Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
21/09/2024, 10:56
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-21_5dadf718bd85c2fabfd0b969e1c4d2a5_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-09-21_5dadf718bd85c2fabfd0b969e1c4d2a5_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-21_5dadf718bd85c2fabfd0b969e1c4d2a5_mafia.exe
-
Size
536KB
-
MD5
5dadf718bd85c2fabfd0b969e1c4d2a5
-
SHA1
4566408a94ff1ac7eb08020972bced8a76de4e7b
-
SHA256
cd847d0cf9041691755276fe4e1d0277ab410fd9dd7bd20301d682920615f98b
-
SHA512
16b7aec789c21436ef885a03111e747a50c1efc96651d05cd53f0ea9802df1a16e878b6e30a8faf38d282b764767dd391fb6255e3517df41219d18de42735b27
-
SSDEEP
12288:wU5rCOTeiUyv7STESwEJtuU7OHM+QIZxVJ0ZT9:wUQOJUyvuBwEJtuUqHZQIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1960 B828.tmp 2232 B895.tmp 2152 B8F3.tmp 2264 B941.tmp 2748 B97F.tmp 2888 B9BE.tmp 2900 BA0C.tmp 2764 BA4A.tmp 2132 BA89.tmp 2608 BAC7.tmp 2680 BB15.tmp 728 BB53.tmp 1592 BB92.tmp 3008 BBD0.tmp 576 BC0F.tmp 2824 BC4D.tmp 2780 BC9B.tmp 1228 BCE9.tmp 844 BD37.tmp 2364 BD85.tmp 860 BDD3.tmp 2396 BE11.tmp 980 BE5F.tmp 1740 BE9E.tmp 1932 BEEC.tmp 1668 BF2A.tmp 1332 BF78.tmp 1148 BFC6.tmp 1636 C024.tmp 1672 C072.tmp 1340 C0B0.tmp 916 C0EF.tmp 2016 C12D.tmp 2324 C16B.tmp 2572 C1AA.tmp 1384 C1E8.tmp 1100 C227.tmp 1580 C275.tmp 2360 C2C3.tmp 1780 C301.tmp 2460 C38D.tmp 2128 C3DB.tmp 2012 C429.tmp 2736 C477.tmp 2148 C4B6.tmp 2288 C504.tmp 792 C542.tmp 2760 C590.tmp 932 C5CF.tmp 2924 C61D.tmp 3024 C65B.tmp 3056 C699.tmp 2444 C6E7.tmp 316 C726.tmp 2564 C764.tmp 2636 C7A3.tmp 2996 C7E1.tmp 1908 C83F.tmp 2804 C88D.tmp 2476 C8DB.tmp 1060 C938.tmp 1832 C996.tmp 1596 C9E4.tmp 1532 CA32.tmp -
Loads dropped DLL 64 IoCs
pid Process 1952 2024-09-21_5dadf718bd85c2fabfd0b969e1c4d2a5_mafia.exe 1960 B828.tmp 2232 B895.tmp 2152 B8F3.tmp 2264 B941.tmp 2748 B97F.tmp 2888 B9BE.tmp 2900 BA0C.tmp 2764 BA4A.tmp 2132 BA89.tmp 2608 BAC7.tmp 2680 BB15.tmp 728 BB53.tmp 1592 BB92.tmp 3008 BBD0.tmp 576 BC0F.tmp 2824 BC4D.tmp 2780 BC9B.tmp 1228 BCE9.tmp 844 BD37.tmp 2364 BD85.tmp 860 BDD3.tmp 2396 BE11.tmp 980 BE5F.tmp 1740 BE9E.tmp 1932 BEEC.tmp 1668 BF2A.tmp 1332 BF78.tmp 1148 BFC6.tmp 1636 C024.tmp 1672 C072.tmp 1340 C0B0.tmp 916 C0EF.tmp 2016 C12D.tmp 2324 C16B.tmp 2572 C1AA.tmp 1384 C1E8.tmp 1100 C227.tmp 1580 C275.tmp 2360 C2C3.tmp 1544 C34F.tmp 2460 C38D.tmp 2128 C3DB.tmp 2012 C429.tmp 2736 C477.tmp 2148 C4B6.tmp 2288 C504.tmp 792 C542.tmp 2760 C590.tmp 932 C5CF.tmp 2924 C61D.tmp 3024 C65B.tmp 3056 C699.tmp 2444 C6E7.tmp 316 C726.tmp 2564 C764.tmp 2636 C7A3.tmp 2996 C7E1.tmp 1908 C83F.tmp 2804 C88D.tmp 2476 C8DB.tmp 1060 C938.tmp 1832 C996.tmp 1596 C9E4.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E61B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 822B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3736.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C081.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 445.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 899A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C36E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1786.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7021.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 705F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 963.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC4D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C477.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BCA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D0A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E447.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAAD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D01B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA79.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C552.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1952 wrote to memory of 1960 1952 2024-09-21_5dadf718bd85c2fabfd0b969e1c4d2a5_mafia.exe 30 PID 1952 wrote to memory of 1960 1952 2024-09-21_5dadf718bd85c2fabfd0b969e1c4d2a5_mafia.exe 30 PID 1952 wrote to memory of 1960 1952 2024-09-21_5dadf718bd85c2fabfd0b969e1c4d2a5_mafia.exe 30 PID 1952 wrote to memory of 1960 1952 2024-09-21_5dadf718bd85c2fabfd0b969e1c4d2a5_mafia.exe 30 PID 1960 wrote to memory of 2232 1960 B828.tmp 31 PID 1960 wrote to memory of 2232 1960 B828.tmp 31 PID 1960 wrote to memory of 2232 1960 B828.tmp 31 PID 1960 wrote to memory of 2232 1960 B828.tmp 31 PID 2232 wrote to memory of 2152 2232 B895.tmp 32 PID 2232 wrote to memory of 2152 2232 B895.tmp 32 PID 2232 wrote to memory of 2152 2232 B895.tmp 32 PID 2232 wrote to memory of 2152 2232 B895.tmp 32 PID 2152 wrote to memory of 2264 2152 B8F3.tmp 33 PID 2152 wrote to memory of 2264 2152 B8F3.tmp 33 PID 2152 wrote to memory of 2264 2152 B8F3.tmp 33 PID 2152 wrote to memory of 2264 2152 B8F3.tmp 33 PID 2264 wrote to memory of 2748 2264 B941.tmp 34 PID 2264 wrote to memory of 2748 2264 B941.tmp 34 PID 2264 wrote to memory of 2748 2264 B941.tmp 34 PID 2264 wrote to memory of 2748 2264 B941.tmp 34 PID 2748 wrote to memory of 2888 2748 B97F.tmp 35 PID 2748 wrote to memory of 2888 2748 B97F.tmp 35 PID 2748 wrote to memory of 2888 2748 B97F.tmp 35 PID 2748 wrote to memory of 2888 2748 B97F.tmp 35 PID 2888 wrote to memory of 2900 2888 B9BE.tmp 36 PID 2888 wrote to memory of 2900 2888 B9BE.tmp 36 PID 2888 wrote to memory of 2900 2888 B9BE.tmp 36 PID 2888 wrote to memory of 2900 2888 B9BE.tmp 36 PID 2900 wrote to memory of 2764 2900 BA0C.tmp 37 PID 2900 wrote to memory of 2764 2900 BA0C.tmp 37 PID 2900 wrote to memory of 2764 2900 BA0C.tmp 37 PID 2900 wrote to memory of 2764 2900 BA0C.tmp 37 PID 2764 wrote to memory of 2132 2764 BA4A.tmp 38 PID 2764 wrote to memory of 2132 2764 BA4A.tmp 38 PID 2764 wrote to memory of 2132 2764 BA4A.tmp 38 PID 2764 wrote to memory of 2132 2764 BA4A.tmp 38 PID 2132 wrote to memory of 2608 2132 BA89.tmp 39 PID 2132 wrote to memory of 2608 2132 BA89.tmp 39 PID 2132 wrote to memory of 2608 2132 BA89.tmp 39 PID 2132 wrote to memory of 2608 2132 BA89.tmp 39 PID 2608 wrote to memory of 2680 2608 BAC7.tmp 40 PID 2608 wrote to memory of 2680 2608 BAC7.tmp 40 PID 2608 wrote to memory of 2680 2608 BAC7.tmp 40 PID 2608 wrote to memory of 2680 2608 BAC7.tmp 40 PID 2680 wrote to memory of 728 2680 BB15.tmp 41 PID 2680 wrote to memory of 728 2680 BB15.tmp 41 PID 2680 wrote to memory of 728 2680 BB15.tmp 41 PID 2680 wrote to memory of 728 2680 BB15.tmp 41 PID 728 wrote to memory of 1592 728 BB53.tmp 42 PID 728 wrote to memory of 1592 728 BB53.tmp 42 PID 728 wrote to memory of 1592 728 BB53.tmp 42 PID 728 wrote to memory of 1592 728 BB53.tmp 42 PID 1592 wrote to memory of 3008 1592 BB92.tmp 43 PID 1592 wrote to memory of 3008 1592 BB92.tmp 43 PID 1592 wrote to memory of 3008 1592 BB92.tmp 43 PID 1592 wrote to memory of 3008 1592 BB92.tmp 43 PID 3008 wrote to memory of 576 3008 BBD0.tmp 44 PID 3008 wrote to memory of 576 3008 BBD0.tmp 44 PID 3008 wrote to memory of 576 3008 BBD0.tmp 44 PID 3008 wrote to memory of 576 3008 BBD0.tmp 44 PID 576 wrote to memory of 2824 576 BC0F.tmp 45 PID 576 wrote to memory of 2824 576 BC0F.tmp 45 PID 576 wrote to memory of 2824 576 BC0F.tmp 45 PID 576 wrote to memory of 2824 576 BC0F.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-21_5dadf718bd85c2fabfd0b969e1c4d2a5_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-21_5dadf718bd85c2fabfd0b969e1c4d2a5_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\B828.tmp"C:\Users\Admin\AppData\Local\Temp\B828.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\B895.tmp"C:\Users\Admin\AppData\Local\Temp\B895.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\B8F3.tmp"C:\Users\Admin\AppData\Local\Temp\B8F3.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\B941.tmp"C:\Users\Admin\AppData\Local\Temp\B941.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\B97F.tmp"C:\Users\Admin\AppData\Local\Temp\B97F.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\B9BE.tmp"C:\Users\Admin\AppData\Local\Temp\B9BE.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\BA0C.tmp"C:\Users\Admin\AppData\Local\Temp\BA0C.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\BA4A.tmp"C:\Users\Admin\AppData\Local\Temp\BA4A.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\BA89.tmp"C:\Users\Admin\AppData\Local\Temp\BA89.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\BAC7.tmp"C:\Users\Admin\AppData\Local\Temp\BAC7.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\BB15.tmp"C:\Users\Admin\AppData\Local\Temp\BB15.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\BB53.tmp"C:\Users\Admin\AppData\Local\Temp\BB53.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:728 -
C:\Users\Admin\AppData\Local\Temp\BB92.tmp"C:\Users\Admin\AppData\Local\Temp\BB92.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\BBD0.tmp"C:\Users\Admin\AppData\Local\Temp\BBD0.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\BC0F.tmp"C:\Users\Admin\AppData\Local\Temp\BC0F.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Users\Admin\AppData\Local\Temp\BC4D.tmp"C:\Users\Admin\AppData\Local\Temp\BC4D.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\BC9B.tmp"C:\Users\Admin\AppData\Local\Temp\BC9B.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\BCE9.tmp"C:\Users\Admin\AppData\Local\Temp\BCE9.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\BD37.tmp"C:\Users\Admin\AppData\Local\Temp\BD37.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:844 -
C:\Users\Admin\AppData\Local\Temp\BD85.tmp"C:\Users\Admin\AppData\Local\Temp\BD85.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\BDD3.tmp"C:\Users\Admin\AppData\Local\Temp\BDD3.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:860 -
C:\Users\Admin\AppData\Local\Temp\BE11.tmp"C:\Users\Admin\AppData\Local\Temp\BE11.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\BE5F.tmp"C:\Users\Admin\AppData\Local\Temp\BE5F.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:980 -
C:\Users\Admin\AppData\Local\Temp\BE9E.tmp"C:\Users\Admin\AppData\Local\Temp\BE9E.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\BEEC.tmp"C:\Users\Admin\AppData\Local\Temp\BEEC.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\BF2A.tmp"C:\Users\Admin\AppData\Local\Temp\BF2A.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\BF78.tmp"C:\Users\Admin\AppData\Local\Temp\BF78.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\C024.tmp"C:\Users\Admin\AppData\Local\Temp\C024.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\C072.tmp"C:\Users\Admin\AppData\Local\Temp\C072.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\C0EF.tmp"C:\Users\Admin\AppData\Local\Temp\C0EF.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:916 -
C:\Users\Admin\AppData\Local\Temp\C12D.tmp"C:\Users\Admin\AppData\Local\Temp\C12D.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\C16B.tmp"C:\Users\Admin\AppData\Local\Temp\C16B.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\C227.tmp"C:\Users\Admin\AppData\Local\Temp\C227.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\C275.tmp"C:\Users\Admin\AppData\Local\Temp\C275.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\C301.tmp"C:\Users\Admin\AppData\Local\Temp\C301.tmp"41⤵
- Executes dropped EXE
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\C34F.tmp"C:\Users\Admin\AppData\Local\Temp\C34F.tmp"42⤵
- Loads dropped DLL
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\C38D.tmp"C:\Users\Admin\AppData\Local\Temp\C38D.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\C3DB.tmp"C:\Users\Admin\AppData\Local\Temp\C3DB.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\C429.tmp"C:\Users\Admin\AppData\Local\Temp\C429.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\C477.tmp"C:\Users\Admin\AppData\Local\Temp\C477.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\C4B6.tmp"C:\Users\Admin\AppData\Local\Temp\C4B6.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\C504.tmp"C:\Users\Admin\AppData\Local\Temp\C504.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\C542.tmp"C:\Users\Admin\AppData\Local\Temp\C542.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:792 -
C:\Users\Admin\AppData\Local\Temp\C590.tmp"C:\Users\Admin\AppData\Local\Temp\C590.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\C5CF.tmp"C:\Users\Admin\AppData\Local\Temp\C5CF.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:932 -
C:\Users\Admin\AppData\Local\Temp\C61D.tmp"C:\Users\Admin\AppData\Local\Temp\C61D.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\C65B.tmp"C:\Users\Admin\AppData\Local\Temp\C65B.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\C699.tmp"C:\Users\Admin\AppData\Local\Temp\C699.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\C6E7.tmp"C:\Users\Admin\AppData\Local\Temp\C6E7.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\C726.tmp"C:\Users\Admin\AppData\Local\Temp\C726.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:316 -
C:\Users\Admin\AppData\Local\Temp\C764.tmp"C:\Users\Admin\AppData\Local\Temp\C764.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\C7A3.tmp"C:\Users\Admin\AppData\Local\Temp\C7A3.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\C7E1.tmp"C:\Users\Admin\AppData\Local\Temp\C7E1.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\C83F.tmp"C:\Users\Admin\AppData\Local\Temp\C83F.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\C88D.tmp"C:\Users\Admin\AppData\Local\Temp\C88D.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\C8DB.tmp"C:\Users\Admin\AppData\Local\Temp\C8DB.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\C938.tmp"C:\Users\Admin\AppData\Local\Temp\C938.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\C996.tmp"C:\Users\Admin\AppData\Local\Temp\C996.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\C9E4.tmp"C:\Users\Admin\AppData\Local\Temp\C9E4.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\CA32.tmp"C:\Users\Admin\AppData\Local\Temp\CA32.tmp"66⤵
- Executes dropped EXE
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\CA70.tmp"C:\Users\Admin\AppData\Local\Temp\CA70.tmp"67⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\CAAF.tmp"C:\Users\Admin\AppData\Local\Temp\CAAF.tmp"68⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\CB0C.tmp"C:\Users\Admin\AppData\Local\Temp\CB0C.tmp"69⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\CB5A.tmp"C:\Users\Admin\AppData\Local\Temp\CB5A.tmp"70⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\CB99.tmp"C:\Users\Admin\AppData\Local\Temp\CB99.tmp"71⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\CBF6.tmp"C:\Users\Admin\AppData\Local\Temp\CBF6.tmp"72⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\CC44.tmp"C:\Users\Admin\AppData\Local\Temp\CC44.tmp"73⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\CC83.tmp"C:\Users\Admin\AppData\Local\Temp\CC83.tmp"74⤵PID:480
-
C:\Users\Admin\AppData\Local\Temp\CD0F.tmp"C:\Users\Admin\AppData\Local\Temp\CD0F.tmp"75⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"76⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\CDBB.tmp"C:\Users\Admin\AppData\Local\Temp\CDBB.tmp"77⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\CDF9.tmp"C:\Users\Admin\AppData\Local\Temp\CDF9.tmp"78⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\CE37.tmp"C:\Users\Admin\AppData\Local\Temp\CE37.tmp"79⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\CE76.tmp"C:\Users\Admin\AppData\Local\Temp\CE76.tmp"80⤵PID:328
-
C:\Users\Admin\AppData\Local\Temp\CEC4.tmp"C:\Users\Admin\AppData\Local\Temp\CEC4.tmp"81⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\CF02.tmp"C:\Users\Admin\AppData\Local\Temp\CF02.tmp"82⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\CF50.tmp"C:\Users\Admin\AppData\Local\Temp\CF50.tmp"83⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\CF8F.tmp"C:\Users\Admin\AppData\Local\Temp\CF8F.tmp"84⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\CFCD.tmp"C:\Users\Admin\AppData\Local\Temp\CFCD.tmp"85⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\D01B.tmp"C:\Users\Admin\AppData\Local\Temp\D01B.tmp"86⤵
- System Location Discovery: System Language Discovery
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\D069.tmp"C:\Users\Admin\AppData\Local\Temp\D069.tmp"87⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\D0B7.tmp"C:\Users\Admin\AppData\Local\Temp\D0B7.tmp"88⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\D0F5.tmp"C:\Users\Admin\AppData\Local\Temp\D0F5.tmp"89⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\D153.tmp"C:\Users\Admin\AppData\Local\Temp\D153.tmp"90⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\D1A1.tmp"C:\Users\Admin\AppData\Local\Temp\D1A1.tmp"91⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\D1EF.tmp"C:\Users\Admin\AppData\Local\Temp\D1EF.tmp"92⤵
- System Location Discovery: System Language Discovery
PID:864 -
C:\Users\Admin\AppData\Local\Temp\D22D.tmp"C:\Users\Admin\AppData\Local\Temp\D22D.tmp"93⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\D29B.tmp"C:\Users\Admin\AppData\Local\Temp\D29B.tmp"94⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\D2F8.tmp"C:\Users\Admin\AppData\Local\Temp\D2F8.tmp"95⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\D346.tmp"C:\Users\Admin\AppData\Local\Temp\D346.tmp"96⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\D3B3.tmp"C:\Users\Admin\AppData\Local\Temp\D3B3.tmp"97⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\D421.tmp"C:\Users\Admin\AppData\Local\Temp\D421.tmp"98⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\D46F.tmp"C:\Users\Admin\AppData\Local\Temp\D46F.tmp"99⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\D4AD.tmp"C:\Users\Admin\AppData\Local\Temp\D4AD.tmp"100⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\D4FB.tmp"C:\Users\Admin\AppData\Local\Temp\D4FB.tmp"101⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\D539.tmp"C:\Users\Admin\AppData\Local\Temp\D539.tmp"102⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\D578.tmp"C:\Users\Admin\AppData\Local\Temp\D578.tmp"103⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\D5B6.tmp"C:\Users\Admin\AppData\Local\Temp\D5B6.tmp"104⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\D604.tmp"C:\Users\Admin\AppData\Local\Temp\D604.tmp"105⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\D643.tmp"C:\Users\Admin\AppData\Local\Temp\D643.tmp"106⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\D681.tmp"C:\Users\Admin\AppData\Local\Temp\D681.tmp"107⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\D6CF.tmp"C:\Users\Admin\AppData\Local\Temp\D6CF.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\D70D.tmp"C:\Users\Admin\AppData\Local\Temp\D70D.tmp"109⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\D74C.tmp"C:\Users\Admin\AppData\Local\Temp\D74C.tmp"110⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\D78A.tmp"C:\Users\Admin\AppData\Local\Temp\D78A.tmp"111⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\D7D8.tmp"C:\Users\Admin\AppData\Local\Temp\D7D8.tmp"112⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\D826.tmp"C:\Users\Admin\AppData\Local\Temp\D826.tmp"113⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\D874.tmp"C:\Users\Admin\AppData\Local\Temp\D874.tmp"114⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\D8D2.tmp"C:\Users\Admin\AppData\Local\Temp\D8D2.tmp"115⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\D920.tmp"C:\Users\Admin\AppData\Local\Temp\D920.tmp"116⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\D96E.tmp"C:\Users\Admin\AppData\Local\Temp\D96E.tmp"117⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\D9AC.tmp"C:\Users\Admin\AppData\Local\Temp\D9AC.tmp"118⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\D9EB.tmp"C:\Users\Admin\AppData\Local\Temp\D9EB.tmp"119⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\DA29.tmp"C:\Users\Admin\AppData\Local\Temp\DA29.tmp"120⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\DA67.tmp"C:\Users\Admin\AppData\Local\Temp\DA67.tmp"121⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\DAB5.tmp"C:\Users\Admin\AppData\Local\Temp\DAB5.tmp"122⤵PID:2052
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-