Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
22-08-2024 05:32
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-22_2f714d805e57d78440b438727b583b23_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-08-22_2f714d805e57d78440b438727b583b23_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-22_2f714d805e57d78440b438727b583b23_mafia.exe
-
Size
488KB
-
MD5
2f714d805e57d78440b438727b583b23
-
SHA1
3ec0ecdada027c76b3fab2698927c54abac7a848
-
SHA256
67811f666892240375b9bad4b4b81cb2dd7b9251c364b04b6d1a0f2004ca49ff
-
SHA512
bb57983de873ceb1f5dc947a76e854c1137d8386d5ea140edf002cae29de42cc84830c6ad94a08973787bd92d8d8dcce1aeba5566ef8a5e620b47005cd51181e
-
SSDEEP
12288:/U5rCOTeiDMUqjIRZSLDcCo/jOvBqWNZ:/UQOJDMUqsZqDcCIjOvxN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1560 E53.tmp 2700 F6C.tmp 2236 10B3.tmp 2456 119D.tmp 2764 1297.tmp 2816 13B0.tmp 2892 14B9.tmp 2908 15E1.tmp 2636 16DB.tmp 2784 17D4.tmp 2624 18CE.tmp 2016 19B8.tmp 2056 1AD1.tmp 2704 1BDA.tmp 2364 1CE3.tmp 2992 1DEC.tmp 3000 1EB7.tmp 3004 1F82.tmp 2988 207C.tmp 2472 2211.tmp 2100 230B.tmp 1372 2404.tmp 960 24DF.tmp 1368 257B.tmp 1892 2626.tmp 2380 2694.tmp 2144 2720.tmp 2220 27AC.tmp 2108 2839.tmp 984 28C5.tmp 1412 2961.tmp 2428 29EE.tmp 1484 2AA9.tmp 2436 2B35.tmp 1736 2BC2.tmp 1616 2C3E.tmp 1724 2CBB.tmp 2120 2D57.tmp 1688 2DE4.tmp 1028 2E70.tmp 1488 2EFC.tmp 1628 2F89.tmp 2032 3006.tmp 976 3092.tmp 2564 311E.tmp 3056 31AB.tmp 320 3237.tmp 1832 32D3.tmp 2132 3350.tmp 2124 33DC.tmp 1680 344A.tmp 1776 34E6.tmp 1768 3562.tmp 2104 35D0.tmp 1560 3784.tmp 2696 385F.tmp 1032 38FB.tmp 2412 3978.tmp 2828 3A04.tmp 2832 3A81.tmp 2720 3AEE.tmp 2904 3B8A.tmp 2896 3C16.tmp 2732 3C84.tmp -
Loads dropped DLL 64 IoCs
pid Process 2532 2024-08-22_2f714d805e57d78440b438727b583b23_mafia.exe 1560 E53.tmp 2700 F6C.tmp 2236 10B3.tmp 2456 119D.tmp 2764 1297.tmp 2816 13B0.tmp 2892 14B9.tmp 2908 15E1.tmp 2636 16DB.tmp 2784 17D4.tmp 2624 18CE.tmp 2016 19B8.tmp 2056 1AD1.tmp 2704 1BDA.tmp 2364 1CE3.tmp 2992 1DEC.tmp 3000 1EB7.tmp 3004 1F82.tmp 2988 207C.tmp 2472 2211.tmp 2100 230B.tmp 1372 2404.tmp 960 24DF.tmp 1368 257B.tmp 1892 2626.tmp 2380 2694.tmp 2144 2720.tmp 2220 27AC.tmp 2108 2839.tmp 984 28C5.tmp 1412 2961.tmp 2428 29EE.tmp 1484 2AA9.tmp 2436 2B35.tmp 1736 2BC2.tmp 1616 2C3E.tmp 1724 2CBB.tmp 2120 2D57.tmp 1688 2DE4.tmp 1028 2E70.tmp 1488 2EFC.tmp 1628 2F89.tmp 2032 3006.tmp 976 3092.tmp 2564 311E.tmp 3056 31AB.tmp 320 3237.tmp 1832 32D3.tmp 2132 3350.tmp 2124 33DC.tmp 1680 344A.tmp 1776 34E6.tmp 1768 3562.tmp 2104 35D0.tmp 1560 3784.tmp 2696 385F.tmp 1032 38FB.tmp 2412 3978.tmp 2828 3A04.tmp 2832 3A81.tmp 2720 3AEE.tmp 2904 3B8A.tmp 2896 3C16.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 667.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 120A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B367.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6FD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ABD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D0A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D105.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C17B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C58.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A831.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C82F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 177.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FBE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 119E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF42.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DECB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E7B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F566.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 737B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 360E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CBC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8508.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5820.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F40F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 900F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCB6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C072.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D03A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 537D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 628A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC4.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2532 wrote to memory of 1560 2532 2024-08-22_2f714d805e57d78440b438727b583b23_mafia.exe 29 PID 2532 wrote to memory of 1560 2532 2024-08-22_2f714d805e57d78440b438727b583b23_mafia.exe 29 PID 2532 wrote to memory of 1560 2532 2024-08-22_2f714d805e57d78440b438727b583b23_mafia.exe 29 PID 2532 wrote to memory of 1560 2532 2024-08-22_2f714d805e57d78440b438727b583b23_mafia.exe 29 PID 1560 wrote to memory of 2700 1560 E53.tmp 30 PID 1560 wrote to memory of 2700 1560 E53.tmp 30 PID 1560 wrote to memory of 2700 1560 E53.tmp 30 PID 1560 wrote to memory of 2700 1560 E53.tmp 30 PID 2700 wrote to memory of 2236 2700 F6C.tmp 31 PID 2700 wrote to memory of 2236 2700 F6C.tmp 31 PID 2700 wrote to memory of 2236 2700 F6C.tmp 31 PID 2700 wrote to memory of 2236 2700 F6C.tmp 31 PID 2236 wrote to memory of 2456 2236 10B3.tmp 32 PID 2236 wrote to memory of 2456 2236 10B3.tmp 32 PID 2236 wrote to memory of 2456 2236 10B3.tmp 32 PID 2236 wrote to memory of 2456 2236 10B3.tmp 32 PID 2456 wrote to memory of 2764 2456 119D.tmp 33 PID 2456 wrote to memory of 2764 2456 119D.tmp 33 PID 2456 wrote to memory of 2764 2456 119D.tmp 33 PID 2456 wrote to memory of 2764 2456 119D.tmp 33 PID 2764 wrote to memory of 2816 2764 1297.tmp 34 PID 2764 wrote to memory of 2816 2764 1297.tmp 34 PID 2764 wrote to memory of 2816 2764 1297.tmp 34 PID 2764 wrote to memory of 2816 2764 1297.tmp 34 PID 2816 wrote to memory of 2892 2816 13B0.tmp 35 PID 2816 wrote to memory of 2892 2816 13B0.tmp 35 PID 2816 wrote to memory of 2892 2816 13B0.tmp 35 PID 2816 wrote to memory of 2892 2816 13B0.tmp 35 PID 2892 wrote to memory of 2908 2892 14B9.tmp 36 PID 2892 wrote to memory of 2908 2892 14B9.tmp 36 PID 2892 wrote to memory of 2908 2892 14B9.tmp 36 PID 2892 wrote to memory of 2908 2892 14B9.tmp 36 PID 2908 wrote to memory of 2636 2908 15E1.tmp 37 PID 2908 wrote to memory of 2636 2908 15E1.tmp 37 PID 2908 wrote to memory of 2636 2908 15E1.tmp 37 PID 2908 wrote to memory of 2636 2908 15E1.tmp 37 PID 2636 wrote to memory of 2784 2636 16DB.tmp 38 PID 2636 wrote to memory of 2784 2636 16DB.tmp 38 PID 2636 wrote to memory of 2784 2636 16DB.tmp 38 PID 2636 wrote to memory of 2784 2636 16DB.tmp 38 PID 2784 wrote to memory of 2624 2784 17D4.tmp 39 PID 2784 wrote to memory of 2624 2784 17D4.tmp 39 PID 2784 wrote to memory of 2624 2784 17D4.tmp 39 PID 2784 wrote to memory of 2624 2784 17D4.tmp 39 PID 2624 wrote to memory of 2016 2624 18CE.tmp 40 PID 2624 wrote to memory of 2016 2624 18CE.tmp 40 PID 2624 wrote to memory of 2016 2624 18CE.tmp 40 PID 2624 wrote to memory of 2016 2624 18CE.tmp 40 PID 2016 wrote to memory of 2056 2016 19B8.tmp 41 PID 2016 wrote to memory of 2056 2016 19B8.tmp 41 PID 2016 wrote to memory of 2056 2016 19B8.tmp 41 PID 2016 wrote to memory of 2056 2016 19B8.tmp 41 PID 2056 wrote to memory of 2704 2056 1AD1.tmp 42 PID 2056 wrote to memory of 2704 2056 1AD1.tmp 42 PID 2056 wrote to memory of 2704 2056 1AD1.tmp 42 PID 2056 wrote to memory of 2704 2056 1AD1.tmp 42 PID 2704 wrote to memory of 2364 2704 1BDA.tmp 43 PID 2704 wrote to memory of 2364 2704 1BDA.tmp 43 PID 2704 wrote to memory of 2364 2704 1BDA.tmp 43 PID 2704 wrote to memory of 2364 2704 1BDA.tmp 43 PID 2364 wrote to memory of 2992 2364 1CE3.tmp 44 PID 2364 wrote to memory of 2992 2364 1CE3.tmp 44 PID 2364 wrote to memory of 2992 2364 1CE3.tmp 44 PID 2364 wrote to memory of 2992 2364 1CE3.tmp 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-22_2f714d805e57d78440b438727b583b23_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-22_2f714d805e57d78440b438727b583b23_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\E53.tmp"C:\Users\Admin\AppData\Local\Temp\E53.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\F6C.tmp"C:\Users\Admin\AppData\Local\Temp\F6C.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\10B3.tmp"C:\Users\Admin\AppData\Local\Temp\10B3.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\119D.tmp"C:\Users\Admin\AppData\Local\Temp\119D.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\1297.tmp"C:\Users\Admin\AppData\Local\Temp\1297.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\13B0.tmp"C:\Users\Admin\AppData\Local\Temp\13B0.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\14B9.tmp"C:\Users\Admin\AppData\Local\Temp\14B9.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\15E1.tmp"C:\Users\Admin\AppData\Local\Temp\15E1.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\16DB.tmp"C:\Users\Admin\AppData\Local\Temp\16DB.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\17D4.tmp"C:\Users\Admin\AppData\Local\Temp\17D4.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\18CE.tmp"C:\Users\Admin\AppData\Local\Temp\18CE.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\19B8.tmp"C:\Users\Admin\AppData\Local\Temp\19B8.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\1F82.tmp"C:\Users\Admin\AppData\Local\Temp\1F82.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\207C.tmp"C:\Users\Admin\AppData\Local\Temp\207C.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\2211.tmp"C:\Users\Admin\AppData\Local\Temp\2211.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\230B.tmp"C:\Users\Admin\AppData\Local\Temp\230B.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\2404.tmp"C:\Users\Admin\AppData\Local\Temp\2404.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\24DF.tmp"C:\Users\Admin\AppData\Local\Temp\24DF.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:960 -
C:\Users\Admin\AppData\Local\Temp\257B.tmp"C:\Users\Admin\AppData\Local\Temp\257B.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\2626.tmp"C:\Users\Admin\AppData\Local\Temp\2626.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\2694.tmp"C:\Users\Admin\AppData\Local\Temp\2694.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\2720.tmp"C:\Users\Admin\AppData\Local\Temp\2720.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\27AC.tmp"C:\Users\Admin\AppData\Local\Temp\27AC.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\2839.tmp"C:\Users\Admin\AppData\Local\Temp\2839.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\28C5.tmp"C:\Users\Admin\AppData\Local\Temp\28C5.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:984 -
C:\Users\Admin\AppData\Local\Temp\2961.tmp"C:\Users\Admin\AppData\Local\Temp\2961.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\29EE.tmp"C:\Users\Admin\AppData\Local\Temp\29EE.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\2B35.tmp"C:\Users\Admin\AppData\Local\Temp\2B35.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\2D57.tmp"C:\Users\Admin\AppData\Local\Temp\2D57.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\2E70.tmp"C:\Users\Admin\AppData\Local\Temp\2E70.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\2F89.tmp"C:\Users\Admin\AppData\Local\Temp\2F89.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\3006.tmp"C:\Users\Admin\AppData\Local\Temp\3006.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\3092.tmp"C:\Users\Admin\AppData\Local\Temp\3092.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:976 -
C:\Users\Admin\AppData\Local\Temp\311E.tmp"C:\Users\Admin\AppData\Local\Temp\311E.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\31AB.tmp"C:\Users\Admin\AppData\Local\Temp\31AB.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\3237.tmp"C:\Users\Admin\AppData\Local\Temp\3237.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:320 -
C:\Users\Admin\AppData\Local\Temp\32D3.tmp"C:\Users\Admin\AppData\Local\Temp\32D3.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\3350.tmp"C:\Users\Admin\AppData\Local\Temp\3350.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\33DC.tmp"C:\Users\Admin\AppData\Local\Temp\33DC.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\344A.tmp"C:\Users\Admin\AppData\Local\Temp\344A.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\34E6.tmp"C:\Users\Admin\AppData\Local\Temp\34E6.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\3562.tmp"C:\Users\Admin\AppData\Local\Temp\3562.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\35D0.tmp"C:\Users\Admin\AppData\Local\Temp\35D0.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\3784.tmp"C:\Users\Admin\AppData\Local\Temp\3784.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\385F.tmp"C:\Users\Admin\AppData\Local\Temp\385F.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\38FB.tmp"C:\Users\Admin\AppData\Local\Temp\38FB.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\3978.tmp"C:\Users\Admin\AppData\Local\Temp\3978.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\3A04.tmp"C:\Users\Admin\AppData\Local\Temp\3A04.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\3A81.tmp"C:\Users\Admin\AppData\Local\Temp\3A81.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\3AEE.tmp"C:\Users\Admin\AppData\Local\Temp\3AEE.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\3B8A.tmp"C:\Users\Admin\AppData\Local\Temp\3B8A.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\3C16.tmp"C:\Users\Admin\AppData\Local\Temp\3C16.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\3C84.tmp"C:\Users\Admin\AppData\Local\Temp\3C84.tmp"65⤵
- Executes dropped EXE
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\3CF1.tmp"C:\Users\Admin\AppData\Local\Temp\3CF1.tmp"66⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\3D7D.tmp"C:\Users\Admin\AppData\Local\Temp\3D7D.tmp"67⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\3DFA.tmp"C:\Users\Admin\AppData\Local\Temp\3DFA.tmp"68⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\3E77.tmp"C:\Users\Admin\AppData\Local\Temp\3E77.tmp"69⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\3EF4.tmp"C:\Users\Admin\AppData\Local\Temp\3EF4.tmp"70⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\3F61.tmp"C:\Users\Admin\AppData\Local\Temp\3F61.tmp"71⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\3FBE.tmp"C:\Users\Admin\AppData\Local\Temp\3FBE.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:864 -
C:\Users\Admin\AppData\Local\Temp\401C.tmp"C:\Users\Admin\AppData\Local\Temp\401C.tmp"73⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\4089.tmp"C:\Users\Admin\AppData\Local\Temp\4089.tmp"74⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\4116.tmp"C:\Users\Admin\AppData\Local\Temp\4116.tmp"75⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\4192.tmp"C:\Users\Admin\AppData\Local\Temp\4192.tmp"76⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\421F.tmp"C:\Users\Admin\AppData\Local\Temp\421F.tmp"77⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\42AB.tmp"C:\Users\Admin\AppData\Local\Temp\42AB.tmp"78⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\4318.tmp"C:\Users\Admin\AppData\Local\Temp\4318.tmp"79⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\4395.tmp"C:\Users\Admin\AppData\Local\Temp\4395.tmp"80⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\4422.tmp"C:\Users\Admin\AppData\Local\Temp\4422.tmp"81⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\44BE.tmp"C:\Users\Admin\AppData\Local\Temp\44BE.tmp"82⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\453A.tmp"C:\Users\Admin\AppData\Local\Temp\453A.tmp"83⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\45C7.tmp"C:\Users\Admin\AppData\Local\Temp\45C7.tmp"84⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\4653.tmp"C:\Users\Admin\AppData\Local\Temp\4653.tmp"85⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\46D0.tmp"C:\Users\Admin\AppData\Local\Temp\46D0.tmp"86⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\474D.tmp"C:\Users\Admin\AppData\Local\Temp\474D.tmp"87⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\47CA.tmp"C:\Users\Admin\AppData\Local\Temp\47CA.tmp"88⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\4837.tmp"C:\Users\Admin\AppData\Local\Temp\4837.tmp"89⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\48A4.tmp"C:\Users\Admin\AppData\Local\Temp\48A4.tmp"90⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\4950.tmp"C:\Users\Admin\AppData\Local\Temp\4950.tmp"91⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\49CC.tmp"C:\Users\Admin\AppData\Local\Temp\49CC.tmp"92⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\4A49.tmp"C:\Users\Admin\AppData\Local\Temp\4A49.tmp"93⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\4AD6.tmp"C:\Users\Admin\AppData\Local\Temp\4AD6.tmp"94⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\4B53.tmp"C:\Users\Admin\AppData\Local\Temp\4B53.tmp"95⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\4BC0.tmp"C:\Users\Admin\AppData\Local\Temp\4BC0.tmp"96⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\4D17.tmp"C:\Users\Admin\AppData\Local\Temp\4D17.tmp"97⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"98⤵PID:588
-
C:\Users\Admin\AppData\Local\Temp\4E30.tmp"C:\Users\Admin\AppData\Local\Temp\4E30.tmp"99⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"100⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"101⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"102⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\5013.tmp"C:\Users\Admin\AppData\Local\Temp\5013.tmp"103⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"104⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"105⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\518A.tmp"C:\Users\Admin\AppData\Local\Temp\518A.tmp"106⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\5216.tmp"C:\Users\Admin\AppData\Local\Temp\5216.tmp"107⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\52A3.tmp"C:\Users\Admin\AppData\Local\Temp\52A3.tmp"108⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\532F.tmp"C:\Users\Admin\AppData\Local\Temp\532F.tmp"109⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\53BB.tmp"C:\Users\Admin\AppData\Local\Temp\53BB.tmp"110⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\5448.tmp"C:\Users\Admin\AppData\Local\Temp\5448.tmp"111⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\54C5.tmp"C:\Users\Admin\AppData\Local\Temp\54C5.tmp"112⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\5541.tmp"C:\Users\Admin\AppData\Local\Temp\5541.tmp"113⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\55CE.tmp"C:\Users\Admin\AppData\Local\Temp\55CE.tmp"114⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\564B.tmp"C:\Users\Admin\AppData\Local\Temp\564B.tmp"115⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\5706.tmp"C:\Users\Admin\AppData\Local\Temp\5706.tmp"116⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\5792.tmp"C:\Users\Admin\AppData\Local\Temp\5792.tmp"117⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\581F.tmp"C:\Users\Admin\AppData\Local\Temp\581F.tmp"118⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\589B.tmp"C:\Users\Admin\AppData\Local\Temp\589B.tmp"119⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\5928.tmp"C:\Users\Admin\AppData\Local\Temp\5928.tmp"120⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\59C4.tmp"C:\Users\Admin\AppData\Local\Temp\59C4.tmp"121⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\5A50.tmp"C:\Users\Admin\AppData\Local\Temp\5A50.tmp"122⤵PID:2756
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-