Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 04:03
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-19_ad39ca967fb7cfdf7afb13b9863a2232_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-19_ad39ca967fb7cfdf7afb13b9863a2232_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-19_ad39ca967fb7cfdf7afb13b9863a2232_mafia.exe
-
Size
712KB
-
MD5
ad39ca967fb7cfdf7afb13b9863a2232
-
SHA1
0b56b5fc0a3356cc4b348049a713d6d5b21616de
-
SHA256
1fef729720aef5da4b838fb1a84d354cc138758df2c97c3e1a9c9eeacb6c15d0
-
SHA512
0d47647d9f71f744af67914b88b6c9f05262c70cf14780bb4f5f50deed05e23102a4b0f1b4deed35c72eb7fed964fb67c332ffb6c2280ec2198e5bb934e1f119
-
SSDEEP
12288:FU5rCOTeiD+nFGlo78CO+Oy44zSkte8BjNZdCvq5TJLCvY90D8/LVBlVk736Y79m:FUQOJD+nd89+VSGjNnCvq5TJLCvY90DA
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1628 869D.tmp 2452 872A.tmp 2212 87B6.tmp 316 8852.tmp 2308 88CF.tmp 2908 894C.tmp 3044 89A9.tmp 2900 8A36.tmp 2596 8AA3.tmp 2704 8B2F.tmp 2872 8BAC.tmp 2620 8C29.tmp 2648 8C87.tmp 2828 8D23.tmp 2600 8D90.tmp 2500 8E2C.tmp 2972 8EB8.tmp 2428 8F35.tmp 1720 8F93.tmp 1604 8FD1.tmp 2240 903E.tmp 2040 909C.tmp 1556 90DA.tmp 1944 9138.tmp 1804 9176.tmp 1028 91B5.tmp 756 91F3.tmp 352 9231.tmp 2848 928F.tmp 2760 92DD.tmp 2840 931B.tmp 3004 9369.tmp 2332 93A8.tmp 2948 93E6.tmp 2076 9425.tmp 2808 9473.tmp 404 94B1.tmp 568 94FF.tmp 704 953D.tmp 948 958B.tmp 1860 95CA.tmp 284 9608.tmp 1540 9647.tmp 1288 9685.tmp 1708 96C3.tmp 876 9702.tmp 1336 9740.tmp 2200 977F.tmp 1700 97BD.tmp 1740 97FB.tmp 1092 9849.tmp 3056 9888.tmp 960 98C6.tmp 880 9905.tmp 2172 9943.tmp 1588 99A1.tmp 1704 99FE.tmp 2284 9A4C.tmp 1628 9A8B.tmp 2296 9AC9.tmp 1728 9B07.tmp 1912 9B46.tmp 1812 9B84.tmp 3048 9BD2.tmp -
Loads dropped DLL 64 IoCs
pid Process 2236 2024-09-19_ad39ca967fb7cfdf7afb13b9863a2232_mafia.exe 1628 869D.tmp 2452 872A.tmp 2212 87B6.tmp 316 8852.tmp 2308 88CF.tmp 2908 894C.tmp 3044 89A9.tmp 2900 8A36.tmp 2596 8AA3.tmp 2704 8B2F.tmp 2872 8BAC.tmp 2620 8C29.tmp 2648 8C87.tmp 2828 8D23.tmp 2600 8D90.tmp 2500 8E2C.tmp 2972 8EB8.tmp 2428 8F35.tmp 1720 8F93.tmp 1604 8FD1.tmp 2240 903E.tmp 2040 909C.tmp 1556 90DA.tmp 1944 9138.tmp 1804 9176.tmp 1028 91B5.tmp 756 91F3.tmp 352 9231.tmp 2848 928F.tmp 2760 92DD.tmp 2840 931B.tmp 3004 9369.tmp 2332 93A8.tmp 2948 93E6.tmp 2076 9425.tmp 2808 9473.tmp 404 94B1.tmp 568 94FF.tmp 704 953D.tmp 948 958B.tmp 1860 95CA.tmp 284 9608.tmp 1540 9647.tmp 1288 9685.tmp 1708 96C3.tmp 876 9702.tmp 1336 9740.tmp 2200 977F.tmp 1700 97BD.tmp 1740 97FB.tmp 1092 9849.tmp 3056 9888.tmp 960 98C6.tmp 880 9905.tmp 2172 9943.tmp 1588 99A1.tmp 1704 99FE.tmp 2284 9A4C.tmp 1628 9A8B.tmp 2296 9AC9.tmp 1728 9B07.tmp 1912 9B46.tmp 1812 9B84.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6078.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E11C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 166E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C552.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 364C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9849.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B490.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8112.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6FE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD4D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D893.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2674.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4450.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5264.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDCA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EB8.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2236 wrote to memory of 1628 2236 2024-09-19_ad39ca967fb7cfdf7afb13b9863a2232_mafia.exe 28 PID 2236 wrote to memory of 1628 2236 2024-09-19_ad39ca967fb7cfdf7afb13b9863a2232_mafia.exe 28 PID 2236 wrote to memory of 1628 2236 2024-09-19_ad39ca967fb7cfdf7afb13b9863a2232_mafia.exe 28 PID 2236 wrote to memory of 1628 2236 2024-09-19_ad39ca967fb7cfdf7afb13b9863a2232_mafia.exe 28 PID 1628 wrote to memory of 2452 1628 869D.tmp 29 PID 1628 wrote to memory of 2452 1628 869D.tmp 29 PID 1628 wrote to memory of 2452 1628 869D.tmp 29 PID 1628 wrote to memory of 2452 1628 869D.tmp 29 PID 2452 wrote to memory of 2212 2452 872A.tmp 30 PID 2452 wrote to memory of 2212 2452 872A.tmp 30 PID 2452 wrote to memory of 2212 2452 872A.tmp 30 PID 2452 wrote to memory of 2212 2452 872A.tmp 30 PID 2212 wrote to memory of 316 2212 87B6.tmp 31 PID 2212 wrote to memory of 316 2212 87B6.tmp 31 PID 2212 wrote to memory of 316 2212 87B6.tmp 31 PID 2212 wrote to memory of 316 2212 87B6.tmp 31 PID 316 wrote to memory of 2308 316 8852.tmp 32 PID 316 wrote to memory of 2308 316 8852.tmp 32 PID 316 wrote to memory of 2308 316 8852.tmp 32 PID 316 wrote to memory of 2308 316 8852.tmp 32 PID 2308 wrote to memory of 2908 2308 88CF.tmp 33 PID 2308 wrote to memory of 2908 2308 88CF.tmp 33 PID 2308 wrote to memory of 2908 2308 88CF.tmp 33 PID 2308 wrote to memory of 2908 2308 88CF.tmp 33 PID 2908 wrote to memory of 3044 2908 894C.tmp 34 PID 2908 wrote to memory of 3044 2908 894C.tmp 34 PID 2908 wrote to memory of 3044 2908 894C.tmp 34 PID 2908 wrote to memory of 3044 2908 894C.tmp 34 PID 3044 wrote to memory of 2900 3044 89A9.tmp 35 PID 3044 wrote to memory of 2900 3044 89A9.tmp 35 PID 3044 wrote to memory of 2900 3044 89A9.tmp 35 PID 3044 wrote to memory of 2900 3044 89A9.tmp 35 PID 2900 wrote to memory of 2596 2900 8A36.tmp 36 PID 2900 wrote to memory of 2596 2900 8A36.tmp 36 PID 2900 wrote to memory of 2596 2900 8A36.tmp 36 PID 2900 wrote to memory of 2596 2900 8A36.tmp 36 PID 2596 wrote to memory of 2704 2596 8AA3.tmp 37 PID 2596 wrote to memory of 2704 2596 8AA3.tmp 37 PID 2596 wrote to memory of 2704 2596 8AA3.tmp 37 PID 2596 wrote to memory of 2704 2596 8AA3.tmp 37 PID 2704 wrote to memory of 2872 2704 8B2F.tmp 38 PID 2704 wrote to memory of 2872 2704 8B2F.tmp 38 PID 2704 wrote to memory of 2872 2704 8B2F.tmp 38 PID 2704 wrote to memory of 2872 2704 8B2F.tmp 38 PID 2872 wrote to memory of 2620 2872 8BAC.tmp 39 PID 2872 wrote to memory of 2620 2872 8BAC.tmp 39 PID 2872 wrote to memory of 2620 2872 8BAC.tmp 39 PID 2872 wrote to memory of 2620 2872 8BAC.tmp 39 PID 2620 wrote to memory of 2648 2620 8C29.tmp 40 PID 2620 wrote to memory of 2648 2620 8C29.tmp 40 PID 2620 wrote to memory of 2648 2620 8C29.tmp 40 PID 2620 wrote to memory of 2648 2620 8C29.tmp 40 PID 2648 wrote to memory of 2828 2648 8C87.tmp 41 PID 2648 wrote to memory of 2828 2648 8C87.tmp 41 PID 2648 wrote to memory of 2828 2648 8C87.tmp 41 PID 2648 wrote to memory of 2828 2648 8C87.tmp 41 PID 2828 wrote to memory of 2600 2828 8D23.tmp 42 PID 2828 wrote to memory of 2600 2828 8D23.tmp 42 PID 2828 wrote to memory of 2600 2828 8D23.tmp 42 PID 2828 wrote to memory of 2600 2828 8D23.tmp 42 PID 2600 wrote to memory of 2500 2600 8D90.tmp 43 PID 2600 wrote to memory of 2500 2600 8D90.tmp 43 PID 2600 wrote to memory of 2500 2600 8D90.tmp 43 PID 2600 wrote to memory of 2500 2600 8D90.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_ad39ca967fb7cfdf7afb13b9863a2232_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_ad39ca967fb7cfdf7afb13b9863a2232_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\869D.tmp"C:\Users\Admin\AppData\Local\Temp\869D.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\872A.tmp"C:\Users\Admin\AppData\Local\Temp\872A.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\87B6.tmp"C:\Users\Admin\AppData\Local\Temp\87B6.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\8852.tmp"C:\Users\Admin\AppData\Local\Temp\8852.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Users\Admin\AppData\Local\Temp\88CF.tmp"C:\Users\Admin\AppData\Local\Temp\88CF.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\894C.tmp"C:\Users\Admin\AppData\Local\Temp\894C.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\89A9.tmp"C:\Users\Admin\AppData\Local\Temp\89A9.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\8A36.tmp"C:\Users\Admin\AppData\Local\Temp\8A36.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\8AA3.tmp"C:\Users\Admin\AppData\Local\Temp\8AA3.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\8B2F.tmp"C:\Users\Admin\AppData\Local\Temp\8B2F.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\8BAC.tmp"C:\Users\Admin\AppData\Local\Temp\8BAC.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\8C29.tmp"C:\Users\Admin\AppData\Local\Temp\8C29.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\8C87.tmp"C:\Users\Admin\AppData\Local\Temp\8C87.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\8D23.tmp"C:\Users\Admin\AppData\Local\Temp\8D23.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\8D90.tmp"C:\Users\Admin\AppData\Local\Temp\8D90.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\8E2C.tmp"C:\Users\Admin\AppData\Local\Temp\8E2C.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\8EB8.tmp"C:\Users\Admin\AppData\Local\Temp\8EB8.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\8F35.tmp"C:\Users\Admin\AppData\Local\Temp\8F35.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\8F93.tmp"C:\Users\Admin\AppData\Local\Temp\8F93.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\8FD1.tmp"C:\Users\Admin\AppData\Local\Temp\8FD1.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\903E.tmp"C:\Users\Admin\AppData\Local\Temp\903E.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\909C.tmp"C:\Users\Admin\AppData\Local\Temp\909C.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\90DA.tmp"C:\Users\Admin\AppData\Local\Temp\90DA.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\9138.tmp"C:\Users\Admin\AppData\Local\Temp\9138.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\9176.tmp"C:\Users\Admin\AppData\Local\Temp\9176.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\91B5.tmp"C:\Users\Admin\AppData\Local\Temp\91B5.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\91F3.tmp"C:\Users\Admin\AppData\Local\Temp\91F3.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:756 -
C:\Users\Admin\AppData\Local\Temp\9231.tmp"C:\Users\Admin\AppData\Local\Temp\9231.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:352 -
C:\Users\Admin\AppData\Local\Temp\928F.tmp"C:\Users\Admin\AppData\Local\Temp\928F.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\92DD.tmp"C:\Users\Admin\AppData\Local\Temp\92DD.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\931B.tmp"C:\Users\Admin\AppData\Local\Temp\931B.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\9369.tmp"C:\Users\Admin\AppData\Local\Temp\9369.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\93A8.tmp"C:\Users\Admin\AppData\Local\Temp\93A8.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\93E6.tmp"C:\Users\Admin\AppData\Local\Temp\93E6.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\9425.tmp"C:\Users\Admin\AppData\Local\Temp\9425.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\9473.tmp"C:\Users\Admin\AppData\Local\Temp\9473.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\94B1.tmp"C:\Users\Admin\AppData\Local\Temp\94B1.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:404 -
C:\Users\Admin\AppData\Local\Temp\94FF.tmp"C:\Users\Admin\AppData\Local\Temp\94FF.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:568 -
C:\Users\Admin\AppData\Local\Temp\953D.tmp"C:\Users\Admin\AppData\Local\Temp\953D.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:704 -
C:\Users\Admin\AppData\Local\Temp\958B.tmp"C:\Users\Admin\AppData\Local\Temp\958B.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:948 -
C:\Users\Admin\AppData\Local\Temp\95CA.tmp"C:\Users\Admin\AppData\Local\Temp\95CA.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\9608.tmp"C:\Users\Admin\AppData\Local\Temp\9608.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:284 -
C:\Users\Admin\AppData\Local\Temp\9647.tmp"C:\Users\Admin\AppData\Local\Temp\9647.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\9685.tmp"C:\Users\Admin\AppData\Local\Temp\9685.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\96C3.tmp"C:\Users\Admin\AppData\Local\Temp\96C3.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\9702.tmp"C:\Users\Admin\AppData\Local\Temp\9702.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:876 -
C:\Users\Admin\AppData\Local\Temp\9740.tmp"C:\Users\Admin\AppData\Local\Temp\9740.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\977F.tmp"C:\Users\Admin\AppData\Local\Temp\977F.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\97BD.tmp"C:\Users\Admin\AppData\Local\Temp\97BD.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\97FB.tmp"C:\Users\Admin\AppData\Local\Temp\97FB.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\9849.tmp"C:\Users\Admin\AppData\Local\Temp\9849.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\9888.tmp"C:\Users\Admin\AppData\Local\Temp\9888.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\98C6.tmp"C:\Users\Admin\AppData\Local\Temp\98C6.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:960 -
C:\Users\Admin\AppData\Local\Temp\9905.tmp"C:\Users\Admin\AppData\Local\Temp\9905.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:880 -
C:\Users\Admin\AppData\Local\Temp\9943.tmp"C:\Users\Admin\AppData\Local\Temp\9943.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\99A1.tmp"C:\Users\Admin\AppData\Local\Temp\99A1.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\99FE.tmp"C:\Users\Admin\AppData\Local\Temp\99FE.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\9A8B.tmp"C:\Users\Admin\AppData\Local\Temp\9A8B.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\9B07.tmp"C:\Users\Admin\AppData\Local\Temp\9B07.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"65⤵
- Executes dropped EXE
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\9C11.tmp"C:\Users\Admin\AppData\Local\Temp\9C11.tmp"66⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"67⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\9C8D.tmp"C:\Users\Admin\AppData\Local\Temp\9C8D.tmp"68⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"69⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\9D0A.tmp"C:\Users\Admin\AppData\Local\Temp\9D0A.tmp"70⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\9D49.tmp"C:\Users\Admin\AppData\Local\Temp\9D49.tmp"71⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\9D87.tmp"C:\Users\Admin\AppData\Local\Temp\9D87.tmp"72⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\9DD5.tmp"C:\Users\Admin\AppData\Local\Temp\9DD5.tmp"73⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\9E13.tmp"C:\Users\Admin\AppData\Local\Temp\9E13.tmp"74⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\9E61.tmp"C:\Users\Admin\AppData\Local\Temp\9E61.tmp"75⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\9EA0.tmp"C:\Users\Admin\AppData\Local\Temp\9EA0.tmp"76⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\9EDE.tmp"C:\Users\Admin\AppData\Local\Temp\9EDE.tmp"77⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\9F1D.tmp"C:\Users\Admin\AppData\Local\Temp\9F1D.tmp"78⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\9F5B.tmp"C:\Users\Admin\AppData\Local\Temp\9F5B.tmp"79⤵
- System Location Discovery: System Language Discovery
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\9F99.tmp"C:\Users\Admin\AppData\Local\Temp\9F99.tmp"80⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\9FD8.tmp"C:\Users\Admin\AppData\Local\Temp\9FD8.tmp"81⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\A016.tmp"C:\Users\Admin\AppData\Local\Temp\A016.tmp"82⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\A055.tmp"C:\Users\Admin\AppData\Local\Temp\A055.tmp"83⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\A093.tmp"C:\Users\Admin\AppData\Local\Temp\A093.tmp"84⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\A0D1.tmp"C:\Users\Admin\AppData\Local\Temp\A0D1.tmp"85⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\A110.tmp"C:\Users\Admin\AppData\Local\Temp\A110.tmp"86⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\A14E.tmp"C:\Users\Admin\AppData\Local\Temp\A14E.tmp"87⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\A18D.tmp"C:\Users\Admin\AppData\Local\Temp\A18D.tmp"88⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\A1CB.tmp"C:\Users\Admin\AppData\Local\Temp\A1CB.tmp"89⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\A209.tmp"C:\Users\Admin\AppData\Local\Temp\A209.tmp"90⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\A248.tmp"C:\Users\Admin\AppData\Local\Temp\A248.tmp"91⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\A286.tmp"C:\Users\Admin\AppData\Local\Temp\A286.tmp"92⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\A2C5.tmp"C:\Users\Admin\AppData\Local\Temp\A2C5.tmp"93⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\A303.tmp"C:\Users\Admin\AppData\Local\Temp\A303.tmp"94⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\A341.tmp"C:\Users\Admin\AppData\Local\Temp\A341.tmp"95⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\A380.tmp"C:\Users\Admin\AppData\Local\Temp\A380.tmp"96⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\A3BE.tmp"C:\Users\Admin\AppData\Local\Temp\A3BE.tmp"97⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\A3FD.tmp"C:\Users\Admin\AppData\Local\Temp\A3FD.tmp"98⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\A43B.tmp"C:\Users\Admin\AppData\Local\Temp\A43B.tmp"99⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\A479.tmp"C:\Users\Admin\AppData\Local\Temp\A479.tmp"100⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\A4B8.tmp"C:\Users\Admin\AppData\Local\Temp\A4B8.tmp"101⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\A4F6.tmp"C:\Users\Admin\AppData\Local\Temp\A4F6.tmp"102⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\A535.tmp"C:\Users\Admin\AppData\Local\Temp\A535.tmp"103⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\A563.tmp"C:\Users\Admin\AppData\Local\Temp\A563.tmp"104⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\A5A2.tmp"C:\Users\Admin\AppData\Local\Temp\A5A2.tmp"105⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\A5E0.tmp"C:\Users\Admin\AppData\Local\Temp\A5E0.tmp"106⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\A61F.tmp"C:\Users\Admin\AppData\Local\Temp\A61F.tmp"107⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\A65D.tmp"C:\Users\Admin\AppData\Local\Temp\A65D.tmp"108⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\A69B.tmp"C:\Users\Admin\AppData\Local\Temp\A69B.tmp"109⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\A6DA.tmp"C:\Users\Admin\AppData\Local\Temp\A6DA.tmp"110⤵PID:308
-
C:\Users\Admin\AppData\Local\Temp\A718.tmp"C:\Users\Admin\AppData\Local\Temp\A718.tmp"111⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\A757.tmp"C:\Users\Admin\AppData\Local\Temp\A757.tmp"112⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\A795.tmp"C:\Users\Admin\AppData\Local\Temp\A795.tmp"113⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\A7D3.tmp"C:\Users\Admin\AppData\Local\Temp\A7D3.tmp"114⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\A812.tmp"C:\Users\Admin\AppData\Local\Temp\A812.tmp"115⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\A850.tmp"C:\Users\Admin\AppData\Local\Temp\A850.tmp"116⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\A88F.tmp"C:\Users\Admin\AppData\Local\Temp\A88F.tmp"117⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\A8CD.tmp"C:\Users\Admin\AppData\Local\Temp\A8CD.tmp"118⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\A90B.tmp"C:\Users\Admin\AppData\Local\Temp\A90B.tmp"119⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\A94A.tmp"C:\Users\Admin\AppData\Local\Temp\A94A.tmp"120⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\A988.tmp"C:\Users\Admin\AppData\Local\Temp\A988.tmp"121⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\A9C7.tmp"C:\Users\Admin\AppData\Local\Temp\A9C7.tmp"122⤵PID:2412
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-