB5.tmp"99⤵
- System Location Discovery: System Language Discovery
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\DB03.tmp"C:\Users\Admin\AppData\Local\Temp\DB03.tmp"100⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\DB42.tmp"C:\Users\Admin\AppData\Local\Temp\DB42.tmp"101⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\DB80.tmp"C:\Users\Admin\AppData\Local\Temp\DB80.tmp"102⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\DBBF.tmp"C:\Users\Admin\AppData\Local\Temp\DBBF.tmp"103⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\DBFD.tmp"C:\Users\Admin\AppData\Local\Temp\DBFD.tmp"104⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\DC2C.tmp"C:\Users\Admin\AppData\Local\Temp\DC2C.tmp"105⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\DC5B.tmp"C:\Users\Admin\AppData\Local\Temp\DC5B.tmp"106⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\DC99.tmp"C:\Users\Admin\AppData\Local\Temp\DC99.tmp"107⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\DCD7.tmp"C:\Users\Admin\AppData\Local\Temp\DCD7.tmp"108⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\DD16.tmp"C:\Users\Admin\AppData\Local\Temp\DD16.tmp"109⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\DD54.tmp"C:\Users\Admin\AppData\Local\Temp\DD54.tmp"110⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\DD93.tmp"C:\Users\Admin\AppData\Local\Temp\DD93.tmp"111⤵
- System Location Discovery: System Language Discovery
PID:692 -
C:\Users\Admin\AppData\Local\Temp\DDD1.tmp"C:\Users\Admin\AppData\Local\Temp\DDD1.tmp"112⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\DE10.tmp"C:\Users\Admin\AppData\Local\Temp\DE10.tmp"113⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\DE4E.tmp"C:\Users\Admin\AppData\Local\Temp\DE4E.tmp"114⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\DE8C.tmp"C:\Users\Admin\AppData\Local\Temp\DE8C.tmp"115⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\DECB.tmp"C:\Users\Admin\AppData\Local\Temp\DECB.tmp"116⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\DF09.tmp"C:\Users\Admin\AppData\Local\Temp\DF09.tmp"117⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\DF48.tmp"C:\Users\Admin\AppData\Local\Temp\DF48.tmp"118⤵
- System Location Discovery: System Language Discovery
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\DF86.tmp"C:\Users\Admin\AppData\Local\Temp\DF86.tmp"119⤵
- System Location Discovery: System Language Discovery
PID:568 -
C:\Users\Admin\AppData\Local\Temp\DFC4.tmp"C:\Users\Admin\AppData\Local\Temp\DFC4.tmp"120⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\E003.tmp"C:\Users\Admin\AppData\Local\Temp\E003.tmp"121⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\E041.tmp"C:\Users\Admin\AppData\Local\Temp\E041.tmp"122⤵
- System Location Discovery: System Language Discovery
PID:2792
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-