Analysis
-
max time kernel
150s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 04:01
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-19_96f0f1205cd81f874d3197d72704885e_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-19_96f0f1205cd81f874d3197d72704885e_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-19_96f0f1205cd81f874d3197d72704885e_mafia.exe
-
Size
541KB
-
MD5
96f0f1205cd81f874d3197d72704885e
-
SHA1
d97bff14d617f29534657f4bc9c5fdfb53b3e0b6
-
SHA256
0088f633c08a497391c681cd08f8d5e6bca9c3cb6deb5a393959bfb9e9f0cac2
-
SHA512
bb96de81b78f0c96010962368d68bd0eee7cfd638eb92d1bc249b7c9f2e845d6bc0525abba353e8507ecda43992560181eb9d5707687ceb8a216a00ad02bb5bc
-
SSDEEP
12288:UU5rCOTeifSKt/T+L8XDBTzjMV25dCXZ2rZa73ctO:UUQOJfSq/yAX5CXZ2rU73ctO
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2696 5909.tmp 2804 5985.tmp 2360 5A02.tmp 2760 5A7F.tmp 2704 5ADD.tmp 1804 5B59.tmp 2592 5BC7.tmp 3052 5C43.tmp 2080 5CB1.tmp 2072 5D2D.tmp 2120 5D9B.tmp 2384 5E37.tmp 3000 5EB3.tmp 2156 5F30.tmp 3028 5FAD.tmp 2892 5FFB.tmp 3040 6078.tmp 2828 6104.tmp 2824 6171.tmp 2460 61EE.tmp 984 626B.tmp 540 62D8.tmp 1792 6345.tmp 2140 6384.tmp 2164 63C2.tmp 2484 6410.tmp 2012 644F.tmp 2232 648D.tmp 1320 64CB.tmp 1592 650A.tmp 952 6548.tmp 1860 6596.tmp 772 65D5.tmp 1716 6623.tmp 2876 6661.tmp 824 669F.tmp 2228 66ED.tmp 2512 672C.tmp 1672 676A.tmp 2008 67A9.tmp 1956 67E7.tmp 1156 6825.tmp 1988 6864.tmp 764 68B2.tmp 372 6900.tmp 1628 693E.tmp 2280 697D.tmp 2052 69CB.tmp 2288 6A09.tmp 1432 6A57.tmp 1900 6A95.tmp 1576 6AE3.tmp 1548 6B22.tmp 2732 6B70.tmp 2696 6BAE.tmp 2984 6C1B.tmp 2844 6C5A.tmp 2920 6C98.tmp 2208 6CD7.tmp 2588 6D15.tmp 2720 6D53.tmp 2728 6DA1.tmp 2840 6DEF.tmp 2604 6E2E.tmp -
Loads dropped DLL 64 IoCs
pid Process 2644 2024-09-19_96f0f1205cd81f874d3197d72704885e_mafia.exe 2696 5909.tmp 2804 5985.tmp 2360 5A02.tmp 2760 5A7F.tmp 2704 5ADD.tmp 1804 5B59.tmp 2592 5BC7.tmp 3052 5C43.tmp 2080 5CB1.tmp 2072 5D2D.tmp 2120 5D9B.tmp 2384 5E37.tmp 3000 5EB3.tmp 2156 5F30.tmp 3028 5FAD.tmp 2892 5FFB.tmp 3040 6078.tmp 2828 6104.tmp 2824 6171.tmp 2460 61EE.tmp 984 626B.tmp 540 62D8.tmp 1792 6345.tmp 2140 6384.tmp 2164 63C2.tmp 2484 6410.tmp 2012 644F.tmp 2232 648D.tmp 1320 64CB.tmp 1592 650A.tmp 952 6548.tmp 1860 6596.tmp 772 65D5.tmp 1716 6623.tmp 2876 6661.tmp 824 669F.tmp 2228 66ED.tmp 2512 672C.tmp 1672 676A.tmp 2008 67A9.tmp 1956 67E7.tmp 1156 6825.tmp 1988 6864.tmp 764 68B2.tmp 372 6900.tmp 1628 693E.tmp 2280 697D.tmp 2052 69CB.tmp 2288 6A09.tmp 1432 6A57.tmp 1900 6A95.tmp 1576 6AE3.tmp 1548 6B22.tmp 2732 6B70.tmp 2696 6BAE.tmp 2984 6C1B.tmp 2844 6C5A.tmp 2920 6C98.tmp 2208 6CD7.tmp 2588 6D15.tmp 2720 6D53.tmp 2728 6DA1.tmp 2840 6DEF.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A016.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 341B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 644F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C89C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 253C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5023.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7465.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 230B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A40C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D0E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FB8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3360.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2404.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 471E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E34D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E7EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C76.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2644 wrote to memory of 2696 2644 2024-09-19_96f0f1205cd81f874d3197d72704885e_mafia.exe 30 PID 2644 wrote to memory of 2696 2644 2024-09-19_96f0f1205cd81f874d3197d72704885e_mafia.exe 30 PID 2644 wrote to memory of 2696 2644 2024-09-19_96f0f1205cd81f874d3197d72704885e_mafia.exe 30 PID 2644 wrote to memory of 2696 2644 2024-09-19_96f0f1205cd81f874d3197d72704885e_mafia.exe 30 PID 2696 wrote to memory of 2804 2696 5909.tmp 31 PID 2696 wrote to memory of 2804 2696 5909.tmp 31 PID 2696 wrote to memory of 2804 2696 5909.tmp 31 PID 2696 wrote to memory of 2804 2696 5909.tmp 31 PID 2804 wrote to memory of 2360 2804 5985.tmp 32 PID 2804 wrote to memory of 2360 2804 5985.tmp 32 PID 2804 wrote to memory of 2360 2804 5985.tmp 32 PID 2804 wrote to memory of 2360 2804 5985.tmp 32 PID 2360 wrote to memory of 2760 2360 5A02.tmp 33 PID 2360 wrote to memory of 2760 2360 5A02.tmp 33 PID 2360 wrote to memory of 2760 2360 5A02.tmp 33 PID 2360 wrote to memory of 2760 2360 5A02.tmp 33 PID 2760 wrote to memory of 2704 2760 5A7F.tmp 34 PID 2760 wrote to memory of 2704 2760 5A7F.tmp 34 PID 2760 wrote to memory of 2704 2760 5A7F.tmp 34 PID 2760 wrote to memory of 2704 2760 5A7F.tmp 34 PID 2704 wrote to memory of 1804 2704 5ADD.tmp 35 PID 2704 wrote to memory of 1804 2704 5ADD.tmp 35 PID 2704 wrote to memory of 1804 2704 5ADD.tmp 35 PID 2704 wrote to memory of 1804 2704 5ADD.tmp 35 PID 1804 wrote to memory of 2592 1804 5B59.tmp 36 PID 1804 wrote to memory of 2592 1804 5B59.tmp 36 PID 1804 wrote to memory of 2592 1804 5B59.tmp 36 PID 1804 wrote to memory of 2592 1804 5B59.tmp 36 PID 2592 wrote to memory of 3052 2592 5BC7.tmp 37 PID 2592 wrote to memory of 3052 2592 5BC7.tmp 37 PID 2592 wrote to memory of 3052 2592 5BC7.tmp 37 PID 2592 wrote to memory of 3052 2592 5BC7.tmp 37 PID 3052 wrote to memory of 2080 3052 5C43.tmp 38 PID 3052 wrote to memory of 2080 3052 5C43.tmp 38 PID 3052 wrote to memory of 2080 3052 5C43.tmp 38 PID 3052 wrote to memory of 2080 3052 5C43.tmp 38 PID 2080 wrote to memory of 2072 2080 5CB1.tmp 39 PID 2080 wrote to memory of 2072 2080 5CB1.tmp 39 PID 2080 wrote to memory of 2072 2080 5CB1.tmp 39 PID 2080 wrote to memory of 2072 2080 5CB1.tmp 39 PID 2072 wrote to memory of 2120 2072 5D2D.tmp 40 PID 2072 wrote to memory of 2120 2072 5D2D.tmp 40 PID 2072 wrote to memory of 2120 2072 5D2D.tmp 40 PID 2072 wrote to memory of 2120 2072 5D2D.tmp 40 PID 2120 wrote to memory of 2384 2120 5D9B.tmp 41 PID 2120 wrote to memory of 2384 2120 5D9B.tmp 41 PID 2120 wrote to memory of 2384 2120 5D9B.tmp 41 PID 2120 wrote to memory of 2384 2120 5D9B.tmp 41 PID 2384 wrote to memory of 3000 2384 5E37.tmp 42 PID 2384 wrote to memory of 3000 2384 5E37.tmp 42 PID 2384 wrote to memory of 3000 2384 5E37.tmp 42 PID 2384 wrote to memory of 3000 2384 5E37.tmp 42 PID 3000 wrote to memory of 2156 3000 5EB3.tmp 43 PID 3000 wrote to memory of 2156 3000 5EB3.tmp 43 PID 3000 wrote to memory of 2156 3000 5EB3.tmp 43 PID 3000 wrote to memory of 2156 3000 5EB3.tmp 43 PID 2156 wrote to memory of 3028 2156 5F30.tmp 44 PID 2156 wrote to memory of 3028 2156 5F30.tmp 44 PID 2156 wrote to memory of 3028 2156 5F30.tmp 44 PID 2156 wrote to memory of 3028 2156 5F30.tmp 44 PID 3028 wrote to memory of 2892 3028 5FAD.tmp 45 PID 3028 wrote to memory of 2892 3028 5FAD.tmp 45 PID 3028 wrote to memory of 2892 3028 5FAD.tmp 45 PID 3028 wrote to memory of 2892 3028 5FAD.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_96f0f1205cd81f874d3197d72704885e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_96f0f1205cd81f874d3197d72704885e_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\5909.tmp"C:\Users\Admin\AppData\Local\Temp\5909.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\5985.tmp"C:\Users\Admin\AppData\Local\Temp\5985.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\5A02.tmp"C:\Users\Admin\AppData\Local\Temp\5A02.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\5A7F.tmp"C:\Users\Admin\AppData\Local\Temp\5A7F.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\5ADD.tmp"C:\Users\Admin\AppData\Local\Temp\5ADD.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\5B59.tmp"C:\Users\Admin\AppData\Local\Temp\5B59.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\5BC7.tmp"C:\Users\Admin\AppData\Local\Temp\5BC7.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\5C43.tmp"C:\Users\Admin\AppData\Local\Temp\5C43.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\5CB1.tmp"C:\Users\Admin\AppData\Local\Temp\5CB1.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\5D2D.tmp"C:\Users\Admin\AppData\Local\Temp\5D2D.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\5D9B.tmp"C:\Users\Admin\AppData\Local\Temp\5D9B.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\5E37.tmp"C:\Users\Admin\AppData\Local\Temp\5E37.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\5EB3.tmp"C:\Users\Admin\AppData\Local\Temp\5EB3.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\5F30.tmp"C:\Users\Admin\AppData\Local\Temp\5F30.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\5FAD.tmp"C:\Users\Admin\AppData\Local\Temp\5FAD.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\5FFB.tmp"C:\Users\Admin\AppData\Local\Temp\5FFB.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\6078.tmp"C:\Users\Admin\AppData\Local\Temp\6078.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\6104.tmp"C:\Users\Admin\AppData\Local\Temp\6104.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\6171.tmp"C:\Users\Admin\AppData\Local\Temp\6171.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\61EE.tmp"C:\Users\Admin\AppData\Local\Temp\61EE.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\626B.tmp"C:\Users\Admin\AppData\Local\Temp\626B.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:984 -
C:\Users\Admin\AppData\Local\Temp\62D8.tmp"C:\Users\Admin\AppData\Local\Temp\62D8.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:540 -
C:\Users\Admin\AppData\Local\Temp\6345.tmp"C:\Users\Admin\AppData\Local\Temp\6345.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\6384.tmp"C:\Users\Admin\AppData\Local\Temp\6384.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\63C2.tmp"C:\Users\Admin\AppData\Local\Temp\63C2.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\6410.tmp"C:\Users\Admin\AppData\Local\Temp\6410.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\644F.tmp"C:\Users\Admin\AppData\Local\Temp\644F.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\648D.tmp"C:\Users\Admin\AppData\Local\Temp\648D.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\64CB.tmp"C:\Users\Admin\AppData\Local\Temp\64CB.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\650A.tmp"C:\Users\Admin\AppData\Local\Temp\650A.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\6548.tmp"C:\Users\Admin\AppData\Local\Temp\6548.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:952 -
C:\Users\Admin\AppData\Local\Temp\6596.tmp"C:\Users\Admin\AppData\Local\Temp\6596.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\65D5.tmp"C:\Users\Admin\AppData\Local\Temp\65D5.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:772 -
C:\Users\Admin\AppData\Local\Temp\6623.tmp"C:\Users\Admin\AppData\Local\Temp\6623.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\6661.tmp"C:\Users\Admin\AppData\Local\Temp\6661.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\669F.tmp"C:\Users\Admin\AppData\Local\Temp\669F.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:824 -
C:\Users\Admin\AppData\Local\Temp\66ED.tmp"C:\Users\Admin\AppData\Local\Temp\66ED.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\672C.tmp"C:\Users\Admin\AppData\Local\Temp\672C.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\676A.tmp"C:\Users\Admin\AppData\Local\Temp\676A.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\67A9.tmp"C:\Users\Admin\AppData\Local\Temp\67A9.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\67E7.tmp"C:\Users\Admin\AppData\Local\Temp\67E7.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\6825.tmp"C:\Users\Admin\AppData\Local\Temp\6825.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\6864.tmp"C:\Users\Admin\AppData\Local\Temp\6864.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\68B2.tmp"C:\Users\Admin\AppData\Local\Temp\68B2.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:764 -
C:\Users\Admin\AppData\Local\Temp\6900.tmp"C:\Users\Admin\AppData\Local\Temp\6900.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:372 -
C:\Users\Admin\AppData\Local\Temp\693E.tmp"C:\Users\Admin\AppData\Local\Temp\693E.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\697D.tmp"C:\Users\Admin\AppData\Local\Temp\697D.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\69CB.tmp"C:\Users\Admin\AppData\Local\Temp\69CB.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\6A09.tmp"C:\Users\Admin\AppData\Local\Temp\6A09.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\6A57.tmp"C:\Users\Admin\AppData\Local\Temp\6A57.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\6A95.tmp"C:\Users\Admin\AppData\Local\Temp\6A95.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\6AE3.tmp"C:\Users\Admin\AppData\Local\Temp\6AE3.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\6B22.tmp"C:\Users\Admin\AppData\Local\Temp\6B22.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\6B70.tmp"C:\Users\Admin\AppData\Local\Temp\6B70.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\6BAE.tmp"C:\Users\Admin\AppData\Local\Temp\6BAE.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\6C1B.tmp"C:\Users\Admin\AppData\Local\Temp\6C1B.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\6C5A.tmp"C:\Users\Admin\AppData\Local\Temp\6C5A.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\6C98.tmp"C:\Users\Admin\AppData\Local\Temp\6C98.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\6CD7.tmp"C:\Users\Admin\AppData\Local\Temp\6CD7.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\6D15.tmp"C:\Users\Admin\AppData\Local\Temp\6D15.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\6D53.tmp"C:\Users\Admin\AppData\Local\Temp\6D53.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\6DA1.tmp"C:\Users\Admin\AppData\Local\Temp\6DA1.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\6DEF.tmp"C:\Users\Admin\AppData\Local\Temp\6DEF.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\6E2E.tmp"C:\Users\Admin\AppData\Local\Temp\6E2E.tmp"65⤵
- Executes dropped EXE
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\6E6C.tmp"C:\Users\Admin\AppData\Local\Temp\6E6C.tmp"66⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\6EAB.tmp"C:\Users\Admin\AppData\Local\Temp\6EAB.tmp"67⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\6EF9.tmp"C:\Users\Admin\AppData\Local\Temp\6EF9.tmp"68⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\6F47.tmp"C:\Users\Admin\AppData\Local\Temp\6F47.tmp"69⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\6F85.tmp"C:\Users\Admin\AppData\Local\Temp\6F85.tmp"70⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\6FD3.tmp"C:\Users\Admin\AppData\Local\Temp\6FD3.tmp"71⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\7011.tmp"C:\Users\Admin\AppData\Local\Temp\7011.tmp"72⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\7050.tmp"C:\Users\Admin\AppData\Local\Temp\7050.tmp"73⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\708E.tmp"C:\Users\Admin\AppData\Local\Temp\708E.tmp"74⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\70CD.tmp"C:\Users\Admin\AppData\Local\Temp\70CD.tmp"75⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\710B.tmp"C:\Users\Admin\AppData\Local\Temp\710B.tmp"76⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\7149.tmp"C:\Users\Admin\AppData\Local\Temp\7149.tmp"77⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\7188.tmp"C:\Users\Admin\AppData\Local\Temp\7188.tmp"78⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\71D6.tmp"C:\Users\Admin\AppData\Local\Temp\71D6.tmp"79⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\7214.tmp"C:\Users\Admin\AppData\Local\Temp\7214.tmp"80⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\7262.tmp"C:\Users\Admin\AppData\Local\Temp\7262.tmp"81⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\72A1.tmp"C:\Users\Admin\AppData\Local\Temp\72A1.tmp"82⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\72EF.tmp"C:\Users\Admin\AppData\Local\Temp\72EF.tmp"83⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\732D.tmp"C:\Users\Admin\AppData\Local\Temp\732D.tmp"84⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\736B.tmp"C:\Users\Admin\AppData\Local\Temp\736B.tmp"85⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\73AA.tmp"C:\Users\Admin\AppData\Local\Temp\73AA.tmp"86⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\73E8.tmp"C:\Users\Admin\AppData\Local\Temp\73E8.tmp"87⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\7427.tmp"C:\Users\Admin\AppData\Local\Temp\7427.tmp"88⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\7465.tmp"C:\Users\Admin\AppData\Local\Temp\7465.tmp"89⤵
- System Location Discovery: System Language Discovery
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\74A3.tmp"C:\Users\Admin\AppData\Local\Temp\74A3.tmp"90⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"91⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"92⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"93⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\75AD.tmp"C:\Users\Admin\AppData\Local\Temp\75AD.tmp"94⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\75EB.tmp"C:\Users\Admin\AppData\Local\Temp\75EB.tmp"95⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\7629.tmp"C:\Users\Admin\AppData\Local\Temp\7629.tmp"96⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\7668.tmp"C:\Users\Admin\AppData\Local\Temp\7668.tmp"97⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\76A6.tmp"C:\Users\Admin\AppData\Local\Temp\76A6.tmp"98⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\76E5.tmp"C:\Users\Admin\AppData\Local\Temp\76E5.tmp"99⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\7723.tmp"C:\Users\Admin\AppData\Local\Temp\7723.tmp"100⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\7761.tmp"C:\Users\Admin\AppData\Local\Temp\7761.tmp"101⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\77A0.tmp"C:\Users\Admin\AppData\Local\Temp\77A0.tmp"102⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\77DE.tmp"C:\Users\Admin\AppData\Local\Temp\77DE.tmp"103⤵
- System Location Discovery: System Language Discovery
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\781D.tmp"C:\Users\Admin\AppData\Local\Temp\781D.tmp"104⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\785B.tmp"C:\Users\Admin\AppData\Local\Temp\785B.tmp"105⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\7899.tmp"C:\Users\Admin\AppData\Local\Temp\7899.tmp"106⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\78D8.tmp"C:\Users\Admin\AppData\Local\Temp\78D8.tmp"107⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\7916.tmp"C:\Users\Admin\AppData\Local\Temp\7916.tmp"108⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\7955.tmp"C:\Users\Admin\AppData\Local\Temp\7955.tmp"109⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\7993.tmp"C:\Users\Admin\AppData\Local\Temp\7993.tmp"110⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\79D1.tmp"C:\Users\Admin\AppData\Local\Temp\79D1.tmp"111⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\7A10.tmp"C:\Users\Admin\AppData\Local\Temp\7A10.tmp"112⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\7A5E.tmp"C:\Users\Admin\AppData\Local\Temp\7A5E.tmp"113⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\7A9C.tmp"C:\Users\Admin\AppData\Local\Temp\7A9C.tmp"114⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\7ADB.tmp"C:\Users\Admin\AppData\Local\Temp\7ADB.tmp"115⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\7B19.tmp"C:\Users\Admin\AppData\Local\Temp\7B19.tmp"116⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\7B57.tmp"C:\Users\Admin\AppData\Local\Temp\7B57.tmp"117⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\7B96.tmp"C:\Users\Admin\AppData\Local\Temp\7B96.tmp"118⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\7BD4.tmp"C:\Users\Admin\AppData\Local\Temp\7BD4.tmp"119⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\7C13.tmp"C:\Users\Admin\AppData\Local\Temp\7C13.tmp"120⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\7C61.tmp"C:\Users\Admin\AppData\Local\Temp\7C61.tmp"121⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\7C9F.tmp"C:\Users\Admin\AppData\Local\Temp\7C9F.tmp"122⤵PID:2784
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-