Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
22/08/2024, 07:45
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-22_a7a0bcb9d9059b5dcc72ec3ad911d3ac_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-08-22_a7a0bcb9d9059b5dcc72ec3ad911d3ac_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-22_a7a0bcb9d9059b5dcc72ec3ad911d3ac_mafia.exe
-
Size
527KB
-
MD5
a7a0bcb9d9059b5dcc72ec3ad911d3ac
-
SHA1
905fe7a2bc8e498302a54081a7ed6308d356fd29
-
SHA256
e0eb8f9fb37024a698156c8ee9308e538b010810ed6d95273882968e5aeca689
-
SHA512
e08483bd7e2ea25ce090f9200182cd593da6124dfdb98f4c4535b50b6aa0b0d3e4d8c866f84e4d3219c68a8c71cf62978b41d138e4aaafcb95dbcaadf1219d97
-
SSDEEP
6144:yorf3lPvovsgZnqG2C7mOTeiLRDYB3sLhM038b+uXhELZ3YmZbMN3O9uLDl1Y31l:fU5rCOTeidO3s6UO+p1Zbyf/Y0HDZu
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2192 8037.tmp 2796 8085.tmp 2276 8102.tmp 2176 816F.tmp 2840 81DD.tmp 2644 823A.tmp 2820 82A7.tmp 2616 8324.tmp 2724 8391.tmp 2560 83EF.tmp 1288 844D.tmp 828 84BA.tmp 1864 8517.tmp 2552 8575.tmp 1400 85D3.tmp 808 8640.tmp 3024 86AD.tmp 3012 870B.tmp 2932 8768.tmp 2896 87D5.tmp 2700 8833.tmp 648 8891.tmp 2040 88EE.tmp 584 892D.tmp 832 897B.tmp 1412 89B9.tmp 2308 89F7.tmp 2188 8A36.tmp 2448 8A74.tmp 2280 8AB3.tmp 2200 8AF1.tmp 2132 8B2F.tmp 2268 8B6E.tmp 1124 8BAC.tmp 1712 8BEB.tmp 1872 8C29.tmp 696 8C77.tmp 1880 8CC5.tmp 2844 8D03.tmp 1464 8D42.tmp 1668 8D80.tmp 856 8DBF.tmp 2496 8DFD.tmp 852 8E4B.tmp 1708 8E89.tmp 1848 8EC8.tmp 2284 8F16.tmp 1800 8F54.tmp 1648 8F93.tmp 1220 8FD1.tmp 344 900F.tmp 1716 904E.tmp 2864 909C.tmp 2400 90DA.tmp 2748 9119.tmp 2732 9157.tmp 2756 91A5.tmp 2744 91E3.tmp 2852 9231.tmp 2792 9270.tmp 2944 92BE.tmp 2640 930C.tmp 2768 9369.tmp 2608 93A8.tmp -
Loads dropped DLL 64 IoCs
pid Process 2864 2024-08-22_a7a0bcb9d9059b5dcc72ec3ad911d3ac_mafia.exe 2192 8037.tmp 2796 8085.tmp 2276 8102.tmp 2176 816F.tmp 2840 81DD.tmp 2644 823A.tmp 2820 82A7.tmp 2616 8324.tmp 2724 8391.tmp 2560 83EF.tmp 1288 844D.tmp 828 84BA.tmp 1864 8517.tmp 2552 8575.tmp 1400 85D3.tmp 808 8640.tmp 3024 86AD.tmp 3012 870B.tmp 2932 8768.tmp 2896 87D5.tmp 2700 8833.tmp 648 8891.tmp 2040 88EE.tmp 584 892D.tmp 832 897B.tmp 1412 89B9.tmp 2308 89F7.tmp 2188 8A36.tmp 2448 8A74.tmp 2280 8AB3.tmp 2200 8AF1.tmp 2132 8B2F.tmp 2268 8B6E.tmp 1124 8BAC.tmp 1712 8BEB.tmp 1872 8C29.tmp 696 8C77.tmp 1880 8CC5.tmp 2844 8D03.tmp 1464 8D42.tmp 1668 8D80.tmp 856 8DBF.tmp 2496 8DFD.tmp 852 8E4B.tmp 1708 8E89.tmp 1848 8EC8.tmp 2284 8F16.tmp 1800 8F54.tmp 1648 8F93.tmp 1220 8FD1.tmp 344 900F.tmp 1716 904E.tmp 2864 909C.tmp 2400 90DA.tmp 2748 9119.tmp 2732 9157.tmp 2756 91A5.tmp 2744 91E3.tmp 2852 9231.tmp 2792 9270.tmp 2944 92BE.tmp 2640 930C.tmp 2768 9369.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8391.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 341B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C726.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A14E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C265.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4682.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 930C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2655.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8102.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A860.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B348.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D059.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 223.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2864 wrote to memory of 2192 2864 2024-08-22_a7a0bcb9d9059b5dcc72ec3ad911d3ac_mafia.exe 30 PID 2864 wrote to memory of 2192 2864 2024-08-22_a7a0bcb9d9059b5dcc72ec3ad911d3ac_mafia.exe 30 PID 2864 wrote to memory of 2192 2864 2024-08-22_a7a0bcb9d9059b5dcc72ec3ad911d3ac_mafia.exe 30 PID 2864 wrote to memory of 2192 2864 2024-08-22_a7a0bcb9d9059b5dcc72ec3ad911d3ac_mafia.exe 30 PID 2192 wrote to memory of 2796 2192 8037.tmp 31 PID 2192 wrote to memory of 2796 2192 8037.tmp 31 PID 2192 wrote to memory of 2796 2192 8037.tmp 31 PID 2192 wrote to memory of 2796 2192 8037.tmp 31 PID 2796 wrote to memory of 2276 2796 8085.tmp 32 PID 2796 wrote to memory of 2276 2796 8085.tmp 32 PID 2796 wrote to memory of 2276 2796 8085.tmp 32 PID 2796 wrote to memory of 2276 2796 8085.tmp 32 PID 2276 wrote to memory of 2176 2276 8102.tmp 33 PID 2276 wrote to memory of 2176 2276 8102.tmp 33 PID 2276 wrote to memory of 2176 2276 8102.tmp 33 PID 2276 wrote to memory of 2176 2276 8102.tmp 33 PID 2176 wrote to memory of 2840 2176 816F.tmp 34 PID 2176 wrote to memory of 2840 2176 816F.tmp 34 PID 2176 wrote to memory of 2840 2176 816F.tmp 34 PID 2176 wrote to memory of 2840 2176 816F.tmp 34 PID 2840 wrote to memory of 2644 2840 81DD.tmp 35 PID 2840 wrote to memory of 2644 2840 81DD.tmp 35 PID 2840 wrote to memory of 2644 2840 81DD.tmp 35 PID 2840 wrote to memory of 2644 2840 81DD.tmp 35 PID 2644 wrote to memory of 2820 2644 823A.tmp 36 PID 2644 wrote to memory of 2820 2644 823A.tmp 36 PID 2644 wrote to memory of 2820 2644 823A.tmp 36 PID 2644 wrote to memory of 2820 2644 823A.tmp 36 PID 2820 wrote to memory of 2616 2820 82A7.tmp 37 PID 2820 wrote to memory of 2616 2820 82A7.tmp 37 PID 2820 wrote to memory of 2616 2820 82A7.tmp 37 PID 2820 wrote to memory of 2616 2820 82A7.tmp 37 PID 2616 wrote to memory of 2724 2616 8324.tmp 38 PID 2616 wrote to memory of 2724 2616 8324.tmp 38 PID 2616 wrote to memory of 2724 2616 8324.tmp 38 PID 2616 wrote to memory of 2724 2616 8324.tmp 38 PID 2724 wrote to memory of 2560 2724 8391.tmp 39 PID 2724 wrote to memory of 2560 2724 8391.tmp 39 PID 2724 wrote to memory of 2560 2724 8391.tmp 39 PID 2724 wrote to memory of 2560 2724 8391.tmp 39 PID 2560 wrote to memory of 1288 2560 83EF.tmp 40 PID 2560 wrote to memory of 1288 2560 83EF.tmp 40 PID 2560 wrote to memory of 1288 2560 83EF.tmp 40 PID 2560 wrote to memory of 1288 2560 83EF.tmp 40 PID 1288 wrote to memory of 828 1288 844D.tmp 41 PID 1288 wrote to memory of 828 1288 844D.tmp 41 PID 1288 wrote to memory of 828 1288 844D.tmp 41 PID 1288 wrote to memory of 828 1288 844D.tmp 41 PID 828 wrote to memory of 1864 828 84BA.tmp 42 PID 828 wrote to memory of 1864 828 84BA.tmp 42 PID 828 wrote to memory of 1864 828 84BA.tmp 42 PID 828 wrote to memory of 1864 828 84BA.tmp 42 PID 1864 wrote to memory of 2552 1864 8517.tmp 43 PID 1864 wrote to memory of 2552 1864 8517.tmp 43 PID 1864 wrote to memory of 2552 1864 8517.tmp 43 PID 1864 wrote to memory of 2552 1864 8517.tmp 43 PID 2552 wrote to memory of 1400 2552 8575.tmp 44 PID 2552 wrote to memory of 1400 2552 8575.tmp 44 PID 2552 wrote to memory of 1400 2552 8575.tmp 44 PID 2552 wrote to memory of 1400 2552 8575.tmp 44 PID 1400 wrote to memory of 808 1400 85D3.tmp 45 PID 1400 wrote to memory of 808 1400 85D3.tmp 45 PID 1400 wrote to memory of 808 1400 85D3.tmp 45 PID 1400 wrote to memory of 808 1400 85D3.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-22_a7a0bcb9d9059b5dcc72ec3ad911d3ac_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-22_a7a0bcb9d9059b5dcc72ec3ad911d3ac_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\8037.tmp"C:\Users\Admin\AppData\Local\Temp\8037.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\8085.tmp"C:\Users\Admin\AppData\Local\Temp\8085.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\8102.tmp"C:\Users\Admin\AppData\Local\Temp\8102.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\816F.tmp"C:\Users\Admin\AppData\Local\Temp\816F.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\81DD.tmp"C:\Users\Admin\AppData\Local\Temp\81DD.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\823A.tmp"C:\Users\Admin\AppData\Local\Temp\823A.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\82A7.tmp"C:\Users\Admin\AppData\Local\Temp\82A7.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\8324.tmp"C:\Users\Admin\AppData\Local\Temp\8324.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\8391.tmp"C:\Users\Admin\AppData\Local\Temp\8391.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\83EF.tmp"C:\Users\Admin\AppData\Local\Temp\83EF.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\844D.tmp"C:\Users\Admin\AppData\Local\Temp\844D.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\84BA.tmp"C:\Users\Admin\AppData\Local\Temp\84BA.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\8517.tmp"C:\Users\Admin\AppData\Local\Temp\8517.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\8575.tmp"C:\Users\Admin\AppData\Local\Temp\8575.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\85D3.tmp"C:\Users\Admin\AppData\Local\Temp\85D3.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\8640.tmp"C:\Users\Admin\AppData\Local\Temp\8640.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:808 -
C:\Users\Admin\AppData\Local\Temp\86AD.tmp"C:\Users\Admin\AppData\Local\Temp\86AD.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\870B.tmp"C:\Users\Admin\AppData\Local\Temp\870B.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\8768.tmp"C:\Users\Admin\AppData\Local\Temp\8768.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\87D5.tmp"C:\Users\Admin\AppData\Local\Temp\87D5.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\8833.tmp"C:\Users\Admin\AppData\Local\Temp\8833.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\8891.tmp"C:\Users\Admin\AppData\Local\Temp\8891.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:648 -
C:\Users\Admin\AppData\Local\Temp\88EE.tmp"C:\Users\Admin\AppData\Local\Temp\88EE.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\892D.tmp"C:\Users\Admin\AppData\Local\Temp\892D.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:584 -
C:\Users\Admin\AppData\Local\Temp\897B.tmp"C:\Users\Admin\AppData\Local\Temp\897B.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:832 -
C:\Users\Admin\AppData\Local\Temp\89B9.tmp"C:\Users\Admin\AppData\Local\Temp\89B9.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\89F7.tmp"C:\Users\Admin\AppData\Local\Temp\89F7.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\8A36.tmp"C:\Users\Admin\AppData\Local\Temp\8A36.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\8A74.tmp"C:\Users\Admin\AppData\Local\Temp\8A74.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\8AB3.tmp"C:\Users\Admin\AppData\Local\Temp\8AB3.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\8AF1.tmp"C:\Users\Admin\AppData\Local\Temp\8AF1.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\8B2F.tmp"C:\Users\Admin\AppData\Local\Temp\8B2F.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\8B6E.tmp"C:\Users\Admin\AppData\Local\Temp\8B6E.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\8BAC.tmp"C:\Users\Admin\AppData\Local\Temp\8BAC.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\8BEB.tmp"C:\Users\Admin\AppData\Local\Temp\8BEB.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\8C29.tmp"C:\Users\Admin\AppData\Local\Temp\8C29.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\8C77.tmp"C:\Users\Admin\AppData\Local\Temp\8C77.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:696 -
C:\Users\Admin\AppData\Local\Temp\8CC5.tmp"C:\Users\Admin\AppData\Local\Temp\8CC5.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\8D03.tmp"C:\Users\Admin\AppData\Local\Temp\8D03.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\8D42.tmp"C:\Users\Admin\AppData\Local\Temp\8D42.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\8D80.tmp"C:\Users\Admin\AppData\Local\Temp\8D80.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\8DBF.tmp"C:\Users\Admin\AppData\Local\Temp\8DBF.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:856 -
C:\Users\Admin\AppData\Local\Temp\8DFD.tmp"C:\Users\Admin\AppData\Local\Temp\8DFD.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\8E4B.tmp"C:\Users\Admin\AppData\Local\Temp\8E4B.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:852 -
C:\Users\Admin\AppData\Local\Temp\8E89.tmp"C:\Users\Admin\AppData\Local\Temp\8E89.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\8EC8.tmp"C:\Users\Admin\AppData\Local\Temp\8EC8.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\8F16.tmp"C:\Users\Admin\AppData\Local\Temp\8F16.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\8F54.tmp"C:\Users\Admin\AppData\Local\Temp\8F54.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\8F93.tmp"C:\Users\Admin\AppData\Local\Temp\8F93.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\8FD1.tmp"C:\Users\Admin\AppData\Local\Temp\8FD1.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\900F.tmp"C:\Users\Admin\AppData\Local\Temp\900F.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:344 -
C:\Users\Admin\AppData\Local\Temp\904E.tmp"C:\Users\Admin\AppData\Local\Temp\904E.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\909C.tmp"C:\Users\Admin\AppData\Local\Temp\909C.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\90DA.tmp"C:\Users\Admin\AppData\Local\Temp\90DA.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\9119.tmp"C:\Users\Admin\AppData\Local\Temp\9119.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\9157.tmp"C:\Users\Admin\AppData\Local\Temp\9157.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\91A5.tmp"C:\Users\Admin\AppData\Local\Temp\91A5.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\91E3.tmp"C:\Users\Admin\AppData\Local\Temp\91E3.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\9231.tmp"C:\Users\Admin\AppData\Local\Temp\9231.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\9270.tmp"C:\Users\Admin\AppData\Local\Temp\9270.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\92BE.tmp"C:\Users\Admin\AppData\Local\Temp\92BE.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\930C.tmp"C:\Users\Admin\AppData\Local\Temp\930C.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\9369.tmp"C:\Users\Admin\AppData\Local\Temp\9369.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\93A8.tmp"C:\Users\Admin\AppData\Local\Temp\93A8.tmp"65⤵
- Executes dropped EXE
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\93F6.tmp"C:\Users\Admin\AppData\Local\Temp\93F6.tmp"66⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\9434.tmp"C:\Users\Admin\AppData\Local\Temp\9434.tmp"67⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\9473.tmp"C:\Users\Admin\AppData\Local\Temp\9473.tmp"68⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\94C1.tmp"C:\Users\Admin\AppData\Local\Temp\94C1.tmp"69⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\94FF.tmp"C:\Users\Admin\AppData\Local\Temp\94FF.tmp"70⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\953D.tmp"C:\Users\Admin\AppData\Local\Temp\953D.tmp"71⤵PID:356
-
C:\Users\Admin\AppData\Local\Temp\957C.tmp"C:\Users\Admin\AppData\Local\Temp\957C.tmp"72⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\95BA.tmp"C:\Users\Admin\AppData\Local\Temp\95BA.tmp"73⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\95F9.tmp"C:\Users\Admin\AppData\Local\Temp\95F9.tmp"74⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\9637.tmp"C:\Users\Admin\AppData\Local\Temp\9637.tmp"75⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\9675.tmp"C:\Users\Admin\AppData\Local\Temp\9675.tmp"76⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\96B4.tmp"C:\Users\Admin\AppData\Local\Temp\96B4.tmp"77⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\96F2.tmp"C:\Users\Admin\AppData\Local\Temp\96F2.tmp"78⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\9731.tmp"C:\Users\Admin\AppData\Local\Temp\9731.tmp"79⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\976F.tmp"C:\Users\Admin\AppData\Local\Temp\976F.tmp"80⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\97AD.tmp"C:\Users\Admin\AppData\Local\Temp\97AD.tmp"81⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\97EC.tmp"C:\Users\Admin\AppData\Local\Temp\97EC.tmp"82⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\982A.tmp"C:\Users\Admin\AppData\Local\Temp\982A.tmp"83⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\9869.tmp"C:\Users\Admin\AppData\Local\Temp\9869.tmp"84⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\98A7.tmp"C:\Users\Admin\AppData\Local\Temp\98A7.tmp"85⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\98E5.tmp"C:\Users\Admin\AppData\Local\Temp\98E5.tmp"86⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\9924.tmp"C:\Users\Admin\AppData\Local\Temp\9924.tmp"87⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\9962.tmp"C:\Users\Admin\AppData\Local\Temp\9962.tmp"88⤵PID:648
-
C:\Users\Admin\AppData\Local\Temp\99B0.tmp"C:\Users\Admin\AppData\Local\Temp\99B0.tmp"89⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\99EF.tmp"C:\Users\Admin\AppData\Local\Temp\99EF.tmp"90⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"91⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"92⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"93⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"94⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"95⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\9B75.tmp"C:\Users\Admin\AppData\Local\Temp\9B75.tmp"96⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"97⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\9BF1.tmp"C:\Users\Admin\AppData\Local\Temp\9BF1.tmp"98⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\9C30.tmp"C:\Users\Admin\AppData\Local\Temp\9C30.tmp"99⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\9C6E.tmp"C:\Users\Admin\AppData\Local\Temp\9C6E.tmp"100⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"101⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\9CEB.tmp"C:\Users\Admin\AppData\Local\Temp\9CEB.tmp"102⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\9D29.tmp"C:\Users\Admin\AppData\Local\Temp\9D29.tmp"103⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\9D68.tmp"C:\Users\Admin\AppData\Local\Temp\9D68.tmp"104⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\9DA6.tmp"C:\Users\Admin\AppData\Local\Temp\9DA6.tmp"105⤵PID:328
-
C:\Users\Admin\AppData\Local\Temp\9DE5.tmp"C:\Users\Admin\AppData\Local\Temp\9DE5.tmp"106⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\9E23.tmp"C:\Users\Admin\AppData\Local\Temp\9E23.tmp"107⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\9E61.tmp"C:\Users\Admin\AppData\Local\Temp\9E61.tmp"108⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\9EA0.tmp"C:\Users\Admin\AppData\Local\Temp\9EA0.tmp"109⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\9EDE.tmp"C:\Users\Admin\AppData\Local\Temp\9EDE.tmp"110⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\9F1D.tmp"C:\Users\Admin\AppData\Local\Temp\9F1D.tmp"111⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\9F5B.tmp"C:\Users\Admin\AppData\Local\Temp\9F5B.tmp"112⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\9F99.tmp"C:\Users\Admin\AppData\Local\Temp\9F99.tmp"113⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\9FD8.tmp"C:\Users\Admin\AppData\Local\Temp\9FD8.tmp"114⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\A016.tmp"C:\Users\Admin\AppData\Local\Temp\A016.tmp"115⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\A055.tmp"C:\Users\Admin\AppData\Local\Temp\A055.tmp"116⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\A093.tmp"C:\Users\Admin\AppData\Local\Temp\A093.tmp"117⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\A0D1.tmp"C:\Users\Admin\AppData\Local\Temp\A0D1.tmp"118⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\A110.tmp"C:\Users\Admin\AppData\Local\Temp\A110.tmp"119⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\A14E.tmp"C:\Users\Admin\AppData\Local\Temp\A14E.tmp"120⤵
- System Location Discovery: System Language Discovery
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\A18D.tmp"C:\Users\Admin\AppData\Local\Temp\A18D.tmp"121⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\A1CB.tmp"C:\Users\Admin\AppData\Local\Temp\A1CB.tmp"122⤵PID:2760
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-