Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21-11-2024 13:21
Static task
static1
Behavioral task
behavioral1
Sample
2024-11-21_17e1bf0eb433233731f15c7b069daa1d_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-11-21_17e1bf0eb433233731f15c7b069daa1d_mafia.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-11-21_17e1bf0eb433233731f15c7b069daa1d_mafia.exe
-
Size
536KB
-
MD5
17e1bf0eb433233731f15c7b069daa1d
-
SHA1
f57cb839e27678d6a65a99fe7beb15cbcfa1421a
-
SHA256
5813b3c8a4d1eb58b32da7372c35d687a348df16ea8438fe278b3d12325a16e9
-
SHA512
d784d28fb35a9323ef541d1c9021db04edbcc36bedb4c8d8c2615c1dba2032af9e6d6ae803b44b0b96dbdfdc09b4d5238f439b263a3c96ab011aec1a708a63f7
-
SSDEEP
12288:wU5rCOTeiUSCnmCERUcFJs0y3BzwHNf+0Hen9KnRIZxVJ0ZT9:wUQOJUwvR9hxNf+P+IRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
Processes:
822B.tmp82D6.tmp8382.tmp846C.tmp84E9.tmp8537.tmp8575.tmp85B3.tmp85F2.tmp8630.tmp866F.tmp86AD.tmp86EB.tmp872A.tmp8778.tmp87C6.tmp8814.tmp8852.tmp88A0.tmp88EE.tmp892D.tmp898A.tmp89D8.tmp8A45.tmp8AA3.tmp8AE1.tmp8B20.tmp8B5E.tmp8B9D.tmp8BEB.tmp8C39.tmp8C87.tmp8CC5.tmp8D13.tmp8D51.tmp8D90.tmp8DCE.tmp8E1C.tmp8E6A.tmp8EA9.tmp8EF7.tmp8FC1.tmp900F.tmp905D.tmp90AB.tmp90F9.tmp9147.tmp9195.tmp91D4.tmp9222.tmp9270.tmp92AE.tmp92ED.tmp932B.tmp9389.tmp93E6.tmp9444.tmp94A1.tmp94FF.tmp953D.tmp957C.tmp95BA.tmp95F9.tmp9647.tmppid process 1500 822B.tmp 2428 82D6.tmp 2100 8382.tmp 2960 846C.tmp 3060 84E9.tmp 296 8537.tmp 3052 8575.tmp 2728 85B3.tmp 2648 85F2.tmp 3044 8630.tmp 2520 866F.tmp 2544 86AD.tmp 2540 86EB.tmp 2692 872A.tmp 1432 8778.tmp 1932 87C6.tmp 1824 8814.tmp 768 8852.tmp 1716 88A0.tmp 2036 88EE.tmp 1960 892D.tmp 2484 898A.tmp 2836 89D8.tmp 2860 8A45.tmp 2392 8AA3.tmp 1596 8AE1.tmp 924 8B20.tmp 2256 8B5E.tmp 1300 8B9D.tmp 1620 8BEB.tmp 816 8C39.tmp 1808 8C87.tmp 1052 8CC5.tmp 1288 8D13.tmp 1256 8D51.tmp 2120 8D90.tmp 1636 8DCE.tmp 1648 8E1C.tmp 1640 8E6A.tmp 892 8EA9.tmp 2204 8EF7.tmp 2080 8FC1.tmp 1500 900F.tmp 2436 905D.tmp 2892 90AB.tmp 2100 90F9.tmp 2404 9147.tmp 2604 9195.tmp 2184 91D4.tmp 2524 9222.tmp 2588 9270.tmp 2984 92AE.tmp 648 92ED.tmp 1224 932B.tmp 2716 9389.tmp 2708 93E6.tmp 2760 9444.tmp 2868 94A1.tmp 2660 94FF.tmp 2500 953D.tmp 580 957C.tmp 2272 95BA.tmp 1332 95F9.tmp 2208 9647.tmp -
Loads dropped DLL 64 IoCs
Processes:
2024-11-21_17e1bf0eb433233731f15c7b069daa1d_mafia.exe822B.tmp82D6.tmp8382.tmp846C.tmp84E9.tmp8537.tmp8575.tmp85B3.tmp85F2.tmp8630.tmp866F.tmp86AD.tmp86EB.tmp872A.tmp8778.tmp87C6.tmp8814.tmp8852.tmp88A0.tmp88EE.tmp892D.tmp898A.tmp89D8.tmp8A45.tmp8AA3.tmp8AE1.tmp8B20.tmp8B5E.tmp8B9D.tmp8BEB.tmp8C39.tmp8C87.tmp8CC5.tmp8D13.tmp8D51.tmp8D90.tmp8DCE.tmp8E1C.tmp8E6A.tmp8EA9.tmp8F64.tmp8FC1.tmp900F.tmp905D.tmp90AB.tmp90F9.tmp9147.tmp9195.tmp91D4.tmp9222.tmp9270.tmp92AE.tmp92ED.tmp932B.tmp9389.tmp93E6.tmp9444.tmp94A1.tmp94FF.tmp953D.tmp957C.tmp95BA.tmp95F9.tmppid process 2408 2024-11-21_17e1bf0eb433233731f15c7b069daa1d_mafia.exe 1500 822B.tmp 2428 82D6.tmp 2100 8382.tmp 2960 846C.tmp 3060 84E9.tmp 296 8537.tmp 3052 8575.tmp 2728 85B3.tmp 2648 85F2.tmp 3044 8630.tmp 2520 866F.tmp 2544 86AD.tmp 2540 86EB.tmp 2692 872A.tmp 1432 8778.tmp 1932 87C6.tmp 1824 8814.tmp 768 8852.tmp 1716 88A0.tmp 2036 88EE.tmp 1960 892D.tmp 2484 898A.tmp 2836 89D8.tmp 2860 8A45.tmp 2392 8AA3.tmp 1596 8AE1.tmp 924 8B20.tmp 2256 8B5E.tmp 1300 8B9D.tmp 1620 8BEB.tmp 816 8C39.tmp 1808 8C87.tmp 1052 8CC5.tmp 1288 8D13.tmp 1256 8D51.tmp 2120 8D90.tmp 1636 8DCE.tmp 1648 8E1C.tmp 1640 8E6A.tmp 892 8EA9.tmp 956 8F64.tmp 2080 8FC1.tmp 1500 900F.tmp 2436 905D.tmp 2892 90AB.tmp 2100 90F9.tmp 2404 9147.tmp 2604 9195.tmp 2184 91D4.tmp 2524 9222.tmp 2588 9270.tmp 2984 92AE.tmp 648 92ED.tmp 1224 932B.tmp 2716 9389.tmp 2708 93E6.tmp 2760 9444.tmp 2868 94A1.tmp 2660 94FF.tmp 2500 953D.tmp 580 957C.tmp 2272 95BA.tmp 1332 95F9.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
C1F8.tmpD70D.tmpF882.tmp2BF.tmp9721.tmpC533.tmp76D5.tmp816F.tmpF5B4.tmpE43.tmp2FB8.tmpC8DB.tmpD74C.tmpAB9B.tmp189F.tmp4E20.tmp8565.tmpC919.tmp499E.tmp7B77.tmpD1C0.tmpDA48.tmpE82D.tmp1B3E.tmp4EDB.tmpDCB8.tmpB18.tmp7E25.tmpdescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D70D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F882.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9721.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C533.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 816F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FB8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D74C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB9B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 189F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8565.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C919.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 499E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B77.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA48.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E82D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4EDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCB8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-11-21_17e1bf0eb433233731f15c7b069daa1d_mafia.exe822B.tmp82D6.tmp8382.tmp846C.tmp84E9.tmp8537.tmp8575.tmp85B3.tmp85F2.tmp8630.tmp866F.tmp86AD.tmp86EB.tmp872A.tmp8778.tmpdescription pid process target process PID 2408 wrote to memory of 1500 2408 2024-11-21_17e1bf0eb433233731f15c7b069daa1d_mafia.exe 822B.tmp PID 2408 wrote to memory of 1500 2408 2024-11-21_17e1bf0eb433233731f15c7b069daa1d_mafia.exe 822B.tmp PID 2408 wrote to memory of 1500 2408 2024-11-21_17e1bf0eb433233731f15c7b069daa1d_mafia.exe 822B.tmp PID 2408 wrote to memory of 1500 2408 2024-11-21_17e1bf0eb433233731f15c7b069daa1d_mafia.exe 822B.tmp PID 1500 wrote to memory of 2428 1500 822B.tmp 82D6.tmp PID 1500 wrote to memory of 2428 1500 822B.tmp 82D6.tmp PID 1500 wrote to memory of 2428 1500 822B.tmp 82D6.tmp PID 1500 wrote to memory of 2428 1500 822B.tmp 82D6.tmp PID 2428 wrote to memory of 2100 2428 82D6.tmp 8382.tmp PID 2428 wrote to memory of 2100 2428 82D6.tmp 8382.tmp PID 2428 wrote to memory of 2100 2428 82D6.tmp 8382.tmp PID 2428 wrote to memory of 2100 2428 82D6.tmp 8382.tmp PID 2100 wrote to memory of 2960 2100 8382.tmp 846C.tmp PID 2100 wrote to memory of 2960 2100 8382.tmp 846C.tmp PID 2100 wrote to memory of 2960 2100 8382.tmp 846C.tmp PID 2100 wrote to memory of 2960 2100 8382.tmp 846C.tmp PID 2960 wrote to memory of 3060 2960 846C.tmp 84E9.tmp PID 2960 wrote to memory of 3060 2960 846C.tmp 84E9.tmp PID 2960 wrote to memory of 3060 2960 846C.tmp 84E9.tmp PID 2960 wrote to memory of 3060 2960 846C.tmp 84E9.tmp PID 3060 wrote to memory of 296 3060 84E9.tmp 8537.tmp PID 3060 wrote to memory of 296 3060 84E9.tmp 8537.tmp PID 3060 wrote to memory of 296 3060 84E9.tmp 8537.tmp PID 3060 wrote to memory of 296 3060 84E9.tmp 8537.tmp PID 296 wrote to memory of 3052 296 8537.tmp 8575.tmp PID 296 wrote to memory of 3052 296 8537.tmp 8575.tmp PID 296 wrote to memory of 3052 296 8537.tmp 8575.tmp PID 296 wrote to memory of 3052 296 8537.tmp 8575.tmp PID 3052 wrote to memory of 2728 3052 8575.tmp 85B3.tmp PID 3052 wrote to memory of 2728 3052 8575.tmp 85B3.tmp PID 3052 wrote to memory of 2728 3052 8575.tmp 85B3.tmp PID 3052 wrote to memory of 2728 3052 8575.tmp 85B3.tmp PID 2728 wrote to memory of 2648 2728 85B3.tmp 85F2.tmp PID 2728 wrote to memory of 2648 2728 85B3.tmp 85F2.tmp PID 2728 wrote to memory of 2648 2728 85B3.tmp 85F2.tmp PID 2728 wrote to memory of 2648 2728 85B3.tmp 85F2.tmp PID 2648 wrote to memory of 3044 2648 85F2.tmp 8630.tmp PID 2648 wrote to memory of 3044 2648 85F2.tmp 8630.tmp PID 2648 wrote to memory of 3044 2648 85F2.tmp 8630.tmp PID 2648 wrote to memory of 3044 2648 85F2.tmp 8630.tmp PID 3044 wrote to memory of 2520 3044 8630.tmp 866F.tmp PID 3044 wrote to memory of 2520 3044 8630.tmp 866F.tmp PID 3044 wrote to memory of 2520 3044 8630.tmp 866F.tmp PID 3044 wrote to memory of 2520 3044 8630.tmp 866F.tmp PID 2520 wrote to memory of 2544 2520 866F.tmp 86AD.tmp PID 2520 wrote to memory of 2544 2520 866F.tmp 86AD.tmp PID 2520 wrote to memory of 2544 2520 866F.tmp 86AD.tmp PID 2520 wrote to memory of 2544 2520 866F.tmp 86AD.tmp PID 2544 wrote to memory of 2540 2544 86AD.tmp 86EB.tmp PID 2544 wrote to memory of 2540 2544 86AD.tmp 86EB.tmp PID 2544 wrote to memory of 2540 2544 86AD.tmp 86EB.tmp PID 2544 wrote to memory of 2540 2544 86AD.tmp 86EB.tmp PID 2540 wrote to memory of 2692 2540 86EB.tmp 872A.tmp PID 2540 wrote to memory of 2692 2540 86EB.tmp 872A.tmp PID 2540 wrote to memory of 2692 2540 86EB.tmp 872A.tmp PID 2540 wrote to memory of 2692 2540 86EB.tmp 872A.tmp PID 2692 wrote to memory of 1432 2692 872A.tmp 8778.tmp PID 2692 wrote to memory of 1432 2692 872A.tmp 8778.tmp PID 2692 wrote to memory of 1432 2692 872A.tmp 8778.tmp PID 2692 wrote to memory of 1432 2692 872A.tmp 8778.tmp PID 1432 wrote to memory of 1932 1432 8778.tmp 87C6.tmp PID 1432 wrote to memory of 1932 1432 8778.tmp 87C6.tmp PID 1432 wrote to memory of 1932 1432 8778.tmp 87C6.tmp PID 1432 wrote to memory of 1932 1432 8778.tmp 87C6.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-21_17e1bf0eb433233731f15c7b069daa1d_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-21_17e1bf0eb433233731f15c7b069daa1d_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\822B.tmp"C:\Users\Admin\AppData\Local\Temp\822B.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\82D6.tmp"C:\Users\Admin\AppData\Local\Temp\82D6.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\8382.tmp"C:\Users\Admin\AppData\Local\Temp\8382.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\846C.tmp"C:\Users\Admin\AppData\Local\Temp\846C.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\84E9.tmp"C:\Users\Admin\AppData\Local\Temp\84E9.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\8537.tmp"C:\Users\Admin\AppData\Local\Temp\8537.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:296 -
C:\Users\Admin\AppData\Local\Temp\8575.tmp"C:\Users\Admin\AppData\Local\Temp\8575.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\85B3.tmp"C:\Users\Admin\AppData\Local\Temp\85B3.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\85F2.tmp"C:\Users\Admin\AppData\Local\Temp\85F2.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\8630.tmp"C:\Users\Admin\AppData\Local\Temp\8630.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\866F.tmp"C:\Users\Admin\AppData\Local\Temp\866F.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\86AD.tmp"C:\Users\Admin\AppData\Local\Temp\86AD.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\86EB.tmp"C:\Users\Admin\AppData\Local\Temp\86EB.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\872A.tmp"C:\Users\Admin\AppData\Local\Temp\872A.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\8778.tmp"C:\Users\Admin\AppData\Local\Temp\8778.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\87C6.tmp"C:\Users\Admin\AppData\Local\Temp\87C6.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\8814.tmp"C:\Users\Admin\AppData\Local\Temp\8814.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\8852.tmp"C:\Users\Admin\AppData\Local\Temp\8852.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:768 -
C:\Users\Admin\AppData\Local\Temp\88A0.tmp"C:\Users\Admin\AppData\Local\Temp\88A0.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\88EE.tmp"C:\Users\Admin\AppData\Local\Temp\88EE.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\892D.tmp"C:\Users\Admin\AppData\Local\Temp\892D.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\898A.tmp"C:\Users\Admin\AppData\Local\Temp\898A.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\89D8.tmp"C:\Users\Admin\AppData\Local\Temp\89D8.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\8A45.tmp"C:\Users\Admin\AppData\Local\Temp\8A45.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\8AA3.tmp"C:\Users\Admin\AppData\Local\Temp\8AA3.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\8AE1.tmp"C:\Users\Admin\AppData\Local\Temp\8AE1.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\8B20.tmp"C:\Users\Admin\AppData\Local\Temp\8B20.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:924 -
C:\Users\Admin\AppData\Local\Temp\8B5E.tmp"C:\Users\Admin\AppData\Local\Temp\8B5E.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\8B9D.tmp"C:\Users\Admin\AppData\Local\Temp\8B9D.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\8BEB.tmp"C:\Users\Admin\AppData\Local\Temp\8BEB.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\8C39.tmp"C:\Users\Admin\AppData\Local\Temp\8C39.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:816 -
C:\Users\Admin\AppData\Local\Temp\8C87.tmp"C:\Users\Admin\AppData\Local\Temp\8C87.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\8CC5.tmp"C:\Users\Admin\AppData\Local\Temp\8CC5.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\8D13.tmp"C:\Users\Admin\AppData\Local\Temp\8D13.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\8D51.tmp"C:\Users\Admin\AppData\Local\Temp\8D51.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\8D90.tmp"C:\Users\Admin\AppData\Local\Temp\8D90.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\8DCE.tmp"C:\Users\Admin\AppData\Local\Temp\8DCE.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\8E1C.tmp"C:\Users\Admin\AppData\Local\Temp\8E1C.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\8E6A.tmp"C:\Users\Admin\AppData\Local\Temp\8E6A.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\8EA9.tmp"C:\Users\Admin\AppData\Local\Temp\8EA9.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:892 -
C:\Users\Admin\AppData\Local\Temp\8EF7.tmp"C:\Users\Admin\AppData\Local\Temp\8EF7.tmp"42⤵
- Executes dropped EXE
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\8F64.tmp"C:\Users\Admin\AppData\Local\Temp\8F64.tmp"43⤵
- Loads dropped DLL
PID:956 -
C:\Users\Admin\AppData\Local\Temp\8FC1.tmp"C:\Users\Admin\AppData\Local\Temp\8FC1.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\900F.tmp"C:\Users\Admin\AppData\Local\Temp\900F.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\905D.tmp"C:\Users\Admin\AppData\Local\Temp\905D.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\90AB.tmp"C:\Users\Admin\AppData\Local\Temp\90AB.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\90F9.tmp"C:\Users\Admin\AppData\Local\Temp\90F9.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\9147.tmp"C:\Users\Admin\AppData\Local\Temp\9147.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\9195.tmp"C:\Users\Admin\AppData\Local\Temp\9195.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\91D4.tmp"C:\Users\Admin\AppData\Local\Temp\91D4.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\9222.tmp"C:\Users\Admin\AppData\Local\Temp\9222.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\9270.tmp"C:\Users\Admin\AppData\Local\Temp\9270.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\92AE.tmp"C:\Users\Admin\AppData\Local\Temp\92AE.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\92ED.tmp"C:\Users\Admin\AppData\Local\Temp\92ED.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:648 -
C:\Users\Admin\AppData\Local\Temp\932B.tmp"C:\Users\Admin\AppData\Local\Temp\932B.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\9389.tmp"C:\Users\Admin\AppData\Local\Temp\9389.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\93E6.tmp"C:\Users\Admin\AppData\Local\Temp\93E6.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\9444.tmp"C:\Users\Admin\AppData\Local\Temp\9444.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\94A1.tmp"C:\Users\Admin\AppData\Local\Temp\94A1.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\94FF.tmp"C:\Users\Admin\AppData\Local\Temp\94FF.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\953D.tmp"C:\Users\Admin\AppData\Local\Temp\953D.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\957C.tmp"C:\Users\Admin\AppData\Local\Temp\957C.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:580 -
C:\Users\Admin\AppData\Local\Temp\95BA.tmp"C:\Users\Admin\AppData\Local\Temp\95BA.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\95F9.tmp"C:\Users\Admin\AppData\Local\Temp\95F9.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\9647.tmp"C:\Users\Admin\AppData\Local\Temp\9647.tmp"66⤵
- Executes dropped EXE
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\96C3.tmp"C:\Users\Admin\AppData\Local\Temp\96C3.tmp"67⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\9721.tmp"C:\Users\Admin\AppData\Local\Temp\9721.tmp"68⤵
- System Location Discovery: System Language Discovery
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\976F.tmp"C:\Users\Admin\AppData\Local\Temp\976F.tmp"69⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\97DC.tmp"C:\Users\Admin\AppData\Local\Temp\97DC.tmp"70⤵PID:664
-
C:\Users\Admin\AppData\Local\Temp\983A.tmp"C:\Users\Admin\AppData\Local\Temp\983A.tmp"71⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\9878.tmp"C:\Users\Admin\AppData\Local\Temp\9878.tmp"72⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\98C6.tmp"C:\Users\Admin\AppData\Local\Temp\98C6.tmp"73⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\9905.tmp"C:\Users\Admin\AppData\Local\Temp\9905.tmp"74⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\9962.tmp"C:\Users\Admin\AppData\Local\Temp\9962.tmp"75⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\99B0.tmp"C:\Users\Admin\AppData\Local\Temp\99B0.tmp"76⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\9A0E.tmp"C:\Users\Admin\AppData\Local\Temp\9A0E.tmp"77⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"78⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\9AD9.tmp"C:\Users\Admin\AppData\Local\Temp\9AD9.tmp"79⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"80⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"81⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"82⤵PID:716
-
C:\Users\Admin\AppData\Local\Temp\9C30.tmp"C:\Users\Admin\AppData\Local\Temp\9C30.tmp"83⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\9C6E.tmp"C:\Users\Admin\AppData\Local\Temp\9C6E.tmp"84⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"85⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\9CEB.tmp"C:\Users\Admin\AppData\Local\Temp\9CEB.tmp"86⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\9D49.tmp"C:\Users\Admin\AppData\Local\Temp\9D49.tmp"87⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\9DA6.tmp"C:\Users\Admin\AppData\Local\Temp\9DA6.tmp"88⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\9DE5.tmp"C:\Users\Admin\AppData\Local\Temp\9DE5.tmp"89⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\9E23.tmp"C:\Users\Admin\AppData\Local\Temp\9E23.tmp"90⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\9E71.tmp"C:\Users\Admin\AppData\Local\Temp\9E71.tmp"91⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\9EAF.tmp"C:\Users\Admin\AppData\Local\Temp\9EAF.tmp"92⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\9EFD.tmp"C:\Users\Admin\AppData\Local\Temp\9EFD.tmp"93⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\9F3C.tmp"C:\Users\Admin\AppData\Local\Temp\9F3C.tmp"94⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\9F8A.tmp"C:\Users\Admin\AppData\Local\Temp\9F8A.tmp"95⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\9FC8.tmp"C:\Users\Admin\AppData\Local\Temp\9FC8.tmp"96⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\A016.tmp"C:\Users\Admin\AppData\Local\Temp\A016.tmp"97⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\A055.tmp"C:\Users\Admin\AppData\Local\Temp\A055.tmp"98⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\A0A3.tmp"C:\Users\Admin\AppData\Local\Temp\A0A3.tmp"99⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\A0E1.tmp"C:\Users\Admin\AppData\Local\Temp\A0E1.tmp"100⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\A11F.tmp"C:\Users\Admin\AppData\Local\Temp\A11F.tmp"101⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\A15E.tmp"C:\Users\Admin\AppData\Local\Temp\A15E.tmp"102⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\A1AC.tmp"C:\Users\Admin\AppData\Local\Temp\A1AC.tmp"103⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\A1EA.tmp"C:\Users\Admin\AppData\Local\Temp\A1EA.tmp"104⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\A238.tmp"C:\Users\Admin\AppData\Local\Temp\A238.tmp"105⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\A277.tmp"C:\Users\Admin\AppData\Local\Temp\A277.tmp"106⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\A2C5.tmp"C:\Users\Admin\AppData\Local\Temp\A2C5.tmp"107⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\A303.tmp"C:\Users\Admin\AppData\Local\Temp\A303.tmp"108⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\A341.tmp"C:\Users\Admin\AppData\Local\Temp\A341.tmp"109⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\A380.tmp"C:\Users\Admin\AppData\Local\Temp\A380.tmp"110⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\A3CE.tmp"C:\Users\Admin\AppData\Local\Temp\A3CE.tmp"111⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\A40C.tmp"C:\Users\Admin\AppData\Local\Temp\A40C.tmp"112⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\A44B.tmp"C:\Users\Admin\AppData\Local\Temp\A44B.tmp"113⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\A489.tmp"C:\Users\Admin\AppData\Local\Temp\A489.tmp"114⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\A4D7.tmp"C:\Users\Admin\AppData\Local\Temp\A4D7.tmp"115⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\A515.tmp"C:\Users\Admin\AppData\Local\Temp\A515.tmp"116⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\A554.tmp"C:\Users\Admin\AppData\Local\Temp\A554.tmp"117⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\A592.tmp"C:\Users\Admin\AppData\Local\Temp\A592.tmp"118⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\A5E0.tmp"C:\Users\Admin\AppData\Local\Temp\A5E0.tmp"119⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\A61F.tmp"C:\Users\Admin\AppData\Local\Temp\A61F.tmp"120⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\A65D.tmp"C:\Users\Admin\AppData\Local\Temp\A65D.tmp"121⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\A6AB.tmp"C:\Users\Admin\AppData\Local\Temp\A6AB.tmp"122⤵PID:1156
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-