Analysis
-
max time kernel
150s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
02/09/2024, 06:51
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-02_ae7f119a8ce072e220b5e569585afc2d_mafia.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-09-02_ae7f119a8ce072e220b5e569585afc2d_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-02_ae7f119a8ce072e220b5e569585afc2d_mafia.exe
-
Size
520KB
-
MD5
ae7f119a8ce072e220b5e569585afc2d
-
SHA1
502bbe55d5b6fd446469fcee3fb27da064d2dcde
-
SHA256
004d069b73bf30315744b834712dc11590a3197b947ba594a2efb04b6d664feb
-
SHA512
550ca246ea6ad89f107121faeda3ee758300bdec3d9cfe0cbfba2076a460257d6d941eb8a3c5cd6c627ee992aff0f7619c12285e9cd36bd9abdb347496f360c0
-
SSDEEP
6144:lLvd/XzCjUIF1UuXLyQjmOH+JjLMVFZLMHx3gC/gFpZdHPANpKFPl6xAVRACMCMd:roRXOQjmOyoCR/eSNpKtl6wRtMCxMNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1252 3256.tmp 2516 3295.tmp 2280 3331.tmp 2764 33AE.tmp 2880 341B.tmp 2760 3488.tmp 2984 34F5.tmp 2644 3543.tmp 2780 35B0.tmp 2612 361E.tmp 2736 366C.tmp 1696 36D9.tmp 2840 3736.tmp 2392 37A4.tmp 1204 3811.tmp 1092 385F.tmp 2952 38DC.tmp 2012 3958.tmp 1608 39D5.tmp 2716 3A42.tmp 2248 3ABF.tmp 2448 3B2C.tmp 2116 3B9A.tmp 1268 3BE8.tmp 1016 3C26.tmp 2596 3C64.tmp 2412 3CA3.tmp 2600 3CE1.tmp 2228 3D20.tmp 2356 3D5E.tmp 2176 3D9C.tmp 2336 3DDB.tmp 1300 3E19.tmp 1248 3E58.tmp 2296 3E96.tmp 1820 3ED4.tmp 2308 3F13.tmp 348 3F51.tmp 1196 3F90.tmp 1716 3FDE.tmp 2004 401C.tmp 760 405A.tmp 1756 4099.tmp 1436 40D7.tmp 2080 4116.tmp 1928 4164.tmp 1688 41A2.tmp 2180 41E0.tmp 1612 421F.tmp 1520 426D.tmp 868 42AB.tmp 2564 42EA.tmp 1604 4328.tmp 2332 4366.tmp 2916 43A5.tmp 1252 43E3.tmp 2516 4422.tmp 2720 4460.tmp 1212 449E.tmp 2876 44DD.tmp 2896 451B.tmp 2748 4579.tmp 2760 45C7.tmp 2784 4615.tmp -
Loads dropped DLL 64 IoCs
pid Process 3048 2024-09-02_ae7f119a8ce072e220b5e569585afc2d_mafia.exe 1252 3256.tmp 2516 3295.tmp 2280 3331.tmp 2764 33AE.tmp 2880 341B.tmp 2760 3488.tmp 2984 34F5.tmp 2644 3543.tmp 2780 35B0.tmp 2612 361E.tmp 2736 366C.tmp 1696 36D9.tmp 2840 3736.tmp 2392 37A4.tmp 1204 3811.tmp 1092 385F.tmp 2952 38DC.tmp 2012 3958.tmp 1608 39D5.tmp 2716 3A42.tmp 2248 3ABF.tmp 2448 3B2C.tmp 2116 3B9A.tmp 1268 3BE8.tmp 1016 3C26.tmp 2596 3C64.tmp 2412 3CA3.tmp 2600 3CE1.tmp 2228 3D20.tmp 2356 3D5E.tmp 2176 3D9C.tmp 2336 3DDB.tmp 1300 3E19.tmp 1248 3E58.tmp 2296 3E96.tmp 1820 3ED4.tmp 2308 3F13.tmp 348 3F51.tmp 1196 3F90.tmp 1716 3FDE.tmp 2004 401C.tmp 760 405A.tmp 1756 4099.tmp 1436 40D7.tmp 2080 4116.tmp 1928 4164.tmp 1688 41A2.tmp 2180 41E0.tmp 1612 421F.tmp 1520 426D.tmp 868 42AB.tmp 2564 42EA.tmp 1604 4328.tmp 2332 4366.tmp 2916 43A5.tmp 1252 43E3.tmp 2516 4422.tmp 2720 4460.tmp 1212 449E.tmp 2876 44DD.tmp 2896 451B.tmp 2748 4579.tmp 2760 45C7.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3295.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 675B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E772.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6893.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D88.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7629.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 164E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5409.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6393.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F42E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ABD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D72D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1362.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 822B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EC1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3048 wrote to memory of 1252 3048 2024-09-02_ae7f119a8ce072e220b5e569585afc2d_mafia.exe 29 PID 3048 wrote to memory of 1252 3048 2024-09-02_ae7f119a8ce072e220b5e569585afc2d_mafia.exe 29 PID 3048 wrote to memory of 1252 3048 2024-09-02_ae7f119a8ce072e220b5e569585afc2d_mafia.exe 29 PID 3048 wrote to memory of 1252 3048 2024-09-02_ae7f119a8ce072e220b5e569585afc2d_mafia.exe 29 PID 1252 wrote to memory of 2516 1252 3256.tmp 30 PID 1252 wrote to memory of 2516 1252 3256.tmp 30 PID 1252 wrote to memory of 2516 1252 3256.tmp 30 PID 1252 wrote to memory of 2516 1252 3256.tmp 30 PID 2516 wrote to memory of 2280 2516 3295.tmp 31 PID 2516 wrote to memory of 2280 2516 3295.tmp 31 PID 2516 wrote to memory of 2280 2516 3295.tmp 31 PID 2516 wrote to memory of 2280 2516 3295.tmp 31 PID 2280 wrote to memory of 2764 2280 3331.tmp 32 PID 2280 wrote to memory of 2764 2280 3331.tmp 32 PID 2280 wrote to memory of 2764 2280 3331.tmp 32 PID 2280 wrote to memory of 2764 2280 3331.tmp 32 PID 2764 wrote to memory of 2880 2764 33AE.tmp 33 PID 2764 wrote to memory of 2880 2764 33AE.tmp 33 PID 2764 wrote to memory of 2880 2764 33AE.tmp 33 PID 2764 wrote to memory of 2880 2764 33AE.tmp 33 PID 2880 wrote to memory of 2760 2880 341B.tmp 34 PID 2880 wrote to memory of 2760 2880 341B.tmp 34 PID 2880 wrote to memory of 2760 2880 341B.tmp 34 PID 2880 wrote to memory of 2760 2880 341B.tmp 34 PID 2760 wrote to memory of 2984 2760 3488.tmp 35 PID 2760 wrote to memory of 2984 2760 3488.tmp 35 PID 2760 wrote to memory of 2984 2760 3488.tmp 35 PID 2760 wrote to memory of 2984 2760 3488.tmp 35 PID 2984 wrote to memory of 2644 2984 34F5.tmp 36 PID 2984 wrote to memory of 2644 2984 34F5.tmp 36 PID 2984 wrote to memory of 2644 2984 34F5.tmp 36 PID 2984 wrote to memory of 2644 2984 34F5.tmp 36 PID 2644 wrote to memory of 2780 2644 3543.tmp 37 PID 2644 wrote to memory of 2780 2644 3543.tmp 37 PID 2644 wrote to memory of 2780 2644 3543.tmp 37 PID 2644 wrote to memory of 2780 2644 3543.tmp 37 PID 2780 wrote to memory of 2612 2780 35B0.tmp 38 PID 2780 wrote to memory of 2612 2780 35B0.tmp 38 PID 2780 wrote to memory of 2612 2780 35B0.tmp 38 PID 2780 wrote to memory of 2612 2780 35B0.tmp 38 PID 2612 wrote to memory of 2736 2612 361E.tmp 39 PID 2612 wrote to memory of 2736 2612 361E.tmp 39 PID 2612 wrote to memory of 2736 2612 361E.tmp 39 PID 2612 wrote to memory of 2736 2612 361E.tmp 39 PID 2736 wrote to memory of 1696 2736 366C.tmp 40 PID 2736 wrote to memory of 1696 2736 366C.tmp 40 PID 2736 wrote to memory of 1696 2736 366C.tmp 40 PID 2736 wrote to memory of 1696 2736 366C.tmp 40 PID 1696 wrote to memory of 2840 1696 36D9.tmp 41 PID 1696 wrote to memory of 2840 1696 36D9.tmp 41 PID 1696 wrote to memory of 2840 1696 36D9.tmp 41 PID 1696 wrote to memory of 2840 1696 36D9.tmp 41 PID 2840 wrote to memory of 2392 2840 3736.tmp 42 PID 2840 wrote to memory of 2392 2840 3736.tmp 42 PID 2840 wrote to memory of 2392 2840 3736.tmp 42 PID 2840 wrote to memory of 2392 2840 3736.tmp 42 PID 2392 wrote to memory of 1204 2392 37A4.tmp 43 PID 2392 wrote to memory of 1204 2392 37A4.tmp 43 PID 2392 wrote to memory of 1204 2392 37A4.tmp 43 PID 2392 wrote to memory of 1204 2392 37A4.tmp 43 PID 1204 wrote to memory of 1092 1204 3811.tmp 44 PID 1204 wrote to memory of 1092 1204 3811.tmp 44 PID 1204 wrote to memory of 1092 1204 3811.tmp 44 PID 1204 wrote to memory of 1092 1204 3811.tmp 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-02_ae7f119a8ce072e220b5e569585afc2d_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-02_ae7f119a8ce072e220b5e569585afc2d_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\3295.tmp"C:\Users\Admin\AppData\Local\Temp\3295.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\3331.tmp"C:\Users\Admin\AppData\Local\Temp\3331.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\33AE.tmp"C:\Users\Admin\AppData\Local\Temp\33AE.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\341B.tmp"C:\Users\Admin\AppData\Local\Temp\341B.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\34F5.tmp"C:\Users\Admin\AppData\Local\Temp\34F5.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\3543.tmp"C:\Users\Admin\AppData\Local\Temp\3543.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\35B0.tmp"C:\Users\Admin\AppData\Local\Temp\35B0.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\361E.tmp"C:\Users\Admin\AppData\Local\Temp\361E.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\366C.tmp"C:\Users\Admin\AppData\Local\Temp\366C.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\36D9.tmp"C:\Users\Admin\AppData\Local\Temp\36D9.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\3736.tmp"C:\Users\Admin\AppData\Local\Temp\3736.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\37A4.tmp"C:\Users\Admin\AppData\Local\Temp\37A4.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\3811.tmp"C:\Users\Admin\AppData\Local\Temp\3811.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\385F.tmp"C:\Users\Admin\AppData\Local\Temp\385F.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\38DC.tmp"C:\Users\Admin\AppData\Local\Temp\38DC.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\3958.tmp"C:\Users\Admin\AppData\Local\Temp\3958.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\39D5.tmp"C:\Users\Admin\AppData\Local\Temp\39D5.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\3A42.tmp"C:\Users\Admin\AppData\Local\Temp\3A42.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\3ABF.tmp"C:\Users\Admin\AppData\Local\Temp\3ABF.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\3B2C.tmp"C:\Users\Admin\AppData\Local\Temp\3B2C.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\3B9A.tmp"C:\Users\Admin\AppData\Local\Temp\3B9A.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\3BE8.tmp"C:\Users\Admin\AppData\Local\Temp\3BE8.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\3C26.tmp"C:\Users\Admin\AppData\Local\Temp\3C26.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\3C64.tmp"C:\Users\Admin\AppData\Local\Temp\3C64.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\3CA3.tmp"C:\Users\Admin\AppData\Local\Temp\3CA3.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\3CE1.tmp"C:\Users\Admin\AppData\Local\Temp\3CE1.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\3D20.tmp"C:\Users\Admin\AppData\Local\Temp\3D20.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\3D5E.tmp"C:\Users\Admin\AppData\Local\Temp\3D5E.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\3DDB.tmp"C:\Users\Admin\AppData\Local\Temp\3DDB.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\3E19.tmp"C:\Users\Admin\AppData\Local\Temp\3E19.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\3E58.tmp"C:\Users\Admin\AppData\Local\Temp\3E58.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\3E96.tmp"C:\Users\Admin\AppData\Local\Temp\3E96.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\3ED4.tmp"C:\Users\Admin\AppData\Local\Temp\3ED4.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\3F13.tmp"C:\Users\Admin\AppData\Local\Temp\3F13.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\3F51.tmp"C:\Users\Admin\AppData\Local\Temp\3F51.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:348 -
C:\Users\Admin\AppData\Local\Temp\3F90.tmp"C:\Users\Admin\AppData\Local\Temp\3F90.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\3FDE.tmp"C:\Users\Admin\AppData\Local\Temp\3FDE.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\401C.tmp"C:\Users\Admin\AppData\Local\Temp\401C.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\405A.tmp"C:\Users\Admin\AppData\Local\Temp\405A.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:760 -
C:\Users\Admin\AppData\Local\Temp\4099.tmp"C:\Users\Admin\AppData\Local\Temp\4099.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\40D7.tmp"C:\Users\Admin\AppData\Local\Temp\40D7.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\4116.tmp"C:\Users\Admin\AppData\Local\Temp\4116.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\4164.tmp"C:\Users\Admin\AppData\Local\Temp\4164.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\41A2.tmp"C:\Users\Admin\AppData\Local\Temp\41A2.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\41E0.tmp"C:\Users\Admin\AppData\Local\Temp\41E0.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\421F.tmp"C:\Users\Admin\AppData\Local\Temp\421F.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\426D.tmp"C:\Users\Admin\AppData\Local\Temp\426D.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\42AB.tmp"C:\Users\Admin\AppData\Local\Temp\42AB.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:868 -
C:\Users\Admin\AppData\Local\Temp\42EA.tmp"C:\Users\Admin\AppData\Local\Temp\42EA.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\4328.tmp"C:\Users\Admin\AppData\Local\Temp\4328.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\4366.tmp"C:\Users\Admin\AppData\Local\Temp\4366.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\43A5.tmp"C:\Users\Admin\AppData\Local\Temp\43A5.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\43E3.tmp"C:\Users\Admin\AppData\Local\Temp\43E3.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\4422.tmp"C:\Users\Admin\AppData\Local\Temp\4422.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\4460.tmp"C:\Users\Admin\AppData\Local\Temp\4460.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\449E.tmp"C:\Users\Admin\AppData\Local\Temp\449E.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\44DD.tmp"C:\Users\Admin\AppData\Local\Temp\44DD.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\451B.tmp"C:\Users\Admin\AppData\Local\Temp\451B.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\4579.tmp"C:\Users\Admin\AppData\Local\Temp\4579.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\45C7.tmp"C:\Users\Admin\AppData\Local\Temp\45C7.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\4615.tmp"C:\Users\Admin\AppData\Local\Temp\4615.tmp"65⤵
- Executes dropped EXE
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\4653.tmp"C:\Users\Admin\AppData\Local\Temp\4653.tmp"66⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\4692.tmp"C:\Users\Admin\AppData\Local\Temp\4692.tmp"67⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\46D0.tmp"C:\Users\Admin\AppData\Local\Temp\46D0.tmp"68⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\471E.tmp"C:\Users\Admin\AppData\Local\Temp\471E.tmp"69⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\475C.tmp"C:\Users\Admin\AppData\Local\Temp\475C.tmp"70⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\47AA.tmp"C:\Users\Admin\AppData\Local\Temp\47AA.tmp"71⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\47E9.tmp"C:\Users\Admin\AppData\Local\Temp\47E9.tmp"72⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\4837.tmp"C:\Users\Admin\AppData\Local\Temp\4837.tmp"73⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\4875.tmp"C:\Users\Admin\AppData\Local\Temp\4875.tmp"74⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\48C3.tmp"C:\Users\Admin\AppData\Local\Temp\48C3.tmp"75⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\4902.tmp"C:\Users\Admin\AppData\Local\Temp\4902.tmp"76⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\4940.tmp"C:\Users\Admin\AppData\Local\Temp\4940.tmp"77⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\497E.tmp"C:\Users\Admin\AppData\Local\Temp\497E.tmp"78⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\49CC.tmp"C:\Users\Admin\AppData\Local\Temp\49CC.tmp"79⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\4A0B.tmp"C:\Users\Admin\AppData\Local\Temp\4A0B.tmp"80⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\4A49.tmp"C:\Users\Admin\AppData\Local\Temp\4A49.tmp"81⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\4A88.tmp"C:\Users\Admin\AppData\Local\Temp\4A88.tmp"82⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\4AC6.tmp"C:\Users\Admin\AppData\Local\Temp\4AC6.tmp"83⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\4B04.tmp"C:\Users\Admin\AppData\Local\Temp\4B04.tmp"84⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\4B43.tmp"C:\Users\Admin\AppData\Local\Temp\4B43.tmp"85⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\4B91.tmp"C:\Users\Admin\AppData\Local\Temp\4B91.tmp"86⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\4BDF.tmp"C:\Users\Admin\AppData\Local\Temp\4BDF.tmp"87⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\4C1D.tmp"C:\Users\Admin\AppData\Local\Temp\4C1D.tmp"88⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\4C5C.tmp"C:\Users\Admin\AppData\Local\Temp\4C5C.tmp"89⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\4C9A.tmp"C:\Users\Admin\AppData\Local\Temp\4C9A.tmp"90⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\4CD9.tmp"C:\Users\Admin\AppData\Local\Temp\4CD9.tmp"91⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\4D17.tmp"C:\Users\Admin\AppData\Local\Temp\4D17.tmp"92⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"93⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\4D94.tmp"C:\Users\Admin\AppData\Local\Temp\4D94.tmp"94⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"95⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\4E11.tmp"C:\Users\Admin\AppData\Local\Temp\4E11.tmp"96⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"97⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"98⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"99⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"100⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"101⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"102⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\4FC5.tmp"C:\Users\Admin\AppData\Local\Temp\4FC5.tmp"103⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"104⤵PID:276
-
C:\Users\Admin\AppData\Local\Temp\5042.tmp"C:\Users\Admin\AppData\Local\Temp\5042.tmp"105⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\5081.tmp"C:\Users\Admin\AppData\Local\Temp\5081.tmp"106⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\50BF.tmp"C:\Users\Admin\AppData\Local\Temp\50BF.tmp"107⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\50FD.tmp"C:\Users\Admin\AppData\Local\Temp\50FD.tmp"108⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\514B.tmp"C:\Users\Admin\AppData\Local\Temp\514B.tmp"109⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\518A.tmp"C:\Users\Admin\AppData\Local\Temp\518A.tmp"110⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\51C8.tmp"C:\Users\Admin\AppData\Local\Temp\51C8.tmp"111⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\5207.tmp"C:\Users\Admin\AppData\Local\Temp\5207.tmp"112⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\5245.tmp"C:\Users\Admin\AppData\Local\Temp\5245.tmp"113⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\5283.tmp"C:\Users\Admin\AppData\Local\Temp\5283.tmp"114⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\52C2.tmp"C:\Users\Admin\AppData\Local\Temp\52C2.tmp"115⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\5300.tmp"C:\Users\Admin\AppData\Local\Temp\5300.tmp"116⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\533F.tmp"C:\Users\Admin\AppData\Local\Temp\533F.tmp"117⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\537D.tmp"C:\Users\Admin\AppData\Local\Temp\537D.tmp"118⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\53CB.tmp"C:\Users\Admin\AppData\Local\Temp\53CB.tmp"119⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\5409.tmp"C:\Users\Admin\AppData\Local\Temp\5409.tmp"120⤵
- System Location Discovery: System Language Discovery
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\5448.tmp"C:\Users\Admin\AppData\Local\Temp\5448.tmp"121⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\5486.tmp"C:\Users\Admin\AppData\Local\Temp\5486.tmp"122⤵PID:2224
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-