Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/09/2024, 12:24
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-03_1a40f58307acadd6f9391c86d23dc4f4_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-03_1a40f58307acadd6f9391c86d23dc4f4_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-03_1a40f58307acadd6f9391c86d23dc4f4_mafia.exe
-
Size
486KB
-
MD5
1a40f58307acadd6f9391c86d23dc4f4
-
SHA1
1d62d9f14606b4f215a02df2e24ceb3710d05221
-
SHA256
767b1db01d5411cbd08c1db5615f3680feb7755b294f3d38f3c6862c8873f121
-
SHA512
97f9a06566022bab0c4701f6a30ec3e6ddb523dd0bfa4c0d53aa52dbe93811521d1076a900501462c20e5549e61c95a02703971514de225eaab1272bcaab94b4
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7HN6nOVMChP8OodAstC7L85fgwjVnx8YpKsHT:/U5rCOTeiDtMoMnKLAfBjVnx7NZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2356 8630.tmp 1264 86AD.tmp 2380 871A.tmp 2192 8797.tmp 2752 8814.tmp 2892 8891.tmp 2712 88FE.tmp 864 897B.tmp 2808 8A07.tmp 2648 8A84.tmp 2600 8AF1.tmp 2728 8B5E.tmp 2124 8BCB.tmp 1912 8C39.tmp 660 8C87.tmp 852 8CF4.tmp 2420 8D61.tmp 1280 8DDE.tmp 2008 8E4B.tmp 2012 8EC8.tmp 1312 8F35.tmp 1608 8FC1.tmp 1148 902F.tmp 2968 907D.tmp 2428 90CB.tmp 680 9119.tmp 2588 9157.tmp 2392 91A5.tmp 1076 91E3.tmp 2444 9231.tmp 1792 927F.tmp 1072 92CD.tmp 2460 930C.tmp 692 935A.tmp 960 93B7.tmp 928 93F6.tmp 2928 9444.tmp 1372 9492.tmp 1760 94D0.tmp 2252 951E.tmp 300 956C.tmp 1008 95BA.tmp 2468 9608.tmp 3044 9647.tmp 2988 9685.tmp 2568 96D3.tmp 2052 9711.tmp 1728 9750.tmp 2272 979E.tmp 1840 97DC.tmp 1648 981B.tmp 2268 9869.tmp 1604 98A7.tmp 1704 98F5.tmp 2524 9953.tmp 2572 99A1.tmp 1688 99DF.tmp 2792 9A2D.tmp 1052 9A6B.tmp 2376 9AAA.tmp 2848 9AE8.tmp 2752 9B36.tmp 2880 9B75.tmp 2312 9BB3.tmp -
Loads dropped DLL 64 IoCs
pid Process 2100 2024-09-03_1a40f58307acadd6f9391c86d23dc4f4_mafia.exe 2356 8630.tmp 1264 86AD.tmp 2380 871A.tmp 2192 8797.tmp 2752 8814.tmp 2892 8891.tmp 2712 88FE.tmp 864 897B.tmp 2808 8A07.tmp 2648 8A84.tmp 2600 8AF1.tmp 2728 8B5E.tmp 2124 8BCB.tmp 1912 8C39.tmp 660 8C87.tmp 852 8CF4.tmp 2420 8D61.tmp 1280 8DDE.tmp 2008 8E4B.tmp 2012 8EC8.tmp 1312 8F35.tmp 1608 8FC1.tmp 1148 902F.tmp 2968 907D.tmp 2428 90CB.tmp 680 9119.tmp 2588 9157.tmp 2392 91A5.tmp 1076 91E3.tmp 2444 9231.tmp 1792 927F.tmp 1072 92CD.tmp 2460 930C.tmp 692 935A.tmp 960 93B7.tmp 928 93F6.tmp 2928 9444.tmp 1372 9492.tmp 1760 94D0.tmp 2252 951E.tmp 300 956C.tmp 1008 95BA.tmp 2468 9608.tmp 3044 9647.tmp 2988 9685.tmp 2568 96D3.tmp 2052 9711.tmp 1728 9750.tmp 2272 979E.tmp 1840 97DC.tmp 1648 981B.tmp 2268 9869.tmp 1604 98A7.tmp 1704 98F5.tmp 2524 9953.tmp 2572 99A1.tmp 1688 99DF.tmp 2792 9A2D.tmp 1052 9A6B.tmp 2376 9AAA.tmp 2848 9AE8.tmp 2752 9B36.tmp 2880 9B75.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F58.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B48.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 902F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C64B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4808.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4099.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A728.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2100 wrote to memory of 2356 2100 2024-09-03_1a40f58307acadd6f9391c86d23dc4f4_mafia.exe 30 PID 2100 wrote to memory of 2356 2100 2024-09-03_1a40f58307acadd6f9391c86d23dc4f4_mafia.exe 30 PID 2100 wrote to memory of 2356 2100 2024-09-03_1a40f58307acadd6f9391c86d23dc4f4_mafia.exe 30 PID 2100 wrote to memory of 2356 2100 2024-09-03_1a40f58307acadd6f9391c86d23dc4f4_mafia.exe 30 PID 2356 wrote to memory of 1264 2356 8630.tmp 31 PID 2356 wrote to memory of 1264 2356 8630.tmp 31 PID 2356 wrote to memory of 1264 2356 8630.tmp 31 PID 2356 wrote to memory of 1264 2356 8630.tmp 31 PID 1264 wrote to memory of 2380 1264 86AD.tmp 32 PID 1264 wrote to memory of 2380 1264 86AD.tmp 32 PID 1264 wrote to memory of 2380 1264 86AD.tmp 32 PID 1264 wrote to memory of 2380 1264 86AD.tmp 32 PID 2380 wrote to memory of 2192 2380 871A.tmp 33 PID 2380 wrote to memory of 2192 2380 871A.tmp 33 PID 2380 wrote to memory of 2192 2380 871A.tmp 33 PID 2380 wrote to memory of 2192 2380 871A.tmp 33 PID 2192 wrote to memory of 2752 2192 8797.tmp 34 PID 2192 wrote to memory of 2752 2192 8797.tmp 34 PID 2192 wrote to memory of 2752 2192 8797.tmp 34 PID 2192 wrote to memory of 2752 2192 8797.tmp 34 PID 2752 wrote to memory of 2892 2752 8814.tmp 35 PID 2752 wrote to memory of 2892 2752 8814.tmp 35 PID 2752 wrote to memory of 2892 2752 8814.tmp 35 PID 2752 wrote to memory of 2892 2752 8814.tmp 35 PID 2892 wrote to memory of 2712 2892 8891.tmp 36 PID 2892 wrote to memory of 2712 2892 8891.tmp 36 PID 2892 wrote to memory of 2712 2892 8891.tmp 36 PID 2892 wrote to memory of 2712 2892 8891.tmp 36 PID 2712 wrote to memory of 864 2712 88FE.tmp 37 PID 2712 wrote to memory of 864 2712 88FE.tmp 37 PID 2712 wrote to memory of 864 2712 88FE.tmp 37 PID 2712 wrote to memory of 864 2712 88FE.tmp 37 PID 864 wrote to memory of 2808 864 897B.tmp 38 PID 864 wrote to memory of 2808 864 897B.tmp 38 PID 864 wrote to memory of 2808 864 897B.tmp 38 PID 864 wrote to memory of 2808 864 897B.tmp 38 PID 2808 wrote to memory of 2648 2808 8A07.tmp 39 PID 2808 wrote to memory of 2648 2808 8A07.tmp 39 PID 2808 wrote to memory of 2648 2808 8A07.tmp 39 PID 2808 wrote to memory of 2648 2808 8A07.tmp 39 PID 2648 wrote to memory of 2600 2648 8A84.tmp 40 PID 2648 wrote to memory of 2600 2648 8A84.tmp 40 PID 2648 wrote to memory of 2600 2648 8A84.tmp 40 PID 2648 wrote to memory of 2600 2648 8A84.tmp 40 PID 2600 wrote to memory of 2728 2600 8AF1.tmp 41 PID 2600 wrote to memory of 2728 2600 8AF1.tmp 41 PID 2600 wrote to memory of 2728 2600 8AF1.tmp 41 PID 2600 wrote to memory of 2728 2600 8AF1.tmp 41 PID 2728 wrote to memory of 2124 2728 8B5E.tmp 42 PID 2728 wrote to memory of 2124 2728 8B5E.tmp 42 PID 2728 wrote to memory of 2124 2728 8B5E.tmp 42 PID 2728 wrote to memory of 2124 2728 8B5E.tmp 42 PID 2124 wrote to memory of 1912 2124 8BCB.tmp 43 PID 2124 wrote to memory of 1912 2124 8BCB.tmp 43 PID 2124 wrote to memory of 1912 2124 8BCB.tmp 43 PID 2124 wrote to memory of 1912 2124 8BCB.tmp 43 PID 1912 wrote to memory of 660 1912 8C39.tmp 44 PID 1912 wrote to memory of 660 1912 8C39.tmp 44 PID 1912 wrote to memory of 660 1912 8C39.tmp 44 PID 1912 wrote to memory of 660 1912 8C39.tmp 44 PID 660 wrote to memory of 852 660 8C87.tmp 45 PID 660 wrote to memory of 852 660 8C87.tmp 45 PID 660 wrote to memory of 852 660 8C87.tmp 45 PID 660 wrote to memory of 852 660 8C87.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-03_1a40f58307acadd6f9391c86d23dc4f4_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-03_1a40f58307acadd6f9391c86d23dc4f4_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\8630.tmp"C:\Users\Admin\AppData\Local\Temp\8630.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\86AD.tmp"C:\Users\Admin\AppData\Local\Temp\86AD.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\871A.tmp"C:\Users\Admin\AppData\Local\Temp\871A.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\8797.tmp"C:\Users\Admin\AppData\Local\Temp\8797.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\8814.tmp"C:\Users\Admin\AppData\Local\Temp\8814.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\8891.tmp"C:\Users\Admin\AppData\Local\Temp\8891.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\88FE.tmp"C:\Users\Admin\AppData\Local\Temp\88FE.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\897B.tmp"C:\Users\Admin\AppData\Local\Temp\897B.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\AppData\Local\Temp\8A07.tmp"C:\Users\Admin\AppData\Local\Temp\8A07.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\8A84.tmp"C:\Users\Admin\AppData\Local\Temp\8A84.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\8AF1.tmp"C:\Users\Admin\AppData\Local\Temp\8AF1.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\8B5E.tmp"C:\Users\Admin\AppData\Local\Temp\8B5E.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\8BCB.tmp"C:\Users\Admin\AppData\Local\Temp\8BCB.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\8C39.tmp"C:\Users\Admin\AppData\Local\Temp\8C39.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\8C87.tmp"C:\Users\Admin\AppData\Local\Temp\8C87.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:660 -
C:\Users\Admin\AppData\Local\Temp\8CF4.tmp"C:\Users\Admin\AppData\Local\Temp\8CF4.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:852 -
C:\Users\Admin\AppData\Local\Temp\8D61.tmp"C:\Users\Admin\AppData\Local\Temp\8D61.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\8DDE.tmp"C:\Users\Admin\AppData\Local\Temp\8DDE.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\8E4B.tmp"C:\Users\Admin\AppData\Local\Temp\8E4B.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\8EC8.tmp"C:\Users\Admin\AppData\Local\Temp\8EC8.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\8F35.tmp"C:\Users\Admin\AppData\Local\Temp\8F35.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\8FC1.tmp"C:\Users\Admin\AppData\Local\Temp\8FC1.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\902F.tmp"C:\Users\Admin\AppData\Local\Temp\902F.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\907D.tmp"C:\Users\Admin\AppData\Local\Temp\907D.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\90CB.tmp"C:\Users\Admin\AppData\Local\Temp\90CB.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\9119.tmp"C:\Users\Admin\AppData\Local\Temp\9119.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:680 -
C:\Users\Admin\AppData\Local\Temp\9157.tmp"C:\Users\Admin\AppData\Local\Temp\9157.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\91A5.tmp"C:\Users\Admin\AppData\Local\Temp\91A5.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\91E3.tmp"C:\Users\Admin\AppData\Local\Temp\91E3.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\9231.tmp"C:\Users\Admin\AppData\Local\Temp\9231.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\927F.tmp"C:\Users\Admin\AppData\Local\Temp\927F.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\92CD.tmp"C:\Users\Admin\AppData\Local\Temp\92CD.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\930C.tmp"C:\Users\Admin\AppData\Local\Temp\930C.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\935A.tmp"C:\Users\Admin\AppData\Local\Temp\935A.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:692 -
C:\Users\Admin\AppData\Local\Temp\93B7.tmp"C:\Users\Admin\AppData\Local\Temp\93B7.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:960 -
C:\Users\Admin\AppData\Local\Temp\93F6.tmp"C:\Users\Admin\AppData\Local\Temp\93F6.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:928 -
C:\Users\Admin\AppData\Local\Temp\9444.tmp"C:\Users\Admin\AppData\Local\Temp\9444.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\9492.tmp"C:\Users\Admin\AppData\Local\Temp\9492.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\94D0.tmp"C:\Users\Admin\AppData\Local\Temp\94D0.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\951E.tmp"C:\Users\Admin\AppData\Local\Temp\951E.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\956C.tmp"C:\Users\Admin\AppData\Local\Temp\956C.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:300 -
C:\Users\Admin\AppData\Local\Temp\95BA.tmp"C:\Users\Admin\AppData\Local\Temp\95BA.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\9608.tmp"C:\Users\Admin\AppData\Local\Temp\9608.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\9647.tmp"C:\Users\Admin\AppData\Local\Temp\9647.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\9685.tmp"C:\Users\Admin\AppData\Local\Temp\9685.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\96D3.tmp"C:\Users\Admin\AppData\Local\Temp\96D3.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\9711.tmp"C:\Users\Admin\AppData\Local\Temp\9711.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\9750.tmp"C:\Users\Admin\AppData\Local\Temp\9750.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\979E.tmp"C:\Users\Admin\AppData\Local\Temp\979E.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\97DC.tmp"C:\Users\Admin\AppData\Local\Temp\97DC.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\981B.tmp"C:\Users\Admin\AppData\Local\Temp\981B.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\9869.tmp"C:\Users\Admin\AppData\Local\Temp\9869.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\98A7.tmp"C:\Users\Admin\AppData\Local\Temp\98A7.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\98F5.tmp"C:\Users\Admin\AppData\Local\Temp\98F5.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\9953.tmp"C:\Users\Admin\AppData\Local\Temp\9953.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\99A1.tmp"C:\Users\Admin\AppData\Local\Temp\99A1.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\99DF.tmp"C:\Users\Admin\AppData\Local\Temp\99DF.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\9B75.tmp"C:\Users\Admin\AppData\Local\Temp\9B75.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"65⤵
- Executes dropped EXE
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\9BF1.tmp"C:\Users\Admin\AppData\Local\Temp\9BF1.tmp"66⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\9C3F.tmp"C:\Users\Admin\AppData\Local\Temp\9C3F.tmp"67⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\9C8D.tmp"C:\Users\Admin\AppData\Local\Temp\9C8D.tmp"68⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"69⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\9D0A.tmp"C:\Users\Admin\AppData\Local\Temp\9D0A.tmp"70⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\9D58.tmp"C:\Users\Admin\AppData\Local\Temp\9D58.tmp"71⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\9D97.tmp"C:\Users\Admin\AppData\Local\Temp\9D97.tmp"72⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\9DE5.tmp"C:\Users\Admin\AppData\Local\Temp\9DE5.tmp"73⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\9E23.tmp"C:\Users\Admin\AppData\Local\Temp\9E23.tmp"74⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\9E61.tmp"C:\Users\Admin\AppData\Local\Temp\9E61.tmp"75⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\9EA0.tmp"C:\Users\Admin\AppData\Local\Temp\9EA0.tmp"76⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\9EDE.tmp"C:\Users\Admin\AppData\Local\Temp\9EDE.tmp"77⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\9F1D.tmp"C:\Users\Admin\AppData\Local\Temp\9F1D.tmp"78⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\9F5B.tmp"C:\Users\Admin\AppData\Local\Temp\9F5B.tmp"79⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\9F99.tmp"C:\Users\Admin\AppData\Local\Temp\9F99.tmp"80⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\9FD8.tmp"C:\Users\Admin\AppData\Local\Temp\9FD8.tmp"81⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\A016.tmp"C:\Users\Admin\AppData\Local\Temp\A016.tmp"82⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\A055.tmp"C:\Users\Admin\AppData\Local\Temp\A055.tmp"83⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\A093.tmp"C:\Users\Admin\AppData\Local\Temp\A093.tmp"84⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\A0D1.tmp"C:\Users\Admin\AppData\Local\Temp\A0D1.tmp"85⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\A110.tmp"C:\Users\Admin\AppData\Local\Temp\A110.tmp"86⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\A14E.tmp"C:\Users\Admin\AppData\Local\Temp\A14E.tmp"87⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\A18D.tmp"C:\Users\Admin\AppData\Local\Temp\A18D.tmp"88⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\A1DB.tmp"C:\Users\Admin\AppData\Local\Temp\A1DB.tmp"89⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\A229.tmp"C:\Users\Admin\AppData\Local\Temp\A229.tmp"90⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\A267.tmp"C:\Users\Admin\AppData\Local\Temp\A267.tmp"91⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\A2A5.tmp"C:\Users\Admin\AppData\Local\Temp\A2A5.tmp"92⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\A2E4.tmp"C:\Users\Admin\AppData\Local\Temp\A2E4.tmp"93⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\A332.tmp"C:\Users\Admin\AppData\Local\Temp\A332.tmp"94⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\A370.tmp"C:\Users\Admin\AppData\Local\Temp\A370.tmp"95⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\A3AF.tmp"C:\Users\Admin\AppData\Local\Temp\A3AF.tmp"96⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\A3FD.tmp"C:\Users\Admin\AppData\Local\Temp\A3FD.tmp"97⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\A43B.tmp"C:\Users\Admin\AppData\Local\Temp\A43B.tmp"98⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\A479.tmp"C:\Users\Admin\AppData\Local\Temp\A479.tmp"99⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\A4B8.tmp"C:\Users\Admin\AppData\Local\Temp\A4B8.tmp"100⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\A4F6.tmp"C:\Users\Admin\AppData\Local\Temp\A4F6.tmp"101⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\A535.tmp"C:\Users\Admin\AppData\Local\Temp\A535.tmp"102⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\A583.tmp"C:\Users\Admin\AppData\Local\Temp\A583.tmp"103⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\A5C1.tmp"C:\Users\Admin\AppData\Local\Temp\A5C1.tmp"104⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\A60F.tmp"C:\Users\Admin\AppData\Local\Temp\A60F.tmp"105⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\A65D.tmp"C:\Users\Admin\AppData\Local\Temp\A65D.tmp"106⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\A69B.tmp"C:\Users\Admin\AppData\Local\Temp\A69B.tmp"107⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\A6DA.tmp"C:\Users\Admin\AppData\Local\Temp\A6DA.tmp"108⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\A728.tmp"C:\Users\Admin\AppData\Local\Temp\A728.tmp"109⤵
- System Location Discovery: System Language Discovery
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\A766.tmp"C:\Users\Admin\AppData\Local\Temp\A766.tmp"110⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\A7B4.tmp"C:\Users\Admin\AppData\Local\Temp\A7B4.tmp"111⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\A7F3.tmp"C:\Users\Admin\AppData\Local\Temp\A7F3.tmp"112⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\A831.tmp"C:\Users\Admin\AppData\Local\Temp\A831.tmp"113⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\A86F.tmp"C:\Users\Admin\AppData\Local\Temp\A86F.tmp"114⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\A8AE.tmp"C:\Users\Admin\AppData\Local\Temp\A8AE.tmp"115⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\A8EC.tmp"C:\Users\Admin\AppData\Local\Temp\A8EC.tmp"116⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\A92B.tmp"C:\Users\Admin\AppData\Local\Temp\A92B.tmp"117⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\A988.tmp"C:\Users\Admin\AppData\Local\Temp\A988.tmp"118⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\A9D6.tmp"C:\Users\Admin\AppData\Local\Temp\A9D6.tmp"119⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\AA15.tmp"C:\Users\Admin\AppData\Local\Temp\AA15.tmp"120⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\AA63.tmp"C:\Users\Admin\AppData\Local\Temp\AA63.tmp"121⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\AAB1.tmp"C:\Users\Admin\AppData\Local\Temp\AAB1.tmp"122⤵PID:2920
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-