Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
03-09-2024 04:16
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-03_7052d91f75b22dc590edbcab406a42cf_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-09-03_7052d91f75b22dc590edbcab406a42cf_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-03_7052d91f75b22dc590edbcab406a42cf_mafia.exe
-
Size
712KB
-
MD5
7052d91f75b22dc590edbcab406a42cf
-
SHA1
7780066bae08e886c1f4e865f1d514c83ef2803a
-
SHA256
46d76c2f700dc39944a6ac3bad11c5e03d56cb2ba0762d13409d73d4fe99a007
-
SHA512
df675c81b541c5a992b06d33d31c81b580183212f51a3c240d546a1e3eeca37eee72d2d56ab820c8e7bb674807bc8b6b582195fbcea381765b555694d528efe9
-
SSDEEP
12288:FU5rCOTeiDM6JfCSlMcR7O83GCGJ5bNZdCvq5TJLCvY90D8/LVBlVk736Y79GWzC:FUQOJDdRbM83vilNnCvq5TJLCvY90D8N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2360 975F.tmp 2552 97CD.tmp 2148 983A.tmp 2500 98B7.tmp 2728 9914.tmp 2868 9981.tmp 2760 99DF.tmp 3008 9A4C.tmp 2720 9AAA.tmp 2756 9B17.tmp 2616 9B84.tmp 2680 9C11.tmp 2068 9C9D.tmp 560 9D1A.tmp 1968 9D87.tmp 2800 9DF4.tmp 2428 9E52.tmp 1168 9ECF.tmp 2676 9F2C.tmp 2836 9FA9.tmp 2980 A016.tmp 1308 A093.tmp 1764 A0F1.tmp 2656 A12F.tmp 2988 A16D.tmp 788 A1AC.tmp 280 A1EA.tmp 596 A229.tmp 320 A267.tmp 1680 A2A5.tmp 1008 A2F3.tmp 1724 A332.tmp 1148 A370.tmp 1480 A3AF.tmp 1344 A3ED.tmp 1920 A42B.tmp 2596 A46A.tmp 644 A4B8.tmp 1376 A4F6.tmp 1740 A535.tmp 916 A573.tmp 1656 A5B1.tmp 720 A5FF.tmp 2384 A63E.tmp 1700 A67C.tmp 1032 A6BB.tmp 1804 A6F9.tmp 780 A737.tmp 1736 A785.tmp 1712 A7C4.tmp 2344 A802.tmp 1036 A841.tmp 1600 A87F.tmp 2524 A8BD.tmp 2400 A8FC.tmp 2700 A94A.tmp 1996 A988.tmp 2280 A9C7.tmp 2708 AA05.tmp 2748 AA43.tmp 2876 AA82.tmp 2772 AAD0.tmp 2624 AB0E.tmp 2744 AB4D.tmp -
Loads dropped DLL 64 IoCs
pid Process 2112 2024-09-03_7052d91f75b22dc590edbcab406a42cf_mafia.exe 2360 975F.tmp 2552 97CD.tmp 2148 983A.tmp 2500 98B7.tmp 2728 9914.tmp 2868 9981.tmp 2760 99DF.tmp 3008 9A4C.tmp 2720 9AAA.tmp 2756 9B17.tmp 2616 9B84.tmp 2680 9C11.tmp 2068 9C9D.tmp 560 9D1A.tmp 1968 9D87.tmp 2800 9DF4.tmp 2428 9E52.tmp 1168 9ECF.tmp 2676 9F2C.tmp 2836 9FA9.tmp 2980 A016.tmp 1308 A093.tmp 1764 A0F1.tmp 2656 A12F.tmp 2988 A16D.tmp 788 A1AC.tmp 280 A1EA.tmp 596 A229.tmp 320 A267.tmp 1680 A2A5.tmp 1008 A2F3.tmp 1724 A332.tmp 1148 A370.tmp 1480 A3AF.tmp 1344 A3ED.tmp 1920 A42B.tmp 2596 A46A.tmp 644 A4B8.tmp 1376 A4F6.tmp 1740 A535.tmp 916 A573.tmp 1656 A5B1.tmp 720 A5FF.tmp 2384 A63E.tmp 1700 A67C.tmp 1032 A6BB.tmp 1804 A6F9.tmp 780 A737.tmp 1736 A785.tmp 1712 A7C4.tmp 2344 A802.tmp 1036 A841.tmp 1600 A87F.tmp 2524 A8BD.tmp 2400 A8FC.tmp 2700 A94A.tmp 1996 A988.tmp 2280 A9C7.tmp 2708 AA05.tmp 2748 AA43.tmp 2876 AA82.tmp 2772 AAD0.tmp 2624 AB0E.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C8A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6799.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F086.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B358.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7169.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FC1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E688.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE6F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 820B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D643.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 711B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D02B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2112 wrote to memory of 2360 2112 2024-09-03_7052d91f75b22dc590edbcab406a42cf_mafia.exe 30 PID 2112 wrote to memory of 2360 2112 2024-09-03_7052d91f75b22dc590edbcab406a42cf_mafia.exe 30 PID 2112 wrote to memory of 2360 2112 2024-09-03_7052d91f75b22dc590edbcab406a42cf_mafia.exe 30 PID 2112 wrote to memory of 2360 2112 2024-09-03_7052d91f75b22dc590edbcab406a42cf_mafia.exe 30 PID 2360 wrote to memory of 2552 2360 975F.tmp 31 PID 2360 wrote to memory of 2552 2360 975F.tmp 31 PID 2360 wrote to memory of 2552 2360 975F.tmp 31 PID 2360 wrote to memory of 2552 2360 975F.tmp 31 PID 2552 wrote to memory of 2148 2552 97CD.tmp 32 PID 2552 wrote to memory of 2148 2552 97CD.tmp 32 PID 2552 wrote to memory of 2148 2552 97CD.tmp 32 PID 2552 wrote to memory of 2148 2552 97CD.tmp 32 PID 2148 wrote to memory of 2500 2148 983A.tmp 33 PID 2148 wrote to memory of 2500 2148 983A.tmp 33 PID 2148 wrote to memory of 2500 2148 983A.tmp 33 PID 2148 wrote to memory of 2500 2148 983A.tmp 33 PID 2500 wrote to memory of 2728 2500 98B7.tmp 34 PID 2500 wrote to memory of 2728 2500 98B7.tmp 34 PID 2500 wrote to memory of 2728 2500 98B7.tmp 34 PID 2500 wrote to memory of 2728 2500 98B7.tmp 34 PID 2728 wrote to memory of 2868 2728 9914.tmp 35 PID 2728 wrote to memory of 2868 2728 9914.tmp 35 PID 2728 wrote to memory of 2868 2728 9914.tmp 35 PID 2728 wrote to memory of 2868 2728 9914.tmp 35 PID 2868 wrote to memory of 2760 2868 9981.tmp 36 PID 2868 wrote to memory of 2760 2868 9981.tmp 36 PID 2868 wrote to memory of 2760 2868 9981.tmp 36 PID 2868 wrote to memory of 2760 2868 9981.tmp 36 PID 2760 wrote to memory of 3008 2760 99DF.tmp 37 PID 2760 wrote to memory of 3008 2760 99DF.tmp 37 PID 2760 wrote to memory of 3008 2760 99DF.tmp 37 PID 2760 wrote to memory of 3008 2760 99DF.tmp 37 PID 3008 wrote to memory of 2720 3008 9A4C.tmp 38 PID 3008 wrote to memory of 2720 3008 9A4C.tmp 38 PID 3008 wrote to memory of 2720 3008 9A4C.tmp 38 PID 3008 wrote to memory of 2720 3008 9A4C.tmp 38 PID 2720 wrote to memory of 2756 2720 9AAA.tmp 39 PID 2720 wrote to memory of 2756 2720 9AAA.tmp 39 PID 2720 wrote to memory of 2756 2720 9AAA.tmp 39 PID 2720 wrote to memory of 2756 2720 9AAA.tmp 39 PID 2756 wrote to memory of 2616 2756 9B17.tmp 40 PID 2756 wrote to memory of 2616 2756 9B17.tmp 40 PID 2756 wrote to memory of 2616 2756 9B17.tmp 40 PID 2756 wrote to memory of 2616 2756 9B17.tmp 40 PID 2616 wrote to memory of 2680 2616 9B84.tmp 41 PID 2616 wrote to memory of 2680 2616 9B84.tmp 41 PID 2616 wrote to memory of 2680 2616 9B84.tmp 41 PID 2616 wrote to memory of 2680 2616 9B84.tmp 41 PID 2680 wrote to memory of 2068 2680 9C11.tmp 42 PID 2680 wrote to memory of 2068 2680 9C11.tmp 42 PID 2680 wrote to memory of 2068 2680 9C11.tmp 42 PID 2680 wrote to memory of 2068 2680 9C11.tmp 42 PID 2068 wrote to memory of 560 2068 9C9D.tmp 43 PID 2068 wrote to memory of 560 2068 9C9D.tmp 43 PID 2068 wrote to memory of 560 2068 9C9D.tmp 43 PID 2068 wrote to memory of 560 2068 9C9D.tmp 43 PID 560 wrote to memory of 1968 560 9D1A.tmp 44 PID 560 wrote to memory of 1968 560 9D1A.tmp 44 PID 560 wrote to memory of 1968 560 9D1A.tmp 44 PID 560 wrote to memory of 1968 560 9D1A.tmp 44 PID 1968 wrote to memory of 2800 1968 9D87.tmp 45 PID 1968 wrote to memory of 2800 1968 9D87.tmp 45 PID 1968 wrote to memory of 2800 1968 9D87.tmp 45 PID 1968 wrote to memory of 2800 1968 9D87.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-03_7052d91f75b22dc590edbcab406a42cf_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-03_7052d91f75b22dc590edbcab406a42cf_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\975F.tmp"C:\Users\Admin\AppData\Local\Temp\975F.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\97CD.tmp"C:\Users\Admin\AppData\Local\Temp\97CD.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\983A.tmp"C:\Users\Admin\AppData\Local\Temp\983A.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\98B7.tmp"C:\Users\Admin\AppData\Local\Temp\98B7.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\9914.tmp"C:\Users\Admin\AppData\Local\Temp\9914.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\9981.tmp"C:\Users\Admin\AppData\Local\Temp\9981.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\99DF.tmp"C:\Users\Admin\AppData\Local\Temp\99DF.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\9B17.tmp"C:\Users\Admin\AppData\Local\Temp\9B17.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\9C11.tmp"C:\Users\Admin\AppData\Local\Temp\9C11.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\9C9D.tmp"C:\Users\Admin\AppData\Local\Temp\9C9D.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\9D1A.tmp"C:\Users\Admin\AppData\Local\Temp\9D1A.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Users\Admin\AppData\Local\Temp\9D87.tmp"C:\Users\Admin\AppData\Local\Temp\9D87.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\9DF4.tmp"C:\Users\Admin\AppData\Local\Temp\9DF4.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\9E52.tmp"C:\Users\Admin\AppData\Local\Temp\9E52.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\9ECF.tmp"C:\Users\Admin\AppData\Local\Temp\9ECF.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\9F2C.tmp"C:\Users\Admin\AppData\Local\Temp\9F2C.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\9FA9.tmp"C:\Users\Admin\AppData\Local\Temp\9FA9.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\A016.tmp"C:\Users\Admin\AppData\Local\Temp\A016.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\A093.tmp"C:\Users\Admin\AppData\Local\Temp\A093.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\A0F1.tmp"C:\Users\Admin\AppData\Local\Temp\A0F1.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\A12F.tmp"C:\Users\Admin\AppData\Local\Temp\A12F.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\A16D.tmp"C:\Users\Admin\AppData\Local\Temp\A16D.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\A1AC.tmp"C:\Users\Admin\AppData\Local\Temp\A1AC.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:788 -
C:\Users\Admin\AppData\Local\Temp\A1EA.tmp"C:\Users\Admin\AppData\Local\Temp\A1EA.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:280 -
C:\Users\Admin\AppData\Local\Temp\A229.tmp"C:\Users\Admin\AppData\Local\Temp\A229.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:596 -
C:\Users\Admin\AppData\Local\Temp\A267.tmp"C:\Users\Admin\AppData\Local\Temp\A267.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:320 -
C:\Users\Admin\AppData\Local\Temp\A2A5.tmp"C:\Users\Admin\AppData\Local\Temp\A2A5.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\A2F3.tmp"C:\Users\Admin\AppData\Local\Temp\A2F3.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\A332.tmp"C:\Users\Admin\AppData\Local\Temp\A332.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\A370.tmp"C:\Users\Admin\AppData\Local\Temp\A370.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\A3AF.tmp"C:\Users\Admin\AppData\Local\Temp\A3AF.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\A3ED.tmp"C:\Users\Admin\AppData\Local\Temp\A3ED.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\A42B.tmp"C:\Users\Admin\AppData\Local\Temp\A42B.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\A46A.tmp"C:\Users\Admin\AppData\Local\Temp\A46A.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\A4B8.tmp"C:\Users\Admin\AppData\Local\Temp\A4B8.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:644 -
C:\Users\Admin\AppData\Local\Temp\A4F6.tmp"C:\Users\Admin\AppData\Local\Temp\A4F6.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\A535.tmp"C:\Users\Admin\AppData\Local\Temp\A535.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\A573.tmp"C:\Users\Admin\AppData\Local\Temp\A573.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:916 -
C:\Users\Admin\AppData\Local\Temp\A5B1.tmp"C:\Users\Admin\AppData\Local\Temp\A5B1.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\A5FF.tmp"C:\Users\Admin\AppData\Local\Temp\A5FF.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:720 -
C:\Users\Admin\AppData\Local\Temp\A63E.tmp"C:\Users\Admin\AppData\Local\Temp\A63E.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\A67C.tmp"C:\Users\Admin\AppData\Local\Temp\A67C.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\A6BB.tmp"C:\Users\Admin\AppData\Local\Temp\A6BB.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\A6F9.tmp"C:\Users\Admin\AppData\Local\Temp\A6F9.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\A737.tmp"C:\Users\Admin\AppData\Local\Temp\A737.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:780 -
C:\Users\Admin\AppData\Local\Temp\A785.tmp"C:\Users\Admin\AppData\Local\Temp\A785.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\A7C4.tmp"C:\Users\Admin\AppData\Local\Temp\A7C4.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\A802.tmp"C:\Users\Admin\AppData\Local\Temp\A802.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\A841.tmp"C:\Users\Admin\AppData\Local\Temp\A841.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\A87F.tmp"C:\Users\Admin\AppData\Local\Temp\A87F.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\A8BD.tmp"C:\Users\Admin\AppData\Local\Temp\A8BD.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\A8FC.tmp"C:\Users\Admin\AppData\Local\Temp\A8FC.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\A94A.tmp"C:\Users\Admin\AppData\Local\Temp\A94A.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\A988.tmp"C:\Users\Admin\AppData\Local\Temp\A988.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\A9C7.tmp"C:\Users\Admin\AppData\Local\Temp\A9C7.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\AA05.tmp"C:\Users\Admin\AppData\Local\Temp\AA05.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\AA43.tmp"C:\Users\Admin\AppData\Local\Temp\AA43.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\AA82.tmp"C:\Users\Admin\AppData\Local\Temp\AA82.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\AAD0.tmp"C:\Users\Admin\AppData\Local\Temp\AAD0.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\AB0E.tmp"C:\Users\Admin\AppData\Local\Temp\AB0E.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\AB4D.tmp"C:\Users\Admin\AppData\Local\Temp\AB4D.tmp"65⤵
- Executes dropped EXE
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\AB8B.tmp"C:\Users\Admin\AppData\Local\Temp\AB8B.tmp"66⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\ABC9.tmp"C:\Users\Admin\AppData\Local\Temp\ABC9.tmp"67⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\AC08.tmp"C:\Users\Admin\AppData\Local\Temp\AC08.tmp"68⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\AC46.tmp"C:\Users\Admin\AppData\Local\Temp\AC46.tmp"69⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\AC85.tmp"C:\Users\Admin\AppData\Local\Temp\AC85.tmp"70⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\ACC3.tmp"C:\Users\Admin\AppData\Local\Temp\ACC3.tmp"71⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\AD01.tmp"C:\Users\Admin\AppData\Local\Temp\AD01.tmp"72⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\AD4F.tmp"C:\Users\Admin\AppData\Local\Temp\AD4F.tmp"73⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\AD8E.tmp"C:\Users\Admin\AppData\Local\Temp\AD8E.tmp"74⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\ADCC.tmp"C:\Users\Admin\AppData\Local\Temp\ADCC.tmp"75⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\AE1A.tmp"C:\Users\Admin\AppData\Local\Temp\AE1A.tmp"76⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\AE59.tmp"C:\Users\Admin\AppData\Local\Temp\AE59.tmp"77⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\AE97.tmp"C:\Users\Admin\AppData\Local\Temp\AE97.tmp"78⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\AED5.tmp"C:\Users\Admin\AppData\Local\Temp\AED5.tmp"79⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\AF14.tmp"C:\Users\Admin\AppData\Local\Temp\AF14.tmp"80⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\AF52.tmp"C:\Users\Admin\AppData\Local\Temp\AF52.tmp"81⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\AF91.tmp"C:\Users\Admin\AppData\Local\Temp\AF91.tmp"82⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\AFCF.tmp"C:\Users\Admin\AppData\Local\Temp\AFCF.tmp"83⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\B00D.tmp"C:\Users\Admin\AppData\Local\Temp\B00D.tmp"84⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\B05B.tmp"C:\Users\Admin\AppData\Local\Temp\B05B.tmp"85⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\B09A.tmp"C:\Users\Admin\AppData\Local\Temp\B09A.tmp"86⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\B0E8.tmp"C:\Users\Admin\AppData\Local\Temp\B0E8.tmp"87⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\B126.tmp"C:\Users\Admin\AppData\Local\Temp\B126.tmp"88⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\B165.tmp"C:\Users\Admin\AppData\Local\Temp\B165.tmp"89⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\B1A3.tmp"C:\Users\Admin\AppData\Local\Temp\B1A3.tmp"90⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\B1E1.tmp"C:\Users\Admin\AppData\Local\Temp\B1E1.tmp"91⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\B220.tmp"C:\Users\Admin\AppData\Local\Temp\B220.tmp"92⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\B25E.tmp"C:\Users\Admin\AppData\Local\Temp\B25E.tmp"93⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\B29D.tmp"C:\Users\Admin\AppData\Local\Temp\B29D.tmp"94⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\B2DB.tmp"C:\Users\Admin\AppData\Local\Temp\B2DB.tmp"95⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\B319.tmp"C:\Users\Admin\AppData\Local\Temp\B319.tmp"96⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\B358.tmp"C:\Users\Admin\AppData\Local\Temp\B358.tmp"97⤵
- System Location Discovery: System Language Discovery
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\B396.tmp"C:\Users\Admin\AppData\Local\Temp\B396.tmp"98⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\B3D5.tmp"C:\Users\Admin\AppData\Local\Temp\B3D5.tmp"99⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\B413.tmp"C:\Users\Admin\AppData\Local\Temp\B413.tmp"100⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\B451.tmp"C:\Users\Admin\AppData\Local\Temp\B451.tmp"101⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\B490.tmp"C:\Users\Admin\AppData\Local\Temp\B490.tmp"102⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\B4CE.tmp"C:\Users\Admin\AppData\Local\Temp\B4CE.tmp"103⤵
- System Location Discovery: System Language Discovery
PID:644 -
C:\Users\Admin\AppData\Local\Temp\B50D.tmp"C:\Users\Admin\AppData\Local\Temp\B50D.tmp"104⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\B54B.tmp"C:\Users\Admin\AppData\Local\Temp\B54B.tmp"105⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\B589.tmp"C:\Users\Admin\AppData\Local\Temp\B589.tmp"106⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\B5C8.tmp"C:\Users\Admin\AppData\Local\Temp\B5C8.tmp"107⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\B606.tmp"C:\Users\Admin\AppData\Local\Temp\B606.tmp"108⤵PID:720
-
C:\Users\Admin\AppData\Local\Temp\B645.tmp"C:\Users\Admin\AppData\Local\Temp\B645.tmp"109⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\B693.tmp"C:\Users\Admin\AppData\Local\Temp\B693.tmp"110⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\B6D1.tmp"C:\Users\Admin\AppData\Local\Temp\B6D1.tmp"111⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\B70F.tmp"C:\Users\Admin\AppData\Local\Temp\B70F.tmp"112⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\B75D.tmp"C:\Users\Admin\AppData\Local\Temp\B75D.tmp"113⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\B79C.tmp"C:\Users\Admin\AppData\Local\Temp\B79C.tmp"114⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\B7DA.tmp"C:\Users\Admin\AppData\Local\Temp\B7DA.tmp"115⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\B819.tmp"C:\Users\Admin\AppData\Local\Temp\B819.tmp"116⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\B867.tmp"C:\Users\Admin\AppData\Local\Temp\B867.tmp"117⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\B8B5.tmp"C:\Users\Admin\AppData\Local\Temp\B8B5.tmp"118⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\B8F3.tmp"C:\Users\Admin\AppData\Local\Temp\B8F3.tmp"119⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\B931.tmp"C:\Users\Admin\AppData\Local\Temp\B931.tmp"120⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\B970.tmp"C:\Users\Admin\AppData\Local\Temp\B970.tmp"121⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\B9AE.tmp"C:\Users\Admin\AppData\Local\Temp\B9AE.tmp"122⤵PID:2364
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-