Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
01-09-2024 13:35
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-01_71fa88eb81c3df4dc1ed1b247b9a0dc3_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-09-01_71fa88eb81c3df4dc1ed1b247b9a0dc3_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-01_71fa88eb81c3df4dc1ed1b247b9a0dc3_mafia.exe
-
Size
487KB
-
MD5
71fa88eb81c3df4dc1ed1b247b9a0dc3
-
SHA1
0f48a12ba64cce06b3231a79c2620c1f98ec77bb
-
SHA256
825fa50665ba344d40e79c941f8e450900b71f32224574b592795d1159de9f48
-
SHA512
bfbc97ee6f3b7924cb8ebfacdee4d7e62f09f0c99238a68443e09094354ba48a46b9f536bfa928b5eda160b3d26ba34b340c094c8fc20f2a001afc9eaa6c33dc
-
SSDEEP
6144:zorf3lPvovsgZnqG2C7mOTeiLxDxAs4LzzQm60cRpMCepKFx4tjsiPvW6IRmsH39:yU5rCOTeiN23QmTHfKHiYovjIpbZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1840 DBAF.tmp 2064 DC5B.tmp 2768 DD35.tmp 2944 DE00.tmp 1824 DEDA.tmp 2916 DFA5.tmp 3008 E080.tmp 2776 E189.tmp 2752 E234.tmp 2584 E2F0.tmp 2280 E408.tmp 2624 E4D3.tmp 832 E58E.tmp 1836 E6A7.tmp 2072 E782.tmp 2988 E88B.tmp 3004 E965.tmp 2176 EA20.tmp 2220 EB0A.tmp 2600 EBE5.tmp 2408 ECCF.tmp 1320 EDD8.tmp 2328 EEF1.tmp 2340 EF7D.tmp 1672 F019.tmp 2524 F0A6.tmp 2500 F122.tmp 2332 F1AF.tmp 2204 F21C.tmp 1056 F2B8.tmp 916 F325.tmp 560 F3A2.tmp 2384 F43E.tmp 1820 F4BB.tmp 1828 F547.tmp 2272 F5C4.tmp 1860 F650.tmp 2452 F6CD.tmp 1876 F75A.tmp 2232 F7E6.tmp 1508 F872.tmp 368 F8EF.tmp 1900 F96C.tmp 1112 F9E9.tmp 1796 FA75.tmp 1576 FAF2.tmp 1736 FB6F.tmp 892 FBFB.tmp 1336 FC68.tmp 1360 FCD6.tmp 1532 FD62.tmp 1052 FEAA.tmp 1748 FF65.tmp 2212 FFF1.tmp 2136 6E.tmp 2904 FA.tmp 2784 168.tmp 2772 1D5.tmp 2800 252.tmp 2756 3C8.tmp 2236 493.tmp 2808 500.tmp 2900 57D.tmp 2804 5FA.tmp -
Loads dropped DLL 64 IoCs
pid Process 2276 2024-09-01_71fa88eb81c3df4dc1ed1b247b9a0dc3_mafia.exe 1840 DBAF.tmp 2064 DC5B.tmp 2768 DD35.tmp 2944 DE00.tmp 1824 DEDA.tmp 2916 DFA5.tmp 3008 E080.tmp 2776 E189.tmp 2752 E234.tmp 2584 E2F0.tmp 2280 E408.tmp 2624 E4D3.tmp 832 E58E.tmp 1836 E6A7.tmp 2072 E782.tmp 2988 E88B.tmp 3004 E965.tmp 2176 EA20.tmp 2220 EB0A.tmp 2600 EBE5.tmp 2408 ECCF.tmp 1320 EDD8.tmp 2328 EEF1.tmp 2340 EF7D.tmp 1672 F019.tmp 2524 F0A6.tmp 2500 F122.tmp 2332 F1AF.tmp 2204 F21C.tmp 1056 F2B8.tmp 916 F325.tmp 560 F3A2.tmp 2384 F43E.tmp 1820 F4BB.tmp 1828 F547.tmp 2272 F5C4.tmp 1860 F650.tmp 2452 F6CD.tmp 1876 F75A.tmp 2232 F7E6.tmp 1508 F872.tmp 368 F8EF.tmp 1900 F96C.tmp 1112 F9E9.tmp 1796 FA75.tmp 1576 FAF2.tmp 1736 FB6F.tmp 892 FBFB.tmp 1336 FC68.tmp 1360 FCD6.tmp 1660 FDEE.tmp 1052 FEAA.tmp 1748 FF65.tmp 2212 FFF1.tmp 2136 6E.tmp 2904 FA.tmp 2784 168.tmp 2772 1D5.tmp 2800 252.tmp 2756 3C8.tmp 2236 493.tmp 2808 500.tmp 2900 57D.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9962.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3073.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 318C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 242.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8749.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5081.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAEB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 909C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBBF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E37C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBCC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4895.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C38D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A39F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C14C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4201.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ED4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B28D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D46F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1140.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2923.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFA5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE1F.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2276 wrote to memory of 1840 2276 2024-09-01_71fa88eb81c3df4dc1ed1b247b9a0dc3_mafia.exe 30 PID 2276 wrote to memory of 1840 2276 2024-09-01_71fa88eb81c3df4dc1ed1b247b9a0dc3_mafia.exe 30 PID 2276 wrote to memory of 1840 2276 2024-09-01_71fa88eb81c3df4dc1ed1b247b9a0dc3_mafia.exe 30 PID 2276 wrote to memory of 1840 2276 2024-09-01_71fa88eb81c3df4dc1ed1b247b9a0dc3_mafia.exe 30 PID 1840 wrote to memory of 2064 1840 DBAF.tmp 31 PID 1840 wrote to memory of 2064 1840 DBAF.tmp 31 PID 1840 wrote to memory of 2064 1840 DBAF.tmp 31 PID 1840 wrote to memory of 2064 1840 DBAF.tmp 31 PID 2064 wrote to memory of 2768 2064 DC5B.tmp 32 PID 2064 wrote to memory of 2768 2064 DC5B.tmp 32 PID 2064 wrote to memory of 2768 2064 DC5B.tmp 32 PID 2064 wrote to memory of 2768 2064 DC5B.tmp 32 PID 2768 wrote to memory of 2944 2768 DD35.tmp 33 PID 2768 wrote to memory of 2944 2768 DD35.tmp 33 PID 2768 wrote to memory of 2944 2768 DD35.tmp 33 PID 2768 wrote to memory of 2944 2768 DD35.tmp 33 PID 2944 wrote to memory of 1824 2944 DE00.tmp 34 PID 2944 wrote to memory of 1824 2944 DE00.tmp 34 PID 2944 wrote to memory of 1824 2944 DE00.tmp 34 PID 2944 wrote to memory of 1824 2944 DE00.tmp 34 PID 1824 wrote to memory of 2916 1824 DEDA.tmp 35 PID 1824 wrote to memory of 2916 1824 DEDA.tmp 35 PID 1824 wrote to memory of 2916 1824 DEDA.tmp 35 PID 1824 wrote to memory of 2916 1824 DEDA.tmp 35 PID 2916 wrote to memory of 3008 2916 DFA5.tmp 36 PID 2916 wrote to memory of 3008 2916 DFA5.tmp 36 PID 2916 wrote to memory of 3008 2916 DFA5.tmp 36 PID 2916 wrote to memory of 3008 2916 DFA5.tmp 36 PID 3008 wrote to memory of 2776 3008 E080.tmp 37 PID 3008 wrote to memory of 2776 3008 E080.tmp 37 PID 3008 wrote to memory of 2776 3008 E080.tmp 37 PID 3008 wrote to memory of 2776 3008 E080.tmp 37 PID 2776 wrote to memory of 2752 2776 E189.tmp 38 PID 2776 wrote to memory of 2752 2776 E189.tmp 38 PID 2776 wrote to memory of 2752 2776 E189.tmp 38 PID 2776 wrote to memory of 2752 2776 E189.tmp 38 PID 2752 wrote to memory of 2584 2752 E234.tmp 39 PID 2752 wrote to memory of 2584 2752 E234.tmp 39 PID 2752 wrote to memory of 2584 2752 E234.tmp 39 PID 2752 wrote to memory of 2584 2752 E234.tmp 39 PID 2584 wrote to memory of 2280 2584 E2F0.tmp 40 PID 2584 wrote to memory of 2280 2584 E2F0.tmp 40 PID 2584 wrote to memory of 2280 2584 E2F0.tmp 40 PID 2584 wrote to memory of 2280 2584 E2F0.tmp 40 PID 2280 wrote to memory of 2624 2280 E408.tmp 41 PID 2280 wrote to memory of 2624 2280 E408.tmp 41 PID 2280 wrote to memory of 2624 2280 E408.tmp 41 PID 2280 wrote to memory of 2624 2280 E408.tmp 41 PID 2624 wrote to memory of 832 2624 E4D3.tmp 42 PID 2624 wrote to memory of 832 2624 E4D3.tmp 42 PID 2624 wrote to memory of 832 2624 E4D3.tmp 42 PID 2624 wrote to memory of 832 2624 E4D3.tmp 42 PID 832 wrote to memory of 1836 832 E58E.tmp 43 PID 832 wrote to memory of 1836 832 E58E.tmp 43 PID 832 wrote to memory of 1836 832 E58E.tmp 43 PID 832 wrote to memory of 1836 832 E58E.tmp 43 PID 1836 wrote to memory of 2072 1836 E6A7.tmp 44 PID 1836 wrote to memory of 2072 1836 E6A7.tmp 44 PID 1836 wrote to memory of 2072 1836 E6A7.tmp 44 PID 1836 wrote to memory of 2072 1836 E6A7.tmp 44 PID 2072 wrote to memory of 2988 2072 E782.tmp 45 PID 2072 wrote to memory of 2988 2072 E782.tmp 45 PID 2072 wrote to memory of 2988 2072 E782.tmp 45 PID 2072 wrote to memory of 2988 2072 E782.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-01_71fa88eb81c3df4dc1ed1b247b9a0dc3_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-01_71fa88eb81c3df4dc1ed1b247b9a0dc3_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\DBAF.tmp"C:\Users\Admin\AppData\Local\Temp\DBAF.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\DC5B.tmp"C:\Users\Admin\AppData\Local\Temp\DC5B.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\DD35.tmp"C:\Users\Admin\AppData\Local\Temp\DD35.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\DE00.tmp"C:\Users\Admin\AppData\Local\Temp\DE00.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\DEDA.tmp"C:\Users\Admin\AppData\Local\Temp\DEDA.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\DFA5.tmp"C:\Users\Admin\AppData\Local\Temp\DFA5.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\E080.tmp"C:\Users\Admin\AppData\Local\Temp\E080.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\E189.tmp"C:\Users\Admin\AppData\Local\Temp\E189.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\E234.tmp"C:\Users\Admin\AppData\Local\Temp\E234.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\E2F0.tmp"C:\Users\Admin\AppData\Local\Temp\E2F0.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\E408.tmp"C:\Users\Admin\AppData\Local\Temp\E408.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\E4D3.tmp"C:\Users\Admin\AppData\Local\Temp\E4D3.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\E58E.tmp"C:\Users\Admin\AppData\Local\Temp\E58E.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\E782.tmp"C:\Users\Admin\AppData\Local\Temp\E782.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\E88B.tmp"C:\Users\Admin\AppData\Local\Temp\E88B.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\E965.tmp"C:\Users\Admin\AppData\Local\Temp\E965.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\EA20.tmp"C:\Users\Admin\AppData\Local\Temp\EA20.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\EB0A.tmp"C:\Users\Admin\AppData\Local\Temp\EB0A.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\EBE5.tmp"C:\Users\Admin\AppData\Local\Temp\EBE5.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\ECCF.tmp"C:\Users\Admin\AppData\Local\Temp\ECCF.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\EDD8.tmp"C:\Users\Admin\AppData\Local\Temp\EDD8.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\EEF1.tmp"C:\Users\Admin\AppData\Local\Temp\EEF1.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\EF7D.tmp"C:\Users\Admin\AppData\Local\Temp\EF7D.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\F019.tmp"C:\Users\Admin\AppData\Local\Temp\F019.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\F0A6.tmp"C:\Users\Admin\AppData\Local\Temp\F0A6.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\F122.tmp"C:\Users\Admin\AppData\Local\Temp\F122.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\F1AF.tmp"C:\Users\Admin\AppData\Local\Temp\F1AF.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\F21C.tmp"C:\Users\Admin\AppData\Local\Temp\F21C.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\F2B8.tmp"C:\Users\Admin\AppData\Local\Temp\F2B8.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\F325.tmp"C:\Users\Admin\AppData\Local\Temp\F325.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:916 -
C:\Users\Admin\AppData\Local\Temp\F3A2.tmp"C:\Users\Admin\AppData\Local\Temp\F3A2.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:560 -
C:\Users\Admin\AppData\Local\Temp\F43E.tmp"C:\Users\Admin\AppData\Local\Temp\F43E.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\F4BB.tmp"C:\Users\Admin\AppData\Local\Temp\F4BB.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\F547.tmp"C:\Users\Admin\AppData\Local\Temp\F547.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\F5C4.tmp"C:\Users\Admin\AppData\Local\Temp\F5C4.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\F650.tmp"C:\Users\Admin\AppData\Local\Temp\F650.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\F6CD.tmp"C:\Users\Admin\AppData\Local\Temp\F6CD.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\F75A.tmp"C:\Users\Admin\AppData\Local\Temp\F75A.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\F7E6.tmp"C:\Users\Admin\AppData\Local\Temp\F7E6.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\F872.tmp"C:\Users\Admin\AppData\Local\Temp\F872.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\F8EF.tmp"C:\Users\Admin\AppData\Local\Temp\F8EF.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:368 -
C:\Users\Admin\AppData\Local\Temp\F96C.tmp"C:\Users\Admin\AppData\Local\Temp\F96C.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\F9E9.tmp"C:\Users\Admin\AppData\Local\Temp\F9E9.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\FA75.tmp"C:\Users\Admin\AppData\Local\Temp\FA75.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\FAF2.tmp"C:\Users\Admin\AppData\Local\Temp\FAF2.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\FB6F.tmp"C:\Users\Admin\AppData\Local\Temp\FB6F.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\FBFB.tmp"C:\Users\Admin\AppData\Local\Temp\FBFB.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:892 -
C:\Users\Admin\AppData\Local\Temp\FC68.tmp"C:\Users\Admin\AppData\Local\Temp\FC68.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\FCD6.tmp"C:\Users\Admin\AppData\Local\Temp\FCD6.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\FD62.tmp"C:\Users\Admin\AppData\Local\Temp\FD62.tmp"52⤵
- Executes dropped EXE
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\FDEE.tmp"C:\Users\Admin\AppData\Local\Temp\FDEE.tmp"53⤵
- Loads dropped DLL
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\FEAA.tmp"C:\Users\Admin\AppData\Local\Temp\FEAA.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\FF65.tmp"C:\Users\Admin\AppData\Local\Temp\FF65.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\FFF1.tmp"C:\Users\Admin\AppData\Local\Temp\FFF1.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\6E.tmp"C:\Users\Admin\AppData\Local\Temp\6E.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\FA.tmp"C:\Users\Admin\AppData\Local\Temp\FA.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\168.tmp"C:\Users\Admin\AppData\Local\Temp\168.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\1D5.tmp"C:\Users\Admin\AppData\Local\Temp\1D5.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\252.tmp"C:\Users\Admin\AppData\Local\Temp\252.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\3C8.tmp"C:\Users\Admin\AppData\Local\Temp\3C8.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\493.tmp"C:\Users\Admin\AppData\Local\Temp\493.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\500.tmp"C:\Users\Admin\AppData\Local\Temp\500.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\57D.tmp"C:\Users\Admin\AppData\Local\Temp\57D.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\5FA.tmp"C:\Users\Admin\AppData\Local\Temp\5FA.tmp"66⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\667.tmp"C:\Users\Admin\AppData\Local\Temp\667.tmp"67⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\6E4.tmp"C:\Users\Admin\AppData\Local\Temp\6E4.tmp"68⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\780.tmp"C:\Users\Admin\AppData\Local\Temp\780.tmp"69⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\7ED.tmp"C:\Users\Admin\AppData\Local\Temp\7ED.tmp"70⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\85A.tmp"C:\Users\Admin\AppData\Local\Temp\85A.tmp"71⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\8D7.tmp"C:\Users\Admin\AppData\Local\Temp\8D7.tmp"72⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\973.tmp"C:\Users\Admin\AppData\Local\Temp\973.tmp"73⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\9E0.tmp"C:\Users\Admin\AppData\Local\Temp\9E0.tmp"74⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\A5D.tmp"C:\Users\Admin\AppData\Local\Temp\A5D.tmp"75⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\AE9.tmp"C:\Users\Admin\AppData\Local\Temp\AE9.tmp"76⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\B66.tmp"C:\Users\Admin\AppData\Local\Temp\B66.tmp"77⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\BE3.tmp"C:\Users\Admin\AppData\Local\Temp\BE3.tmp"78⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\C60.tmp"C:\Users\Admin\AppData\Local\Temp\C60.tmp"79⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\CFC.tmp"C:\Users\Admin\AppData\Local\Temp\CFC.tmp"80⤵
- System Location Discovery: System Language Discovery
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\D78.tmp"C:\Users\Admin\AppData\Local\Temp\D78.tmp"81⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\E05.tmp"C:\Users\Admin\AppData\Local\Temp\E05.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\E82.tmp"C:\Users\Admin\AppData\Local\Temp\E82.tmp"83⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\EEF.tmp"C:\Users\Admin\AppData\Local\Temp\EEF.tmp"84⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\F6C.tmp"C:\Users\Admin\AppData\Local\Temp\F6C.tmp"85⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\FE8.tmp"C:\Users\Admin\AppData\Local\Temp\FE8.tmp"86⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\1075.tmp"C:\Users\Admin\AppData\Local\Temp\1075.tmp"87⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\10F2.tmp"C:\Users\Admin\AppData\Local\Temp\10F2.tmp"88⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\116E.tmp"C:\Users\Admin\AppData\Local\Temp\116E.tmp"89⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\11EB.tmp"C:\Users\Admin\AppData\Local\Temp\11EB.tmp"90⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\1258.tmp"C:\Users\Admin\AppData\Local\Temp\1258.tmp"91⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\12B6.tmp"C:\Users\Admin\AppData\Local\Temp\12B6.tmp"92⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\1333.tmp"C:\Users\Admin\AppData\Local\Temp\1333.tmp"93⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\13A0.tmp"C:\Users\Admin\AppData\Local\Temp\13A0.tmp"94⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\141D.tmp"C:\Users\Admin\AppData\Local\Temp\141D.tmp"95⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\14A9.tmp"C:\Users\Admin\AppData\Local\Temp\14A9.tmp"96⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\1516.tmp"C:\Users\Admin\AppData\Local\Temp\1516.tmp"97⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\1584.tmp"C:\Users\Admin\AppData\Local\Temp\1584.tmp"98⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\15F1.tmp"C:\Users\Admin\AppData\Local\Temp\15F1.tmp"99⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\165E.tmp"C:\Users\Admin\AppData\Local\Temp\165E.tmp"100⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\16DB.tmp"C:\Users\Admin\AppData\Local\Temp\16DB.tmp"101⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\1758.tmp"C:\Users\Admin\AppData\Local\Temp\1758.tmp"102⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\17C5.tmp"C:\Users\Admin\AppData\Local\Temp\17C5.tmp"103⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\1842.tmp"C:\Users\Admin\AppData\Local\Temp\1842.tmp"104⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\1A06.tmp"C:\Users\Admin\AppData\Local\Temp\1A06.tmp"105⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\1A92.tmp"C:\Users\Admin\AppData\Local\Temp\1A92.tmp"106⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\1B00.tmp"C:\Users\Admin\AppData\Local\Temp\1B00.tmp"107⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"108⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\1BEA.tmp"C:\Users\Admin\AppData\Local\Temp\1BEA.tmp"109⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\1C76.tmp"C:\Users\Admin\AppData\Local\Temp\1C76.tmp"110⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"111⤵
- System Location Discovery: System Language Discovery
PID:596 -
C:\Users\Admin\AppData\Local\Temp\1D60.tmp"C:\Users\Admin\AppData\Local\Temp\1D60.tmp"112⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"113⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"114⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"115⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\1F63.tmp"C:\Users\Admin\AppData\Local\Temp\1F63.tmp"116⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"117⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\204D.tmp"C:\Users\Admin\AppData\Local\Temp\204D.tmp"118⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\20BA.tmp"C:\Users\Admin\AppData\Local\Temp\20BA.tmp"119⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\2146.tmp"C:\Users\Admin\AppData\Local\Temp\2146.tmp"120⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\21B4.tmp"C:\Users\Admin\AppData\Local\Temp\21B4.tmp"121⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\2230.tmp"C:\Users\Admin\AppData\Local\Temp\2230.tmp"122⤵PID:2788
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-