Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 03:48
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-19_147497ea765f16f105b18b41a9decd4c_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-19_147497ea765f16f105b18b41a9decd4c_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-19_147497ea765f16f105b18b41a9decd4c_mafia.exe
-
Size
487KB
-
MD5
147497ea765f16f105b18b41a9decd4c
-
SHA1
869b0c1ed65f050f1b350d25952a62af6f991076
-
SHA256
68781103df55069dafce9b7ff0e4e74d36c49c8d074c6027afbe80e248c388ba
-
SHA512
d415edd7e015fe1bbb697d9c9e05aa0e7a205f3d45db6a0c07e80300c1a4a88905af0c7542098d5901ca2bc651379db3c9eec366b0ebfc2cc71e3faabc0531dc
-
SSDEEP
12288:HU5rCOTeiJqUmeoM6XCWokXBPKiURLAUNZ:HUQOJJqUOTXCpqoPFN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3036 F6AE.tmp 2736 F72B.tmp 2892 F7B7.tmp 2880 F824.tmp 2824 F8A1.tmp 2680 F8EF.tmp 292 F95C.tmp 2584 F9AA.tmp 2972 FA18.tmp 2980 FA85.tmp 2784 FB02.tmp 2984 FB7E.tmp 2028 FC0B.tmp 1660 FC78.tmp 1628 FCF5.tmp 780 FD52.tmp 2272 FDDF.tmp 2280 FE6B.tmp 2528 FED8.tmp 536 FF36.tmp 1912 FFB3.tmp 2524 20.tmp 2412 7E.tmp 2088 BC.tmp 2220 10A.tmp 2204 158.tmp 2896 1A6.tmp 2376 1F4.tmp 2124 232.tmp 448 280.tmp 2372 2CE.tmp 960 30D.tmp 1640 35B.tmp 2020 3A9.tmp 1924 3F7.tmp 956 445.tmp 2112 493.tmp 1372 4E1.tmp 772 52F.tmp 2928 56D.tmp 816 5BB.tmp 704 609.tmp 2872 657.tmp 3004 696.tmp 1404 6E4.tmp 1596 722.tmp 2168 760.tmp 1740 79F.tmp 1984 7ED.tmp 2472 82B.tmp 2312 879.tmp 1180 906.tmp 2692 944.tmp 2748 992.tmp 2768 9E0.tmp 2816 A2E.tmp 2704 A8C.tmp 2880 ADA.tmp 2800 B28.tmp 2708 B66.tmp 2540 BA4.tmp 2616 BF2.tmp 2608 C40.tmp 2584 C8E.tmp -
Loads dropped DLL 64 IoCs
pid Process 3040 2024-09-19_147497ea765f16f105b18b41a9decd4c_mafia.exe 3036 F6AE.tmp 2736 F72B.tmp 2892 F7B7.tmp 2880 F824.tmp 2824 F8A1.tmp 2680 F8EF.tmp 292 F95C.tmp 2584 F9AA.tmp 2972 FA18.tmp 2980 FA85.tmp 2784 FB02.tmp 2984 FB7E.tmp 2028 FC0B.tmp 1660 FC78.tmp 1628 FCF5.tmp 780 FD52.tmp 2272 FDDF.tmp 2280 FE6B.tmp 2528 FED8.tmp 536 FF36.tmp 1912 FFB3.tmp 2524 20.tmp 2412 7E.tmp 2088 BC.tmp 2220 10A.tmp 2204 158.tmp 2896 1A6.tmp 2376 1F4.tmp 2124 232.tmp 448 280.tmp 2372 2CE.tmp 960 30D.tmp 1640 35B.tmp 2020 3A9.tmp 1924 3F7.tmp 956 445.tmp 2112 493.tmp 1372 4E1.tmp 772 52F.tmp 2928 56D.tmp 816 5BB.tmp 704 609.tmp 2872 657.tmp 3004 696.tmp 1404 6E4.tmp 1596 722.tmp 2168 760.tmp 1740 79F.tmp 1984 7ED.tmp 2472 82B.tmp 1576 8B8.tmp 1180 906.tmp 2692 944.tmp 2748 992.tmp 2768 9E0.tmp 2816 A2E.tmp 2704 A8C.tmp 2880 ADA.tmp 2800 B28.tmp 2708 B66.tmp 2540 BA4.tmp 2616 BF2.tmp 2608 C40.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 427C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 450C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B4F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C468.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B664.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E08F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B423.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4EFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7742.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 760A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 538C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E62A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8CD5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3040 wrote to memory of 3036 3040 2024-09-19_147497ea765f16f105b18b41a9decd4c_mafia.exe 31 PID 3040 wrote to memory of 3036 3040 2024-09-19_147497ea765f16f105b18b41a9decd4c_mafia.exe 31 PID 3040 wrote to memory of 3036 3040 2024-09-19_147497ea765f16f105b18b41a9decd4c_mafia.exe 31 PID 3040 wrote to memory of 3036 3040 2024-09-19_147497ea765f16f105b18b41a9decd4c_mafia.exe 31 PID 3036 wrote to memory of 2736 3036 F6AE.tmp 32 PID 3036 wrote to memory of 2736 3036 F6AE.tmp 32 PID 3036 wrote to memory of 2736 3036 F6AE.tmp 32 PID 3036 wrote to memory of 2736 3036 F6AE.tmp 32 PID 2736 wrote to memory of 2892 2736 F72B.tmp 33 PID 2736 wrote to memory of 2892 2736 F72B.tmp 33 PID 2736 wrote to memory of 2892 2736 F72B.tmp 33 PID 2736 wrote to memory of 2892 2736 F72B.tmp 33 PID 2892 wrote to memory of 2880 2892 F7B7.tmp 34 PID 2892 wrote to memory of 2880 2892 F7B7.tmp 34 PID 2892 wrote to memory of 2880 2892 F7B7.tmp 34 PID 2892 wrote to memory of 2880 2892 F7B7.tmp 34 PID 2880 wrote to memory of 2824 2880 F824.tmp 35 PID 2880 wrote to memory of 2824 2880 F824.tmp 35 PID 2880 wrote to memory of 2824 2880 F824.tmp 35 PID 2880 wrote to memory of 2824 2880 F824.tmp 35 PID 2824 wrote to memory of 2680 2824 F8A1.tmp 36 PID 2824 wrote to memory of 2680 2824 F8A1.tmp 36 PID 2824 wrote to memory of 2680 2824 F8A1.tmp 36 PID 2824 wrote to memory of 2680 2824 F8A1.tmp 36 PID 2680 wrote to memory of 292 2680 F8EF.tmp 37 PID 2680 wrote to memory of 292 2680 F8EF.tmp 37 PID 2680 wrote to memory of 292 2680 F8EF.tmp 37 PID 2680 wrote to memory of 292 2680 F8EF.tmp 37 PID 292 wrote to memory of 2584 292 F95C.tmp 38 PID 292 wrote to memory of 2584 292 F95C.tmp 38 PID 292 wrote to memory of 2584 292 F95C.tmp 38 PID 292 wrote to memory of 2584 292 F95C.tmp 38 PID 2584 wrote to memory of 2972 2584 F9AA.tmp 39 PID 2584 wrote to memory of 2972 2584 F9AA.tmp 39 PID 2584 wrote to memory of 2972 2584 F9AA.tmp 39 PID 2584 wrote to memory of 2972 2584 F9AA.tmp 39 PID 2972 wrote to memory of 2980 2972 FA18.tmp 40 PID 2972 wrote to memory of 2980 2972 FA18.tmp 40 PID 2972 wrote to memory of 2980 2972 FA18.tmp 40 PID 2972 wrote to memory of 2980 2972 FA18.tmp 40 PID 2980 wrote to memory of 2784 2980 FA85.tmp 41 PID 2980 wrote to memory of 2784 2980 FA85.tmp 41 PID 2980 wrote to memory of 2784 2980 FA85.tmp 41 PID 2980 wrote to memory of 2784 2980 FA85.tmp 41 PID 2784 wrote to memory of 2984 2784 FB02.tmp 42 PID 2784 wrote to memory of 2984 2784 FB02.tmp 42 PID 2784 wrote to memory of 2984 2784 FB02.tmp 42 PID 2784 wrote to memory of 2984 2784 FB02.tmp 42 PID 2984 wrote to memory of 2028 2984 FB7E.tmp 43 PID 2984 wrote to memory of 2028 2984 FB7E.tmp 43 PID 2984 wrote to memory of 2028 2984 FB7E.tmp 43 PID 2984 wrote to memory of 2028 2984 FB7E.tmp 43 PID 2028 wrote to memory of 1660 2028 FC0B.tmp 44 PID 2028 wrote to memory of 1660 2028 FC0B.tmp 44 PID 2028 wrote to memory of 1660 2028 FC0B.tmp 44 PID 2028 wrote to memory of 1660 2028 FC0B.tmp 44 PID 1660 wrote to memory of 1628 1660 FC78.tmp 45 PID 1660 wrote to memory of 1628 1660 FC78.tmp 45 PID 1660 wrote to memory of 1628 1660 FC78.tmp 45 PID 1660 wrote to memory of 1628 1660 FC78.tmp 45 PID 1628 wrote to memory of 780 1628 FCF5.tmp 46 PID 1628 wrote to memory of 780 1628 FCF5.tmp 46 PID 1628 wrote to memory of 780 1628 FCF5.tmp 46 PID 1628 wrote to memory of 780 1628 FCF5.tmp 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_147497ea765f16f105b18b41a9decd4c_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_147497ea765f16f105b18b41a9decd4c_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\F6AE.tmp"C:\Users\Admin\AppData\Local\Temp\F6AE.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\F72B.tmp"C:\Users\Admin\AppData\Local\Temp\F72B.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\F7B7.tmp"C:\Users\Admin\AppData\Local\Temp\F7B7.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\F824.tmp"C:\Users\Admin\AppData\Local\Temp\F824.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\F8A1.tmp"C:\Users\Admin\AppData\Local\Temp\F8A1.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\F8EF.tmp"C:\Users\Admin\AppData\Local\Temp\F8EF.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\F95C.tmp"C:\Users\Admin\AppData\Local\Temp\F95C.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:292 -
C:\Users\Admin\AppData\Local\Temp\F9AA.tmp"C:\Users\Admin\AppData\Local\Temp\F9AA.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\FA18.tmp"C:\Users\Admin\AppData\Local\Temp\FA18.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\FA85.tmp"C:\Users\Admin\AppData\Local\Temp\FA85.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\FB02.tmp"C:\Users\Admin\AppData\Local\Temp\FB02.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\FB7E.tmp"C:\Users\Admin\AppData\Local\Temp\FB7E.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\FC0B.tmp"C:\Users\Admin\AppData\Local\Temp\FC0B.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\FC78.tmp"C:\Users\Admin\AppData\Local\Temp\FC78.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\FCF5.tmp"C:\Users\Admin\AppData\Local\Temp\FCF5.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\FD52.tmp"C:\Users\Admin\AppData\Local\Temp\FD52.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:780 -
C:\Users\Admin\AppData\Local\Temp\FDDF.tmp"C:\Users\Admin\AppData\Local\Temp\FDDF.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\FE6B.tmp"C:\Users\Admin\AppData\Local\Temp\FE6B.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\FED8.tmp"C:\Users\Admin\AppData\Local\Temp\FED8.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\FF36.tmp"C:\Users\Admin\AppData\Local\Temp\FF36.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:536 -
C:\Users\Admin\AppData\Local\Temp\FFB3.tmp"C:\Users\Admin\AppData\Local\Temp\FFB3.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\20.tmp"C:\Users\Admin\AppData\Local\Temp\20.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\7E.tmp"C:\Users\Admin\AppData\Local\Temp\7E.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\BC.tmp"C:\Users\Admin\AppData\Local\Temp\BC.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\10A.tmp"C:\Users\Admin\AppData\Local\Temp\10A.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\158.tmp"C:\Users\Admin\AppData\Local\Temp\158.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\1A6.tmp"C:\Users\Admin\AppData\Local\Temp\1A6.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\1F4.tmp"C:\Users\Admin\AppData\Local\Temp\1F4.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\232.tmp"C:\Users\Admin\AppData\Local\Temp\232.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\280.tmp"C:\Users\Admin\AppData\Local\Temp\280.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:448 -
C:\Users\Admin\AppData\Local\Temp\2CE.tmp"C:\Users\Admin\AppData\Local\Temp\2CE.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\30D.tmp"C:\Users\Admin\AppData\Local\Temp\30D.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:960 -
C:\Users\Admin\AppData\Local\Temp\35B.tmp"C:\Users\Admin\AppData\Local\Temp\35B.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\3A9.tmp"C:\Users\Admin\AppData\Local\Temp\3A9.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\3F7.tmp"C:\Users\Admin\AppData\Local\Temp\3F7.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\445.tmp"C:\Users\Admin\AppData\Local\Temp\445.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:956 -
C:\Users\Admin\AppData\Local\Temp\493.tmp"C:\Users\Admin\AppData\Local\Temp\493.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\4E1.tmp"C:\Users\Admin\AppData\Local\Temp\4E1.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\52F.tmp"C:\Users\Admin\AppData\Local\Temp\52F.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:772 -
C:\Users\Admin\AppData\Local\Temp\56D.tmp"C:\Users\Admin\AppData\Local\Temp\56D.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\5BB.tmp"C:\Users\Admin\AppData\Local\Temp\5BB.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:816 -
C:\Users\Admin\AppData\Local\Temp\609.tmp"C:\Users\Admin\AppData\Local\Temp\609.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:704 -
C:\Users\Admin\AppData\Local\Temp\657.tmp"C:\Users\Admin\AppData\Local\Temp\657.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\696.tmp"C:\Users\Admin\AppData\Local\Temp\696.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\6E4.tmp"C:\Users\Admin\AppData\Local\Temp\6E4.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\722.tmp"C:\Users\Admin\AppData\Local\Temp\722.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\760.tmp"C:\Users\Admin\AppData\Local\Temp\760.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\79F.tmp"C:\Users\Admin\AppData\Local\Temp\79F.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\7ED.tmp"C:\Users\Admin\AppData\Local\Temp\7ED.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\82B.tmp"C:\Users\Admin\AppData\Local\Temp\82B.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\879.tmp"C:\Users\Admin\AppData\Local\Temp\879.tmp"52⤵
- Executes dropped EXE
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\8B8.tmp"C:\Users\Admin\AppData\Local\Temp\8B8.tmp"53⤵
- Loads dropped DLL
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\906.tmp"C:\Users\Admin\AppData\Local\Temp\906.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\944.tmp"C:\Users\Admin\AppData\Local\Temp\944.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\992.tmp"C:\Users\Admin\AppData\Local\Temp\992.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\9E0.tmp"C:\Users\Admin\AppData\Local\Temp\9E0.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\A2E.tmp"C:\Users\Admin\AppData\Local\Temp\A2E.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\A8C.tmp"C:\Users\Admin\AppData\Local\Temp\A8C.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\ADA.tmp"C:\Users\Admin\AppData\Local\Temp\ADA.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\B28.tmp"C:\Users\Admin\AppData\Local\Temp\B28.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\B66.tmp"C:\Users\Admin\AppData\Local\Temp\B66.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\BA4.tmp"C:\Users\Admin\AppData\Local\Temp\BA4.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\BF2.tmp"C:\Users\Admin\AppData\Local\Temp\BF2.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\C40.tmp"C:\Users\Admin\AppData\Local\Temp\C40.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\C8E.tmp"C:\Users\Admin\AppData\Local\Temp\C8E.tmp"66⤵
- Executes dropped EXE
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\CCD.tmp"C:\Users\Admin\AppData\Local\Temp\CCD.tmp"67⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\D0B.tmp"C:\Users\Admin\AppData\Local\Temp\D0B.tmp"68⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\D59.tmp"C:\Users\Admin\AppData\Local\Temp\D59.tmp"69⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\DA7.tmp"C:\Users\Admin\AppData\Local\Temp\DA7.tmp"70⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\DF5.tmp"C:\Users\Admin\AppData\Local\Temp\DF5.tmp"71⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\E43.tmp"C:\Users\Admin\AppData\Local\Temp\E43.tmp"72⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\E91.tmp"C:\Users\Admin\AppData\Local\Temp\E91.tmp"73⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\EDF.tmp"C:\Users\Admin\AppData\Local\Temp\EDF.tmp"74⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\F1E.tmp"C:\Users\Admin\AppData\Local\Temp\F1E.tmp"75⤵
- System Location Discovery: System Language Discovery
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\F5C.tmp"C:\Users\Admin\AppData\Local\Temp\F5C.tmp"76⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\FAA.tmp"C:\Users\Admin\AppData\Local\Temp\FAA.tmp"77⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\FF8.tmp"C:\Users\Admin\AppData\Local\Temp\FF8.tmp"78⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\1046.tmp"C:\Users\Admin\AppData\Local\Temp\1046.tmp"79⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\1084.tmp"C:\Users\Admin\AppData\Local\Temp\1084.tmp"80⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\10C3.tmp"C:\Users\Admin\AppData\Local\Temp\10C3.tmp"81⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\1101.tmp"C:\Users\Admin\AppData\Local\Temp\1101.tmp"82⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\1140.tmp"C:\Users\Admin\AppData\Local\Temp\1140.tmp"83⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\117E.tmp"C:\Users\Admin\AppData\Local\Temp\117E.tmp"84⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\11BC.tmp"C:\Users\Admin\AppData\Local\Temp\11BC.tmp"85⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\120A.tmp"C:\Users\Admin\AppData\Local\Temp\120A.tmp"86⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\1258.tmp"C:\Users\Admin\AppData\Local\Temp\1258.tmp"87⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\12A6.tmp"C:\Users\Admin\AppData\Local\Temp\12A6.tmp"88⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\12E5.tmp"C:\Users\Admin\AppData\Local\Temp\12E5.tmp"89⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\1323.tmp"C:\Users\Admin\AppData\Local\Temp\1323.tmp"90⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\1362.tmp"C:\Users\Admin\AppData\Local\Temp\1362.tmp"91⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\13A0.tmp"C:\Users\Admin\AppData\Local\Temp\13A0.tmp"92⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\13EE.tmp"C:\Users\Admin\AppData\Local\Temp\13EE.tmp"93⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\143C.tmp"C:\Users\Admin\AppData\Local\Temp\143C.tmp"94⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\147A.tmp"C:\Users\Admin\AppData\Local\Temp\147A.tmp"95⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\14B9.tmp"C:\Users\Admin\AppData\Local\Temp\14B9.tmp"96⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\14F7.tmp"C:\Users\Admin\AppData\Local\Temp\14F7.tmp"97⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\1536.tmp"C:\Users\Admin\AppData\Local\Temp\1536.tmp"98⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\1584.tmp"C:\Users\Admin\AppData\Local\Temp\1584.tmp"99⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\15C2.tmp"C:\Users\Admin\AppData\Local\Temp\15C2.tmp"100⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\1600.tmp"C:\Users\Admin\AppData\Local\Temp\1600.tmp"101⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\164E.tmp"C:\Users\Admin\AppData\Local\Temp\164E.tmp"102⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\169C.tmp"C:\Users\Admin\AppData\Local\Temp\169C.tmp"103⤵PID:296
-
C:\Users\Admin\AppData\Local\Temp\16DB.tmp"C:\Users\Admin\AppData\Local\Temp\16DB.tmp"104⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\1719.tmp"C:\Users\Admin\AppData\Local\Temp\1719.tmp"105⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\1758.tmp"C:\Users\Admin\AppData\Local\Temp\1758.tmp"106⤵PID:344
-
C:\Users\Admin\AppData\Local\Temp\1796.tmp"C:\Users\Admin\AppData\Local\Temp\1796.tmp"107⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\17D4.tmp"C:\Users\Admin\AppData\Local\Temp\17D4.tmp"108⤵PID:588
-
C:\Users\Admin\AppData\Local\Temp\1813.tmp"C:\Users\Admin\AppData\Local\Temp\1813.tmp"109⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\1851.tmp"C:\Users\Admin\AppData\Local\Temp\1851.tmp"110⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\1890.tmp"C:\Users\Admin\AppData\Local\Temp\1890.tmp"111⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\18CE.tmp"C:\Users\Admin\AppData\Local\Temp\18CE.tmp"112⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\190C.tmp"C:\Users\Admin\AppData\Local\Temp\190C.tmp"113⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\194B.tmp"C:\Users\Admin\AppData\Local\Temp\194B.tmp"114⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\1989.tmp"C:\Users\Admin\AppData\Local\Temp\1989.tmp"115⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\19C8.tmp"C:\Users\Admin\AppData\Local\Temp\19C8.tmp"116⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\1A06.tmp"C:\Users\Admin\AppData\Local\Temp\1A06.tmp"117⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\1A44.tmp"C:\Users\Admin\AppData\Local\Temp\1A44.tmp"118⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\1A83.tmp"C:\Users\Admin\AppData\Local\Temp\1A83.tmp"119⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"120⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\1B00.tmp"C:\Users\Admin\AppData\Local\Temp\1B00.tmp"121⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"122⤵PID:2576
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-