Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 03:52
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-19_3f48b5ac189f4bacf0ca883aba3eccda_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-09-19_3f48b5ac189f4bacf0ca883aba3eccda_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-19_3f48b5ac189f4bacf0ca883aba3eccda_mafia.exe
-
Size
530KB
-
MD5
3f48b5ac189f4bacf0ca883aba3eccda
-
SHA1
aebddf0d261d052068cbf71a22f7ecbcd4119a25
-
SHA256
ab7a9381e0a7c300151ab1f10e70e6c8bbbf98e052e37df0078db79fd10b8eee
-
SHA512
8a49eb0c492fcb070acdd41e72043c76efc7155e21c0be699324901a3f74c6a39304f431d19f4fe83dbe6b728423702feb15c8be07655ebc4bc4418949024fee
-
SSDEEP
12288:AU5rCOTeiofRaSzRy6Cr8oTf2kNZulFVg0M1:AUQOJoQEc6gNclFV/M1
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2716 627A.tmp 2824 62E8.tmp 2708 6374.tmp 1764 63D2.tmp 2872 642F.tmp 2748 649D.tmp 2572 650A.tmp 2652 6577.tmp 1920 65F4.tmp 264 6661.tmp 1164 66BF.tmp 1492 671C.tmp 2672 676A.tmp 2260 67D7.tmp 2272 6825.tmp 1440 6883.tmp 2564 68C1.tmp 1128 691F.tmp 1464 697D.tmp 1856 69BB.tmp 3032 69F9.tmp 1948 6A47.tmp 2344 6A95.tmp 1980 6AF3.tmp 2944 6B51.tmp 2016 6B8F.tmp 2224 6BDD.tmp 792 6C1B.tmp 2192 6C5A.tmp 2296 6C98.tmp 2152 6CD7.tmp 1624 6D15.tmp 2464 6D53.tmp 604 6DA1.tmp 2216 6DE0.tmp 1528 6E1E.tmp 872 6E5D.tmp 976 6E9B.tmp 944 6ECA.tmp 2320 6F08.tmp 1740 6F47.tmp 1712 6F85.tmp 2444 6FC3.tmp 880 7002.tmp 684 7040.tmp 3040 707F.tmp 2660 70BD.tmp 1488 710B.tmp 2976 7149.tmp 1200 7197.tmp 3036 71D6.tmp 2100 7224.tmp 1600 7262.tmp 2784 72B0.tmp 2804 72EF.tmp 2716 732D.tmp 2836 736B.tmp 2848 73AA.tmp 2708 73E8.tmp 2776 7427.tmp 496 7465.tmp 2600 74A3.tmp 2596 74E2.tmp 2620 7520.tmp -
Loads dropped DLL 64 IoCs
pid Process 2160 2024-09-19_3f48b5ac189f4bacf0ca883aba3eccda_mafia.exe 2716 627A.tmp 2824 62E8.tmp 2708 6374.tmp 1764 63D2.tmp 2872 642F.tmp 2748 649D.tmp 2572 650A.tmp 2652 6577.tmp 1920 65F4.tmp 264 6661.tmp 1164 66BF.tmp 1492 671C.tmp 2672 676A.tmp 2260 67D7.tmp 2272 6825.tmp 1440 6883.tmp 2564 68C1.tmp 1128 691F.tmp 1464 697D.tmp 1856 69BB.tmp 3032 69F9.tmp 1948 6A47.tmp 2344 6A95.tmp 1980 6AF3.tmp 2944 6B51.tmp 2016 6B8F.tmp 2224 6BDD.tmp 792 6C1B.tmp 2192 6C5A.tmp 2296 6C98.tmp 2152 6CD7.tmp 1624 6D15.tmp 2464 6D53.tmp 604 6DA1.tmp 2216 6DE0.tmp 1528 6E1E.tmp 872 6E5D.tmp 976 6E9B.tmp 944 6ECA.tmp 2320 6F08.tmp 1740 6F47.tmp 1712 6F85.tmp 2444 6FC3.tmp 880 7002.tmp 684 7040.tmp 3040 707F.tmp 2660 70BD.tmp 1488 710B.tmp 2976 7149.tmp 1200 7197.tmp 3036 71D6.tmp 2100 7224.tmp 1600 7262.tmp 2784 72B0.tmp 2804 72EF.tmp 2716 732D.tmp 2836 736B.tmp 2848 73AA.tmp 2708 73E8.tmp 2776 7427.tmp 496 7465.tmp 2600 74A3.tmp 2596 74E2.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 657.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 909C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EED2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1297.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 207C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6087.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBE7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E33E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C38D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3784.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5AEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF07.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A04.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A66D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F306.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4154.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2160 wrote to memory of 2716 2160 2024-09-19_3f48b5ac189f4bacf0ca883aba3eccda_mafia.exe 30 PID 2160 wrote to memory of 2716 2160 2024-09-19_3f48b5ac189f4bacf0ca883aba3eccda_mafia.exe 30 PID 2160 wrote to memory of 2716 2160 2024-09-19_3f48b5ac189f4bacf0ca883aba3eccda_mafia.exe 30 PID 2160 wrote to memory of 2716 2160 2024-09-19_3f48b5ac189f4bacf0ca883aba3eccda_mafia.exe 30 PID 2716 wrote to memory of 2824 2716 627A.tmp 31 PID 2716 wrote to memory of 2824 2716 627A.tmp 31 PID 2716 wrote to memory of 2824 2716 627A.tmp 31 PID 2716 wrote to memory of 2824 2716 627A.tmp 31 PID 2824 wrote to memory of 2708 2824 62E8.tmp 32 PID 2824 wrote to memory of 2708 2824 62E8.tmp 32 PID 2824 wrote to memory of 2708 2824 62E8.tmp 32 PID 2824 wrote to memory of 2708 2824 62E8.tmp 32 PID 2708 wrote to memory of 1764 2708 6374.tmp 33 PID 2708 wrote to memory of 1764 2708 6374.tmp 33 PID 2708 wrote to memory of 1764 2708 6374.tmp 33 PID 2708 wrote to memory of 1764 2708 6374.tmp 33 PID 1764 wrote to memory of 2872 1764 63D2.tmp 34 PID 1764 wrote to memory of 2872 1764 63D2.tmp 34 PID 1764 wrote to memory of 2872 1764 63D2.tmp 34 PID 1764 wrote to memory of 2872 1764 63D2.tmp 34 PID 2872 wrote to memory of 2748 2872 642F.tmp 35 PID 2872 wrote to memory of 2748 2872 642F.tmp 35 PID 2872 wrote to memory of 2748 2872 642F.tmp 35 PID 2872 wrote to memory of 2748 2872 642F.tmp 35 PID 2748 wrote to memory of 2572 2748 649D.tmp 36 PID 2748 wrote to memory of 2572 2748 649D.tmp 36 PID 2748 wrote to memory of 2572 2748 649D.tmp 36 PID 2748 wrote to memory of 2572 2748 649D.tmp 36 PID 2572 wrote to memory of 2652 2572 650A.tmp 37 PID 2572 wrote to memory of 2652 2572 650A.tmp 37 PID 2572 wrote to memory of 2652 2572 650A.tmp 37 PID 2572 wrote to memory of 2652 2572 650A.tmp 37 PID 2652 wrote to memory of 1920 2652 6577.tmp 38 PID 2652 wrote to memory of 1920 2652 6577.tmp 38 PID 2652 wrote to memory of 1920 2652 6577.tmp 38 PID 2652 wrote to memory of 1920 2652 6577.tmp 38 PID 1920 wrote to memory of 264 1920 65F4.tmp 39 PID 1920 wrote to memory of 264 1920 65F4.tmp 39 PID 1920 wrote to memory of 264 1920 65F4.tmp 39 PID 1920 wrote to memory of 264 1920 65F4.tmp 39 PID 264 wrote to memory of 1164 264 6661.tmp 40 PID 264 wrote to memory of 1164 264 6661.tmp 40 PID 264 wrote to memory of 1164 264 6661.tmp 40 PID 264 wrote to memory of 1164 264 6661.tmp 40 PID 1164 wrote to memory of 1492 1164 66BF.tmp 41 PID 1164 wrote to memory of 1492 1164 66BF.tmp 41 PID 1164 wrote to memory of 1492 1164 66BF.tmp 41 PID 1164 wrote to memory of 1492 1164 66BF.tmp 41 PID 1492 wrote to memory of 2672 1492 671C.tmp 42 PID 1492 wrote to memory of 2672 1492 671C.tmp 42 PID 1492 wrote to memory of 2672 1492 671C.tmp 42 PID 1492 wrote to memory of 2672 1492 671C.tmp 42 PID 2672 wrote to memory of 2260 2672 676A.tmp 43 PID 2672 wrote to memory of 2260 2672 676A.tmp 43 PID 2672 wrote to memory of 2260 2672 676A.tmp 43 PID 2672 wrote to memory of 2260 2672 676A.tmp 43 PID 2260 wrote to memory of 2272 2260 67D7.tmp 44 PID 2260 wrote to memory of 2272 2260 67D7.tmp 44 PID 2260 wrote to memory of 2272 2260 67D7.tmp 44 PID 2260 wrote to memory of 2272 2260 67D7.tmp 44 PID 2272 wrote to memory of 1440 2272 6825.tmp 45 PID 2272 wrote to memory of 1440 2272 6825.tmp 45 PID 2272 wrote to memory of 1440 2272 6825.tmp 45 PID 2272 wrote to memory of 1440 2272 6825.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_3f48b5ac189f4bacf0ca883aba3eccda_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_3f48b5ac189f4bacf0ca883aba3eccda_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\627A.tmp"C:\Users\Admin\AppData\Local\Temp\627A.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\62E8.tmp"C:\Users\Admin\AppData\Local\Temp\62E8.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\6374.tmp"C:\Users\Admin\AppData\Local\Temp\6374.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\63D2.tmp"C:\Users\Admin\AppData\Local\Temp\63D2.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\642F.tmp"C:\Users\Admin\AppData\Local\Temp\642F.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\649D.tmp"C:\Users\Admin\AppData\Local\Temp\649D.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\650A.tmp"C:\Users\Admin\AppData\Local\Temp\650A.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\6577.tmp"C:\Users\Admin\AppData\Local\Temp\6577.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\65F4.tmp"C:\Users\Admin\AppData\Local\Temp\65F4.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\6661.tmp"C:\Users\Admin\AppData\Local\Temp\6661.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Users\Admin\AppData\Local\Temp\66BF.tmp"C:\Users\Admin\AppData\Local\Temp\66BF.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\671C.tmp"C:\Users\Admin\AppData\Local\Temp\671C.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\676A.tmp"C:\Users\Admin\AppData\Local\Temp\676A.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\67D7.tmp"C:\Users\Admin\AppData\Local\Temp\67D7.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\6825.tmp"C:\Users\Admin\AppData\Local\Temp\6825.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\6883.tmp"C:\Users\Admin\AppData\Local\Temp\6883.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\68C1.tmp"C:\Users\Admin\AppData\Local\Temp\68C1.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\691F.tmp"C:\Users\Admin\AppData\Local\Temp\691F.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\697D.tmp"C:\Users\Admin\AppData\Local\Temp\697D.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\69BB.tmp"C:\Users\Admin\AppData\Local\Temp\69BB.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\69F9.tmp"C:\Users\Admin\AppData\Local\Temp\69F9.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\6A47.tmp"C:\Users\Admin\AppData\Local\Temp\6A47.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\6A95.tmp"C:\Users\Admin\AppData\Local\Temp\6A95.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\6AF3.tmp"C:\Users\Admin\AppData\Local\Temp\6AF3.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\6B51.tmp"C:\Users\Admin\AppData\Local\Temp\6B51.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\6B8F.tmp"C:\Users\Admin\AppData\Local\Temp\6B8F.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\6BDD.tmp"C:\Users\Admin\AppData\Local\Temp\6BDD.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\6C1B.tmp"C:\Users\Admin\AppData\Local\Temp\6C1B.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:792 -
C:\Users\Admin\AppData\Local\Temp\6C5A.tmp"C:\Users\Admin\AppData\Local\Temp\6C5A.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\6C98.tmp"C:\Users\Admin\AppData\Local\Temp\6C98.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\6CD7.tmp"C:\Users\Admin\AppData\Local\Temp\6CD7.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\6D15.tmp"C:\Users\Admin\AppData\Local\Temp\6D15.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\6D53.tmp"C:\Users\Admin\AppData\Local\Temp\6D53.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\6DA1.tmp"C:\Users\Admin\AppData\Local\Temp\6DA1.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:604 -
C:\Users\Admin\AppData\Local\Temp\6DE0.tmp"C:\Users\Admin\AppData\Local\Temp\6DE0.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\6E1E.tmp"C:\Users\Admin\AppData\Local\Temp\6E1E.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\6E5D.tmp"C:\Users\Admin\AppData\Local\Temp\6E5D.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:872 -
C:\Users\Admin\AppData\Local\Temp\6E9B.tmp"C:\Users\Admin\AppData\Local\Temp\6E9B.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:976 -
C:\Users\Admin\AppData\Local\Temp\6ECA.tmp"C:\Users\Admin\AppData\Local\Temp\6ECA.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:944 -
C:\Users\Admin\AppData\Local\Temp\6F08.tmp"C:\Users\Admin\AppData\Local\Temp\6F08.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\6F47.tmp"C:\Users\Admin\AppData\Local\Temp\6F47.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\6F85.tmp"C:\Users\Admin\AppData\Local\Temp\6F85.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\6FC3.tmp"C:\Users\Admin\AppData\Local\Temp\6FC3.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\7002.tmp"C:\Users\Admin\AppData\Local\Temp\7002.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:880 -
C:\Users\Admin\AppData\Local\Temp\7040.tmp"C:\Users\Admin\AppData\Local\Temp\7040.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:684 -
C:\Users\Admin\AppData\Local\Temp\707F.tmp"C:\Users\Admin\AppData\Local\Temp\707F.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\70BD.tmp"C:\Users\Admin\AppData\Local\Temp\70BD.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\710B.tmp"C:\Users\Admin\AppData\Local\Temp\710B.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\7149.tmp"C:\Users\Admin\AppData\Local\Temp\7149.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\7197.tmp"C:\Users\Admin\AppData\Local\Temp\7197.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\71D6.tmp"C:\Users\Admin\AppData\Local\Temp\71D6.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\7224.tmp"C:\Users\Admin\AppData\Local\Temp\7224.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\7262.tmp"C:\Users\Admin\AppData\Local\Temp\7262.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\72B0.tmp"C:\Users\Admin\AppData\Local\Temp\72B0.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\72EF.tmp"C:\Users\Admin\AppData\Local\Temp\72EF.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\732D.tmp"C:\Users\Admin\AppData\Local\Temp\732D.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\736B.tmp"C:\Users\Admin\AppData\Local\Temp\736B.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\73AA.tmp"C:\Users\Admin\AppData\Local\Temp\73AA.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\73E8.tmp"C:\Users\Admin\AppData\Local\Temp\73E8.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\7427.tmp"C:\Users\Admin\AppData\Local\Temp\7427.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\7465.tmp"C:\Users\Admin\AppData\Local\Temp\7465.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:496 -
C:\Users\Admin\AppData\Local\Temp\74A3.tmp"C:\Users\Admin\AppData\Local\Temp\74A3.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"65⤵
- Executes dropped EXE
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\755F.tmp"C:\Users\Admin\AppData\Local\Temp\755F.tmp"66⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\75BC.tmp"C:\Users\Admin\AppData\Local\Temp\75BC.tmp"67⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\75FB.tmp"C:\Users\Admin\AppData\Local\Temp\75FB.tmp"68⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\7649.tmp"C:\Users\Admin\AppData\Local\Temp\7649.tmp"69⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\7687.tmp"C:\Users\Admin\AppData\Local\Temp\7687.tmp"70⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\76C5.tmp"C:\Users\Admin\AppData\Local\Temp\76C5.tmp"71⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\7704.tmp"C:\Users\Admin\AppData\Local\Temp\7704.tmp"72⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\7752.tmp"C:\Users\Admin\AppData\Local\Temp\7752.tmp"73⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\7790.tmp"C:\Users\Admin\AppData\Local\Temp\7790.tmp"74⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\77DE.tmp"C:\Users\Admin\AppData\Local\Temp\77DE.tmp"75⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\781D.tmp"C:\Users\Admin\AppData\Local\Temp\781D.tmp"76⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\786B.tmp"C:\Users\Admin\AppData\Local\Temp\786B.tmp"77⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\78A9.tmp"C:\Users\Admin\AppData\Local\Temp\78A9.tmp"78⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\78E7.tmp"C:\Users\Admin\AppData\Local\Temp\78E7.tmp"79⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\7926.tmp"C:\Users\Admin\AppData\Local\Temp\7926.tmp"80⤵PID:308
-
C:\Users\Admin\AppData\Local\Temp\7964.tmp"C:\Users\Admin\AppData\Local\Temp\7964.tmp"81⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\79A3.tmp"C:\Users\Admin\AppData\Local\Temp\79A3.tmp"82⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\79F1.tmp"C:\Users\Admin\AppData\Local\Temp\79F1.tmp"83⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\7A2F.tmp"C:\Users\Admin\AppData\Local\Temp\7A2F.tmp"84⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\7A7D.tmp"C:\Users\Admin\AppData\Local\Temp\7A7D.tmp"85⤵PID:344
-
C:\Users\Admin\AppData\Local\Temp\7ABB.tmp"C:\Users\Admin\AppData\Local\Temp\7ABB.tmp"86⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\7AFA.tmp"C:\Users\Admin\AppData\Local\Temp\7AFA.tmp"87⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\7B38.tmp"C:\Users\Admin\AppData\Local\Temp\7B38.tmp"88⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\7B77.tmp"C:\Users\Admin\AppData\Local\Temp\7B77.tmp"89⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\7BB5.tmp"C:\Users\Admin\AppData\Local\Temp\7BB5.tmp"90⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\7BF3.tmp"C:\Users\Admin\AppData\Local\Temp\7BF3.tmp"91⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\7C32.tmp"C:\Users\Admin\AppData\Local\Temp\7C32.tmp"92⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\7C70.tmp"C:\Users\Admin\AppData\Local\Temp\7C70.tmp"93⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\7CAF.tmp"C:\Users\Admin\AppData\Local\Temp\7CAF.tmp"94⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\7CED.tmp"C:\Users\Admin\AppData\Local\Temp\7CED.tmp"95⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\7D2B.tmp"C:\Users\Admin\AppData\Local\Temp\7D2B.tmp"96⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\7D6A.tmp"C:\Users\Admin\AppData\Local\Temp\7D6A.tmp"97⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\7DB8.tmp"C:\Users\Admin\AppData\Local\Temp\7DB8.tmp"98⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\7DF6.tmp"C:\Users\Admin\AppData\Local\Temp\7DF6.tmp"99⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\7E35.tmp"C:\Users\Admin\AppData\Local\Temp\7E35.tmp"100⤵PID:604
-
C:\Users\Admin\AppData\Local\Temp\7E73.tmp"C:\Users\Admin\AppData\Local\Temp\7E73.tmp"101⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\7EB1.tmp"C:\Users\Admin\AppData\Local\Temp\7EB1.tmp"102⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\7EF0.tmp"C:\Users\Admin\AppData\Local\Temp\7EF0.tmp"103⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\7F2E.tmp"C:\Users\Admin\AppData\Local\Temp\7F2E.tmp"104⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\7F6D.tmp"C:\Users\Admin\AppData\Local\Temp\7F6D.tmp"105⤵PID:328
-
C:\Users\Admin\AppData\Local\Temp\7FAB.tmp"C:\Users\Admin\AppData\Local\Temp\7FAB.tmp"106⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\7FE9.tmp"C:\Users\Admin\AppData\Local\Temp\7FE9.tmp"107⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\8028.tmp"C:\Users\Admin\AppData\Local\Temp\8028.tmp"108⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\8066.tmp"C:\Users\Admin\AppData\Local\Temp\8066.tmp"109⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\80A5.tmp"C:\Users\Admin\AppData\Local\Temp\80A5.tmp"110⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\80F3.tmp"C:\Users\Admin\AppData\Local\Temp\80F3.tmp"111⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\8131.tmp"C:\Users\Admin\AppData\Local\Temp\8131.tmp"112⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\816F.tmp"C:\Users\Admin\AppData\Local\Temp\816F.tmp"113⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\81AE.tmp"C:\Users\Admin\AppData\Local\Temp\81AE.tmp"114⤵
- System Location Discovery: System Language Discovery
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\81EC.tmp"C:\Users\Admin\AppData\Local\Temp\81EC.tmp"115⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\822B.tmp"C:\Users\Admin\AppData\Local\Temp\822B.tmp"116⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\8269.tmp"C:\Users\Admin\AppData\Local\Temp\8269.tmp"117⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\82A7.tmp"C:\Users\Admin\AppData\Local\Temp\82A7.tmp"118⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\82E6.tmp"C:\Users\Admin\AppData\Local\Temp\82E6.tmp"119⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\8334.tmp"C:\Users\Admin\AppData\Local\Temp\8334.tmp"120⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\8372.tmp"C:\Users\Admin\AppData\Local\Temp\8372.tmp"121⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\83B1.tmp"C:\Users\Admin\AppData\Local\Temp\83B1.tmp"122⤵PID:2168
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-