Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
09/08/2024, 03:23
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-09_2640342ae18cc758ca113435e5d7c03a_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-08-09_2640342ae18cc758ca113435e5d7c03a_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-09_2640342ae18cc758ca113435e5d7c03a_mafia.exe
-
Size
486KB
-
MD5
2640342ae18cc758ca113435e5d7c03a
-
SHA1
8faf9e2d31e31a0a383d8217d6a232e584dd8548
-
SHA256
92ac6b063acb43266505b3e590ca0c2329ed89768e0aeca4712aa7eafd1c6312
-
SHA512
151a9211d1aba3ca6adb920210957a277c82c7e97bf578c6245c414206899773c89c735e12775a7f70107d294071c7caaaefe9a312a4a981b17ba3a0e167b8e7
-
SSDEEP
12288:UU5rCOTeiDKGkLQqtjGg8pvadUMEBnLHNZ:UUQOJDKGkHjGvavEVN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1788 C0CF.tmp 2388 C12D.tmp 2088 C1B9.tmp 2948 C236.tmp 2776 C294.tmp 2704 C301.tmp 2856 C36E.tmp 2752 C3EB.tmp 2844 C449.tmp 2852 C4A6.tmp 2212 C504.tmp 2840 C571.tmp 2656 C5CF.tmp 3040 C63C.tmp 3048 C6A9.tmp 1484 C707.tmp 900 C774.tmp 1728 C7D1.tmp 1668 C83F.tmp 2024 C8AC.tmp 1676 C919.tmp 1500 C977.tmp 2796 C9D4.tmp 2696 CA13.tmp 2116 CA51.tmp 1900 CA8F.tmp 2164 CACE.tmp 3020 CB0C.tmp 1260 CB4B.tmp 2428 CB89.tmp 844 CBC7.tmp 2232 CC06.tmp 440 CC44.tmp 1712 CC83.tmp 1296 CCC1.tmp 2020 CCFF.tmp 384 CD3E.tmp 1612 CD7C.tmp 764 CDAB.tmp 888 CDE9.tmp 1588 CE28.tmp 736 CE66.tmp 2072 CEA5.tmp 2192 CEE3.tmp 1744 CF21.tmp 2004 CF60.tmp 336 CF9E.tmp 2260 CFDD.tmp 2324 D01B.tmp 804 D059.tmp 2308 D098.tmp 684 D0D6.tmp 1524 D115.tmp 1216 D153.tmp 2312 D191.tmp 2092 D1D0.tmp 2076 D20E.tmp 2504 D24D.tmp 2088 D28B.tmp 2420 D2C9.tmp 2156 D308.tmp 2208 D346.tmp 2872 D385.tmp 2904 D3C3.tmp -
Loads dropped DLL 64 IoCs
pid Process 2556 2024-08-09_2640342ae18cc758ca113435e5d7c03a_mafia.exe 1788 C0CF.tmp 2388 C12D.tmp 2088 C1B9.tmp 2948 C236.tmp 2776 C294.tmp 2704 C301.tmp 2856 C36E.tmp 2752 C3EB.tmp 2844 C449.tmp 2852 C4A6.tmp 2212 C504.tmp 2840 C571.tmp 2656 C5CF.tmp 3040 C63C.tmp 3048 C6A9.tmp 1484 C707.tmp 900 C774.tmp 1728 C7D1.tmp 1668 C83F.tmp 2024 C8AC.tmp 1676 C919.tmp 1500 C977.tmp 2796 C9D4.tmp 2696 CA13.tmp 2116 CA51.tmp 1900 CA8F.tmp 2164 CACE.tmp 3020 CB0C.tmp 1260 CB4B.tmp 2428 CB89.tmp 844 CBC7.tmp 2232 CC06.tmp 440 CC44.tmp 1712 CC83.tmp 1296 CCC1.tmp 2020 CCFF.tmp 384 CD3E.tmp 1612 CD7C.tmp 764 CDAB.tmp 888 CDE9.tmp 1588 CE28.tmp 736 CE66.tmp 2072 CEA5.tmp 2192 CEE3.tmp 1744 CF21.tmp 2004 CF60.tmp 336 CF9E.tmp 2260 CFDD.tmp 2324 D01B.tmp 804 D059.tmp 2308 D098.tmp 684 D0D6.tmp 1524 D115.tmp 1216 D153.tmp 2312 D191.tmp 2092 D1D0.tmp 2076 D20E.tmp 2504 D24D.tmp 2088 D28B.tmp 2420 D2C9.tmp 2156 D308.tmp 2208 D346.tmp 2872 D385.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6336.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 983A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAD5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E418.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 226F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE68.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A41C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E032.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F576.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 498E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 623C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6FE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 563B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 954D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3524.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B05B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBB6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75BC.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2556 wrote to memory of 1788 2556 2024-08-09_2640342ae18cc758ca113435e5d7c03a_mafia.exe 30 PID 2556 wrote to memory of 1788 2556 2024-08-09_2640342ae18cc758ca113435e5d7c03a_mafia.exe 30 PID 2556 wrote to memory of 1788 2556 2024-08-09_2640342ae18cc758ca113435e5d7c03a_mafia.exe 30 PID 2556 wrote to memory of 1788 2556 2024-08-09_2640342ae18cc758ca113435e5d7c03a_mafia.exe 30 PID 1788 wrote to memory of 2388 1788 C0CF.tmp 31 PID 1788 wrote to memory of 2388 1788 C0CF.tmp 31 PID 1788 wrote to memory of 2388 1788 C0CF.tmp 31 PID 1788 wrote to memory of 2388 1788 C0CF.tmp 31 PID 2388 wrote to memory of 2088 2388 C12D.tmp 32 PID 2388 wrote to memory of 2088 2388 C12D.tmp 32 PID 2388 wrote to memory of 2088 2388 C12D.tmp 32 PID 2388 wrote to memory of 2088 2388 C12D.tmp 32 PID 2088 wrote to memory of 2948 2088 C1B9.tmp 33 PID 2088 wrote to memory of 2948 2088 C1B9.tmp 33 PID 2088 wrote to memory of 2948 2088 C1B9.tmp 33 PID 2088 wrote to memory of 2948 2088 C1B9.tmp 33 PID 2948 wrote to memory of 2776 2948 C236.tmp 34 PID 2948 wrote to memory of 2776 2948 C236.tmp 34 PID 2948 wrote to memory of 2776 2948 C236.tmp 34 PID 2948 wrote to memory of 2776 2948 C236.tmp 34 PID 2776 wrote to memory of 2704 2776 C294.tmp 35 PID 2776 wrote to memory of 2704 2776 C294.tmp 35 PID 2776 wrote to memory of 2704 2776 C294.tmp 35 PID 2776 wrote to memory of 2704 2776 C294.tmp 35 PID 2704 wrote to memory of 2856 2704 C301.tmp 36 PID 2704 wrote to memory of 2856 2704 C301.tmp 36 PID 2704 wrote to memory of 2856 2704 C301.tmp 36 PID 2704 wrote to memory of 2856 2704 C301.tmp 36 PID 2856 wrote to memory of 2752 2856 C36E.tmp 37 PID 2856 wrote to memory of 2752 2856 C36E.tmp 37 PID 2856 wrote to memory of 2752 2856 C36E.tmp 37 PID 2856 wrote to memory of 2752 2856 C36E.tmp 37 PID 2752 wrote to memory of 2844 2752 C3EB.tmp 38 PID 2752 wrote to memory of 2844 2752 C3EB.tmp 38 PID 2752 wrote to memory of 2844 2752 C3EB.tmp 38 PID 2752 wrote to memory of 2844 2752 C3EB.tmp 38 PID 2844 wrote to memory of 2852 2844 C449.tmp 39 PID 2844 wrote to memory of 2852 2844 C449.tmp 39 PID 2844 wrote to memory of 2852 2844 C449.tmp 39 PID 2844 wrote to memory of 2852 2844 C449.tmp 39 PID 2852 wrote to memory of 2212 2852 C4A6.tmp 40 PID 2852 wrote to memory of 2212 2852 C4A6.tmp 40 PID 2852 wrote to memory of 2212 2852 C4A6.tmp 40 PID 2852 wrote to memory of 2212 2852 C4A6.tmp 40 PID 2212 wrote to memory of 2840 2212 C504.tmp 41 PID 2212 wrote to memory of 2840 2212 C504.tmp 41 PID 2212 wrote to memory of 2840 2212 C504.tmp 41 PID 2212 wrote to memory of 2840 2212 C504.tmp 41 PID 2840 wrote to memory of 2656 2840 C571.tmp 42 PID 2840 wrote to memory of 2656 2840 C571.tmp 42 PID 2840 wrote to memory of 2656 2840 C571.tmp 42 PID 2840 wrote to memory of 2656 2840 C571.tmp 42 PID 2656 wrote to memory of 3040 2656 C5CF.tmp 43 PID 2656 wrote to memory of 3040 2656 C5CF.tmp 43 PID 2656 wrote to memory of 3040 2656 C5CF.tmp 43 PID 2656 wrote to memory of 3040 2656 C5CF.tmp 43 PID 3040 wrote to memory of 3048 3040 C63C.tmp 44 PID 3040 wrote to memory of 3048 3040 C63C.tmp 44 PID 3040 wrote to memory of 3048 3040 C63C.tmp 44 PID 3040 wrote to memory of 3048 3040 C63C.tmp 44 PID 3048 wrote to memory of 1484 3048 C6A9.tmp 45 PID 3048 wrote to memory of 1484 3048 C6A9.tmp 45 PID 3048 wrote to memory of 1484 3048 C6A9.tmp 45 PID 3048 wrote to memory of 1484 3048 C6A9.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-09_2640342ae18cc758ca113435e5d7c03a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-09_2640342ae18cc758ca113435e5d7c03a_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\C12D.tmp"C:\Users\Admin\AppData\Local\Temp\C12D.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\C1B9.tmp"C:\Users\Admin\AppData\Local\Temp\C1B9.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\C236.tmp"C:\Users\Admin\AppData\Local\Temp\C236.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\C294.tmp"C:\Users\Admin\AppData\Local\Temp\C294.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\C301.tmp"C:\Users\Admin\AppData\Local\Temp\C301.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\C36E.tmp"C:\Users\Admin\AppData\Local\Temp\C36E.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\C3EB.tmp"C:\Users\Admin\AppData\Local\Temp\C3EB.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\C449.tmp"C:\Users\Admin\AppData\Local\Temp\C449.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\C4A6.tmp"C:\Users\Admin\AppData\Local\Temp\C4A6.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\C504.tmp"C:\Users\Admin\AppData\Local\Temp\C504.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\C571.tmp"C:\Users\Admin\AppData\Local\Temp\C571.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\C5CF.tmp"C:\Users\Admin\AppData\Local\Temp\C5CF.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\C63C.tmp"C:\Users\Admin\AppData\Local\Temp\C63C.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\C6A9.tmp"C:\Users\Admin\AppData\Local\Temp\C6A9.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\C707.tmp"C:\Users\Admin\AppData\Local\Temp\C707.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\C774.tmp"C:\Users\Admin\AppData\Local\Temp\C774.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:900 -
C:\Users\Admin\AppData\Local\Temp\C7D1.tmp"C:\Users\Admin\AppData\Local\Temp\C7D1.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\C83F.tmp"C:\Users\Admin\AppData\Local\Temp\C83F.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\C8AC.tmp"C:\Users\Admin\AppData\Local\Temp\C8AC.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\C919.tmp"C:\Users\Admin\AppData\Local\Temp\C919.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\C977.tmp"C:\Users\Admin\AppData\Local\Temp\C977.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\C9D4.tmp"C:\Users\Admin\AppData\Local\Temp\C9D4.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\CA13.tmp"C:\Users\Admin\AppData\Local\Temp\CA13.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\CA51.tmp"C:\Users\Admin\AppData\Local\Temp\CA51.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\CA8F.tmp"C:\Users\Admin\AppData\Local\Temp\CA8F.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\CACE.tmp"C:\Users\Admin\AppData\Local\Temp\CACE.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\CB0C.tmp"C:\Users\Admin\AppData\Local\Temp\CB0C.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\CB4B.tmp"C:\Users\Admin\AppData\Local\Temp\CB4B.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\CB89.tmp"C:\Users\Admin\AppData\Local\Temp\CB89.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\CBC7.tmp"C:\Users\Admin\AppData\Local\Temp\CBC7.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:844 -
C:\Users\Admin\AppData\Local\Temp\CC06.tmp"C:\Users\Admin\AppData\Local\Temp\CC06.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\CC44.tmp"C:\Users\Admin\AppData\Local\Temp\CC44.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:440 -
C:\Users\Admin\AppData\Local\Temp\CC83.tmp"C:\Users\Admin\AppData\Local\Temp\CC83.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\CCC1.tmp"C:\Users\Admin\AppData\Local\Temp\CCC1.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\CCFF.tmp"C:\Users\Admin\AppData\Local\Temp\CCFF.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\CD3E.tmp"C:\Users\Admin\AppData\Local\Temp\CD3E.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:384 -
C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\CDAB.tmp"C:\Users\Admin\AppData\Local\Temp\CDAB.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:764 -
C:\Users\Admin\AppData\Local\Temp\CDE9.tmp"C:\Users\Admin\AppData\Local\Temp\CDE9.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:888 -
C:\Users\Admin\AppData\Local\Temp\CE28.tmp"C:\Users\Admin\AppData\Local\Temp\CE28.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\CE66.tmp"C:\Users\Admin\AppData\Local\Temp\CE66.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:736 -
C:\Users\Admin\AppData\Local\Temp\CEA5.tmp"C:\Users\Admin\AppData\Local\Temp\CEA5.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\CEE3.tmp"C:\Users\Admin\AppData\Local\Temp\CEE3.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\CF21.tmp"C:\Users\Admin\AppData\Local\Temp\CF21.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\CF60.tmp"C:\Users\Admin\AppData\Local\Temp\CF60.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\CF9E.tmp"C:\Users\Admin\AppData\Local\Temp\CF9E.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:336 -
C:\Users\Admin\AppData\Local\Temp\CFDD.tmp"C:\Users\Admin\AppData\Local\Temp\CFDD.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\D01B.tmp"C:\Users\Admin\AppData\Local\Temp\D01B.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\D059.tmp"C:\Users\Admin\AppData\Local\Temp\D059.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:804 -
C:\Users\Admin\AppData\Local\Temp\D098.tmp"C:\Users\Admin\AppData\Local\Temp\D098.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\D0D6.tmp"C:\Users\Admin\AppData\Local\Temp\D0D6.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:684 -
C:\Users\Admin\AppData\Local\Temp\D115.tmp"C:\Users\Admin\AppData\Local\Temp\D115.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\D153.tmp"C:\Users\Admin\AppData\Local\Temp\D153.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\D191.tmp"C:\Users\Admin\AppData\Local\Temp\D191.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\D1D0.tmp"C:\Users\Admin\AppData\Local\Temp\D1D0.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\D20E.tmp"C:\Users\Admin\AppData\Local\Temp\D20E.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\D24D.tmp"C:\Users\Admin\AppData\Local\Temp\D24D.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\D28B.tmp"C:\Users\Admin\AppData\Local\Temp\D28B.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\D2C9.tmp"C:\Users\Admin\AppData\Local\Temp\D2C9.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\D308.tmp"C:\Users\Admin\AppData\Local\Temp\D308.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\D346.tmp"C:\Users\Admin\AppData\Local\Temp\D346.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\D385.tmp"C:\Users\Admin\AppData\Local\Temp\D385.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\D3C3.tmp"C:\Users\Admin\AppData\Local\Temp\D3C3.tmp"65⤵
- Executes dropped EXE
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\D401.tmp"C:\Users\Admin\AppData\Local\Temp\D401.tmp"66⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\D440.tmp"C:\Users\Admin\AppData\Local\Temp\D440.tmp"67⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\D47E.tmp"C:\Users\Admin\AppData\Local\Temp\D47E.tmp"68⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\D4BD.tmp"C:\Users\Admin\AppData\Local\Temp\D4BD.tmp"69⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\D4FB.tmp"C:\Users\Admin\AppData\Local\Temp\D4FB.tmp"70⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\D539.tmp"C:\Users\Admin\AppData\Local\Temp\D539.tmp"71⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\D578.tmp"C:\Users\Admin\AppData\Local\Temp\D578.tmp"72⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\D5B6.tmp"C:\Users\Admin\AppData\Local\Temp\D5B6.tmp"73⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\D5F5.tmp"C:\Users\Admin\AppData\Local\Temp\D5F5.tmp"74⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\D633.tmp"C:\Users\Admin\AppData\Local\Temp\D633.tmp"75⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\D671.tmp"C:\Users\Admin\AppData\Local\Temp\D671.tmp"76⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\D6B0.tmp"C:\Users\Admin\AppData\Local\Temp\D6B0.tmp"77⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\D6EE.tmp"C:\Users\Admin\AppData\Local\Temp\D6EE.tmp"78⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\D72D.tmp"C:\Users\Admin\AppData\Local\Temp\D72D.tmp"79⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\D76B.tmp"C:\Users\Admin\AppData\Local\Temp\D76B.tmp"80⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\D7A9.tmp"C:\Users\Admin\AppData\Local\Temp\D7A9.tmp"81⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\D7E8.tmp"C:\Users\Admin\AppData\Local\Temp\D7E8.tmp"82⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\D826.tmp"C:\Users\Admin\AppData\Local\Temp\D826.tmp"83⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\D865.tmp"C:\Users\Admin\AppData\Local\Temp\D865.tmp"84⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\D8A3.tmp"C:\Users\Admin\AppData\Local\Temp\D8A3.tmp"85⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\D8E1.tmp"C:\Users\Admin\AppData\Local\Temp\D8E1.tmp"86⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\D920.tmp"C:\Users\Admin\AppData\Local\Temp\D920.tmp"87⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\D95E.tmp"C:\Users\Admin\AppData\Local\Temp\D95E.tmp"88⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\D99D.tmp"C:\Users\Admin\AppData\Local\Temp\D99D.tmp"89⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\D9DB.tmp"C:\Users\Admin\AppData\Local\Temp\D9DB.tmp"90⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\DA19.tmp"C:\Users\Admin\AppData\Local\Temp\DA19.tmp"91⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\DA58.tmp"C:\Users\Admin\AppData\Local\Temp\DA58.tmp"92⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\DA96.tmp"C:\Users\Admin\AppData\Local\Temp\DA96.tmp"93⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\DAD5.tmp"C:\Users\Admin\AppData\Local\Temp\DAD5.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\DB13.tmp"C:\Users\Admin\AppData\Local\Temp\DB13.tmp"95⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\DB51.tmp"C:\Users\Admin\AppData\Local\Temp\DB51.tmp"96⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\DB90.tmp"C:\Users\Admin\AppData\Local\Temp\DB90.tmp"97⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\DBCE.tmp"C:\Users\Admin\AppData\Local\Temp\DBCE.tmp"98⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\DC0D.tmp"C:\Users\Admin\AppData\Local\Temp\DC0D.tmp"99⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\DC4B.tmp"C:\Users\Admin\AppData\Local\Temp\DC4B.tmp"100⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\DC89.tmp"C:\Users\Admin\AppData\Local\Temp\DC89.tmp"101⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\DCC8.tmp"C:\Users\Admin\AppData\Local\Temp\DCC8.tmp"102⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\DD06.tmp"C:\Users\Admin\AppData\Local\Temp\DD06.tmp"103⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\DD45.tmp"C:\Users\Admin\AppData\Local\Temp\DD45.tmp"104⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\DD83.tmp"C:\Users\Admin\AppData\Local\Temp\DD83.tmp"105⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\DDC2.tmp"C:\Users\Admin\AppData\Local\Temp\DDC2.tmp"106⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\DE00.tmp"C:\Users\Admin\AppData\Local\Temp\DE00.tmp"107⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\DE3E.tmp"C:\Users\Admin\AppData\Local\Temp\DE3E.tmp"108⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\DE7D.tmp"C:\Users\Admin\AppData\Local\Temp\DE7D.tmp"109⤵PID:304
-
C:\Users\Admin\AppData\Local\Temp\DEBB.tmp"C:\Users\Admin\AppData\Local\Temp\DEBB.tmp"110⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\DEFA.tmp"C:\Users\Admin\AppData\Local\Temp\DEFA.tmp"111⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\DF38.tmp"C:\Users\Admin\AppData\Local\Temp\DF38.tmp"112⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\DF76.tmp"C:\Users\Admin\AppData\Local\Temp\DF76.tmp"113⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\DFB5.tmp"C:\Users\Admin\AppData\Local\Temp\DFB5.tmp"114⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\DFF3.tmp"C:\Users\Admin\AppData\Local\Temp\DFF3.tmp"115⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\E032.tmp"C:\Users\Admin\AppData\Local\Temp\E032.tmp"116⤵
- System Location Discovery: System Language Discovery
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\E070.tmp"C:\Users\Admin\AppData\Local\Temp\E070.tmp"117⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\E0BE.tmp"C:\Users\Admin\AppData\Local\Temp\E0BE.tmp"118⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\E0FC.tmp"C:\Users\Admin\AppData\Local\Temp\E0FC.tmp"119⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\E13B.tmp"C:\Users\Admin\AppData\Local\Temp\E13B.tmp"120⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\E179.tmp"C:\Users\Admin\AppData\Local\Temp\E179.tmp"121⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\E1B8.tmp"C:\Users\Admin\AppData\Local\Temp\E1B8.tmp"122⤵PID:2084
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-