Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
03-10-2024 11:22
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-03_16c61b741a06d1f8075e353ec85ac961_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-10-03_16c61b741a06d1f8075e353ec85ac961_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-10-03_16c61b741a06d1f8075e353ec85ac961_mafia.exe
-
Size
541KB
-
MD5
16c61b741a06d1f8075e353ec85ac961
-
SHA1
99fd55d1ee06ffb9c651d17aa4331a2a583febbc
-
SHA256
f5c94b9f99ee3e41355da57a0c5320496ef82ead54614c6e70594589cfd2f671
-
SHA512
2cf291c11d17343af17da4cd140bf4dd695cb64f82bda932baa5bc3863dbda0ab5ddaa95354b539cc97d0e11336c9e8397ee30715fe527717027899d3519512b
-
SSDEEP
12288:HU5rCOTeiJqTfn3b0aGv2JmwINZb73ctO:HUQOJJAnjO8INV73ctO
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2340 57A2.tmp 2708 57F0.tmp 2836 584D.tmp 2864 58BB.tmp 2668 5928.tmp 2920 5995.tmp 2716 59F3.tmp 2564 5A41.tmp 1336 5A9E.tmp 2324 5AFC.tmp 2948 5B59.tmp 1592 5BB7.tmp 2276 5C15.tmp 616 5C82.tmp 1088 5CDF.tmp 1488 5D3D.tmp 2832 5DAA.tmp 2900 5E27.tmp 1100 5E85.tmp 2884 5EF2.tmp 2468 5F5F.tmp 1712 5FBD.tmp 1152 600B.tmp 596 6049.tmp 2332 6097.tmp 2504 60E5.tmp 2120 6133.tmp 2124 6171.tmp 2056 61BF.tmp 2096 620D.tmp 1748 625B.tmp 1348 629A.tmp 1820 62D8.tmp 996 6317.tmp 684 6365.tmp 1364 63B3.tmp 1376 6410.tmp 2104 647D.tmp 1560 64CB.tmp 1976 6519.tmp 2024 6587.tmp 2256 65D5.tmp 1196 6613.tmp 2492 6661.tmp 3000 669F.tmp 2528 66ED.tmp 1936 672C.tmp 2060 677A.tmp 1296 67B8.tmp 1516 6806.tmp 1780 6845.tmp 2480 6893.tmp 2280 68D1.tmp 1616 691F.tmp 2656 695D.tmp 2760 699C.tmp 2780 69DA.tmp 2752 6A19.tmp 2992 6A57.tmp 2988 6AA5.tmp 2864 6AF3.tmp 1704 6B31.tmp 2812 6B70.tmp 2776 6BBE.tmp -
Loads dropped DLL 64 IoCs
pid Process 1960 2024-10-03_16c61b741a06d1f8075e353ec85ac961_mafia.exe 2340 57A2.tmp 2708 57F0.tmp 2836 584D.tmp 2864 58BB.tmp 2668 5928.tmp 2920 5995.tmp 2716 59F3.tmp 2564 5A41.tmp 1336 5A9E.tmp 2324 5AFC.tmp 2948 5B59.tmp 1592 5BB7.tmp 2276 5C15.tmp 616 5C82.tmp 1088 5CDF.tmp 1488 5D3D.tmp 2832 5DAA.tmp 2900 5E27.tmp 1100 5E85.tmp 2884 5EF2.tmp 2468 5F5F.tmp 1712 5FBD.tmp 1152 600B.tmp 596 6049.tmp 2332 6097.tmp 2504 60E5.tmp 2120 6133.tmp 2124 6171.tmp 2056 61BF.tmp 2096 620D.tmp 1748 625B.tmp 1348 629A.tmp 1820 62D8.tmp 996 6317.tmp 684 6365.tmp 1364 63B3.tmp 1376 6410.tmp 2104 647D.tmp 1560 64CB.tmp 1976 6519.tmp 2024 6587.tmp 2256 65D5.tmp 1196 6613.tmp 2492 6661.tmp 3000 669F.tmp 2528 66ED.tmp 1936 672C.tmp 2060 677A.tmp 1296 67B8.tmp 1516 6806.tmp 1780 6845.tmp 2480 6893.tmp 2280 68D1.tmp 1616 691F.tmp 2656 695D.tmp 2760 699C.tmp 2780 69DA.tmp 2752 6A19.tmp 2992 6A57.tmp 2988 6AA5.tmp 2864 6AF3.tmp 1704 6B31.tmp 2812 6B70.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F73.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E36C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E91.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5AAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E791.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 273F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A46A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8363.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2AC8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2839.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D069.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C82F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5226.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A083.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C542.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 118E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FBE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B857.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 145B.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1960 wrote to memory of 2340 1960 2024-10-03_16c61b741a06d1f8075e353ec85ac961_mafia.exe 30 PID 1960 wrote to memory of 2340 1960 2024-10-03_16c61b741a06d1f8075e353ec85ac961_mafia.exe 30 PID 1960 wrote to memory of 2340 1960 2024-10-03_16c61b741a06d1f8075e353ec85ac961_mafia.exe 30 PID 1960 wrote to memory of 2340 1960 2024-10-03_16c61b741a06d1f8075e353ec85ac961_mafia.exe 30 PID 2340 wrote to memory of 2708 2340 57A2.tmp 31 PID 2340 wrote to memory of 2708 2340 57A2.tmp 31 PID 2340 wrote to memory of 2708 2340 57A2.tmp 31 PID 2340 wrote to memory of 2708 2340 57A2.tmp 31 PID 2708 wrote to memory of 2836 2708 57F0.tmp 32 PID 2708 wrote to memory of 2836 2708 57F0.tmp 32 PID 2708 wrote to memory of 2836 2708 57F0.tmp 32 PID 2708 wrote to memory of 2836 2708 57F0.tmp 32 PID 2836 wrote to memory of 2864 2836 584D.tmp 33 PID 2836 wrote to memory of 2864 2836 584D.tmp 33 PID 2836 wrote to memory of 2864 2836 584D.tmp 33 PID 2836 wrote to memory of 2864 2836 584D.tmp 33 PID 2864 wrote to memory of 2668 2864 58BB.tmp 34 PID 2864 wrote to memory of 2668 2864 58BB.tmp 34 PID 2864 wrote to memory of 2668 2864 58BB.tmp 34 PID 2864 wrote to memory of 2668 2864 58BB.tmp 34 PID 2668 wrote to memory of 2920 2668 5928.tmp 35 PID 2668 wrote to memory of 2920 2668 5928.tmp 35 PID 2668 wrote to memory of 2920 2668 5928.tmp 35 PID 2668 wrote to memory of 2920 2668 5928.tmp 35 PID 2920 wrote to memory of 2716 2920 5995.tmp 36 PID 2920 wrote to memory of 2716 2920 5995.tmp 36 PID 2920 wrote to memory of 2716 2920 5995.tmp 36 PID 2920 wrote to memory of 2716 2920 5995.tmp 36 PID 2716 wrote to memory of 2564 2716 59F3.tmp 37 PID 2716 wrote to memory of 2564 2716 59F3.tmp 37 PID 2716 wrote to memory of 2564 2716 59F3.tmp 37 PID 2716 wrote to memory of 2564 2716 59F3.tmp 37 PID 2564 wrote to memory of 1336 2564 5A41.tmp 38 PID 2564 wrote to memory of 1336 2564 5A41.tmp 38 PID 2564 wrote to memory of 1336 2564 5A41.tmp 38 PID 2564 wrote to memory of 1336 2564 5A41.tmp 38 PID 1336 wrote to memory of 2324 1336 5A9E.tmp 39 PID 1336 wrote to memory of 2324 1336 5A9E.tmp 39 PID 1336 wrote to memory of 2324 1336 5A9E.tmp 39 PID 1336 wrote to memory of 2324 1336 5A9E.tmp 39 PID 2324 wrote to memory of 2948 2324 5AFC.tmp 40 PID 2324 wrote to memory of 2948 2324 5AFC.tmp 40 PID 2324 wrote to memory of 2948 2324 5AFC.tmp 40 PID 2324 wrote to memory of 2948 2324 5AFC.tmp 40 PID 2948 wrote to memory of 1592 2948 5B59.tmp 41 PID 2948 wrote to memory of 1592 2948 5B59.tmp 41 PID 2948 wrote to memory of 1592 2948 5B59.tmp 41 PID 2948 wrote to memory of 1592 2948 5B59.tmp 41 PID 1592 wrote to memory of 2276 1592 5BB7.tmp 42 PID 1592 wrote to memory of 2276 1592 5BB7.tmp 42 PID 1592 wrote to memory of 2276 1592 5BB7.tmp 42 PID 1592 wrote to memory of 2276 1592 5BB7.tmp 42 PID 2276 wrote to memory of 616 2276 5C15.tmp 43 PID 2276 wrote to memory of 616 2276 5C15.tmp 43 PID 2276 wrote to memory of 616 2276 5C15.tmp 43 PID 2276 wrote to memory of 616 2276 5C15.tmp 43 PID 616 wrote to memory of 1088 616 5C82.tmp 44 PID 616 wrote to memory of 1088 616 5C82.tmp 44 PID 616 wrote to memory of 1088 616 5C82.tmp 44 PID 616 wrote to memory of 1088 616 5C82.tmp 44 PID 1088 wrote to memory of 1488 1088 5CDF.tmp 45 PID 1088 wrote to memory of 1488 1088 5CDF.tmp 45 PID 1088 wrote to memory of 1488 1088 5CDF.tmp 45 PID 1088 wrote to memory of 1488 1088 5CDF.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-03_16c61b741a06d1f8075e353ec85ac961_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-03_16c61b741a06d1f8075e353ec85ac961_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\57A2.tmp"C:\Users\Admin\AppData\Local\Temp\57A2.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\57F0.tmp"C:\Users\Admin\AppData\Local\Temp\57F0.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\584D.tmp"C:\Users\Admin\AppData\Local\Temp\584D.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\58BB.tmp"C:\Users\Admin\AppData\Local\Temp\58BB.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\5928.tmp"C:\Users\Admin\AppData\Local\Temp\5928.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\5995.tmp"C:\Users\Admin\AppData\Local\Temp\5995.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\59F3.tmp"C:\Users\Admin\AppData\Local\Temp\59F3.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\5A41.tmp"C:\Users\Admin\AppData\Local\Temp\5A41.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\5AFC.tmp"C:\Users\Admin\AppData\Local\Temp\5AFC.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\5B59.tmp"C:\Users\Admin\AppData\Local\Temp\5B59.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\5BB7.tmp"C:\Users\Admin\AppData\Local\Temp\5BB7.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\5C15.tmp"C:\Users\Admin\AppData\Local\Temp\5C15.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\5C82.tmp"C:\Users\Admin\AppData\Local\Temp\5C82.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Users\Admin\AppData\Local\Temp\5CDF.tmp"C:\Users\Admin\AppData\Local\Temp\5CDF.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\5D3D.tmp"C:\Users\Admin\AppData\Local\Temp\5D3D.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\5DAA.tmp"C:\Users\Admin\AppData\Local\Temp\5DAA.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\5E27.tmp"C:\Users\Admin\AppData\Local\Temp\5E27.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\5E85.tmp"C:\Users\Admin\AppData\Local\Temp\5E85.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\5EF2.tmp"C:\Users\Admin\AppData\Local\Temp\5EF2.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\5F5F.tmp"C:\Users\Admin\AppData\Local\Temp\5F5F.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\5FBD.tmp"C:\Users\Admin\AppData\Local\Temp\5FBD.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\600B.tmp"C:\Users\Admin\AppData\Local\Temp\600B.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\6049.tmp"C:\Users\Admin\AppData\Local\Temp\6049.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:596 -
C:\Users\Admin\AppData\Local\Temp\6097.tmp"C:\Users\Admin\AppData\Local\Temp\6097.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\60E5.tmp"C:\Users\Admin\AppData\Local\Temp\60E5.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\6133.tmp"C:\Users\Admin\AppData\Local\Temp\6133.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\6171.tmp"C:\Users\Admin\AppData\Local\Temp\6171.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\61BF.tmp"C:\Users\Admin\AppData\Local\Temp\61BF.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\620D.tmp"C:\Users\Admin\AppData\Local\Temp\620D.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\625B.tmp"C:\Users\Admin\AppData\Local\Temp\625B.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\629A.tmp"C:\Users\Admin\AppData\Local\Temp\629A.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\62D8.tmp"C:\Users\Admin\AppData\Local\Temp\62D8.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\6317.tmp"C:\Users\Admin\AppData\Local\Temp\6317.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:996 -
C:\Users\Admin\AppData\Local\Temp\6365.tmp"C:\Users\Admin\AppData\Local\Temp\6365.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:684 -
C:\Users\Admin\AppData\Local\Temp\63B3.tmp"C:\Users\Admin\AppData\Local\Temp\63B3.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\6410.tmp"C:\Users\Admin\AppData\Local\Temp\6410.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\647D.tmp"C:\Users\Admin\AppData\Local\Temp\647D.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\64CB.tmp"C:\Users\Admin\AppData\Local\Temp\64CB.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\6519.tmp"C:\Users\Admin\AppData\Local\Temp\6519.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\6587.tmp"C:\Users\Admin\AppData\Local\Temp\6587.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\65D5.tmp"C:\Users\Admin\AppData\Local\Temp\65D5.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\6613.tmp"C:\Users\Admin\AppData\Local\Temp\6613.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\6661.tmp"C:\Users\Admin\AppData\Local\Temp\6661.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\669F.tmp"C:\Users\Admin\AppData\Local\Temp\669F.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\66ED.tmp"C:\Users\Admin\AppData\Local\Temp\66ED.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\672C.tmp"C:\Users\Admin\AppData\Local\Temp\672C.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\677A.tmp"C:\Users\Admin\AppData\Local\Temp\677A.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\67B8.tmp"C:\Users\Admin\AppData\Local\Temp\67B8.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\6806.tmp"C:\Users\Admin\AppData\Local\Temp\6806.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\6845.tmp"C:\Users\Admin\AppData\Local\Temp\6845.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\6893.tmp"C:\Users\Admin\AppData\Local\Temp\6893.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\68D1.tmp"C:\Users\Admin\AppData\Local\Temp\68D1.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\691F.tmp"C:\Users\Admin\AppData\Local\Temp\691F.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\695D.tmp"C:\Users\Admin\AppData\Local\Temp\695D.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\699C.tmp"C:\Users\Admin\AppData\Local\Temp\699C.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\69DA.tmp"C:\Users\Admin\AppData\Local\Temp\69DA.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\6A19.tmp"C:\Users\Admin\AppData\Local\Temp\6A19.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\6A57.tmp"C:\Users\Admin\AppData\Local\Temp\6A57.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\6AA5.tmp"C:\Users\Admin\AppData\Local\Temp\6AA5.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\6AF3.tmp"C:\Users\Admin\AppData\Local\Temp\6AF3.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\6B31.tmp"C:\Users\Admin\AppData\Local\Temp\6B31.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\6B70.tmp"C:\Users\Admin\AppData\Local\Temp\6B70.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\6BBE.tmp"C:\Users\Admin\AppData\Local\Temp\6BBE.tmp"65⤵
- Executes dropped EXE
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\6BFC.tmp"C:\Users\Admin\AppData\Local\Temp\6BFC.tmp"66⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\6C3B.tmp"C:\Users\Admin\AppData\Local\Temp\6C3B.tmp"67⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\6C79.tmp"C:\Users\Admin\AppData\Local\Temp\6C79.tmp"68⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\6CB7.tmp"C:\Users\Admin\AppData\Local\Temp\6CB7.tmp"69⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\6CF6.tmp"C:\Users\Admin\AppData\Local\Temp\6CF6.tmp"70⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\6D34.tmp"C:\Users\Admin\AppData\Local\Temp\6D34.tmp"71⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\6D82.tmp"C:\Users\Admin\AppData\Local\Temp\6D82.tmp"72⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\6DC1.tmp"C:\Users\Admin\AppData\Local\Temp\6DC1.tmp"73⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\6E0F.tmp"C:\Users\Admin\AppData\Local\Temp\6E0F.tmp"74⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\6E5D.tmp"C:\Users\Admin\AppData\Local\Temp\6E5D.tmp"75⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\6E9B.tmp"C:\Users\Admin\AppData\Local\Temp\6E9B.tmp"76⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\6ED9.tmp"C:\Users\Admin\AppData\Local\Temp\6ED9.tmp"77⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\6F27.tmp"C:\Users\Admin\AppData\Local\Temp\6F27.tmp"78⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\6F66.tmp"C:\Users\Admin\AppData\Local\Temp\6F66.tmp"79⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\6FB4.tmp"C:\Users\Admin\AppData\Local\Temp\6FB4.tmp"80⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\6FF2.tmp"C:\Users\Admin\AppData\Local\Temp\6FF2.tmp"81⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\7031.tmp"C:\Users\Admin\AppData\Local\Temp\7031.tmp"82⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\706F.tmp"C:\Users\Admin\AppData\Local\Temp\706F.tmp"83⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\70AD.tmp"C:\Users\Admin\AppData\Local\Temp\70AD.tmp"84⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\70FB.tmp"C:\Users\Admin\AppData\Local\Temp\70FB.tmp"85⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\713A.tmp"C:\Users\Admin\AppData\Local\Temp\713A.tmp"86⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\7188.tmp"C:\Users\Admin\AppData\Local\Temp\7188.tmp"87⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\71C6.tmp"C:\Users\Admin\AppData\Local\Temp\71C6.tmp"88⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\7205.tmp"C:\Users\Admin\AppData\Local\Temp\7205.tmp"89⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\7253.tmp"C:\Users\Admin\AppData\Local\Temp\7253.tmp"90⤵PID:596
-
C:\Users\Admin\AppData\Local\Temp\7291.tmp"C:\Users\Admin\AppData\Local\Temp\7291.tmp"91⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\72CF.tmp"C:\Users\Admin\AppData\Local\Temp\72CF.tmp"92⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\730E.tmp"C:\Users\Admin\AppData\Local\Temp\730E.tmp"93⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\735C.tmp"C:\Users\Admin\AppData\Local\Temp\735C.tmp"94⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\739A.tmp"C:\Users\Admin\AppData\Local\Temp\739A.tmp"95⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\73D9.tmp"C:\Users\Admin\AppData\Local\Temp\73D9.tmp"96⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"97⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"98⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\7494.tmp"C:\Users\Admin\AppData\Local\Temp\7494.tmp"99⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"100⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"101⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\754F.tmp"C:\Users\Admin\AppData\Local\Temp\754F.tmp"102⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\758D.tmp"C:\Users\Admin\AppData\Local\Temp\758D.tmp"103⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\75DB.tmp"C:\Users\Admin\AppData\Local\Temp\75DB.tmp"104⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"105⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\7658.tmp"C:\Users\Admin\AppData\Local\Temp\7658.tmp"106⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\7697.tmp"C:\Users\Admin\AppData\Local\Temp\7697.tmp"107⤵PID:288
-
C:\Users\Admin\AppData\Local\Temp\76D5.tmp"C:\Users\Admin\AppData\Local\Temp\76D5.tmp"108⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\7713.tmp"C:\Users\Admin\AppData\Local\Temp\7713.tmp"109⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\7752.tmp"C:\Users\Admin\AppData\Local\Temp\7752.tmp"110⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\7790.tmp"C:\Users\Admin\AppData\Local\Temp\7790.tmp"111⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\77DE.tmp"C:\Users\Admin\AppData\Local\Temp\77DE.tmp"112⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\781D.tmp"C:\Users\Admin\AppData\Local\Temp\781D.tmp"113⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\786B.tmp"C:\Users\Admin\AppData\Local\Temp\786B.tmp"114⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\78A9.tmp"C:\Users\Admin\AppData\Local\Temp\78A9.tmp"115⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\78E7.tmp"C:\Users\Admin\AppData\Local\Temp\78E7.tmp"116⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\7926.tmp"C:\Users\Admin\AppData\Local\Temp\7926.tmp"117⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\7974.tmp"C:\Users\Admin\AppData\Local\Temp\7974.tmp"118⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\79C2.tmp"C:\Users\Admin\AppData\Local\Temp\79C2.tmp"119⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\7A00.tmp"C:\Users\Admin\AppData\Local\Temp\7A00.tmp"120⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\7A3F.tmp"C:\Users\Admin\AppData\Local\Temp\7A3F.tmp"121⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\7A7D.tmp"C:\Users\Admin\AppData\Local\Temp\7A7D.tmp"122⤵PID:2856
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-