Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 03:46
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-19_12f6b190586899fe4e8dec99864e0190_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-19_12f6b190586899fe4e8dec99864e0190_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-19_12f6b190586899fe4e8dec99864e0190_mafia.exe
-
Size
530KB
-
MD5
12f6b190586899fe4e8dec99864e0190
-
SHA1
cf912d7524d05ed79793ebe75608458a415fafa8
-
SHA256
6c4d0325938167c7d0f71bfd83306b03659531ab54070f848ba7ec644c50b730
-
SHA512
6807c03c527ea9ce1300fe8f76a133f3cba4a64c1ae9e059429d9aec59b77d0082e4a6304201b368845baf2a1486c719b814cb92ba5664c63a0d7b2b2660a8e1
-
SSDEEP
12288:AU5rCOTeionqLYDJZVSSfRZBih8cvONZulFVg0M1:AUQOJoq4H/XibmNclFV/M1
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2532 A361.tmp 2412 A3BE.tmp 2140 A42B.tmp 2692 A4A8.tmp 1912 A515.tmp 2828 A592.tmp 2812 A5FF.tmp 2840 A66D.tmp 2724 A6BB.tmp 2628 A728.tmp 2660 A785.tmp 2636 A802.tmp 3056 A860.tmp 2116 A8BD.tmp 1568 A91B.tmp 568 A988.tmp 532 A9E6.tmp 1632 AA63.tmp 1584 AAC0.tmp 1364 AB2D.tmp 2676 AB9B.tmp 2796 ABE9.tmp 2696 AC46.tmp 3052 AC85.tmp 2704 ACC3.tmp 2024 AD11.tmp 2200 AD4F.tmp 1824 AD9D.tmp 576 ADDC.tmp 1660 AE2A.tmp 2508 AE78.tmp 316 AEB6.tmp 2108 AEF5.tmp 2036 AF33.tmp 1308 AF71.tmp 1916 AFB0.tmp 684 AFEE.tmp 1488 B03C.tmp 2040 B07B.tmp 1268 B0B9.tmp 580 B0F7.tmp 2288 B136.tmp 2208 B174.tmp 2304 B1C2.tmp 872 B201.tmp 1892 B23F.tmp 1804 B27D.tmp 1712 B2BC.tmp 1796 B2FA.tmp 2276 B348.tmp 2580 B387.tmp 2972 B3C5.tmp 2528 B403.tmp 1988 B451.tmp 1616 B490.tmp 2532 B4CE.tmp 1840 B50D.tmp 2372 B55B.tmp 2316 B599.tmp 2472 B5D7.tmp 2712 B625.tmp 1912 B673.tmp 2876 B6D1.tmp 2856 B70F.tmp -
Loads dropped DLL 64 IoCs
pid Process 2528 2024-09-19_12f6b190586899fe4e8dec99864e0190_mafia.exe 2532 A361.tmp 2412 A3BE.tmp 2140 A42B.tmp 2692 A4A8.tmp 1912 A515.tmp 2828 A592.tmp 2812 A5FF.tmp 2840 A66D.tmp 2724 A6BB.tmp 2628 A728.tmp 2660 A785.tmp 2636 A802.tmp 3056 A860.tmp 2116 A8BD.tmp 1568 A91B.tmp 568 A988.tmp 532 A9E6.tmp 1632 AA63.tmp 1584 AAC0.tmp 1364 AB2D.tmp 2676 AB9B.tmp 2796 ABE9.tmp 2696 AC46.tmp 3052 AC85.tmp 2704 ACC3.tmp 2024 AD11.tmp 2200 AD4F.tmp 1824 AD9D.tmp 576 ADDC.tmp 1660 AE2A.tmp 2508 AE78.tmp 316 AEB6.tmp 2108 AEF5.tmp 2036 AF33.tmp 1308 AF71.tmp 1916 AFB0.tmp 684 AFEE.tmp 1488 B03C.tmp 2040 B07B.tmp 1268 B0B9.tmp 580 B0F7.tmp 2288 B136.tmp 2208 B174.tmp 2304 B1C2.tmp 872 B201.tmp 1892 B23F.tmp 1804 B27D.tmp 1712 B2BC.tmp 1796 B2FA.tmp 2276 B348.tmp 2580 B387.tmp 2972 B3C5.tmp 2528 B403.tmp 1988 B451.tmp 1616 B490.tmp 2532 B4CE.tmp 1840 B50D.tmp 2372 B55B.tmp 2316 B599.tmp 2472 B5D7.tmp 2712 B625.tmp 1912 B673.tmp 2876 B6D1.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C986.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 896B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBB8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 906.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6078.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A91B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C37E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2137.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4338.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2528 wrote to memory of 2532 2528 2024-09-19_12f6b190586899fe4e8dec99864e0190_mafia.exe 30 PID 2528 wrote to memory of 2532 2528 2024-09-19_12f6b190586899fe4e8dec99864e0190_mafia.exe 30 PID 2528 wrote to memory of 2532 2528 2024-09-19_12f6b190586899fe4e8dec99864e0190_mafia.exe 30 PID 2528 wrote to memory of 2532 2528 2024-09-19_12f6b190586899fe4e8dec99864e0190_mafia.exe 30 PID 2532 wrote to memory of 2412 2532 A361.tmp 31 PID 2532 wrote to memory of 2412 2532 A361.tmp 31 PID 2532 wrote to memory of 2412 2532 A361.tmp 31 PID 2532 wrote to memory of 2412 2532 A361.tmp 31 PID 2412 wrote to memory of 2140 2412 A3BE.tmp 32 PID 2412 wrote to memory of 2140 2412 A3BE.tmp 32 PID 2412 wrote to memory of 2140 2412 A3BE.tmp 32 PID 2412 wrote to memory of 2140 2412 A3BE.tmp 32 PID 2140 wrote to memory of 2692 2140 A42B.tmp 33 PID 2140 wrote to memory of 2692 2140 A42B.tmp 33 PID 2140 wrote to memory of 2692 2140 A42B.tmp 33 PID 2140 wrote to memory of 2692 2140 A42B.tmp 33 PID 2692 wrote to memory of 1912 2692 A4A8.tmp 34 PID 2692 wrote to memory of 1912 2692 A4A8.tmp 34 PID 2692 wrote to memory of 1912 2692 A4A8.tmp 34 PID 2692 wrote to memory of 1912 2692 A4A8.tmp 34 PID 1912 wrote to memory of 2828 1912 A515.tmp 35 PID 1912 wrote to memory of 2828 1912 A515.tmp 35 PID 1912 wrote to memory of 2828 1912 A515.tmp 35 PID 1912 wrote to memory of 2828 1912 A515.tmp 35 PID 2828 wrote to memory of 2812 2828 A592.tmp 36 PID 2828 wrote to memory of 2812 2828 A592.tmp 36 PID 2828 wrote to memory of 2812 2828 A592.tmp 36 PID 2828 wrote to memory of 2812 2828 A592.tmp 36 PID 2812 wrote to memory of 2840 2812 A5FF.tmp 37 PID 2812 wrote to memory of 2840 2812 A5FF.tmp 37 PID 2812 wrote to memory of 2840 2812 A5FF.tmp 37 PID 2812 wrote to memory of 2840 2812 A5FF.tmp 37 PID 2840 wrote to memory of 2724 2840 A66D.tmp 38 PID 2840 wrote to memory of 2724 2840 A66D.tmp 38 PID 2840 wrote to memory of 2724 2840 A66D.tmp 38 PID 2840 wrote to memory of 2724 2840 A66D.tmp 38 PID 2724 wrote to memory of 2628 2724 A6BB.tmp 39 PID 2724 wrote to memory of 2628 2724 A6BB.tmp 39 PID 2724 wrote to memory of 2628 2724 A6BB.tmp 39 PID 2724 wrote to memory of 2628 2724 A6BB.tmp 39 PID 2628 wrote to memory of 2660 2628 A728.tmp 40 PID 2628 wrote to memory of 2660 2628 A728.tmp 40 PID 2628 wrote to memory of 2660 2628 A728.tmp 40 PID 2628 wrote to memory of 2660 2628 A728.tmp 40 PID 2660 wrote to memory of 2636 2660 A785.tmp 41 PID 2660 wrote to memory of 2636 2660 A785.tmp 41 PID 2660 wrote to memory of 2636 2660 A785.tmp 41 PID 2660 wrote to memory of 2636 2660 A785.tmp 41 PID 2636 wrote to memory of 3056 2636 A802.tmp 42 PID 2636 wrote to memory of 3056 2636 A802.tmp 42 PID 2636 wrote to memory of 3056 2636 A802.tmp 42 PID 2636 wrote to memory of 3056 2636 A802.tmp 42 PID 3056 wrote to memory of 2116 3056 A860.tmp 43 PID 3056 wrote to memory of 2116 3056 A860.tmp 43 PID 3056 wrote to memory of 2116 3056 A860.tmp 43 PID 3056 wrote to memory of 2116 3056 A860.tmp 43 PID 2116 wrote to memory of 1568 2116 A8BD.tmp 44 PID 2116 wrote to memory of 1568 2116 A8BD.tmp 44 PID 2116 wrote to memory of 1568 2116 A8BD.tmp 44 PID 2116 wrote to memory of 1568 2116 A8BD.tmp 44 PID 1568 wrote to memory of 568 1568 A91B.tmp 45 PID 1568 wrote to memory of 568 1568 A91B.tmp 45 PID 1568 wrote to memory of 568 1568 A91B.tmp 45 PID 1568 wrote to memory of 568 1568 A91B.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_12f6b190586899fe4e8dec99864e0190_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_12f6b190586899fe4e8dec99864e0190_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\A361.tmp"C:\Users\Admin\AppData\Local\Temp\A361.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\A3BE.tmp"C:\Users\Admin\AppData\Local\Temp\A3BE.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\A42B.tmp"C:\Users\Admin\AppData\Local\Temp\A42B.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\A4A8.tmp"C:\Users\Admin\AppData\Local\Temp\A4A8.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\A515.tmp"C:\Users\Admin\AppData\Local\Temp\A515.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\A592.tmp"C:\Users\Admin\AppData\Local\Temp\A592.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\A5FF.tmp"C:\Users\Admin\AppData\Local\Temp\A5FF.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\A66D.tmp"C:\Users\Admin\AppData\Local\Temp\A66D.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\A6BB.tmp"C:\Users\Admin\AppData\Local\Temp\A6BB.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\A728.tmp"C:\Users\Admin\AppData\Local\Temp\A728.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\A785.tmp"C:\Users\Admin\AppData\Local\Temp\A785.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\A802.tmp"C:\Users\Admin\AppData\Local\Temp\A802.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\A860.tmp"C:\Users\Admin\AppData\Local\Temp\A860.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\A8BD.tmp"C:\Users\Admin\AppData\Local\Temp\A8BD.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\A91B.tmp"C:\Users\Admin\AppData\Local\Temp\A91B.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\A988.tmp"C:\Users\Admin\AppData\Local\Temp\A988.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:568 -
C:\Users\Admin\AppData\Local\Temp\A9E6.tmp"C:\Users\Admin\AppData\Local\Temp\A9E6.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:532 -
C:\Users\Admin\AppData\Local\Temp\AA63.tmp"C:\Users\Admin\AppData\Local\Temp\AA63.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\AAC0.tmp"C:\Users\Admin\AppData\Local\Temp\AAC0.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\AB2D.tmp"C:\Users\Admin\AppData\Local\Temp\AB2D.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\AB9B.tmp"C:\Users\Admin\AppData\Local\Temp\AB9B.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\ABE9.tmp"C:\Users\Admin\AppData\Local\Temp\ABE9.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\AC46.tmp"C:\Users\Admin\AppData\Local\Temp\AC46.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\AC85.tmp"C:\Users\Admin\AppData\Local\Temp\AC85.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\ACC3.tmp"C:\Users\Admin\AppData\Local\Temp\ACC3.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\AD11.tmp"C:\Users\Admin\AppData\Local\Temp\AD11.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\AD4F.tmp"C:\Users\Admin\AppData\Local\Temp\AD4F.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\AD9D.tmp"C:\Users\Admin\AppData\Local\Temp\AD9D.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\ADDC.tmp"C:\Users\Admin\AppData\Local\Temp\ADDC.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:576 -
C:\Users\Admin\AppData\Local\Temp\AE2A.tmp"C:\Users\Admin\AppData\Local\Temp\AE2A.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\AE78.tmp"C:\Users\Admin\AppData\Local\Temp\AE78.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\AEB6.tmp"C:\Users\Admin\AppData\Local\Temp\AEB6.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:316 -
C:\Users\Admin\AppData\Local\Temp\AEF5.tmp"C:\Users\Admin\AppData\Local\Temp\AEF5.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\AF33.tmp"C:\Users\Admin\AppData\Local\Temp\AF33.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\AF71.tmp"C:\Users\Admin\AppData\Local\Temp\AF71.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\AFB0.tmp"C:\Users\Admin\AppData\Local\Temp\AFB0.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\AFEE.tmp"C:\Users\Admin\AppData\Local\Temp\AFEE.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:684 -
C:\Users\Admin\AppData\Local\Temp\B03C.tmp"C:\Users\Admin\AppData\Local\Temp\B03C.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\B07B.tmp"C:\Users\Admin\AppData\Local\Temp\B07B.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\B0B9.tmp"C:\Users\Admin\AppData\Local\Temp\B0B9.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:580 -
C:\Users\Admin\AppData\Local\Temp\B136.tmp"C:\Users\Admin\AppData\Local\Temp\B136.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\B174.tmp"C:\Users\Admin\AppData\Local\Temp\B174.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\B1C2.tmp"C:\Users\Admin\AppData\Local\Temp\B1C2.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\B201.tmp"C:\Users\Admin\AppData\Local\Temp\B201.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:872 -
C:\Users\Admin\AppData\Local\Temp\B23F.tmp"C:\Users\Admin\AppData\Local\Temp\B23F.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\B27D.tmp"C:\Users\Admin\AppData\Local\Temp\B27D.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\B2BC.tmp"C:\Users\Admin\AppData\Local\Temp\B2BC.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\B2FA.tmp"C:\Users\Admin\AppData\Local\Temp\B2FA.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\B348.tmp"C:\Users\Admin\AppData\Local\Temp\B348.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\B387.tmp"C:\Users\Admin\AppData\Local\Temp\B387.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\B3C5.tmp"C:\Users\Admin\AppData\Local\Temp\B3C5.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\B403.tmp"C:\Users\Admin\AppData\Local\Temp\B403.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\B451.tmp"C:\Users\Admin\AppData\Local\Temp\B451.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\B490.tmp"C:\Users\Admin\AppData\Local\Temp\B490.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\B4CE.tmp"C:\Users\Admin\AppData\Local\Temp\B4CE.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\B50D.tmp"C:\Users\Admin\AppData\Local\Temp\B50D.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\B55B.tmp"C:\Users\Admin\AppData\Local\Temp\B55B.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\B599.tmp"C:\Users\Admin\AppData\Local\Temp\B599.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\B5D7.tmp"C:\Users\Admin\AppData\Local\Temp\B5D7.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\B625.tmp"C:\Users\Admin\AppData\Local\Temp\B625.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\B673.tmp"C:\Users\Admin\AppData\Local\Temp\B673.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\B6D1.tmp"C:\Users\Admin\AppData\Local\Temp\B6D1.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\B70F.tmp"C:\Users\Admin\AppData\Local\Temp\B70F.tmp"65⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\B74E.tmp"C:\Users\Admin\AppData\Local\Temp\B74E.tmp"66⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\B78C.tmp"C:\Users\Admin\AppData\Local\Temp\B78C.tmp"67⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\B7CB.tmp"C:\Users\Admin\AppData\Local\Temp\B7CB.tmp"68⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\B809.tmp"C:\Users\Admin\AppData\Local\Temp\B809.tmp"69⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\B857.tmp"C:\Users\Admin\AppData\Local\Temp\B857.tmp"70⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\B8A5.tmp"C:\Users\Admin\AppData\Local\Temp\B8A5.tmp"71⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\B8E3.tmp"C:\Users\Admin\AppData\Local\Temp\B8E3.tmp"72⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\B922.tmp"C:\Users\Admin\AppData\Local\Temp\B922.tmp"73⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\B960.tmp"C:\Users\Admin\AppData\Local\Temp\B960.tmp"74⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\B99F.tmp"C:\Users\Admin\AppData\Local\Temp\B99F.tmp"75⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\B9DD.tmp"C:\Users\Admin\AppData\Local\Temp\B9DD.tmp"76⤵PID:664
-
C:\Users\Admin\AppData\Local\Temp\BA1B.tmp"C:\Users\Admin\AppData\Local\Temp\BA1B.tmp"77⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\BA5A.tmp"C:\Users\Admin\AppData\Local\Temp\BA5A.tmp"78⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\BAA8.tmp"C:\Users\Admin\AppData\Local\Temp\BAA8.tmp"79⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\BAE6.tmp"C:\Users\Admin\AppData\Local\Temp\BAE6.tmp"80⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\BB25.tmp"C:\Users\Admin\AppData\Local\Temp\BB25.tmp"81⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\BB63.tmp"C:\Users\Admin\AppData\Local\Temp\BB63.tmp"82⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\BBA1.tmp"C:\Users\Admin\AppData\Local\Temp\BBA1.tmp"83⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\BBE0.tmp"C:\Users\Admin\AppData\Local\Temp\BBE0.tmp"84⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\BC1E.tmp"C:\Users\Admin\AppData\Local\Temp\BC1E.tmp"85⤵
- System Location Discovery: System Language Discovery
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\BC5D.tmp"C:\Users\Admin\AppData\Local\Temp\BC5D.tmp"86⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\BC9B.tmp"C:\Users\Admin\AppData\Local\Temp\BC9B.tmp"87⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\BCD9.tmp"C:\Users\Admin\AppData\Local\Temp\BCD9.tmp"88⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\BD27.tmp"C:\Users\Admin\AppData\Local\Temp\BD27.tmp"89⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\BD66.tmp"C:\Users\Admin\AppData\Local\Temp\BD66.tmp"90⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\BDA4.tmp"C:\Users\Admin\AppData\Local\Temp\BDA4.tmp"91⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\BDE3.tmp"C:\Users\Admin\AppData\Local\Temp\BDE3.tmp"92⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\BE21.tmp"C:\Users\Admin\AppData\Local\Temp\BE21.tmp"93⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\BE5F.tmp"C:\Users\Admin\AppData\Local\Temp\BE5F.tmp"94⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\BE9E.tmp"C:\Users\Admin\AppData\Local\Temp\BE9E.tmp"95⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\BEDC.tmp"C:\Users\Admin\AppData\Local\Temp\BEDC.tmp"96⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\BF1B.tmp"C:\Users\Admin\AppData\Local\Temp\BF1B.tmp"97⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\BF59.tmp"C:\Users\Admin\AppData\Local\Temp\BF59.tmp"98⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\BF97.tmp"C:\Users\Admin\AppData\Local\Temp\BF97.tmp"99⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\BFD6.tmp"C:\Users\Admin\AppData\Local\Temp\BFD6.tmp"100⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\C014.tmp"C:\Users\Admin\AppData\Local\Temp\C014.tmp"101⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\C053.tmp"C:\Users\Admin\AppData\Local\Temp\C053.tmp"102⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\C091.tmp"C:\Users\Admin\AppData\Local\Temp\C091.tmp"103⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"104⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\C11D.tmp"C:\Users\Admin\AppData\Local\Temp\C11D.tmp"105⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\C16B.tmp"C:\Users\Admin\AppData\Local\Temp\C16B.tmp"106⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"107⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\C207.tmp"C:\Users\Admin\AppData\Local\Temp\C207.tmp"108⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\C246.tmp"C:\Users\Admin\AppData\Local\Temp\C246.tmp"109⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\C284.tmp"C:\Users\Admin\AppData\Local\Temp\C284.tmp"110⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"111⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\C301.tmp"C:\Users\Admin\AppData\Local\Temp\C301.tmp"112⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\C33F.tmp"C:\Users\Admin\AppData\Local\Temp\C33F.tmp"113⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\C37E.tmp"C:\Users\Admin\AppData\Local\Temp\C37E.tmp"114⤵
- System Location Discovery: System Language Discovery
PID:868 -
C:\Users\Admin\AppData\Local\Temp\C3BC.tmp"C:\Users\Admin\AppData\Local\Temp\C3BC.tmp"115⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\C3FB.tmp"C:\Users\Admin\AppData\Local\Temp\C3FB.tmp"116⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\C439.tmp"C:\Users\Admin\AppData\Local\Temp\C439.tmp"117⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\C477.tmp"C:\Users\Admin\AppData\Local\Temp\C477.tmp"118⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\C4C5.tmp"C:\Users\Admin\AppData\Local\Temp\C4C5.tmp"119⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\C513.tmp"C:\Users\Admin\AppData\Local\Temp\C513.tmp"120⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\C552.tmp"C:\Users\Admin\AppData\Local\Temp\C552.tmp"121⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\C590.tmp"C:\Users\Admin\AppData\Local\Temp\C590.tmp"122⤵PID:2232
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-