Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/09/2024, 05:52
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-05_42d7ab572b790cf784e1c533dbe907ee_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-05_42d7ab572b790cf784e1c533dbe907ee_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-05_42d7ab572b790cf784e1c533dbe907ee_mafia.exe
-
Size
712KB
-
MD5
42d7ab572b790cf784e1c533dbe907ee
-
SHA1
8ad86eec44b1566ae91bfdac926b16238eece637
-
SHA256
8a8a562c0b4f4a9432bea2d841fd8a83b6e95d40955a4e32fb13bfa0809cc890
-
SHA512
b0fc3f86edd7b086076b343912de1431c83064393a079418ee67d63a625ab8228f94df40f97ad87502a4e2c5bb565517358f9543eaf7a7fccd1be1fbf5a448ca
-
SSDEEP
12288:FU5rCOTeiDJzSVKj2G/zaAt1taTl56G2flgZ6NZdCvq5TJLCvY90D8/LVBlVk730:FUQOJDJl2ES556GAlg4NnCvq5TJLCvYR
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2684 5E27.tmp 2644 5E94.tmp 2880 5F11.tmp 2692 5F6E.tmp 2532 5FDC.tmp 2648 6039.tmp 3048 6087.tmp 480 60F4.tmp 992 6133.tmp 1308 6190.tmp 2980 61FE.tmp 2400 625B.tmp 1840 629A.tmp 2436 6307.tmp 1232 6345.tmp 2000 63C2.tmp 2772 645E.tmp 2032 649D.tmp 2788 64EB.tmp 2376 6558.tmp 1736 65B5.tmp 2928 6642.tmp 2408 669F.tmp 2128 66DE.tmp 2228 671C.tmp 1864 675B.tmp 2940 67A9.tmp 868 67E7.tmp 236 6825.tmp 764 6883.tmp 1264 68E1.tmp 656 693E.tmp 1660 698C.tmp 2364 69CB.tmp 1944 6A19.tmp 1676 6A67.tmp 956 6AA5.tmp 1472 6AF3.tmp 1456 6B31.tmp 1956 6B70.tmp 892 6BBE.tmp 1092 6BFC.tmp 2384 6C3B.tmp 1912 6C79.tmp 1856 6CC7.tmp 3020 6D05.tmp 1788 6D53.tmp 2332 6D92.tmp 1992 6DE0.tmp 2712 6E1E.tmp 2296 6E5D.tmp 1528 6E9B.tmp 1516 6ED9.tmp 2848 6F18.tmp 2908 6F56.tmp 2852 6FA4.tmp 2808 6FE3.tmp 1640 7031.tmp 2692 707F.tmp 2984 70BD.tmp 2580 710B.tmp 3000 7188.tmp 3048 71D6.tmp 568 7224.tmp -
Loads dropped DLL 64 IoCs
pid Process 2820 2024-09-05_42d7ab572b790cf784e1c533dbe907ee_mafia.exe 2684 5E27.tmp 2644 5E94.tmp 2880 5F11.tmp 2692 5F6E.tmp 2532 5FDC.tmp 2648 6039.tmp 3048 6087.tmp 480 60F4.tmp 992 6133.tmp 1308 6190.tmp 2980 61FE.tmp 2400 625B.tmp 1840 629A.tmp 2436 6307.tmp 1232 6345.tmp 2000 63C2.tmp 2772 645E.tmp 2032 649D.tmp 2788 64EB.tmp 2376 6558.tmp 1736 65B5.tmp 2928 6642.tmp 2408 669F.tmp 2128 66DE.tmp 2228 671C.tmp 1864 675B.tmp 2940 67A9.tmp 868 67E7.tmp 236 6825.tmp 764 6883.tmp 1264 68E1.tmp 656 693E.tmp 1660 698C.tmp 2364 69CB.tmp 1944 6A19.tmp 1676 6A67.tmp 956 6AA5.tmp 1472 6AF3.tmp 1456 6B31.tmp 1956 6B70.tmp 892 6BBE.tmp 1092 6BFC.tmp 2384 6C3B.tmp 1912 6C79.tmp 1856 6CC7.tmp 3020 6D05.tmp 1788 6D53.tmp 2332 6D92.tmp 1992 6DE0.tmp 2712 6E1E.tmp 2296 6E5D.tmp 1528 6E9B.tmp 1516 6ED9.tmp 2848 6F18.tmp 2908 6F56.tmp 2852 6FA4.tmp 2808 6FE3.tmp 1640 7031.tmp 2692 707F.tmp 2984 70BD.tmp 2580 710B.tmp 3000 7188.tmp 3048 71D6.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A2D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A89E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3256.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D28B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BBE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4089.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2230.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3775.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 906.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 416.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8CA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 400C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4144.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF7F.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2820 wrote to memory of 2684 2820 2024-09-05_42d7ab572b790cf784e1c533dbe907ee_mafia.exe 30 PID 2820 wrote to memory of 2684 2820 2024-09-05_42d7ab572b790cf784e1c533dbe907ee_mafia.exe 30 PID 2820 wrote to memory of 2684 2820 2024-09-05_42d7ab572b790cf784e1c533dbe907ee_mafia.exe 30 PID 2820 wrote to memory of 2684 2820 2024-09-05_42d7ab572b790cf784e1c533dbe907ee_mafia.exe 30 PID 2684 wrote to memory of 2644 2684 5E27.tmp 31 PID 2684 wrote to memory of 2644 2684 5E27.tmp 31 PID 2684 wrote to memory of 2644 2684 5E27.tmp 31 PID 2684 wrote to memory of 2644 2684 5E27.tmp 31 PID 2644 wrote to memory of 2880 2644 5E94.tmp 32 PID 2644 wrote to memory of 2880 2644 5E94.tmp 32 PID 2644 wrote to memory of 2880 2644 5E94.tmp 32 PID 2644 wrote to memory of 2880 2644 5E94.tmp 32 PID 2880 wrote to memory of 2692 2880 5F11.tmp 33 PID 2880 wrote to memory of 2692 2880 5F11.tmp 33 PID 2880 wrote to memory of 2692 2880 5F11.tmp 33 PID 2880 wrote to memory of 2692 2880 5F11.tmp 33 PID 2692 wrote to memory of 2532 2692 5F6E.tmp 34 PID 2692 wrote to memory of 2532 2692 5F6E.tmp 34 PID 2692 wrote to memory of 2532 2692 5F6E.tmp 34 PID 2692 wrote to memory of 2532 2692 5F6E.tmp 34 PID 2532 wrote to memory of 2648 2532 5FDC.tmp 35 PID 2532 wrote to memory of 2648 2532 5FDC.tmp 35 PID 2532 wrote to memory of 2648 2532 5FDC.tmp 35 PID 2532 wrote to memory of 2648 2532 5FDC.tmp 35 PID 2648 wrote to memory of 3048 2648 6039.tmp 36 PID 2648 wrote to memory of 3048 2648 6039.tmp 36 PID 2648 wrote to memory of 3048 2648 6039.tmp 36 PID 2648 wrote to memory of 3048 2648 6039.tmp 36 PID 3048 wrote to memory of 480 3048 6087.tmp 37 PID 3048 wrote to memory of 480 3048 6087.tmp 37 PID 3048 wrote to memory of 480 3048 6087.tmp 37 PID 3048 wrote to memory of 480 3048 6087.tmp 37 PID 480 wrote to memory of 992 480 60F4.tmp 38 PID 480 wrote to memory of 992 480 60F4.tmp 38 PID 480 wrote to memory of 992 480 60F4.tmp 38 PID 480 wrote to memory of 992 480 60F4.tmp 38 PID 992 wrote to memory of 1308 992 6133.tmp 39 PID 992 wrote to memory of 1308 992 6133.tmp 39 PID 992 wrote to memory of 1308 992 6133.tmp 39 PID 992 wrote to memory of 1308 992 6133.tmp 39 PID 1308 wrote to memory of 2980 1308 6190.tmp 40 PID 1308 wrote to memory of 2980 1308 6190.tmp 40 PID 1308 wrote to memory of 2980 1308 6190.tmp 40 PID 1308 wrote to memory of 2980 1308 6190.tmp 40 PID 2980 wrote to memory of 2400 2980 61FE.tmp 41 PID 2980 wrote to memory of 2400 2980 61FE.tmp 41 PID 2980 wrote to memory of 2400 2980 61FE.tmp 41 PID 2980 wrote to memory of 2400 2980 61FE.tmp 41 PID 2400 wrote to memory of 1840 2400 625B.tmp 42 PID 2400 wrote to memory of 1840 2400 625B.tmp 42 PID 2400 wrote to memory of 1840 2400 625B.tmp 42 PID 2400 wrote to memory of 1840 2400 625B.tmp 42 PID 1840 wrote to memory of 2436 1840 629A.tmp 43 PID 1840 wrote to memory of 2436 1840 629A.tmp 43 PID 1840 wrote to memory of 2436 1840 629A.tmp 43 PID 1840 wrote to memory of 2436 1840 629A.tmp 43 PID 2436 wrote to memory of 1232 2436 6307.tmp 44 PID 2436 wrote to memory of 1232 2436 6307.tmp 44 PID 2436 wrote to memory of 1232 2436 6307.tmp 44 PID 2436 wrote to memory of 1232 2436 6307.tmp 44 PID 1232 wrote to memory of 2000 1232 6345.tmp 45 PID 1232 wrote to memory of 2000 1232 6345.tmp 45 PID 1232 wrote to memory of 2000 1232 6345.tmp 45 PID 1232 wrote to memory of 2000 1232 6345.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-05_42d7ab572b790cf784e1c533dbe907ee_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-05_42d7ab572b790cf784e1c533dbe907ee_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\5E27.tmp"C:\Users\Admin\AppData\Local\Temp\5E27.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\5E94.tmp"C:\Users\Admin\AppData\Local\Temp\5E94.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\5F11.tmp"C:\Users\Admin\AppData\Local\Temp\5F11.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\5F6E.tmp"C:\Users\Admin\AppData\Local\Temp\5F6E.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\5FDC.tmp"C:\Users\Admin\AppData\Local\Temp\5FDC.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\6039.tmp"C:\Users\Admin\AppData\Local\Temp\6039.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\6087.tmp"C:\Users\Admin\AppData\Local\Temp\6087.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\60F4.tmp"C:\Users\Admin\AppData\Local\Temp\60F4.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Users\Admin\AppData\Local\Temp\6133.tmp"C:\Users\Admin\AppData\Local\Temp\6133.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\AppData\Local\Temp\6190.tmp"C:\Users\Admin\AppData\Local\Temp\6190.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\61FE.tmp"C:\Users\Admin\AppData\Local\Temp\61FE.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\625B.tmp"C:\Users\Admin\AppData\Local\Temp\625B.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\629A.tmp"C:\Users\Admin\AppData\Local\Temp\629A.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\6307.tmp"C:\Users\Admin\AppData\Local\Temp\6307.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\6345.tmp"C:\Users\Admin\AppData\Local\Temp\6345.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\63C2.tmp"C:\Users\Admin\AppData\Local\Temp\63C2.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\645E.tmp"C:\Users\Admin\AppData\Local\Temp\645E.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\649D.tmp"C:\Users\Admin\AppData\Local\Temp\649D.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\64EB.tmp"C:\Users\Admin\AppData\Local\Temp\64EB.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\6558.tmp"C:\Users\Admin\AppData\Local\Temp\6558.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\65B5.tmp"C:\Users\Admin\AppData\Local\Temp\65B5.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\6642.tmp"C:\Users\Admin\AppData\Local\Temp\6642.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\669F.tmp"C:\Users\Admin\AppData\Local\Temp\669F.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\66DE.tmp"C:\Users\Admin\AppData\Local\Temp\66DE.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\671C.tmp"C:\Users\Admin\AppData\Local\Temp\671C.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\675B.tmp"C:\Users\Admin\AppData\Local\Temp\675B.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\67A9.tmp"C:\Users\Admin\AppData\Local\Temp\67A9.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\67E7.tmp"C:\Users\Admin\AppData\Local\Temp\67E7.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:868 -
C:\Users\Admin\AppData\Local\Temp\6825.tmp"C:\Users\Admin\AppData\Local\Temp\6825.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:236 -
C:\Users\Admin\AppData\Local\Temp\6883.tmp"C:\Users\Admin\AppData\Local\Temp\6883.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:764 -
C:\Users\Admin\AppData\Local\Temp\68E1.tmp"C:\Users\Admin\AppData\Local\Temp\68E1.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\693E.tmp"C:\Users\Admin\AppData\Local\Temp\693E.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:656 -
C:\Users\Admin\AppData\Local\Temp\698C.tmp"C:\Users\Admin\AppData\Local\Temp\698C.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\69CB.tmp"C:\Users\Admin\AppData\Local\Temp\69CB.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\6A19.tmp"C:\Users\Admin\AppData\Local\Temp\6A19.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\6A67.tmp"C:\Users\Admin\AppData\Local\Temp\6A67.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\6AA5.tmp"C:\Users\Admin\AppData\Local\Temp\6AA5.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:956 -
C:\Users\Admin\AppData\Local\Temp\6AF3.tmp"C:\Users\Admin\AppData\Local\Temp\6AF3.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\6B31.tmp"C:\Users\Admin\AppData\Local\Temp\6B31.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\6B70.tmp"C:\Users\Admin\AppData\Local\Temp\6B70.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\6BBE.tmp"C:\Users\Admin\AppData\Local\Temp\6BBE.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:892 -
C:\Users\Admin\AppData\Local\Temp\6BFC.tmp"C:\Users\Admin\AppData\Local\Temp\6BFC.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\6C3B.tmp"C:\Users\Admin\AppData\Local\Temp\6C3B.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\6C79.tmp"C:\Users\Admin\AppData\Local\Temp\6C79.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\6CC7.tmp"C:\Users\Admin\AppData\Local\Temp\6CC7.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\6D05.tmp"C:\Users\Admin\AppData\Local\Temp\6D05.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\6D53.tmp"C:\Users\Admin\AppData\Local\Temp\6D53.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\6D92.tmp"C:\Users\Admin\AppData\Local\Temp\6D92.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\6DE0.tmp"C:\Users\Admin\AppData\Local\Temp\6DE0.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\6E1E.tmp"C:\Users\Admin\AppData\Local\Temp\6E1E.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\6E5D.tmp"C:\Users\Admin\AppData\Local\Temp\6E5D.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\6E9B.tmp"C:\Users\Admin\AppData\Local\Temp\6E9B.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\6ED9.tmp"C:\Users\Admin\AppData\Local\Temp\6ED9.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\6F18.tmp"C:\Users\Admin\AppData\Local\Temp\6F18.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\6F56.tmp"C:\Users\Admin\AppData\Local\Temp\6F56.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\6FA4.tmp"C:\Users\Admin\AppData\Local\Temp\6FA4.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\6FE3.tmp"C:\Users\Admin\AppData\Local\Temp\6FE3.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\7031.tmp"C:\Users\Admin\AppData\Local\Temp\7031.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\707F.tmp"C:\Users\Admin\AppData\Local\Temp\707F.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\70BD.tmp"C:\Users\Admin\AppData\Local\Temp\70BD.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\710B.tmp"C:\Users\Admin\AppData\Local\Temp\710B.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\7188.tmp"C:\Users\Admin\AppData\Local\Temp\7188.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\71D6.tmp"C:\Users\Admin\AppData\Local\Temp\71D6.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\7224.tmp"C:\Users\Admin\AppData\Local\Temp\7224.tmp"65⤵
- Executes dropped EXE
PID:568 -
C:\Users\Admin\AppData\Local\Temp\7262.tmp"C:\Users\Admin\AppData\Local\Temp\7262.tmp"66⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\72B0.tmp"C:\Users\Admin\AppData\Local\Temp\72B0.tmp"67⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\72FE.tmp"C:\Users\Admin\AppData\Local\Temp\72FE.tmp"68⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\734C.tmp"C:\Users\Admin\AppData\Local\Temp\734C.tmp"69⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\738B.tmp"C:\Users\Admin\AppData\Local\Temp\738B.tmp"70⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\73C9.tmp"C:\Users\Admin\AppData\Local\Temp\73C9.tmp"71⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"72⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\7446.tmp"C:\Users\Admin\AppData\Local\Temp\7446.tmp"73⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\7484.tmp"C:\Users\Admin\AppData\Local\Temp\7484.tmp"74⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"75⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"76⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\754F.tmp"C:\Users\Admin\AppData\Local\Temp\754F.tmp"77⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\758D.tmp"C:\Users\Admin\AppData\Local\Temp\758D.tmp"78⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\75CC.tmp"C:\Users\Admin\AppData\Local\Temp\75CC.tmp"79⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\760A.tmp"C:\Users\Admin\AppData\Local\Temp\760A.tmp"80⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\7649.tmp"C:\Users\Admin\AppData\Local\Temp\7649.tmp"81⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\7687.tmp"C:\Users\Admin\AppData\Local\Temp\7687.tmp"82⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\76C5.tmp"C:\Users\Admin\AppData\Local\Temp\76C5.tmp"83⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\7704.tmp"C:\Users\Admin\AppData\Local\Temp\7704.tmp"84⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\7742.tmp"C:\Users\Admin\AppData\Local\Temp\7742.tmp"85⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\7781.tmp"C:\Users\Admin\AppData\Local\Temp\7781.tmp"86⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\77BF.tmp"C:\Users\Admin\AppData\Local\Temp\77BF.tmp"87⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\77FD.tmp"C:\Users\Admin\AppData\Local\Temp\77FD.tmp"88⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\783C.tmp"C:\Users\Admin\AppData\Local\Temp\783C.tmp"89⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\787A.tmp"C:\Users\Admin\AppData\Local\Temp\787A.tmp"90⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\78B9.tmp"C:\Users\Admin\AppData\Local\Temp\78B9.tmp"91⤵
- System Location Discovery: System Language Discovery
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\78F7.tmp"C:\Users\Admin\AppData\Local\Temp\78F7.tmp"92⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\7935.tmp"C:\Users\Admin\AppData\Local\Temp\7935.tmp"93⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\7974.tmp"C:\Users\Admin\AppData\Local\Temp\7974.tmp"94⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\79B2.tmp"C:\Users\Admin\AppData\Local\Temp\79B2.tmp"95⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\79F1.tmp"C:\Users\Admin\AppData\Local\Temp\79F1.tmp"96⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\7A2F.tmp"C:\Users\Admin\AppData\Local\Temp\7A2F.tmp"97⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\7A6D.tmp"C:\Users\Admin\AppData\Local\Temp\7A6D.tmp"98⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\7AAC.tmp"C:\Users\Admin\AppData\Local\Temp\7AAC.tmp"99⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\7AEA.tmp"C:\Users\Admin\AppData\Local\Temp\7AEA.tmp"100⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\7B29.tmp"C:\Users\Admin\AppData\Local\Temp\7B29.tmp"101⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\7B67.tmp"C:\Users\Admin\AppData\Local\Temp\7B67.tmp"102⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\7BB5.tmp"C:\Users\Admin\AppData\Local\Temp\7BB5.tmp"103⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\7BF3.tmp"C:\Users\Admin\AppData\Local\Temp\7BF3.tmp"104⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\7C32.tmp"C:\Users\Admin\AppData\Local\Temp\7C32.tmp"105⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\7C70.tmp"C:\Users\Admin\AppData\Local\Temp\7C70.tmp"106⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\7CAF.tmp"C:\Users\Admin\AppData\Local\Temp\7CAF.tmp"107⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\7CED.tmp"C:\Users\Admin\AppData\Local\Temp\7CED.tmp"108⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\7D2B.tmp"C:\Users\Admin\AppData\Local\Temp\7D2B.tmp"109⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\7D6A.tmp"C:\Users\Admin\AppData\Local\Temp\7D6A.tmp"110⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\7DA8.tmp"C:\Users\Admin\AppData\Local\Temp\7DA8.tmp"111⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\7DE7.tmp"C:\Users\Admin\AppData\Local\Temp\7DE7.tmp"112⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\7E35.tmp"C:\Users\Admin\AppData\Local\Temp\7E35.tmp"113⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\7E73.tmp"C:\Users\Admin\AppData\Local\Temp\7E73.tmp"114⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\7EB1.tmp"C:\Users\Admin\AppData\Local\Temp\7EB1.tmp"115⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\7EF0.tmp"C:\Users\Admin\AppData\Local\Temp\7EF0.tmp"116⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\7F3E.tmp"C:\Users\Admin\AppData\Local\Temp\7F3E.tmp"117⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\7F7C.tmp"C:\Users\Admin\AppData\Local\Temp\7F7C.tmp"118⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\7FBB.tmp"C:\Users\Admin\AppData\Local\Temp\7FBB.tmp"119⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\7FF9.tmp"C:\Users\Admin\AppData\Local\Temp\7FF9.tmp"120⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\8037.tmp"C:\Users\Admin\AppData\Local\Temp\8037.tmp"121⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\8076.tmp"C:\Users\Admin\AppData\Local\Temp\8076.tmp"122⤵PID:2548
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-