Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07-09-2024 20:27
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-07_ae71e5bc89de5a4a16e2fbca0f237ca2_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-07_ae71e5bc89de5a4a16e2fbca0f237ca2_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-07_ae71e5bc89de5a4a16e2fbca0f237ca2_mafia.exe
-
Size
520KB
-
MD5
ae71e5bc89de5a4a16e2fbca0f237ca2
-
SHA1
79313eaf0ba3db747953c10dbbc5abf9a26754fa
-
SHA256
f18deea8106346f1657017c2ef49decabf295e5cd7c3b1267bcb322e690a5090
-
SHA512
1dfbb70ac45568c4e13e414f44233db85b60dd602b23baee2e656617377a59b33df4cac53cbe3020f0b9b859a010dce1b616ac8069a4961bc39e5eb74074bc7f
-
SSDEEP
12288:roRXOQjmOy2fu2B5Yfq7PWDR0wIAldJFFkNZ:rogQ9yquO5Yfqr/AzJFFkN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2748 BA0C.tmp 2372 BAB7.tmp 2800 BBA1.tmp 2940 BC9B.tmp 3068 BD18.tmp 2832 BE5F.tmp 3012 BEDC.tmp 2336 BF88.tmp 2784 C0B0.tmp 2700 C13D.tmp 2236 C207.tmp 1456 C33F.tmp 1324 C41A.tmp 1964 C4B6.tmp 2124 C533.tmp 1200 C5BF.tmp 2960 C67A.tmp 2768 C745.tmp 2028 C7E1.tmp 3048 C87D.tmp 2108 C996.tmp 1096 CA32.tmp 816 CAAF.tmp 2848 CCF0.tmp 2540 CD4D.tmp 2100 CDE9.tmp 2004 CF41.tmp 2524 D0B7.tmp 2400 D134.tmp 472 D1A1.tmp 936 D20E.tmp 1204 D27C.tmp 1864 D2E9.tmp 1156 D356.tmp 944 D3C3.tmp 1064 D430.tmp 1340 D49E.tmp 1508 D50B.tmp 1368 D578.tmp 2152 D5E5.tmp 2132 D652.tmp 800 D6DF.tmp 1940 D74C.tmp 1952 D7C9.tmp 2244 D826.tmp 2608 D894.tmp 2560 D901.tmp 1548 D97E.tmp 1784 D9DB.tmp 884 DA48.tmp 2304 DAB6.tmp 2292 DB42.tmp 1664 DBEE.tmp 1936 DC5B.tmp 2748 DCC8.tmp 2908 DD83.tmp 2912 DE00.tmp 2800 DE5E.tmp 2940 DECB.tmp 2104 DF28.tmp 2816 DF86.tmp 2788 DFF3.tmp 2708 E060.tmp 2808 E0CE.tmp -
Loads dropped DLL 64 IoCs
pid Process 1620 2024-09-07_ae71e5bc89de5a4a16e2fbca0f237ca2_mafia.exe 2748 BA0C.tmp 2372 BAB7.tmp 2800 BBA1.tmp 2940 BC9B.tmp 3068 BD18.tmp 2832 BE5F.tmp 3012 BEDC.tmp 2336 BF88.tmp 2784 C0B0.tmp 2700 C13D.tmp 2236 C207.tmp 1456 C33F.tmp 1324 C41A.tmp 1964 C4B6.tmp 2124 C533.tmp 1200 C5BF.tmp 2960 C67A.tmp 2768 C745.tmp 2028 C7E1.tmp 3048 C87D.tmp 2108 C996.tmp 1096 CA32.tmp 816 CAAF.tmp 2848 CCF0.tmp 2540 CD4D.tmp 2100 CDE9.tmp 2004 CF41.tmp 2524 D0B7.tmp 2400 D134.tmp 472 D1A1.tmp 936 D20E.tmp 1204 D27C.tmp 1864 D2E9.tmp 1156 D356.tmp 944 D3C3.tmp 1064 D430.tmp 1340 D49E.tmp 1508 D50B.tmp 1368 D578.tmp 2152 D5E5.tmp 2132 D652.tmp 800 D6DF.tmp 1940 D74C.tmp 1952 D7C9.tmp 2244 D826.tmp 2608 D894.tmp 2560 D901.tmp 1548 D97E.tmp 1784 D9DB.tmp 884 DA48.tmp 2304 DAB6.tmp 2292 DB42.tmp 1664 DBEE.tmp 1936 DC5B.tmp 2748 DCC8.tmp 2908 DD83.tmp 2912 DE00.tmp 2800 DE5E.tmp 2940 DECB.tmp 2104 DF28.tmp 2816 DF86.tmp 2788 DFF3.tmp 2708 E060.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1748.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 712.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E521.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3266.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A969.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D97E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B76.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7687.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4AA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 783C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C745.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED8A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9119.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8CF5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 753F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B07.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA24.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E061.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E70.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F42.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCC8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D652.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3073.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2646.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F22.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D9BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3562.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4827.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C15.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1620 wrote to memory of 2748 1620 2024-09-07_ae71e5bc89de5a4a16e2fbca0f237ca2_mafia.exe 30 PID 1620 wrote to memory of 2748 1620 2024-09-07_ae71e5bc89de5a4a16e2fbca0f237ca2_mafia.exe 30 PID 1620 wrote to memory of 2748 1620 2024-09-07_ae71e5bc89de5a4a16e2fbca0f237ca2_mafia.exe 30 PID 1620 wrote to memory of 2748 1620 2024-09-07_ae71e5bc89de5a4a16e2fbca0f237ca2_mafia.exe 30 PID 2748 wrote to memory of 2372 2748 BA0C.tmp 31 PID 2748 wrote to memory of 2372 2748 BA0C.tmp 31 PID 2748 wrote to memory of 2372 2748 BA0C.tmp 31 PID 2748 wrote to memory of 2372 2748 BA0C.tmp 31 PID 2372 wrote to memory of 2800 2372 BAB7.tmp 32 PID 2372 wrote to memory of 2800 2372 BAB7.tmp 32 PID 2372 wrote to memory of 2800 2372 BAB7.tmp 32 PID 2372 wrote to memory of 2800 2372 BAB7.tmp 32 PID 2800 wrote to memory of 2940 2800 BBA1.tmp 33 PID 2800 wrote to memory of 2940 2800 BBA1.tmp 33 PID 2800 wrote to memory of 2940 2800 BBA1.tmp 33 PID 2800 wrote to memory of 2940 2800 BBA1.tmp 33 PID 2940 wrote to memory of 3068 2940 BC9B.tmp 34 PID 2940 wrote to memory of 3068 2940 BC9B.tmp 34 PID 2940 wrote to memory of 3068 2940 BC9B.tmp 34 PID 2940 wrote to memory of 3068 2940 BC9B.tmp 34 PID 3068 wrote to memory of 2832 3068 BD18.tmp 35 PID 3068 wrote to memory of 2832 3068 BD18.tmp 35 PID 3068 wrote to memory of 2832 3068 BD18.tmp 35 PID 3068 wrote to memory of 2832 3068 BD18.tmp 35 PID 2832 wrote to memory of 3012 2832 BE5F.tmp 36 PID 2832 wrote to memory of 3012 2832 BE5F.tmp 36 PID 2832 wrote to memory of 3012 2832 BE5F.tmp 36 PID 2832 wrote to memory of 3012 2832 BE5F.tmp 36 PID 3012 wrote to memory of 2336 3012 BEDC.tmp 37 PID 3012 wrote to memory of 2336 3012 BEDC.tmp 37 PID 3012 wrote to memory of 2336 3012 BEDC.tmp 37 PID 3012 wrote to memory of 2336 3012 BEDC.tmp 37 PID 2336 wrote to memory of 2784 2336 BF88.tmp 38 PID 2336 wrote to memory of 2784 2336 BF88.tmp 38 PID 2336 wrote to memory of 2784 2336 BF88.tmp 38 PID 2336 wrote to memory of 2784 2336 BF88.tmp 38 PID 2784 wrote to memory of 2700 2784 C0B0.tmp 96 PID 2784 wrote to memory of 2700 2784 C0B0.tmp 96 PID 2784 wrote to memory of 2700 2784 C0B0.tmp 96 PID 2784 wrote to memory of 2700 2784 C0B0.tmp 96 PID 2700 wrote to memory of 2236 2700 C13D.tmp 40 PID 2700 wrote to memory of 2236 2700 C13D.tmp 40 PID 2700 wrote to memory of 2236 2700 C13D.tmp 40 PID 2700 wrote to memory of 2236 2700 C13D.tmp 40 PID 2236 wrote to memory of 1456 2236 C207.tmp 41 PID 2236 wrote to memory of 1456 2236 C207.tmp 41 PID 2236 wrote to memory of 1456 2236 C207.tmp 41 PID 2236 wrote to memory of 1456 2236 C207.tmp 41 PID 1456 wrote to memory of 1324 1456 C33F.tmp 42 PID 1456 wrote to memory of 1324 1456 C33F.tmp 42 PID 1456 wrote to memory of 1324 1456 C33F.tmp 42 PID 1456 wrote to memory of 1324 1456 C33F.tmp 42 PID 1324 wrote to memory of 1964 1324 C41A.tmp 43 PID 1324 wrote to memory of 1964 1324 C41A.tmp 43 PID 1324 wrote to memory of 1964 1324 C41A.tmp 43 PID 1324 wrote to memory of 1964 1324 C41A.tmp 43 PID 1964 wrote to memory of 2124 1964 C4B6.tmp 103 PID 1964 wrote to memory of 2124 1964 C4B6.tmp 103 PID 1964 wrote to memory of 2124 1964 C4B6.tmp 103 PID 1964 wrote to memory of 2124 1964 C4B6.tmp 103 PID 2124 wrote to memory of 1200 2124 C533.tmp 45 PID 2124 wrote to memory of 1200 2124 C533.tmp 45 PID 2124 wrote to memory of 1200 2124 C533.tmp 45 PID 2124 wrote to memory of 1200 2124 C533.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-07_ae71e5bc89de5a4a16e2fbca0f237ca2_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-07_ae71e5bc89de5a4a16e2fbca0f237ca2_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\BA0C.tmp"C:\Users\Admin\AppData\Local\Temp\BA0C.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\BAB7.tmp"C:\Users\Admin\AppData\Local\Temp\BAB7.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\BBA1.tmp"C:\Users\Admin\AppData\Local\Temp\BBA1.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\BC9B.tmp"C:\Users\Admin\AppData\Local\Temp\BC9B.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\BD18.tmp"C:\Users\Admin\AppData\Local\Temp\BD18.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\BE5F.tmp"C:\Users\Admin\AppData\Local\Temp\BE5F.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\BEDC.tmp"C:\Users\Admin\AppData\Local\Temp\BEDC.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\BF88.tmp"C:\Users\Admin\AppData\Local\Temp\BF88.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\C13D.tmp"C:\Users\Admin\AppData\Local\Temp\C13D.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\C207.tmp"C:\Users\Admin\AppData\Local\Temp\C207.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\C33F.tmp"C:\Users\Admin\AppData\Local\Temp\C33F.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\C41A.tmp"C:\Users\Admin\AppData\Local\Temp\C41A.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\C4B6.tmp"C:\Users\Admin\AppData\Local\Temp\C4B6.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\C533.tmp"C:\Users\Admin\AppData\Local\Temp\C533.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\C5BF.tmp"C:\Users\Admin\AppData\Local\Temp\C5BF.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\C67A.tmp"C:\Users\Admin\AppData\Local\Temp\C67A.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\C745.tmp"C:\Users\Admin\AppData\Local\Temp\C745.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\C7E1.tmp"C:\Users\Admin\AppData\Local\Temp\C7E1.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\C87D.tmp"C:\Users\Admin\AppData\Local\Temp\C87D.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\C996.tmp"C:\Users\Admin\AppData\Local\Temp\C996.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\CA32.tmp"C:\Users\Admin\AppData\Local\Temp\CA32.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\CAAF.tmp"C:\Users\Admin\AppData\Local\Temp\CAAF.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:816 -
C:\Users\Admin\AppData\Local\Temp\CCF0.tmp"C:\Users\Admin\AppData\Local\Temp\CCF0.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\CD4D.tmp"C:\Users\Admin\AppData\Local\Temp\CD4D.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\CDE9.tmp"C:\Users\Admin\AppData\Local\Temp\CDE9.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\CF41.tmp"C:\Users\Admin\AppData\Local\Temp\CF41.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\D0B7.tmp"C:\Users\Admin\AppData\Local\Temp\D0B7.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\D134.tmp"C:\Users\Admin\AppData\Local\Temp\D134.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\D1A1.tmp"C:\Users\Admin\AppData\Local\Temp\D1A1.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:472 -
C:\Users\Admin\AppData\Local\Temp\D20E.tmp"C:\Users\Admin\AppData\Local\Temp\D20E.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:936 -
C:\Users\Admin\AppData\Local\Temp\D27C.tmp"C:\Users\Admin\AppData\Local\Temp\D27C.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\D2E9.tmp"C:\Users\Admin\AppData\Local\Temp\D2E9.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\D356.tmp"C:\Users\Admin\AppData\Local\Temp\D356.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\D3C3.tmp"C:\Users\Admin\AppData\Local\Temp\D3C3.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:944 -
C:\Users\Admin\AppData\Local\Temp\D430.tmp"C:\Users\Admin\AppData\Local\Temp\D430.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\D49E.tmp"C:\Users\Admin\AppData\Local\Temp\D49E.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\D50B.tmp"C:\Users\Admin\AppData\Local\Temp\D50B.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\D578.tmp"C:\Users\Admin\AppData\Local\Temp\D578.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\D5E5.tmp"C:\Users\Admin\AppData\Local\Temp\D5E5.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\D652.tmp"C:\Users\Admin\AppData\Local\Temp\D652.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\D6DF.tmp"C:\Users\Admin\AppData\Local\Temp\D6DF.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:800 -
C:\Users\Admin\AppData\Local\Temp\D74C.tmp"C:\Users\Admin\AppData\Local\Temp\D74C.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\D7C9.tmp"C:\Users\Admin\AppData\Local\Temp\D7C9.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\D826.tmp"C:\Users\Admin\AppData\Local\Temp\D826.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\D894.tmp"C:\Users\Admin\AppData\Local\Temp\D894.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\D901.tmp"C:\Users\Admin\AppData\Local\Temp\D901.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\D97E.tmp"C:\Users\Admin\AppData\Local\Temp\D97E.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\D9DB.tmp"C:\Users\Admin\AppData\Local\Temp\D9DB.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\DA48.tmp"C:\Users\Admin\AppData\Local\Temp\DA48.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:884 -
C:\Users\Admin\AppData\Local\Temp\DAB6.tmp"C:\Users\Admin\AppData\Local\Temp\DAB6.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\DB42.tmp"C:\Users\Admin\AppData\Local\Temp\DB42.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\DBEE.tmp"C:\Users\Admin\AppData\Local\Temp\DBEE.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\DC5B.tmp"C:\Users\Admin\AppData\Local\Temp\DC5B.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\DCC8.tmp"C:\Users\Admin\AppData\Local\Temp\DCC8.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\DD83.tmp"C:\Users\Admin\AppData\Local\Temp\DD83.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\DE00.tmp"C:\Users\Admin\AppData\Local\Temp\DE00.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\DE5E.tmp"C:\Users\Admin\AppData\Local\Temp\DE5E.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\DECB.tmp"C:\Users\Admin\AppData\Local\Temp\DECB.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\DF28.tmp"C:\Users\Admin\AppData\Local\Temp\DF28.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\DF86.tmp"C:\Users\Admin\AppData\Local\Temp\DF86.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\DFF3.tmp"C:\Users\Admin\AppData\Local\Temp\DFF3.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\E060.tmp"C:\Users\Admin\AppData\Local\Temp\E060.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\E0CE.tmp"C:\Users\Admin\AppData\Local\Temp\E0CE.tmp"65⤵
- Executes dropped EXE
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\E456.tmp"C:\Users\Admin\AppData\Local\Temp\E456.tmp"66⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\E5AE.tmp"C:\Users\Admin\AppData\Local\Temp\E5AE.tmp"67⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\E62A.tmp"C:\Users\Admin\AppData\Local\Temp\E62A.tmp"68⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\E688.tmp"C:\Users\Admin\AppData\Local\Temp\E688.tmp"69⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"70⤵PID:340
-
C:\Users\Admin\AppData\Local\Temp\E772.tmp"C:\Users\Admin\AppData\Local\Temp\E772.tmp"71⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\E7D0.tmp"C:\Users\Admin\AppData\Local\Temp\E7D0.tmp"72⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\E83D.tmp"C:\Users\Admin\AppData\Local\Temp\E83D.tmp"73⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\E8C9.tmp"C:\Users\Admin\AppData\Local\Temp\E8C9.tmp"74⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\E927.tmp"C:\Users\Admin\AppData\Local\Temp\E927.tmp"75⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\E994.tmp"C:\Users\Admin\AppData\Local\Temp\E994.tmp"76⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\EA01.tmp"C:\Users\Admin\AppData\Local\Temp\EA01.tmp"77⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\EA8E.tmp"C:\Users\Admin\AppData\Local\Temp\EA8E.tmp"78⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\EAEB.tmp"C:\Users\Admin\AppData\Local\Temp\EAEB.tmp"79⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\EB87.tmp"C:\Users\Admin\AppData\Local\Temp\EB87.tmp"80⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\EC14.tmp"C:\Users\Admin\AppData\Local\Temp\EC14.tmp"81⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\ECB0.tmp"C:\Users\Admin\AppData\Local\Temp\ECB0.tmp"82⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\ED1D.tmp"C:\Users\Admin\AppData\Local\Temp\ED1D.tmp"83⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\ED8A.tmp"C:\Users\Admin\AppData\Local\Temp\ED8A.tmp"84⤵
- System Location Discovery: System Language Discovery
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\EDF7.tmp"C:\Users\Admin\AppData\Local\Temp\EDF7.tmp"85⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\EE74.tmp"C:\Users\Admin\AppData\Local\Temp\EE74.tmp"86⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\EEE1.tmp"C:\Users\Admin\AppData\Local\Temp\EEE1.tmp"87⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\EF3F.tmp"C:\Users\Admin\AppData\Local\Temp\EF3F.tmp"88⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\EF8D.tmp"C:\Users\Admin\AppData\Local\Temp\EF8D.tmp"89⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\EFFA.tmp"C:\Users\Admin\AppData\Local\Temp\EFFA.tmp"90⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\F048.tmp"C:\Users\Admin\AppData\Local\Temp\F048.tmp"91⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\F0A6.tmp"C:\Users\Admin\AppData\Local\Temp\F0A6.tmp"92⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\F103.tmp"C:\Users\Admin\AppData\Local\Temp\F103.tmp"93⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\F170.tmp"C:\Users\Admin\AppData\Local\Temp\F170.tmp"94⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\F1CE.tmp"C:\Users\Admin\AppData\Local\Temp\F1CE.tmp"95⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\F23B.tmp"C:\Users\Admin\AppData\Local\Temp\F23B.tmp"96⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\F2A8.tmp"C:\Users\Admin\AppData\Local\Temp\F2A8.tmp"97⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\F364.tmp"C:\Users\Admin\AppData\Local\Temp\F364.tmp"98⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\F3D1.tmp"C:\Users\Admin\AppData\Local\Temp\F3D1.tmp"99⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\F47C.tmp"C:\Users\Admin\AppData\Local\Temp\F47C.tmp"100⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\F4EA.tmp"C:\Users\Admin\AppData\Local\Temp\F4EA.tmp"101⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\F586.tmp"C:\Users\Admin\AppData\Local\Temp\F586.tmp"102⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\F602.tmp"C:\Users\Admin\AppData\Local\Temp\F602.tmp"103⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\F670.tmp"C:\Users\Admin\AppData\Local\Temp\F670.tmp"104⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\F6DD.tmp"C:\Users\Admin\AppData\Local\Temp\F6DD.tmp"105⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\F75A.tmp"C:\Users\Admin\AppData\Local\Temp\F75A.tmp"106⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\F7D6.tmp"C:\Users\Admin\AppData\Local\Temp\F7D6.tmp"107⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\F844.tmp"C:\Users\Admin\AppData\Local\Temp\F844.tmp"108⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\F8C0.tmp"C:\Users\Admin\AppData\Local\Temp\F8C0.tmp"109⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\F92E.tmp"C:\Users\Admin\AppData\Local\Temp\F92E.tmp"110⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\FB21.tmp"C:\Users\Admin\AppData\Local\Temp\FB21.tmp"111⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\FBDC.tmp"C:\Users\Admin\AppData\Local\Temp\FBDC.tmp"112⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\FC3A.tmp"C:\Users\Admin\AppData\Local\Temp\FC3A.tmp"113⤵PID:328
-
C:\Users\Admin\AppData\Local\Temp\FCA7.tmp"C:\Users\Admin\AppData\Local\Temp\FCA7.tmp"114⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\FD14.tmp"C:\Users\Admin\AppData\Local\Temp\FD14.tmp"115⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\FD81.tmp"C:\Users\Admin\AppData\Local\Temp\FD81.tmp"116⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\FE0E.tmp"C:\Users\Admin\AppData\Local\Temp\FE0E.tmp"117⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\FE7B.tmp"C:\Users\Admin\AppData\Local\Temp\FE7B.tmp"118⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\FEE8.tmp"C:\Users\Admin\AppData\Local\Temp\FEE8.tmp"119⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\FF46.tmp"C:\Users\Admin\AppData\Local\Temp\FF46.tmp"120⤵
- System Location Discovery: System Language Discovery
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\FFA3.tmp"C:\Users\Admin\AppData\Local\Temp\FFA3.tmp"121⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\30.tmp"C:\Users\Admin\AppData\Local\Temp\30.tmp"122⤵PID:1428
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-