Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 04:15
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-19_fbaab7ed67ac9d0740f508ca07fff8c1_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-19_fbaab7ed67ac9d0740f508ca07fff8c1_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-19_fbaab7ed67ac9d0740f508ca07fff8c1_mafia.exe
-
Size
530KB
-
MD5
fbaab7ed67ac9d0740f508ca07fff8c1
-
SHA1
9d43e49535f91791ce397cd75a7b9bc27d38c3e0
-
SHA256
0ad672ebb55d2648f9dd8e786838246fa7be0b8708f68cb911480e39e109283a
-
SHA512
ce7088229035c89fdd78bb36420df5a3fb9b5ed99f63926dea9de062bc4ddee9273085392c9e681568d59399e7572cf8d8d0f6a840131ee036bff01c5e65c09f
-
SSDEEP
12288:AU5rCOTeioCcjvq22ATgclhJHH2fNZulFVg0M1:AUQOJoCcDsAT1p2fNclFV/M1
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2524 CD9B.tmp 2544 CE18.tmp 2480 CEA5.tmp 708 CEF3.tmp 2764 CF60.tmp 2924 CFCD.tmp 2892 D03A.tmp 2888 D0B7.tmp 2628 D124.tmp 2772 D182.tmp 2620 D1EF.tmp 2216 D25C.tmp 476 D2C9.tmp 2004 D337.tmp 1728 D3A4.tmp 1348 D411.tmp 2028 D47E.tmp 1928 D4EB.tmp 1620 D568.tmp 1884 D5D5.tmp 380 D643.tmp 2824 D6A0.tmp 2844 D6FE.tmp 2340 D73C.tmp 2968 D77B.tmp 2232 D7B9.tmp 2708 D7F7.tmp 2140 D836.tmp 1700 D874.tmp 408 D8B3.tmp 2976 D8F1.tmp 2840 D92F.tmp 692 D96E.tmp 1300 D9AC.tmp 1172 D9EB.tmp 2796 DA29.tmp 2472 DA67.tmp 892 DAA6.tmp 920 DAE4.tmp 680 DB23.tmp 1208 DB61.tmp 3052 DB9F.tmp 2280 DBDE.tmp 1844 DC1C.tmp 2476 DC5B.tmp 2300 DC99.tmp 2064 DCD7.tmp 800 DD16.tmp 2240 DD54.tmp 2252 DD93.tmp 2348 DDD1.tmp 1520 DE10.tmp 2520 DE4E.tmp 2376 DE8C.tmp 2368 DECB.tmp 2544 DF09.tmp 2936 DF48.tmp 2272 DF86.tmp 2752 DFC4.tmp 2920 E003.tmp 2908 E041.tmp 3032 E080.tmp 2204 E0BE.tmp 2308 E10C.tmp -
Loads dropped DLL 64 IoCs
pid Process 2332 2024-09-19_fbaab7ed67ac9d0740f508ca07fff8c1_mafia.exe 2524 CD9B.tmp 2544 CE18.tmp 2480 CEA5.tmp 708 CEF3.tmp 2764 CF60.tmp 2924 CFCD.tmp 2892 D03A.tmp 2888 D0B7.tmp 2628 D124.tmp 2772 D182.tmp 2620 D1EF.tmp 2216 D25C.tmp 476 D2C9.tmp 2004 D337.tmp 1728 D3A4.tmp 1348 D411.tmp 2028 D47E.tmp 1928 D4EB.tmp 1620 D568.tmp 1884 D5D5.tmp 380 D643.tmp 2824 D6A0.tmp 2844 D6FE.tmp 2340 D73C.tmp 2968 D77B.tmp 2232 D7B9.tmp 2708 D7F7.tmp 2140 D836.tmp 1700 D874.tmp 408 D8B3.tmp 2976 D8F1.tmp 2840 D92F.tmp 692 D96E.tmp 1300 D9AC.tmp 1172 D9EB.tmp 2796 DA29.tmp 2472 DA67.tmp 892 DAA6.tmp 920 DAE4.tmp 680 DB23.tmp 1208 DB61.tmp 3052 DB9F.tmp 2280 DBDE.tmp 1844 DC1C.tmp 2476 DC5B.tmp 2300 DC99.tmp 2064 DCD7.tmp 800 DD16.tmp 2240 DD54.tmp 2252 DD93.tmp 2348 DDD1.tmp 1520 DE10.tmp 2520 DE4E.tmp 2376 DE8C.tmp 2368 DECB.tmp 2544 DF09.tmp 2936 DF48.tmp 2272 DF86.tmp 2752 DFC4.tmp 2920 E003.tmp 2908 E041.tmp 3032 E080.tmp 2204 E0BE.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1065.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 227E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9241.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8749.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDD1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D03A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6152.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4EAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E30F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 712.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C4B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F42E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1120.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3794.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2332 wrote to memory of 2524 2332 2024-09-19_fbaab7ed67ac9d0740f508ca07fff8c1_mafia.exe 31 PID 2332 wrote to memory of 2524 2332 2024-09-19_fbaab7ed67ac9d0740f508ca07fff8c1_mafia.exe 31 PID 2332 wrote to memory of 2524 2332 2024-09-19_fbaab7ed67ac9d0740f508ca07fff8c1_mafia.exe 31 PID 2332 wrote to memory of 2524 2332 2024-09-19_fbaab7ed67ac9d0740f508ca07fff8c1_mafia.exe 31 PID 2524 wrote to memory of 2544 2524 CD9B.tmp 32 PID 2524 wrote to memory of 2544 2524 CD9B.tmp 32 PID 2524 wrote to memory of 2544 2524 CD9B.tmp 32 PID 2524 wrote to memory of 2544 2524 CD9B.tmp 32 PID 2544 wrote to memory of 2480 2544 CE18.tmp 33 PID 2544 wrote to memory of 2480 2544 CE18.tmp 33 PID 2544 wrote to memory of 2480 2544 CE18.tmp 33 PID 2544 wrote to memory of 2480 2544 CE18.tmp 33 PID 2480 wrote to memory of 708 2480 CEA5.tmp 34 PID 2480 wrote to memory of 708 2480 CEA5.tmp 34 PID 2480 wrote to memory of 708 2480 CEA5.tmp 34 PID 2480 wrote to memory of 708 2480 CEA5.tmp 34 PID 708 wrote to memory of 2764 708 CEF3.tmp 35 PID 708 wrote to memory of 2764 708 CEF3.tmp 35 PID 708 wrote to memory of 2764 708 CEF3.tmp 35 PID 708 wrote to memory of 2764 708 CEF3.tmp 35 PID 2764 wrote to memory of 2924 2764 CF60.tmp 36 PID 2764 wrote to memory of 2924 2764 CF60.tmp 36 PID 2764 wrote to memory of 2924 2764 CF60.tmp 36 PID 2764 wrote to memory of 2924 2764 CF60.tmp 36 PID 2924 wrote to memory of 2892 2924 CFCD.tmp 37 PID 2924 wrote to memory of 2892 2924 CFCD.tmp 37 PID 2924 wrote to memory of 2892 2924 CFCD.tmp 37 PID 2924 wrote to memory of 2892 2924 CFCD.tmp 37 PID 2892 wrote to memory of 2888 2892 D03A.tmp 38 PID 2892 wrote to memory of 2888 2892 D03A.tmp 38 PID 2892 wrote to memory of 2888 2892 D03A.tmp 38 PID 2892 wrote to memory of 2888 2892 D03A.tmp 38 PID 2888 wrote to memory of 2628 2888 D0B7.tmp 39 PID 2888 wrote to memory of 2628 2888 D0B7.tmp 39 PID 2888 wrote to memory of 2628 2888 D0B7.tmp 39 PID 2888 wrote to memory of 2628 2888 D0B7.tmp 39 PID 2628 wrote to memory of 2772 2628 D124.tmp 40 PID 2628 wrote to memory of 2772 2628 D124.tmp 40 PID 2628 wrote to memory of 2772 2628 D124.tmp 40 PID 2628 wrote to memory of 2772 2628 D124.tmp 40 PID 2772 wrote to memory of 2620 2772 D182.tmp 41 PID 2772 wrote to memory of 2620 2772 D182.tmp 41 PID 2772 wrote to memory of 2620 2772 D182.tmp 41 PID 2772 wrote to memory of 2620 2772 D182.tmp 41 PID 2620 wrote to memory of 2216 2620 D1EF.tmp 42 PID 2620 wrote to memory of 2216 2620 D1EF.tmp 42 PID 2620 wrote to memory of 2216 2620 D1EF.tmp 42 PID 2620 wrote to memory of 2216 2620 D1EF.tmp 42 PID 2216 wrote to memory of 476 2216 D25C.tmp 43 PID 2216 wrote to memory of 476 2216 D25C.tmp 43 PID 2216 wrote to memory of 476 2216 D25C.tmp 43 PID 2216 wrote to memory of 476 2216 D25C.tmp 43 PID 476 wrote to memory of 2004 476 D2C9.tmp 44 PID 476 wrote to memory of 2004 476 D2C9.tmp 44 PID 476 wrote to memory of 2004 476 D2C9.tmp 44 PID 476 wrote to memory of 2004 476 D2C9.tmp 44 PID 2004 wrote to memory of 1728 2004 D337.tmp 45 PID 2004 wrote to memory of 1728 2004 D337.tmp 45 PID 2004 wrote to memory of 1728 2004 D337.tmp 45 PID 2004 wrote to memory of 1728 2004 D337.tmp 45 PID 1728 wrote to memory of 1348 1728 D3A4.tmp 46 PID 1728 wrote to memory of 1348 1728 D3A4.tmp 46 PID 1728 wrote to memory of 1348 1728 D3A4.tmp 46 PID 1728 wrote to memory of 1348 1728 D3A4.tmp 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_fbaab7ed67ac9d0740f508ca07fff8c1_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_fbaab7ed67ac9d0740f508ca07fff8c1_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\CD9B.tmp"C:\Users\Admin\AppData\Local\Temp\CD9B.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\CE18.tmp"C:\Users\Admin\AppData\Local\Temp\CE18.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\CEA5.tmp"C:\Users\Admin\AppData\Local\Temp\CEA5.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\CEF3.tmp"C:\Users\Admin\AppData\Local\Temp\CEF3.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Users\Admin\AppData\Local\Temp\CF60.tmp"C:\Users\Admin\AppData\Local\Temp\CF60.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\CFCD.tmp"C:\Users\Admin\AppData\Local\Temp\CFCD.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\D03A.tmp"C:\Users\Admin\AppData\Local\Temp\D03A.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\D0B7.tmp"C:\Users\Admin\AppData\Local\Temp\D0B7.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\D124.tmp"C:\Users\Admin\AppData\Local\Temp\D124.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\D182.tmp"C:\Users\Admin\AppData\Local\Temp\D182.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\D1EF.tmp"C:\Users\Admin\AppData\Local\Temp\D1EF.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\D25C.tmp"C:\Users\Admin\AppData\Local\Temp\D25C.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\D2C9.tmp"C:\Users\Admin\AppData\Local\Temp\D2C9.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:476 -
C:\Users\Admin\AppData\Local\Temp\D337.tmp"C:\Users\Admin\AppData\Local\Temp\D337.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\D3A4.tmp"C:\Users\Admin\AppData\Local\Temp\D3A4.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\D411.tmp"C:\Users\Admin\AppData\Local\Temp\D411.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\D47E.tmp"C:\Users\Admin\AppData\Local\Temp\D47E.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\D4EB.tmp"C:\Users\Admin\AppData\Local\Temp\D4EB.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\D568.tmp"C:\Users\Admin\AppData\Local\Temp\D568.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\D5D5.tmp"C:\Users\Admin\AppData\Local\Temp\D5D5.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\D643.tmp"C:\Users\Admin\AppData\Local\Temp\D643.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:380 -
C:\Users\Admin\AppData\Local\Temp\D6A0.tmp"C:\Users\Admin\AppData\Local\Temp\D6A0.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\D6FE.tmp"C:\Users\Admin\AppData\Local\Temp\D6FE.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\D73C.tmp"C:\Users\Admin\AppData\Local\Temp\D73C.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\D77B.tmp"C:\Users\Admin\AppData\Local\Temp\D77B.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\D7B9.tmp"C:\Users\Admin\AppData\Local\Temp\D7B9.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\D7F7.tmp"C:\Users\Admin\AppData\Local\Temp\D7F7.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\D836.tmp"C:\Users\Admin\AppData\Local\Temp\D836.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\D874.tmp"C:\Users\Admin\AppData\Local\Temp\D874.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\D8B3.tmp"C:\Users\Admin\AppData\Local\Temp\D8B3.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:408 -
C:\Users\Admin\AppData\Local\Temp\D8F1.tmp"C:\Users\Admin\AppData\Local\Temp\D8F1.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\D92F.tmp"C:\Users\Admin\AppData\Local\Temp\D92F.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\D96E.tmp"C:\Users\Admin\AppData\Local\Temp\D96E.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:692 -
C:\Users\Admin\AppData\Local\Temp\D9AC.tmp"C:\Users\Admin\AppData\Local\Temp\D9AC.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\D9EB.tmp"C:\Users\Admin\AppData\Local\Temp\D9EB.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\DA29.tmp"C:\Users\Admin\AppData\Local\Temp\DA29.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\DA67.tmp"C:\Users\Admin\AppData\Local\Temp\DA67.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\DAA6.tmp"C:\Users\Admin\AppData\Local\Temp\DAA6.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:892 -
C:\Users\Admin\AppData\Local\Temp\DAE4.tmp"C:\Users\Admin\AppData\Local\Temp\DAE4.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:920 -
C:\Users\Admin\AppData\Local\Temp\DB23.tmp"C:\Users\Admin\AppData\Local\Temp\DB23.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:680 -
C:\Users\Admin\AppData\Local\Temp\DB61.tmp"C:\Users\Admin\AppData\Local\Temp\DB61.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\DB9F.tmp"C:\Users\Admin\AppData\Local\Temp\DB9F.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\DBDE.tmp"C:\Users\Admin\AppData\Local\Temp\DBDE.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\DC1C.tmp"C:\Users\Admin\AppData\Local\Temp\DC1C.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\DC5B.tmp"C:\Users\Admin\AppData\Local\Temp\DC5B.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\DC99.tmp"C:\Users\Admin\AppData\Local\Temp\DC99.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\DCD7.tmp"C:\Users\Admin\AppData\Local\Temp\DCD7.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\DD16.tmp"C:\Users\Admin\AppData\Local\Temp\DD16.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:800 -
C:\Users\Admin\AppData\Local\Temp\DD54.tmp"C:\Users\Admin\AppData\Local\Temp\DD54.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\DD93.tmp"C:\Users\Admin\AppData\Local\Temp\DD93.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\DDD1.tmp"C:\Users\Admin\AppData\Local\Temp\DDD1.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\DE10.tmp"C:\Users\Admin\AppData\Local\Temp\DE10.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\DE4E.tmp"C:\Users\Admin\AppData\Local\Temp\DE4E.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\DE8C.tmp"C:\Users\Admin\AppData\Local\Temp\DE8C.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\DECB.tmp"C:\Users\Admin\AppData\Local\Temp\DECB.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\DF09.tmp"C:\Users\Admin\AppData\Local\Temp\DF09.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\DF48.tmp"C:\Users\Admin\AppData\Local\Temp\DF48.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\DF86.tmp"C:\Users\Admin\AppData\Local\Temp\DF86.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\DFC4.tmp"C:\Users\Admin\AppData\Local\Temp\DFC4.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\E003.tmp"C:\Users\Admin\AppData\Local\Temp\E003.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\E041.tmp"C:\Users\Admin\AppData\Local\Temp\E041.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\E080.tmp"C:\Users\Admin\AppData\Local\Temp\E080.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\E0BE.tmp"C:\Users\Admin\AppData\Local\Temp\E0BE.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\E10C.tmp"C:\Users\Admin\AppData\Local\Temp\E10C.tmp"65⤵
- Executes dropped EXE
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\E15A.tmp"C:\Users\Admin\AppData\Local\Temp\E15A.tmp"66⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\E198.tmp"C:\Users\Admin\AppData\Local\Temp\E198.tmp"67⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\E1D7.tmp"C:\Users\Admin\AppData\Local\Temp\E1D7.tmp"68⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\E215.tmp"C:\Users\Admin\AppData\Local\Temp\E215.tmp"69⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\E254.tmp"C:\Users\Admin\AppData\Local\Temp\E254.tmp"70⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\E292.tmp"C:\Users\Admin\AppData\Local\Temp\E292.tmp"71⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\E2D0.tmp"C:\Users\Admin\AppData\Local\Temp\E2D0.tmp"72⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\E30F.tmp"C:\Users\Admin\AppData\Local\Temp\E30F.tmp"73⤵
- System Location Discovery: System Language Discovery
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\E34D.tmp"C:\Users\Admin\AppData\Local\Temp\E34D.tmp"74⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\E38C.tmp"C:\Users\Admin\AppData\Local\Temp\E38C.tmp"75⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\E3CA.tmp"C:\Users\Admin\AppData\Local\Temp\E3CA.tmp"76⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\E408.tmp"C:\Users\Admin\AppData\Local\Temp\E408.tmp"77⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\E447.tmp"C:\Users\Admin\AppData\Local\Temp\E447.tmp"78⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\E485.tmp"C:\Users\Admin\AppData\Local\Temp\E485.tmp"79⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\E4C4.tmp"C:\Users\Admin\AppData\Local\Temp\E4C4.tmp"80⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\E502.tmp"C:\Users\Admin\AppData\Local\Temp\E502.tmp"81⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\E540.tmp"C:\Users\Admin\AppData\Local\Temp\E540.tmp"82⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\E57F.tmp"C:\Users\Admin\AppData\Local\Temp\E57F.tmp"83⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\E5BD.tmp"C:\Users\Admin\AppData\Local\Temp\E5BD.tmp"84⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\E5FC.tmp"C:\Users\Admin\AppData\Local\Temp\E5FC.tmp"85⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\E63A.tmp"C:\Users\Admin\AppData\Local\Temp\E63A.tmp"86⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\E678.tmp"C:\Users\Admin\AppData\Local\Temp\E678.tmp"87⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\E6B7.tmp"C:\Users\Admin\AppData\Local\Temp\E6B7.tmp"88⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"89⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\E734.tmp"C:\Users\Admin\AppData\Local\Temp\E734.tmp"90⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\E772.tmp"C:\Users\Admin\AppData\Local\Temp\E772.tmp"91⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"92⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"93⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\E82D.tmp"C:\Users\Admin\AppData\Local\Temp\E82D.tmp"94⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\E86C.tmp"C:\Users\Admin\AppData\Local\Temp\E86C.tmp"95⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\E8AA.tmp"C:\Users\Admin\AppData\Local\Temp\E8AA.tmp"96⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\E8E8.tmp"C:\Users\Admin\AppData\Local\Temp\E8E8.tmp"97⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\E927.tmp"C:\Users\Admin\AppData\Local\Temp\E927.tmp"98⤵PID:308
-
C:\Users\Admin\AppData\Local\Temp\E965.tmp"C:\Users\Admin\AppData\Local\Temp\E965.tmp"99⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\E9A4.tmp"C:\Users\Admin\AppData\Local\Temp\E9A4.tmp"100⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\E9E2.tmp"C:\Users\Admin\AppData\Local\Temp\E9E2.tmp"101⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\EA20.tmp"C:\Users\Admin\AppData\Local\Temp\EA20.tmp"102⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\EA5F.tmp"C:\Users\Admin\AppData\Local\Temp\EA5F.tmp"103⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\EA9D.tmp"C:\Users\Admin\AppData\Local\Temp\EA9D.tmp"104⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\EADC.tmp"C:\Users\Admin\AppData\Local\Temp\EADC.tmp"105⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\EB1A.tmp"C:\Users\Admin\AppData\Local\Temp\EB1A.tmp"106⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\EB58.tmp"C:\Users\Admin\AppData\Local\Temp\EB58.tmp"107⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\EB97.tmp"C:\Users\Admin\AppData\Local\Temp\EB97.tmp"108⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\EBD5.tmp"C:\Users\Admin\AppData\Local\Temp\EBD5.tmp"109⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\EC14.tmp"C:\Users\Admin\AppData\Local\Temp\EC14.tmp"110⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\EC52.tmp"C:\Users\Admin\AppData\Local\Temp\EC52.tmp"111⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\EC90.tmp"C:\Users\Admin\AppData\Local\Temp\EC90.tmp"112⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\ECCF.tmp"C:\Users\Admin\AppData\Local\Temp\ECCF.tmp"113⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\ED0D.tmp"C:\Users\Admin\AppData\Local\Temp\ED0D.tmp"114⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\ED4C.tmp"C:\Users\Admin\AppData\Local\Temp\ED4C.tmp"115⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\ED8A.tmp"C:\Users\Admin\AppData\Local\Temp\ED8A.tmp"116⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\EDC8.tmp"C:\Users\Admin\AppData\Local\Temp\EDC8.tmp"117⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\EE07.tmp"C:\Users\Admin\AppData\Local\Temp\EE07.tmp"118⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\EE45.tmp"C:\Users\Admin\AppData\Local\Temp\EE45.tmp"119⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\EE84.tmp"C:\Users\Admin\AppData\Local\Temp\EE84.tmp"120⤵
- System Location Discovery: System Language Discovery
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\EEC2.tmp"C:\Users\Admin\AppData\Local\Temp\EEC2.tmp"121⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\EF00.tmp"C:\Users\Admin\AppData\Local\Temp\EF00.tmp"122⤵PID:708
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-