Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
08/09/2024, 14:04
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-08_fc2d18284b508bf7a30a4d29541e499b_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-09-08_fc2d18284b508bf7a30a4d29541e499b_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-08_fc2d18284b508bf7a30a4d29541e499b_mafia.exe
-
Size
765KB
-
MD5
fc2d18284b508bf7a30a4d29541e499b
-
SHA1
e550188988b58c9a3aedf918bdc1b22f1f3ed2e8
-
SHA256
9b1220b4a20195c681d9a28caa75079e252937d66f16bf6927cd59137010f4ff
-
SHA512
b06933e16fa02b46c61b03285c9ee1fc3296e30453722d4500e4650e4d1247096cfbf098d9470a5c6363a3a3ae4dde9939ce86d196f9cb9ae09e3c4f4202db81
-
SSDEEP
12288:ZU5rCOTeiDKvbMpiWD9vWID3tek5mRqDI3ZF5rn5rLOa54U5w5A:ZUQOJDKIXWi3JkoI3vh5Oa+UOS
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2788 741.tmp 2708 78F.tmp 2672 81C.tmp 2876 898.tmp 2692 915.tmp 2560 9A2.tmp 2632 9FF.tmp 2236 A6C.tmp 2136 AE9.tmp 1476 B66.tmp 1064 BE3.tmp 1452 C50.tmp 2540 CCD.tmp 1884 D3A.tmp 2840 DA7.tmp 2888 E05.tmp 2468 E53.tmp 2372 EC0.tmp 1788 F2D.tmp 320 FAA.tmp 1564 1008.tmp 2452 1056.tmp 1708 10A4.tmp 2140 10F2.tmp 2480 1140.tmp 2084 117E.tmp 1312 11CC.tmp 2900 121A.tmp 2912 1258.tmp 1940 1297.tmp 1604 12E5.tmp 940 1323.tmp 1060 1371.tmp 924 13CF.tmp 1020 141D.tmp 1520 145B.tmp 1916 149A.tmp 2348 14D8.tmp 560 1526.tmp 1868 1564.tmp 1496 15A3.tmp 2256 15E1.tmp 1072 1620.tmp 2288 165E.tmp 2488 169C.tmp 1892 16DB.tmp 1744 1719.tmp 2984 1758.tmp 772 1796.tmp 2952 17D4.tmp 2304 1813.tmp 1592 1851.tmp 1628 189F.tmp 2772 18DE.tmp 2688 191C.tmp 2680 195A.tmp 2836 1999.tmp 2672 19D7.tmp 2668 1A16.tmp 2804 1A54.tmp 2720 1A92.tmp 2552 1AD1.tmp 3036 1B2E.tmp 2628 1B8C.tmp -
Loads dropped DLL 64 IoCs
pid Process 2116 2024-09-08_fc2d18284b508bf7a30a4d29541e499b_mafia.exe 2788 741.tmp 2708 78F.tmp 2672 81C.tmp 2876 898.tmp 2692 915.tmp 2560 9A2.tmp 2632 9FF.tmp 2236 A6C.tmp 2136 AE9.tmp 1476 B66.tmp 1064 BE3.tmp 1452 C50.tmp 2540 CCD.tmp 1884 D3A.tmp 2840 DA7.tmp 2888 E05.tmp 2468 E53.tmp 2372 EC0.tmp 1788 F2D.tmp 320 FAA.tmp 1564 1008.tmp 2452 1056.tmp 1708 10A4.tmp 2140 10F2.tmp 2480 1140.tmp 2084 117E.tmp 1312 11CC.tmp 2900 121A.tmp 2912 1258.tmp 1940 1297.tmp 1604 12E5.tmp 940 1323.tmp 1060 1371.tmp 924 13CF.tmp 1020 141D.tmp 1520 145B.tmp 1916 149A.tmp 2348 14D8.tmp 560 1526.tmp 1868 1564.tmp 1496 15A3.tmp 2256 15E1.tmp 1072 1620.tmp 2288 165E.tmp 2488 169C.tmp 1892 16DB.tmp 1744 1719.tmp 2984 1758.tmp 772 1796.tmp 2952 17D4.tmp 2304 1813.tmp 1592 1851.tmp 1628 189F.tmp 2772 18DE.tmp 2688 191C.tmp 2680 195A.tmp 2836 1999.tmp 2672 19D7.tmp 2668 1A16.tmp 2804 1A54.tmp 2720 1A92.tmp 2552 1AD1.tmp 3036 1B2E.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4672.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2730.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7291.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B24.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5725.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9FC8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D47E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C810.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7993.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA48.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DDE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A110.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A43B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6854.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9492.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9AD9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2116 wrote to memory of 2788 2116 2024-09-08_fc2d18284b508bf7a30a4d29541e499b_mafia.exe 30 PID 2116 wrote to memory of 2788 2116 2024-09-08_fc2d18284b508bf7a30a4d29541e499b_mafia.exe 30 PID 2116 wrote to memory of 2788 2116 2024-09-08_fc2d18284b508bf7a30a4d29541e499b_mafia.exe 30 PID 2116 wrote to memory of 2788 2116 2024-09-08_fc2d18284b508bf7a30a4d29541e499b_mafia.exe 30 PID 2788 wrote to memory of 2708 2788 741.tmp 31 PID 2788 wrote to memory of 2708 2788 741.tmp 31 PID 2788 wrote to memory of 2708 2788 741.tmp 31 PID 2788 wrote to memory of 2708 2788 741.tmp 31 PID 2708 wrote to memory of 2672 2708 78F.tmp 32 PID 2708 wrote to memory of 2672 2708 78F.tmp 32 PID 2708 wrote to memory of 2672 2708 78F.tmp 32 PID 2708 wrote to memory of 2672 2708 78F.tmp 32 PID 2672 wrote to memory of 2876 2672 81C.tmp 33 PID 2672 wrote to memory of 2876 2672 81C.tmp 33 PID 2672 wrote to memory of 2876 2672 81C.tmp 33 PID 2672 wrote to memory of 2876 2672 81C.tmp 33 PID 2876 wrote to memory of 2692 2876 898.tmp 34 PID 2876 wrote to memory of 2692 2876 898.tmp 34 PID 2876 wrote to memory of 2692 2876 898.tmp 34 PID 2876 wrote to memory of 2692 2876 898.tmp 34 PID 2692 wrote to memory of 2560 2692 915.tmp 35 PID 2692 wrote to memory of 2560 2692 915.tmp 35 PID 2692 wrote to memory of 2560 2692 915.tmp 35 PID 2692 wrote to memory of 2560 2692 915.tmp 35 PID 2560 wrote to memory of 2632 2560 9A2.tmp 36 PID 2560 wrote to memory of 2632 2560 9A2.tmp 36 PID 2560 wrote to memory of 2632 2560 9A2.tmp 36 PID 2560 wrote to memory of 2632 2560 9A2.tmp 36 PID 2632 wrote to memory of 2236 2632 9FF.tmp 37 PID 2632 wrote to memory of 2236 2632 9FF.tmp 37 PID 2632 wrote to memory of 2236 2632 9FF.tmp 37 PID 2632 wrote to memory of 2236 2632 9FF.tmp 37 PID 2236 wrote to memory of 2136 2236 A6C.tmp 38 PID 2236 wrote to memory of 2136 2236 A6C.tmp 38 PID 2236 wrote to memory of 2136 2236 A6C.tmp 38 PID 2236 wrote to memory of 2136 2236 A6C.tmp 38 PID 2136 wrote to memory of 1476 2136 AE9.tmp 39 PID 2136 wrote to memory of 1476 2136 AE9.tmp 39 PID 2136 wrote to memory of 1476 2136 AE9.tmp 39 PID 2136 wrote to memory of 1476 2136 AE9.tmp 39 PID 1476 wrote to memory of 1064 1476 B66.tmp 40 PID 1476 wrote to memory of 1064 1476 B66.tmp 40 PID 1476 wrote to memory of 1064 1476 B66.tmp 40 PID 1476 wrote to memory of 1064 1476 B66.tmp 40 PID 1064 wrote to memory of 1452 1064 BE3.tmp 41 PID 1064 wrote to memory of 1452 1064 BE3.tmp 41 PID 1064 wrote to memory of 1452 1064 BE3.tmp 41 PID 1064 wrote to memory of 1452 1064 BE3.tmp 41 PID 1452 wrote to memory of 2540 1452 C50.tmp 42 PID 1452 wrote to memory of 2540 1452 C50.tmp 42 PID 1452 wrote to memory of 2540 1452 C50.tmp 42 PID 1452 wrote to memory of 2540 1452 C50.tmp 42 PID 2540 wrote to memory of 1884 2540 CCD.tmp 43 PID 2540 wrote to memory of 1884 2540 CCD.tmp 43 PID 2540 wrote to memory of 1884 2540 CCD.tmp 43 PID 2540 wrote to memory of 1884 2540 CCD.tmp 43 PID 1884 wrote to memory of 2840 1884 D3A.tmp 44 PID 1884 wrote to memory of 2840 1884 D3A.tmp 44 PID 1884 wrote to memory of 2840 1884 D3A.tmp 44 PID 1884 wrote to memory of 2840 1884 D3A.tmp 44 PID 2840 wrote to memory of 2888 2840 DA7.tmp 45 PID 2840 wrote to memory of 2888 2840 DA7.tmp 45 PID 2840 wrote to memory of 2888 2840 DA7.tmp 45 PID 2840 wrote to memory of 2888 2840 DA7.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-08_fc2d18284b508bf7a30a4d29541e499b_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-08_fc2d18284b508bf7a30a4d29541e499b_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\741.tmp"C:\Users\Admin\AppData\Local\Temp\741.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\78F.tmp"C:\Users\Admin\AppData\Local\Temp\78F.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\81C.tmp"C:\Users\Admin\AppData\Local\Temp\81C.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\898.tmp"C:\Users\Admin\AppData\Local\Temp\898.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\915.tmp"C:\Users\Admin\AppData\Local\Temp\915.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\9A2.tmp"C:\Users\Admin\AppData\Local\Temp\9A2.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\9FF.tmp"C:\Users\Admin\AppData\Local\Temp\9FF.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\A6C.tmp"C:\Users\Admin\AppData\Local\Temp\A6C.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\AE9.tmp"C:\Users\Admin\AppData\Local\Temp\AE9.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\B66.tmp"C:\Users\Admin\AppData\Local\Temp\B66.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\BE3.tmp"C:\Users\Admin\AppData\Local\Temp\BE3.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\C50.tmp"C:\Users\Admin\AppData\Local\Temp\C50.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\CCD.tmp"C:\Users\Admin\AppData\Local\Temp\CCD.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\D3A.tmp"C:\Users\Admin\AppData\Local\Temp\D3A.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\DA7.tmp"C:\Users\Admin\AppData\Local\Temp\DA7.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\E05.tmp"C:\Users\Admin\AppData\Local\Temp\E05.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\E53.tmp"C:\Users\Admin\AppData\Local\Temp\E53.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\EC0.tmp"C:\Users\Admin\AppData\Local\Temp\EC0.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\F2D.tmp"C:\Users\Admin\AppData\Local\Temp\F2D.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\FAA.tmp"C:\Users\Admin\AppData\Local\Temp\FAA.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:320 -
C:\Users\Admin\AppData\Local\Temp\1008.tmp"C:\Users\Admin\AppData\Local\Temp\1008.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\1056.tmp"C:\Users\Admin\AppData\Local\Temp\1056.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\10A4.tmp"C:\Users\Admin\AppData\Local\Temp\10A4.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\10F2.tmp"C:\Users\Admin\AppData\Local\Temp\10F2.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\1140.tmp"C:\Users\Admin\AppData\Local\Temp\1140.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\117E.tmp"C:\Users\Admin\AppData\Local\Temp\117E.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\11CC.tmp"C:\Users\Admin\AppData\Local\Temp\11CC.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\121A.tmp"C:\Users\Admin\AppData\Local\Temp\121A.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\1258.tmp"C:\Users\Admin\AppData\Local\Temp\1258.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\1297.tmp"C:\Users\Admin\AppData\Local\Temp\1297.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\12E5.tmp"C:\Users\Admin\AppData\Local\Temp\12E5.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\1323.tmp"C:\Users\Admin\AppData\Local\Temp\1323.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:940 -
C:\Users\Admin\AppData\Local\Temp\1371.tmp"C:\Users\Admin\AppData\Local\Temp\1371.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\13CF.tmp"C:\Users\Admin\AppData\Local\Temp\13CF.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:924 -
C:\Users\Admin\AppData\Local\Temp\141D.tmp"C:\Users\Admin\AppData\Local\Temp\141D.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\145B.tmp"C:\Users\Admin\AppData\Local\Temp\145B.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\149A.tmp"C:\Users\Admin\AppData\Local\Temp\149A.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\14D8.tmp"C:\Users\Admin\AppData\Local\Temp\14D8.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\1526.tmp"C:\Users\Admin\AppData\Local\Temp\1526.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:560 -
C:\Users\Admin\AppData\Local\Temp\1564.tmp"C:\Users\Admin\AppData\Local\Temp\1564.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\15A3.tmp"C:\Users\Admin\AppData\Local\Temp\15A3.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\15E1.tmp"C:\Users\Admin\AppData\Local\Temp\15E1.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\1620.tmp"C:\Users\Admin\AppData\Local\Temp\1620.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\165E.tmp"C:\Users\Admin\AppData\Local\Temp\165E.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\169C.tmp"C:\Users\Admin\AppData\Local\Temp\169C.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\16DB.tmp"C:\Users\Admin\AppData\Local\Temp\16DB.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\1719.tmp"C:\Users\Admin\AppData\Local\Temp\1719.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\1758.tmp"C:\Users\Admin\AppData\Local\Temp\1758.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\1796.tmp"C:\Users\Admin\AppData\Local\Temp\1796.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:772 -
C:\Users\Admin\AppData\Local\Temp\17D4.tmp"C:\Users\Admin\AppData\Local\Temp\17D4.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\1813.tmp"C:\Users\Admin\AppData\Local\Temp\1813.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\1851.tmp"C:\Users\Admin\AppData\Local\Temp\1851.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\189F.tmp"C:\Users\Admin\AppData\Local\Temp\189F.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\18DE.tmp"C:\Users\Admin\AppData\Local\Temp\18DE.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\191C.tmp"C:\Users\Admin\AppData\Local\Temp\191C.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\195A.tmp"C:\Users\Admin\AppData\Local\Temp\195A.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\1999.tmp"C:\Users\Admin\AppData\Local\Temp\1999.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\19D7.tmp"C:\Users\Admin\AppData\Local\Temp\19D7.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\1A16.tmp"C:\Users\Admin\AppData\Local\Temp\1A16.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\1A54.tmp"C:\Users\Admin\AppData\Local\Temp\1A54.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\1A92.tmp"C:\Users\Admin\AppData\Local\Temp\1A92.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\1B8C.tmp"C:\Users\Admin\AppData\Local\Temp\1B8C.tmp"65⤵
- Executes dropped EXE
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"66⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\1C47.tmp"C:\Users\Admin\AppData\Local\Temp\1C47.tmp"67⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\1C86.tmp"C:\Users\Admin\AppData\Local\Temp\1C86.tmp"68⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"69⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\1D31.tmp"C:\Users\Admin\AppData\Local\Temp\1D31.tmp"70⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"72⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"73⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\1E79.tmp"C:\Users\Admin\AppData\Local\Temp\1E79.tmp"74⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"75⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\1F15.tmp"C:\Users\Admin\AppData\Local\Temp\1F15.tmp"76⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\1F63.tmp"C:\Users\Admin\AppData\Local\Temp\1F63.tmp"77⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"78⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"79⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\202E.tmp"C:\Users\Admin\AppData\Local\Temp\202E.tmp"80⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\207C.tmp"C:\Users\Admin\AppData\Local\Temp\207C.tmp"81⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\20BA.tmp"C:\Users\Admin\AppData\Local\Temp\20BA.tmp"82⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\2108.tmp"C:\Users\Admin\AppData\Local\Temp\2108.tmp"83⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\2156.tmp"C:\Users\Admin\AppData\Local\Temp\2156.tmp"84⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\2194.tmp"C:\Users\Admin\AppData\Local\Temp\2194.tmp"85⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\21D3.tmp"C:\Users\Admin\AppData\Local\Temp\21D3.tmp"86⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\2211.tmp"C:\Users\Admin\AppData\Local\Temp\2211.tmp"87⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\2250.tmp"C:\Users\Admin\AppData\Local\Temp\2250.tmp"88⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\228E.tmp"C:\Users\Admin\AppData\Local\Temp\228E.tmp"89⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\22CC.tmp"C:\Users\Admin\AppData\Local\Temp\22CC.tmp"90⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\230B.tmp"C:\Users\Admin\AppData\Local\Temp\230B.tmp"91⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\2349.tmp"C:\Users\Admin\AppData\Local\Temp\2349.tmp"92⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\2388.tmp"C:\Users\Admin\AppData\Local\Temp\2388.tmp"93⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\23D6.tmp"C:\Users\Admin\AppData\Local\Temp\23D6.tmp"94⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\2414.tmp"C:\Users\Admin\AppData\Local\Temp\2414.tmp"95⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"96⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\24B0.tmp"C:\Users\Admin\AppData\Local\Temp\24B0.tmp"97⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\24EE.tmp"C:\Users\Admin\AppData\Local\Temp\24EE.tmp"98⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\252D.tmp"C:\Users\Admin\AppData\Local\Temp\252D.tmp"99⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\256B.tmp"C:\Users\Admin\AppData\Local\Temp\256B.tmp"100⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\25B9.tmp"C:\Users\Admin\AppData\Local\Temp\25B9.tmp"101⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\2607.tmp"C:\Users\Admin\AppData\Local\Temp\2607.tmp"102⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\2646.tmp"C:\Users\Admin\AppData\Local\Temp\2646.tmp"103⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\2694.tmp"C:\Users\Admin\AppData\Local\Temp\2694.tmp"104⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\26E2.tmp"C:\Users\Admin\AppData\Local\Temp\26E2.tmp"105⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\2730.tmp"C:\Users\Admin\AppData\Local\Temp\2730.tmp"106⤵
- System Location Discovery: System Language Discovery
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\277E.tmp"C:\Users\Admin\AppData\Local\Temp\277E.tmp"107⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\27BC.tmp"C:\Users\Admin\AppData\Local\Temp\27BC.tmp"108⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\27FA.tmp"C:\Users\Admin\AppData\Local\Temp\27FA.tmp"109⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\2839.tmp"C:\Users\Admin\AppData\Local\Temp\2839.tmp"110⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\2877.tmp"C:\Users\Admin\AppData\Local\Temp\2877.tmp"111⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\28B6.tmp"C:\Users\Admin\AppData\Local\Temp\28B6.tmp"112⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\2904.tmp"C:\Users\Admin\AppData\Local\Temp\2904.tmp"113⤵PID:304
-
C:\Users\Admin\AppData\Local\Temp\2952.tmp"C:\Users\Admin\AppData\Local\Temp\2952.tmp"114⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\2990.tmp"C:\Users\Admin\AppData\Local\Temp\2990.tmp"115⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\29DE.tmp"C:\Users\Admin\AppData\Local\Temp\29DE.tmp"116⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"117⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"118⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\2A99.tmp"C:\Users\Admin\AppData\Local\Temp\2A99.tmp"119⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"120⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\2B26.tmp"C:\Users\Admin\AppData\Local\Temp\2B26.tmp"121⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\2B64.tmp"C:\Users\Admin\AppData\Local\Temp\2B64.tmp"122⤵PID:2580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-