Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04-10-2024 19:33
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-04_5445b2ab6488f671b19e8f0d70ee89e7_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-04_5445b2ab6488f671b19e8f0d70ee89e7_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-10-04_5445b2ab6488f671b19e8f0d70ee89e7_mafia.exe
-
Size
536KB
-
MD5
5445b2ab6488f671b19e8f0d70ee89e7
-
SHA1
6ef1ab1c749e406a7d42f371f040f5dc9b4aa751
-
SHA256
8ca221ae20cd5b71ed1391b398656668e8db75f0f855f00baa0f08c3ea5c1add
-
SHA512
951d56bfaa9cdd51aaefda4c59d67ea40dca1da44a10b7f8726d6df0cbb78624720a270961ff67daa62e9f929e0718d3c316325ece71699c97e1b4e91a6db48f
-
SSDEEP
12288:wU5rCOTeiUm+Jh6LmUHlR97ACehN1BOpF76tn5AAIZxVJ0ZT9:wUQOJUp6NHlR97ACGKgtn5JIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1524 A525.tmp 1044 A573.tmp 3064 A61F.tmp 2116 A6CA.tmp 2224 A718.tmp 2844 A795.tmp 3028 A821.tmp 3016 A87F.tmp 2612 A90B.tmp 2700 A979.tmp 2660 A9F5.tmp 2456 AA91.tmp 1668 AB1E.tmp 2688 ABC9.tmp 1760 AC46.tmp 764 ACD3.tmp 1732 AD40.tmp 544 ADFB.tmp 2980 AE78.tmp 2328 AF04.tmp 1072 AF81.tmp 1832 B01D.tmp 860 B0B9.tmp 944 B126.tmp 2336 B174.tmp 1608 B1E1.tmp 2176 B22F.tmp 836 B2AC.tmp 2828 B30A.tmp 1364 B367.tmp 2196 B3B5.tmp 2212 B423.tmp 1168 B471.tmp 796 B4DE.tmp 1724 B51C.tmp 892 B5A9.tmp 2276 B5F7.tmp 1720 B645.tmp 2536 B693.tmp 1872 B6E1.tmp 1740 B71F.tmp 2044 B75D.tmp 1644 B79C.tmp 2116 B7DA.tmp 2860 B828.tmp 2884 B867.tmp 2924 B8B5.tmp 2200 B8F3.tmp 2876 B931.tmp 1520 B97F.tmp 2604 B9BE.tmp 2144 B9FC.tmp 2312 BA3B.tmp 1640 BA79.tmp 1372 BAB7.tmp 1668 BB05.tmp 2688 BB53.tmp 1632 BB92.tmp 348 BBD0.tmp 464 BC1E.tmp 1200 BC5D.tmp 2948 BC9B.tmp 2968 BCD9.tmp 2984 BD27.tmp -
Loads dropped DLL 64 IoCs
pid Process 2668 2024-10-04_5445b2ab6488f671b19e8f0d70ee89e7_mafia.exe 1524 A525.tmp 1044 A573.tmp 3064 A61F.tmp 2116 A6CA.tmp 2224 A718.tmp 2844 A795.tmp 3028 A821.tmp 3016 A87F.tmp 2612 A90B.tmp 2700 A979.tmp 2660 A9F5.tmp 2456 AA91.tmp 1668 AB1E.tmp 2688 ABC9.tmp 1760 AC46.tmp 764 ACD3.tmp 1732 AD40.tmp 544 ADFB.tmp 2980 AE78.tmp 2328 AF04.tmp 1072 AF81.tmp 1832 B01D.tmp 860 B0B9.tmp 944 B126.tmp 2336 B174.tmp 1608 B1E1.tmp 2176 B22F.tmp 836 B2AC.tmp 2828 B30A.tmp 1364 B367.tmp 2196 B3B5.tmp 2212 B423.tmp 1168 B471.tmp 796 B4DE.tmp 1724 B51C.tmp 892 B5A9.tmp 2276 B5F7.tmp 1720 B645.tmp 2536 B693.tmp 1872 B6E1.tmp 1740 B71F.tmp 2044 B75D.tmp 1644 B79C.tmp 2116 B7DA.tmp 2860 B828.tmp 2884 B867.tmp 2924 B8B5.tmp 2200 B8F3.tmp 2876 B931.tmp 1520 B97F.tmp 2604 B9BE.tmp 2144 B9FC.tmp 2312 BA3B.tmp 1640 BA79.tmp 1372 BAB7.tmp 1668 BB05.tmp 2688 BB53.tmp 1632 BB92.tmp 348 BBD0.tmp 464 BC1E.tmp 1200 BC5D.tmp 2948 BC9B.tmp 2968 BCD9.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B77.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9888.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3EC5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7752.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8778.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F44.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1564.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D27B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C919.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E13B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 761A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EBE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3727.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C487.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC9B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBD0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2952.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-04_5445b2ab6488f671b19e8f0d70ee89e7_mafia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3997.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 517A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3820.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2668 wrote to memory of 1524 2668 2024-10-04_5445b2ab6488f671b19e8f0d70ee89e7_mafia.exe 30 PID 2668 wrote to memory of 1524 2668 2024-10-04_5445b2ab6488f671b19e8f0d70ee89e7_mafia.exe 30 PID 2668 wrote to memory of 1524 2668 2024-10-04_5445b2ab6488f671b19e8f0d70ee89e7_mafia.exe 30 PID 2668 wrote to memory of 1524 2668 2024-10-04_5445b2ab6488f671b19e8f0d70ee89e7_mafia.exe 30 PID 1524 wrote to memory of 1044 1524 A525.tmp 31 PID 1524 wrote to memory of 1044 1524 A525.tmp 31 PID 1524 wrote to memory of 1044 1524 A525.tmp 31 PID 1524 wrote to memory of 1044 1524 A525.tmp 31 PID 1044 wrote to memory of 3064 1044 A573.tmp 32 PID 1044 wrote to memory of 3064 1044 A573.tmp 32 PID 1044 wrote to memory of 3064 1044 A573.tmp 32 PID 1044 wrote to memory of 3064 1044 A573.tmp 32 PID 3064 wrote to memory of 2116 3064 A61F.tmp 33 PID 3064 wrote to memory of 2116 3064 A61F.tmp 33 PID 3064 wrote to memory of 2116 3064 A61F.tmp 33 PID 3064 wrote to memory of 2116 3064 A61F.tmp 33 PID 2116 wrote to memory of 2224 2116 A6CA.tmp 34 PID 2116 wrote to memory of 2224 2116 A6CA.tmp 34 PID 2116 wrote to memory of 2224 2116 A6CA.tmp 34 PID 2116 wrote to memory of 2224 2116 A6CA.tmp 34 PID 2224 wrote to memory of 2844 2224 A718.tmp 35 PID 2224 wrote to memory of 2844 2224 A718.tmp 35 PID 2224 wrote to memory of 2844 2224 A718.tmp 35 PID 2224 wrote to memory of 2844 2224 A718.tmp 35 PID 2844 wrote to memory of 3028 2844 A795.tmp 36 PID 2844 wrote to memory of 3028 2844 A795.tmp 36 PID 2844 wrote to memory of 3028 2844 A795.tmp 36 PID 2844 wrote to memory of 3028 2844 A795.tmp 36 PID 3028 wrote to memory of 3016 3028 A821.tmp 37 PID 3028 wrote to memory of 3016 3028 A821.tmp 37 PID 3028 wrote to memory of 3016 3028 A821.tmp 37 PID 3028 wrote to memory of 3016 3028 A821.tmp 37 PID 3016 wrote to memory of 2612 3016 A87F.tmp 38 PID 3016 wrote to memory of 2612 3016 A87F.tmp 38 PID 3016 wrote to memory of 2612 3016 A87F.tmp 38 PID 3016 wrote to memory of 2612 3016 A87F.tmp 38 PID 2612 wrote to memory of 2700 2612 A90B.tmp 39 PID 2612 wrote to memory of 2700 2612 A90B.tmp 39 PID 2612 wrote to memory of 2700 2612 A90B.tmp 39 PID 2612 wrote to memory of 2700 2612 A90B.tmp 39 PID 2700 wrote to memory of 2660 2700 A979.tmp 40 PID 2700 wrote to memory of 2660 2700 A979.tmp 40 PID 2700 wrote to memory of 2660 2700 A979.tmp 40 PID 2700 wrote to memory of 2660 2700 A979.tmp 40 PID 2660 wrote to memory of 2456 2660 A9F5.tmp 41 PID 2660 wrote to memory of 2456 2660 A9F5.tmp 41 PID 2660 wrote to memory of 2456 2660 A9F5.tmp 41 PID 2660 wrote to memory of 2456 2660 A9F5.tmp 41 PID 2456 wrote to memory of 1668 2456 AA91.tmp 42 PID 2456 wrote to memory of 1668 2456 AA91.tmp 42 PID 2456 wrote to memory of 1668 2456 AA91.tmp 42 PID 2456 wrote to memory of 1668 2456 AA91.tmp 42 PID 1668 wrote to memory of 2688 1668 AB1E.tmp 43 PID 1668 wrote to memory of 2688 1668 AB1E.tmp 43 PID 1668 wrote to memory of 2688 1668 AB1E.tmp 43 PID 1668 wrote to memory of 2688 1668 AB1E.tmp 43 PID 2688 wrote to memory of 1760 2688 ABC9.tmp 44 PID 2688 wrote to memory of 1760 2688 ABC9.tmp 44 PID 2688 wrote to memory of 1760 2688 ABC9.tmp 44 PID 2688 wrote to memory of 1760 2688 ABC9.tmp 44 PID 1760 wrote to memory of 764 1760 AC46.tmp 45 PID 1760 wrote to memory of 764 1760 AC46.tmp 45 PID 1760 wrote to memory of 764 1760 AC46.tmp 45 PID 1760 wrote to memory of 764 1760 AC46.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-04_5445b2ab6488f671b19e8f0d70ee89e7_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-04_5445b2ab6488f671b19e8f0d70ee89e7_mafia.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\A525.tmp"C:\Users\Admin\AppData\Local\Temp\A525.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\A573.tmp"C:\Users\Admin\AppData\Local\Temp\A573.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\A61F.tmp"C:\Users\Admin\AppData\Local\Temp\A61F.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\A6CA.tmp"C:\Users\Admin\AppData\Local\Temp\A6CA.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\A718.tmp"C:\Users\Admin\AppData\Local\Temp\A718.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\A795.tmp"C:\Users\Admin\AppData\Local\Temp\A795.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\A821.tmp"C:\Users\Admin\AppData\Local\Temp\A821.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\A87F.tmp"C:\Users\Admin\AppData\Local\Temp\A87F.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\A90B.tmp"C:\Users\Admin\AppData\Local\Temp\A90B.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\A979.tmp"C:\Users\Admin\AppData\Local\Temp\A979.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\A9F5.tmp"C:\Users\Admin\AppData\Local\Temp\A9F5.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\AA91.tmp"C:\Users\Admin\AppData\Local\Temp\AA91.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\AB1E.tmp"C:\Users\Admin\AppData\Local\Temp\AB1E.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\ABC9.tmp"C:\Users\Admin\AppData\Local\Temp\ABC9.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\AC46.tmp"C:\Users\Admin\AppData\Local\Temp\AC46.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\ACD3.tmp"C:\Users\Admin\AppData\Local\Temp\ACD3.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:764 -
C:\Users\Admin\AppData\Local\Temp\AD40.tmp"C:\Users\Admin\AppData\Local\Temp\AD40.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\ADFB.tmp"C:\Users\Admin\AppData\Local\Temp\ADFB.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:544 -
C:\Users\Admin\AppData\Local\Temp\AE78.tmp"C:\Users\Admin\AppData\Local\Temp\AE78.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\AF04.tmp"C:\Users\Admin\AppData\Local\Temp\AF04.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\AF81.tmp"C:\Users\Admin\AppData\Local\Temp\AF81.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\B01D.tmp"C:\Users\Admin\AppData\Local\Temp\B01D.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\B0B9.tmp"C:\Users\Admin\AppData\Local\Temp\B0B9.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:860 -
C:\Users\Admin\AppData\Local\Temp\B126.tmp"C:\Users\Admin\AppData\Local\Temp\B126.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:944 -
C:\Users\Admin\AppData\Local\Temp\B174.tmp"C:\Users\Admin\AppData\Local\Temp\B174.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\B1E1.tmp"C:\Users\Admin\AppData\Local\Temp\B1E1.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\B22F.tmp"C:\Users\Admin\AppData\Local\Temp\B22F.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\B2AC.tmp"C:\Users\Admin\AppData\Local\Temp\B2AC.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:836 -
C:\Users\Admin\AppData\Local\Temp\B30A.tmp"C:\Users\Admin\AppData\Local\Temp\B30A.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\B367.tmp"C:\Users\Admin\AppData\Local\Temp\B367.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\B3B5.tmp"C:\Users\Admin\AppData\Local\Temp\B3B5.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\B423.tmp"C:\Users\Admin\AppData\Local\Temp\B423.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\B471.tmp"C:\Users\Admin\AppData\Local\Temp\B471.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\B4DE.tmp"C:\Users\Admin\AppData\Local\Temp\B4DE.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:796 -
C:\Users\Admin\AppData\Local\Temp\B51C.tmp"C:\Users\Admin\AppData\Local\Temp\B51C.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\B5A9.tmp"C:\Users\Admin\AppData\Local\Temp\B5A9.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:892 -
C:\Users\Admin\AppData\Local\Temp\B5F7.tmp"C:\Users\Admin\AppData\Local\Temp\B5F7.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\B645.tmp"C:\Users\Admin\AppData\Local\Temp\B645.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\B693.tmp"C:\Users\Admin\AppData\Local\Temp\B693.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\B6E1.tmp"C:\Users\Admin\AppData\Local\Temp\B6E1.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\B71F.tmp"C:\Users\Admin\AppData\Local\Temp\B71F.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\B75D.tmp"C:\Users\Admin\AppData\Local\Temp\B75D.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\B79C.tmp"C:\Users\Admin\AppData\Local\Temp\B79C.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\B7DA.tmp"C:\Users\Admin\AppData\Local\Temp\B7DA.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\B828.tmp"C:\Users\Admin\AppData\Local\Temp\B828.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\B867.tmp"C:\Users\Admin\AppData\Local\Temp\B867.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\B8B5.tmp"C:\Users\Admin\AppData\Local\Temp\B8B5.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\B8F3.tmp"C:\Users\Admin\AppData\Local\Temp\B8F3.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\B931.tmp"C:\Users\Admin\AppData\Local\Temp\B931.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\B97F.tmp"C:\Users\Admin\AppData\Local\Temp\B97F.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\B9BE.tmp"C:\Users\Admin\AppData\Local\Temp\B9BE.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\B9FC.tmp"C:\Users\Admin\AppData\Local\Temp\B9FC.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\BA3B.tmp"C:\Users\Admin\AppData\Local\Temp\BA3B.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\BA79.tmp"C:\Users\Admin\AppData\Local\Temp\BA79.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\BAB7.tmp"C:\Users\Admin\AppData\Local\Temp\BAB7.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\BB05.tmp"C:\Users\Admin\AppData\Local\Temp\BB05.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\BB53.tmp"C:\Users\Admin\AppData\Local\Temp\BB53.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\BB92.tmp"C:\Users\Admin\AppData\Local\Temp\BB92.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\BBD0.tmp"C:\Users\Admin\AppData\Local\Temp\BBD0.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:348 -
C:\Users\Admin\AppData\Local\Temp\BC1E.tmp"C:\Users\Admin\AppData\Local\Temp\BC1E.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:464 -
C:\Users\Admin\AppData\Local\Temp\BC5D.tmp"C:\Users\Admin\AppData\Local\Temp\BC5D.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\BC9B.tmp"C:\Users\Admin\AppData\Local\Temp\BC9B.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\BCD9.tmp"C:\Users\Admin\AppData\Local\Temp\BCD9.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\BD27.tmp"C:\Users\Admin\AppData\Local\Temp\BD27.tmp"65⤵
- Executes dropped EXE
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\BD66.tmp"C:\Users\Admin\AppData\Local\Temp\BD66.tmp"66⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\BDA4.tmp"C:\Users\Admin\AppData\Local\Temp\BDA4.tmp"67⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\BDE3.tmp"C:\Users\Admin\AppData\Local\Temp\BDE3.tmp"68⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\BE31.tmp"C:\Users\Admin\AppData\Local\Temp\BE31.tmp"69⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\BE6F.tmp"C:\Users\Admin\AppData\Local\Temp\BE6F.tmp"70⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\BEAD.tmp"C:\Users\Admin\AppData\Local\Temp\BEAD.tmp"71⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\BEEC.tmp"C:\Users\Admin\AppData\Local\Temp\BEEC.tmp"72⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\BF2A.tmp"C:\Users\Admin\AppData\Local\Temp\BF2A.tmp"73⤵PID:288
-
C:\Users\Admin\AppData\Local\Temp\BF69.tmp"C:\Users\Admin\AppData\Local\Temp\BF69.tmp"74⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\BFB7.tmp"C:\Users\Admin\AppData\Local\Temp\BFB7.tmp"75⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\BFF5.tmp"C:\Users\Admin\AppData\Local\Temp\BFF5.tmp"76⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\C033.tmp"C:\Users\Admin\AppData\Local\Temp\C033.tmp"77⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\C072.tmp"C:\Users\Admin\AppData\Local\Temp\C072.tmp"78⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"79⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\C0EF.tmp"C:\Users\Admin\AppData\Local\Temp\C0EF.tmp"80⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\C12D.tmp"C:\Users\Admin\AppData\Local\Temp\C12D.tmp"81⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\C16B.tmp"C:\Users\Admin\AppData\Local\Temp\C16B.tmp"82⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"83⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\C207.tmp"C:\Users\Admin\AppData\Local\Temp\C207.tmp"84⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\C246.tmp"C:\Users\Admin\AppData\Local\Temp\C246.tmp"85⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\C284.tmp"C:\Users\Admin\AppData\Local\Temp\C284.tmp"86⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"87⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\C301.tmp"C:\Users\Admin\AppData\Local\Temp\C301.tmp"88⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\C33F.tmp"C:\Users\Admin\AppData\Local\Temp\C33F.tmp"89⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\C37E.tmp"C:\Users\Admin\AppData\Local\Temp\C37E.tmp"90⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\C3BC.tmp"C:\Users\Admin\AppData\Local\Temp\C3BC.tmp"91⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\C3FB.tmp"C:\Users\Admin\AppData\Local\Temp\C3FB.tmp"92⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\C449.tmp"C:\Users\Admin\AppData\Local\Temp\C449.tmp"93⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\C487.tmp"C:\Users\Admin\AppData\Local\Temp\C487.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\C4C5.tmp"C:\Users\Admin\AppData\Local\Temp\C4C5.tmp"95⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\C504.tmp"C:\Users\Admin\AppData\Local\Temp\C504.tmp"96⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\C542.tmp"C:\Users\Admin\AppData\Local\Temp\C542.tmp"97⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\C581.tmp"C:\Users\Admin\AppData\Local\Temp\C581.tmp"98⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\C5BF.tmp"C:\Users\Admin\AppData\Local\Temp\C5BF.tmp"99⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\C5FD.tmp"C:\Users\Admin\AppData\Local\Temp\C5FD.tmp"100⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\C63C.tmp"C:\Users\Admin\AppData\Local\Temp\C63C.tmp"101⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\C67A.tmp"C:\Users\Admin\AppData\Local\Temp\C67A.tmp"102⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\C6B9.tmp"C:\Users\Admin\AppData\Local\Temp\C6B9.tmp"103⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\C6F7.tmp"C:\Users\Admin\AppData\Local\Temp\C6F7.tmp"104⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\C745.tmp"C:\Users\Admin\AppData\Local\Temp\C745.tmp"105⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\C783.tmp"C:\Users\Admin\AppData\Local\Temp\C783.tmp"106⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\C7E1.tmp"C:\Users\Admin\AppData\Local\Temp\C7E1.tmp"107⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\C81F.tmp"C:\Users\Admin\AppData\Local\Temp\C81F.tmp"108⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\C85E.tmp"C:\Users\Admin\AppData\Local\Temp\C85E.tmp"109⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\C89C.tmp"C:\Users\Admin\AppData\Local\Temp\C89C.tmp"110⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\C8DB.tmp"C:\Users\Admin\AppData\Local\Temp\C8DB.tmp"111⤵PID:284
-
C:\Users\Admin\AppData\Local\Temp\C919.tmp"C:\Users\Admin\AppData\Local\Temp\C919.tmp"112⤵
- System Location Discovery: System Language Discovery
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\C957.tmp"C:\Users\Admin\AppData\Local\Temp\C957.tmp"113⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\C996.tmp"C:\Users\Admin\AppData\Local\Temp\C996.tmp"114⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\C9D4.tmp"C:\Users\Admin\AppData\Local\Temp\C9D4.tmp"115⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\CA13.tmp"C:\Users\Admin\AppData\Local\Temp\CA13.tmp"116⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\CA51.tmp"C:\Users\Admin\AppData\Local\Temp\CA51.tmp"117⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\CA8F.tmp"C:\Users\Admin\AppData\Local\Temp\CA8F.tmp"118⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\CACE.tmp"C:\Users\Admin\AppData\Local\Temp\CACE.tmp"119⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\CB0C.tmp"C:\Users\Admin\AppData\Local\Temp\CB0C.tmp"120⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\CB5A.tmp"C:\Users\Admin\AppData\Local\Temp\CB5A.tmp"121⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\CB99.tmp"C:\Users\Admin\AppData\Local\Temp\CB99.tmp"122⤵PID:960
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-