Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05-09-2024 06:01
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-05_95e77fbf78d8378de02e8ae1ecf9b10d_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-05_95e77fbf78d8378de02e8ae1ecf9b10d_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-05_95e77fbf78d8378de02e8ae1ecf9b10d_mafia.exe
-
Size
541KB
-
MD5
95e77fbf78d8378de02e8ae1ecf9b10d
-
SHA1
4bc716216667f0d6b60ed8d65a98a320916ff5b0
-
SHA256
f9ed4f8c6ebb50a71a6c5a1f0fdf9ca0f093521e56b0d62f08533d95f22e886e
-
SHA512
5fc89facc406f582fa82ab9367fbd6379a20978e06ab3133717bae91b818c602e75d97775f3a3a26974a30f1e1eb3db2debf0f00b1786c51d9c9bf8f16c2a3b4
-
SSDEEP
12288:UU5rCOTeif0t7rTR69+cBR13T5HrZa73ctO:UUQOJf0VrE9HBRdJrU73ctO
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2160 D9DB.tmp 2896 DA29.tmp 2460 DAA6.tmp 2836 DB13.tmp 2380 DB80.tmp 2728 DBDE.tmp 2768 DC3B.tmp 2760 DC99.tmp 2812 DD06.tmp 2564 DD64.tmp 1912 DDC2.tmp 2600 DE10.tmp 2592 DE8C.tmp 1656 DEEA.tmp 540 DF57.tmp 2312 DFC4.tmp 708 E032.tmp 1588 E080.tmp 1688 E0FC.tmp 2316 E15A.tmp 768 E1D7.tmp 1524 E244.tmp 1572 E292.tmp 1964 E2D0.tmp 1504 E30F.tmp 2360 E34D.tmp 2524 E38C.tmp 3044 E3CA.tmp 1916 E408.tmp 2344 E447.tmp 1992 E485.tmp 964 E4C4.tmp 328 E502.tmp 1648 E540.tmp 1668 E57F.tmp 932 E5CD.tmp 2864 E60B.tmp 2868 E64A.tmp 1220 E688.tmp 788 E6C6.tmp 3052 E714.tmp 1124 E762.tmp 2076 E7A1.tmp 568 E7DF.tmp 2248 E81E.tmp 3020 E85C.tmp 2200 E89A.tmp 1424 E8D9.tmp 904 E917.tmp 2056 E956.tmp 2416 E9A4.tmp 1544 E9E2.tmp 1840 EA30.tmp 2168 EA6E.tmp 2448 EAAD.tmp 2412 EAEB.tmp 2460 EB2A.tmp 2984 EB68.tmp 2652 EBA6.tmp 2732 EBE5.tmp 2752 EC23.tmp 2728 EC62.tmp 2768 ECA0.tmp 2992 ECDE.tmp -
Loads dropped DLL 64 IoCs
pid Process 2384 2024-09-05_95e77fbf78d8378de02e8ae1ecf9b10d_mafia.exe 2160 D9DB.tmp 2896 DA29.tmp 2460 DAA6.tmp 2836 DB13.tmp 2380 DB80.tmp 2728 DBDE.tmp 2768 DC3B.tmp 2760 DC99.tmp 2812 DD06.tmp 2564 DD64.tmp 1912 DDC2.tmp 2600 DE10.tmp 2592 DE8C.tmp 1656 DEEA.tmp 540 DF57.tmp 2312 DFC4.tmp 708 E032.tmp 1588 E080.tmp 1688 E0FC.tmp 2316 E15A.tmp 768 E1D7.tmp 1524 E244.tmp 1572 E292.tmp 1964 E2D0.tmp 1504 E30F.tmp 2360 E34D.tmp 2524 E38C.tmp 3044 E3CA.tmp 1916 E408.tmp 2344 E447.tmp 1992 E485.tmp 964 E4C4.tmp 328 E502.tmp 1648 E540.tmp 1668 E57F.tmp 932 E5CD.tmp 2864 E60B.tmp 2868 E64A.tmp 1220 E688.tmp 788 E6C6.tmp 3052 E714.tmp 1124 E762.tmp 2076 E7A1.tmp 568 E7DF.tmp 2248 E81E.tmp 3020 E85C.tmp 2200 E89A.tmp 1424 E8D9.tmp 904 E917.tmp 2056 E956.tmp 2416 E9A4.tmp 1544 E9E2.tmp 1840 EA30.tmp 2168 EA6E.tmp 2448 EAAD.tmp 2412 EAEB.tmp 2460 EB2A.tmp 2984 EB68.tmp 2652 EBA6.tmp 2732 EBE5.tmp 2752 EC23.tmp 2728 EC62.tmp 2768 ECA0.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 953D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E447.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DD9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8823.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BB3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2694.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9AB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F92.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C61.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1AB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3340.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E7DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4309.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8057.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 692F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9FA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2384 wrote to memory of 2160 2384 2024-09-05_95e77fbf78d8378de02e8ae1ecf9b10d_mafia.exe 31 PID 2384 wrote to memory of 2160 2384 2024-09-05_95e77fbf78d8378de02e8ae1ecf9b10d_mafia.exe 31 PID 2384 wrote to memory of 2160 2384 2024-09-05_95e77fbf78d8378de02e8ae1ecf9b10d_mafia.exe 31 PID 2384 wrote to memory of 2160 2384 2024-09-05_95e77fbf78d8378de02e8ae1ecf9b10d_mafia.exe 31 PID 2160 wrote to memory of 2896 2160 D9DB.tmp 32 PID 2160 wrote to memory of 2896 2160 D9DB.tmp 32 PID 2160 wrote to memory of 2896 2160 D9DB.tmp 32 PID 2160 wrote to memory of 2896 2160 D9DB.tmp 32 PID 2896 wrote to memory of 2460 2896 DA29.tmp 33 PID 2896 wrote to memory of 2460 2896 DA29.tmp 33 PID 2896 wrote to memory of 2460 2896 DA29.tmp 33 PID 2896 wrote to memory of 2460 2896 DA29.tmp 33 PID 2460 wrote to memory of 2836 2460 DAA6.tmp 34 PID 2460 wrote to memory of 2836 2460 DAA6.tmp 34 PID 2460 wrote to memory of 2836 2460 DAA6.tmp 34 PID 2460 wrote to memory of 2836 2460 DAA6.tmp 34 PID 2836 wrote to memory of 2380 2836 DB13.tmp 35 PID 2836 wrote to memory of 2380 2836 DB13.tmp 35 PID 2836 wrote to memory of 2380 2836 DB13.tmp 35 PID 2836 wrote to memory of 2380 2836 DB13.tmp 35 PID 2380 wrote to memory of 2728 2380 DB80.tmp 36 PID 2380 wrote to memory of 2728 2380 DB80.tmp 36 PID 2380 wrote to memory of 2728 2380 DB80.tmp 36 PID 2380 wrote to memory of 2728 2380 DB80.tmp 36 PID 2728 wrote to memory of 2768 2728 DBDE.tmp 37 PID 2728 wrote to memory of 2768 2728 DBDE.tmp 37 PID 2728 wrote to memory of 2768 2728 DBDE.tmp 37 PID 2728 wrote to memory of 2768 2728 DBDE.tmp 37 PID 2768 wrote to memory of 2760 2768 DC3B.tmp 38 PID 2768 wrote to memory of 2760 2768 DC3B.tmp 38 PID 2768 wrote to memory of 2760 2768 DC3B.tmp 38 PID 2768 wrote to memory of 2760 2768 DC3B.tmp 38 PID 2760 wrote to memory of 2812 2760 DC99.tmp 39 PID 2760 wrote to memory of 2812 2760 DC99.tmp 39 PID 2760 wrote to memory of 2812 2760 DC99.tmp 39 PID 2760 wrote to memory of 2812 2760 DC99.tmp 39 PID 2812 wrote to memory of 2564 2812 DD06.tmp 40 PID 2812 wrote to memory of 2564 2812 DD06.tmp 40 PID 2812 wrote to memory of 2564 2812 DD06.tmp 40 PID 2812 wrote to memory of 2564 2812 DD06.tmp 40 PID 2564 wrote to memory of 1912 2564 DD64.tmp 41 PID 2564 wrote to memory of 1912 2564 DD64.tmp 41 PID 2564 wrote to memory of 1912 2564 DD64.tmp 41 PID 2564 wrote to memory of 1912 2564 DD64.tmp 41 PID 1912 wrote to memory of 2600 1912 DDC2.tmp 42 PID 1912 wrote to memory of 2600 1912 DDC2.tmp 42 PID 1912 wrote to memory of 2600 1912 DDC2.tmp 42 PID 1912 wrote to memory of 2600 1912 DDC2.tmp 42 PID 2600 wrote to memory of 2592 2600 DE10.tmp 43 PID 2600 wrote to memory of 2592 2600 DE10.tmp 43 PID 2600 wrote to memory of 2592 2600 DE10.tmp 43 PID 2600 wrote to memory of 2592 2600 DE10.tmp 43 PID 2592 wrote to memory of 1656 2592 DE8C.tmp 44 PID 2592 wrote to memory of 1656 2592 DE8C.tmp 44 PID 2592 wrote to memory of 1656 2592 DE8C.tmp 44 PID 2592 wrote to memory of 1656 2592 DE8C.tmp 44 PID 1656 wrote to memory of 540 1656 DEEA.tmp 45 PID 1656 wrote to memory of 540 1656 DEEA.tmp 45 PID 1656 wrote to memory of 540 1656 DEEA.tmp 45 PID 1656 wrote to memory of 540 1656 DEEA.tmp 45 PID 540 wrote to memory of 2312 540 DF57.tmp 46 PID 540 wrote to memory of 2312 540 DF57.tmp 46 PID 540 wrote to memory of 2312 540 DF57.tmp 46 PID 540 wrote to memory of 2312 540 DF57.tmp 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-05_95e77fbf78d8378de02e8ae1ecf9b10d_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-05_95e77fbf78d8378de02e8ae1ecf9b10d_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\D9DB.tmp"C:\Users\Admin\AppData\Local\Temp\D9DB.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\DA29.tmp"C:\Users\Admin\AppData\Local\Temp\DA29.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\DAA6.tmp"C:\Users\Admin\AppData\Local\Temp\DAA6.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\DB13.tmp"C:\Users\Admin\AppData\Local\Temp\DB13.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\DB80.tmp"C:\Users\Admin\AppData\Local\Temp\DB80.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\DBDE.tmp"C:\Users\Admin\AppData\Local\Temp\DBDE.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\DC3B.tmp"C:\Users\Admin\AppData\Local\Temp\DC3B.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\DC99.tmp"C:\Users\Admin\AppData\Local\Temp\DC99.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\DD06.tmp"C:\Users\Admin\AppData\Local\Temp\DD06.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\DD64.tmp"C:\Users\Admin\AppData\Local\Temp\DD64.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\DDC2.tmp"C:\Users\Admin\AppData\Local\Temp\DDC2.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\DE10.tmp"C:\Users\Admin\AppData\Local\Temp\DE10.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\DE8C.tmp"C:\Users\Admin\AppData\Local\Temp\DE8C.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\DEEA.tmp"C:\Users\Admin\AppData\Local\Temp\DEEA.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\DF57.tmp"C:\Users\Admin\AppData\Local\Temp\DF57.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\AppData\Local\Temp\DFC4.tmp"C:\Users\Admin\AppData\Local\Temp\DFC4.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\E032.tmp"C:\Users\Admin\AppData\Local\Temp\E032.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:708 -
C:\Users\Admin\AppData\Local\Temp\E080.tmp"C:\Users\Admin\AppData\Local\Temp\E080.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\E0FC.tmp"C:\Users\Admin\AppData\Local\Temp\E0FC.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\E15A.tmp"C:\Users\Admin\AppData\Local\Temp\E15A.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\E1D7.tmp"C:\Users\Admin\AppData\Local\Temp\E1D7.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:768 -
C:\Users\Admin\AppData\Local\Temp\E244.tmp"C:\Users\Admin\AppData\Local\Temp\E244.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\E292.tmp"C:\Users\Admin\AppData\Local\Temp\E292.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\E2D0.tmp"C:\Users\Admin\AppData\Local\Temp\E2D0.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\E30F.tmp"C:\Users\Admin\AppData\Local\Temp\E30F.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\E34D.tmp"C:\Users\Admin\AppData\Local\Temp\E34D.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\E38C.tmp"C:\Users\Admin\AppData\Local\Temp\E38C.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\E3CA.tmp"C:\Users\Admin\AppData\Local\Temp\E3CA.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\E408.tmp"C:\Users\Admin\AppData\Local\Temp\E408.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\E447.tmp"C:\Users\Admin\AppData\Local\Temp\E447.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\E485.tmp"C:\Users\Admin\AppData\Local\Temp\E485.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\E4C4.tmp"C:\Users\Admin\AppData\Local\Temp\E4C4.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:964 -
C:\Users\Admin\AppData\Local\Temp\E502.tmp"C:\Users\Admin\AppData\Local\Temp\E502.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:328 -
C:\Users\Admin\AppData\Local\Temp\E540.tmp"C:\Users\Admin\AppData\Local\Temp\E540.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\E57F.tmp"C:\Users\Admin\AppData\Local\Temp\E57F.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\E5CD.tmp"C:\Users\Admin\AppData\Local\Temp\E5CD.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:932 -
C:\Users\Admin\AppData\Local\Temp\E60B.tmp"C:\Users\Admin\AppData\Local\Temp\E60B.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\E64A.tmp"C:\Users\Admin\AppData\Local\Temp\E64A.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\E688.tmp"C:\Users\Admin\AppData\Local\Temp\E688.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\E6C6.tmp"C:\Users\Admin\AppData\Local\Temp\E6C6.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:788 -
C:\Users\Admin\AppData\Local\Temp\E714.tmp"C:\Users\Admin\AppData\Local\Temp\E714.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\E762.tmp"C:\Users\Admin\AppData\Local\Temp\E762.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\E7DF.tmp"C:\Users\Admin\AppData\Local\Temp\E7DF.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:568 -
C:\Users\Admin\AppData\Local\Temp\E81E.tmp"C:\Users\Admin\AppData\Local\Temp\E81E.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\E85C.tmp"C:\Users\Admin\AppData\Local\Temp\E85C.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\E89A.tmp"C:\Users\Admin\AppData\Local\Temp\E89A.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\E917.tmp"C:\Users\Admin\AppData\Local\Temp\E917.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:904 -
C:\Users\Admin\AppData\Local\Temp\E956.tmp"C:\Users\Admin\AppData\Local\Temp\E956.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\E9A4.tmp"C:\Users\Admin\AppData\Local\Temp\E9A4.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\E9E2.tmp"C:\Users\Admin\AppData\Local\Temp\E9E2.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\EA30.tmp"C:\Users\Admin\AppData\Local\Temp\EA30.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\EA6E.tmp"C:\Users\Admin\AppData\Local\Temp\EA6E.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\EAAD.tmp"C:\Users\Admin\AppData\Local\Temp\EAAD.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\EAEB.tmp"C:\Users\Admin\AppData\Local\Temp\EAEB.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\EB2A.tmp"C:\Users\Admin\AppData\Local\Temp\EB2A.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\EB68.tmp"C:\Users\Admin\AppData\Local\Temp\EB68.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\EBA6.tmp"C:\Users\Admin\AppData\Local\Temp\EBA6.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\EBE5.tmp"C:\Users\Admin\AppData\Local\Temp\EBE5.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\EC23.tmp"C:\Users\Admin\AppData\Local\Temp\EC23.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\EC62.tmp"C:\Users\Admin\AppData\Local\Temp\EC62.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\ECA0.tmp"C:\Users\Admin\AppData\Local\Temp\ECA0.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\ECDE.tmp"C:\Users\Admin\AppData\Local\Temp\ECDE.tmp"65⤵
- Executes dropped EXE
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\ED1D.tmp"C:\Users\Admin\AppData\Local\Temp\ED1D.tmp"66⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\ED5B.tmp"C:\Users\Admin\AppData\Local\Temp\ED5B.tmp"67⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\EDA9.tmp"C:\Users\Admin\AppData\Local\Temp\EDA9.tmp"68⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\EDE8.tmp"C:\Users\Admin\AppData\Local\Temp\EDE8.tmp"69⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\EE36.tmp"C:\Users\Admin\AppData\Local\Temp\EE36.tmp"70⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\EE74.tmp"C:\Users\Admin\AppData\Local\Temp\EE74.tmp"71⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\EEB2.tmp"C:\Users\Admin\AppData\Local\Temp\EEB2.tmp"72⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\EEF1.tmp"C:\Users\Admin\AppData\Local\Temp\EEF1.tmp"73⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\EF2F.tmp"C:\Users\Admin\AppData\Local\Temp\EF2F.tmp"74⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\EF6E.tmp"C:\Users\Admin\AppData\Local\Temp\EF6E.tmp"75⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\EFAC.tmp"C:\Users\Admin\AppData\Local\Temp\EFAC.tmp"76⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\EFEA.tmp"C:\Users\Admin\AppData\Local\Temp\EFEA.tmp"77⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\F029.tmp"C:\Users\Admin\AppData\Local\Temp\F029.tmp"78⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\F077.tmp"C:\Users\Admin\AppData\Local\Temp\F077.tmp"79⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\F0B5.tmp"C:\Users\Admin\AppData\Local\Temp\F0B5.tmp"80⤵
- System Location Discovery: System Language Discovery
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\F0F4.tmp"C:\Users\Admin\AppData\Local\Temp\F0F4.tmp"81⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\F132.tmp"C:\Users\Admin\AppData\Local\Temp\F132.tmp"82⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\F170.tmp"C:\Users\Admin\AppData\Local\Temp\F170.tmp"83⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\F1AF.tmp"C:\Users\Admin\AppData\Local\Temp\F1AF.tmp"84⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\F1ED.tmp"C:\Users\Admin\AppData\Local\Temp\F1ED.tmp"85⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\F22C.tmp"C:\Users\Admin\AppData\Local\Temp\F22C.tmp"86⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\F26A.tmp"C:\Users\Admin\AppData\Local\Temp\F26A.tmp"87⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\F2A8.tmp"C:\Users\Admin\AppData\Local\Temp\F2A8.tmp"88⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\F2E7.tmp"C:\Users\Admin\AppData\Local\Temp\F2E7.tmp"89⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\F325.tmp"C:\Users\Admin\AppData\Local\Temp\F325.tmp"90⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\F364.tmp"C:\Users\Admin\AppData\Local\Temp\F364.tmp"91⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\F3A2.tmp"C:\Users\Admin\AppData\Local\Temp\F3A2.tmp"92⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\F3E0.tmp"C:\Users\Admin\AppData\Local\Temp\F3E0.tmp"93⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\F41F.tmp"C:\Users\Admin\AppData\Local\Temp\F41F.tmp"94⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\F45D.tmp"C:\Users\Admin\AppData\Local\Temp\F45D.tmp"95⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\F49C.tmp"C:\Users\Admin\AppData\Local\Temp\F49C.tmp"96⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\F4DA.tmp"C:\Users\Admin\AppData\Local\Temp\F4DA.tmp"97⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\F518.tmp"C:\Users\Admin\AppData\Local\Temp\F518.tmp"98⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\F557.tmp"C:\Users\Admin\AppData\Local\Temp\F557.tmp"99⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\F595.tmp"C:\Users\Admin\AppData\Local\Temp\F595.tmp"100⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\F5E3.tmp"C:\Users\Admin\AppData\Local\Temp\F5E3.tmp"101⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\F631.tmp"C:\Users\Admin\AppData\Local\Temp\F631.tmp"102⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\F670.tmp"C:\Users\Admin\AppData\Local\Temp\F670.tmp"103⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\F6AE.tmp"C:\Users\Admin\AppData\Local\Temp\F6AE.tmp"104⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\F6EC.tmp"C:\Users\Admin\AppData\Local\Temp\F6EC.tmp"105⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\F72B.tmp"C:\Users\Admin\AppData\Local\Temp\F72B.tmp"106⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\F769.tmp"C:\Users\Admin\AppData\Local\Temp\F769.tmp"107⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\F7A8.tmp"C:\Users\Admin\AppData\Local\Temp\F7A8.tmp"108⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\F7E6.tmp"C:\Users\Admin\AppData\Local\Temp\F7E6.tmp"109⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\F824.tmp"C:\Users\Admin\AppData\Local\Temp\F824.tmp"110⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\F863.tmp"C:\Users\Admin\AppData\Local\Temp\F863.tmp"111⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\F8A1.tmp"C:\Users\Admin\AppData\Local\Temp\F8A1.tmp"112⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\F8E0.tmp"C:\Users\Admin\AppData\Local\Temp\F8E0.tmp"113⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\F91E.tmp"C:\Users\Admin\AppData\Local\Temp\F91E.tmp"114⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\F95C.tmp"C:\Users\Admin\AppData\Local\Temp\F95C.tmp"115⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\F9AA.tmp"C:\Users\Admin\AppData\Local\Temp\F9AA.tmp"116⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\F9E9.tmp"C:\Users\Admin\AppData\Local\Temp\F9E9.tmp"117⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\FA27.tmp"C:\Users\Admin\AppData\Local\Temp\FA27.tmp"118⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\FA66.tmp"C:\Users\Admin\AppData\Local\Temp\FA66.tmp"119⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\FAA4.tmp"C:\Users\Admin\AppData\Local\Temp\FAA4.tmp"120⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\FAE2.tmp"C:\Users\Admin\AppData\Local\Temp\FAE2.tmp"121⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\FB30.tmp"C:\Users\Admin\AppData\Local\Temp\FB30.tmp"122⤵PID:2984
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-