Analysis
-
max time kernel
150s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05-10-2024 09:31
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-05_3e0112be0032756154cc45111f92a278_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-05_3e0112be0032756154cc45111f92a278_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-10-05_3e0112be0032756154cc45111f92a278_mafia.exe
-
Size
712KB
-
MD5
3e0112be0032756154cc45111f92a278
-
SHA1
79a19fb2fa7e89024db6ce5c16ddf2e667d7f0af
-
SHA256
41904dbd4370dd0279467640f77598f52caf37a4fbe8a7c26029d7b5243abc44
-
SHA512
921e45e658752240b7f0ed49396ab7028b9d6a3618b5e754b1ba2a9aba0c05a160220641d3f4ef58a53bb9e30669897f162f91581739b33e064a9cdff96c8eeb
-
SSDEEP
12288:FU5rCOTeiDFgRRcJHuHSkVrLChx8jL/Q9fTNZdCvq5TJLCvY90D8/LVBlVk736YI:FUQOJDy8eCYI9fTNnCvq5TJLCvY90D8N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2924 5734.tmp 2804 57A2.tmp 2752 581F.tmp 2068 586D.tmp 2580 58BB.tmp 2712 5937.tmp 2556 5976.tmp 2668 5A02.tmp 2496 5A41.tmp 1416 5ADD.tmp 1060 5B59.tmp 1360 5B98.tmp 2940 5BD6.tmp 3024 5C24.tmp 2908 5C72.tmp 2892 5CDF.tmp 1656 5D4D.tmp 2856 5D9B.tmp 1160 5DF8.tmp 1420 5E46.tmp 1732 5EE2.tmp 1696 5F40.tmp 2332 5F8E.tmp 2328 5FCC.tmp 2956 600B.tmp 552 6049.tmp 2144 6097.tmp 2960 60D5.tmp 2196 6114.tmp 1604 6143.tmp 2336 6181.tmp 840 61BF.tmp 2516 61FE.tmp 932 623C.tmp 1064 627B.tmp 1940 62B9.tmp 2128 62F7.tmp 1528 6326.tmp 1116 6365.tmp 2072 63A3.tmp 292 63E1.tmp 2488 6420.tmp 1812 644F.tmp 2500 648D.tmp 1564 64CB.tmp 2508 650A.tmp 2352 6548.tmp 2096 6587.tmp 2912 65C5.tmp 1744 6603.tmp 872 6642.tmp 2448 6680.tmp 2656 66BF.tmp 1588 66FD.tmp 2688 673B.tmp 2836 676A.tmp 2804 67A9.tmp 2840 67E7.tmp 2820 6835.tmp 2700 6883.tmp 2572 68D1.tmp 2876 691F.tmp 2568 695D.tmp 2556 69AB.tmp -
Loads dropped DLL 64 IoCs
pid Process 2372 2024-10-05_3e0112be0032756154cc45111f92a278_mafia.exe 2924 5734.tmp 2804 57A2.tmp 2752 581F.tmp 2068 586D.tmp 2580 58BB.tmp 2712 5937.tmp 2556 5976.tmp 2668 5A02.tmp 2496 5A41.tmp 1416 5ADD.tmp 1060 5B59.tmp 1360 5B98.tmp 2940 5BD6.tmp 3024 5C24.tmp 2908 5C72.tmp 2892 5CDF.tmp 1656 5D4D.tmp 2856 5D9B.tmp 1160 5DF8.tmp 1420 5E46.tmp 1732 5EE2.tmp 1696 5F40.tmp 2332 5F8E.tmp 2328 5FCC.tmp 2956 600B.tmp 552 6049.tmp 2144 6097.tmp 2960 60D5.tmp 2196 6114.tmp 1604 6143.tmp 2336 6181.tmp 840 61BF.tmp 2516 61FE.tmp 932 623C.tmp 1064 627B.tmp 1940 62B9.tmp 2128 62F7.tmp 1528 6326.tmp 1116 6365.tmp 2072 63A3.tmp 292 63E1.tmp 2488 6420.tmp 1812 644F.tmp 2500 648D.tmp 1564 64CB.tmp 2508 650A.tmp 2352 6548.tmp 2096 6587.tmp 2912 65C5.tmp 1744 6603.tmp 872 6642.tmp 2448 6680.tmp 2656 66BF.tmp 1588 66FD.tmp 2688 673B.tmp 2836 676A.tmp 2804 67A9.tmp 2840 67E7.tmp 2820 6835.tmp 2700 6883.tmp 2572 68D1.tmp 2876 691F.tmp 2568 695D.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 909C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F73.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 600B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E39B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 367B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5245.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8814.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBB6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8131.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5477.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 867E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 119D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F74A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8E.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2924 2372 2024-10-05_3e0112be0032756154cc45111f92a278_mafia.exe 30 PID 2372 wrote to memory of 2924 2372 2024-10-05_3e0112be0032756154cc45111f92a278_mafia.exe 30 PID 2372 wrote to memory of 2924 2372 2024-10-05_3e0112be0032756154cc45111f92a278_mafia.exe 30 PID 2372 wrote to memory of 2924 2372 2024-10-05_3e0112be0032756154cc45111f92a278_mafia.exe 30 PID 2924 wrote to memory of 2804 2924 5734.tmp 31 PID 2924 wrote to memory of 2804 2924 5734.tmp 31 PID 2924 wrote to memory of 2804 2924 5734.tmp 31 PID 2924 wrote to memory of 2804 2924 5734.tmp 31 PID 2804 wrote to memory of 2752 2804 57A2.tmp 32 PID 2804 wrote to memory of 2752 2804 57A2.tmp 32 PID 2804 wrote to memory of 2752 2804 57A2.tmp 32 PID 2804 wrote to memory of 2752 2804 57A2.tmp 32 PID 2752 wrote to memory of 2068 2752 581F.tmp 33 PID 2752 wrote to memory of 2068 2752 581F.tmp 33 PID 2752 wrote to memory of 2068 2752 581F.tmp 33 PID 2752 wrote to memory of 2068 2752 581F.tmp 33 PID 2068 wrote to memory of 2580 2068 586D.tmp 34 PID 2068 wrote to memory of 2580 2068 586D.tmp 34 PID 2068 wrote to memory of 2580 2068 586D.tmp 34 PID 2068 wrote to memory of 2580 2068 586D.tmp 34 PID 2580 wrote to memory of 2712 2580 58BB.tmp 35 PID 2580 wrote to memory of 2712 2580 58BB.tmp 35 PID 2580 wrote to memory of 2712 2580 58BB.tmp 35 PID 2580 wrote to memory of 2712 2580 58BB.tmp 35 PID 2712 wrote to memory of 2556 2712 5937.tmp 36 PID 2712 wrote to memory of 2556 2712 5937.tmp 36 PID 2712 wrote to memory of 2556 2712 5937.tmp 36 PID 2712 wrote to memory of 2556 2712 5937.tmp 36 PID 2556 wrote to memory of 2668 2556 5976.tmp 37 PID 2556 wrote to memory of 2668 2556 5976.tmp 37 PID 2556 wrote to memory of 2668 2556 5976.tmp 37 PID 2556 wrote to memory of 2668 2556 5976.tmp 37 PID 2668 wrote to memory of 2496 2668 5A02.tmp 38 PID 2668 wrote to memory of 2496 2668 5A02.tmp 38 PID 2668 wrote to memory of 2496 2668 5A02.tmp 38 PID 2668 wrote to memory of 2496 2668 5A02.tmp 38 PID 2496 wrote to memory of 1416 2496 5A41.tmp 39 PID 2496 wrote to memory of 1416 2496 5A41.tmp 39 PID 2496 wrote to memory of 1416 2496 5A41.tmp 39 PID 2496 wrote to memory of 1416 2496 5A41.tmp 39 PID 1416 wrote to memory of 1060 1416 5ADD.tmp 40 PID 1416 wrote to memory of 1060 1416 5ADD.tmp 40 PID 1416 wrote to memory of 1060 1416 5ADD.tmp 40 PID 1416 wrote to memory of 1060 1416 5ADD.tmp 40 PID 1060 wrote to memory of 1360 1060 5B59.tmp 41 PID 1060 wrote to memory of 1360 1060 5B59.tmp 41 PID 1060 wrote to memory of 1360 1060 5B59.tmp 41 PID 1060 wrote to memory of 1360 1060 5B59.tmp 41 PID 1360 wrote to memory of 2940 1360 5B98.tmp 42 PID 1360 wrote to memory of 2940 1360 5B98.tmp 42 PID 1360 wrote to memory of 2940 1360 5B98.tmp 42 PID 1360 wrote to memory of 2940 1360 5B98.tmp 42 PID 2940 wrote to memory of 3024 2940 5BD6.tmp 43 PID 2940 wrote to memory of 3024 2940 5BD6.tmp 43 PID 2940 wrote to memory of 3024 2940 5BD6.tmp 43 PID 2940 wrote to memory of 3024 2940 5BD6.tmp 43 PID 3024 wrote to memory of 2908 3024 5C24.tmp 44 PID 3024 wrote to memory of 2908 3024 5C24.tmp 44 PID 3024 wrote to memory of 2908 3024 5C24.tmp 44 PID 3024 wrote to memory of 2908 3024 5C24.tmp 44 PID 2908 wrote to memory of 2892 2908 5C72.tmp 45 PID 2908 wrote to memory of 2892 2908 5C72.tmp 45 PID 2908 wrote to memory of 2892 2908 5C72.tmp 45 PID 2908 wrote to memory of 2892 2908 5C72.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-05_3e0112be0032756154cc45111f92a278_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-05_3e0112be0032756154cc45111f92a278_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\5734.tmp"C:\Users\Admin\AppData\Local\Temp\5734.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\57A2.tmp"C:\Users\Admin\AppData\Local\Temp\57A2.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\581F.tmp"C:\Users\Admin\AppData\Local\Temp\581F.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\586D.tmp"C:\Users\Admin\AppData\Local\Temp\586D.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\58BB.tmp"C:\Users\Admin\AppData\Local\Temp\58BB.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\5937.tmp"C:\Users\Admin\AppData\Local\Temp\5937.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\5976.tmp"C:\Users\Admin\AppData\Local\Temp\5976.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\5A02.tmp"C:\Users\Admin\AppData\Local\Temp\5A02.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\5A41.tmp"C:\Users\Admin\AppData\Local\Temp\5A41.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\5ADD.tmp"C:\Users\Admin\AppData\Local\Temp\5ADD.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\5B59.tmp"C:\Users\Admin\AppData\Local\Temp\5B59.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\5B98.tmp"C:\Users\Admin\AppData\Local\Temp\5B98.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\5BD6.tmp"C:\Users\Admin\AppData\Local\Temp\5BD6.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\5C24.tmp"C:\Users\Admin\AppData\Local\Temp\5C24.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\5C72.tmp"C:\Users\Admin\AppData\Local\Temp\5C72.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\5CDF.tmp"C:\Users\Admin\AppData\Local\Temp\5CDF.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\5D4D.tmp"C:\Users\Admin\AppData\Local\Temp\5D4D.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\5D9B.tmp"C:\Users\Admin\AppData\Local\Temp\5D9B.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\5DF8.tmp"C:\Users\Admin\AppData\Local\Temp\5DF8.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\5E46.tmp"C:\Users\Admin\AppData\Local\Temp\5E46.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\5EE2.tmp"C:\Users\Admin\AppData\Local\Temp\5EE2.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\5F40.tmp"C:\Users\Admin\AppData\Local\Temp\5F40.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\5F8E.tmp"C:\Users\Admin\AppData\Local\Temp\5F8E.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\5FCC.tmp"C:\Users\Admin\AppData\Local\Temp\5FCC.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\600B.tmp"C:\Users\Admin\AppData\Local\Temp\600B.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\6049.tmp"C:\Users\Admin\AppData\Local\Temp\6049.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:552 -
C:\Users\Admin\AppData\Local\Temp\6097.tmp"C:\Users\Admin\AppData\Local\Temp\6097.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\60D5.tmp"C:\Users\Admin\AppData\Local\Temp\60D5.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\6114.tmp"C:\Users\Admin\AppData\Local\Temp\6114.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\6143.tmp"C:\Users\Admin\AppData\Local\Temp\6143.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\6181.tmp"C:\Users\Admin\AppData\Local\Temp\6181.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\61BF.tmp"C:\Users\Admin\AppData\Local\Temp\61BF.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:840 -
C:\Users\Admin\AppData\Local\Temp\61FE.tmp"C:\Users\Admin\AppData\Local\Temp\61FE.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\623C.tmp"C:\Users\Admin\AppData\Local\Temp\623C.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:932 -
C:\Users\Admin\AppData\Local\Temp\627B.tmp"C:\Users\Admin\AppData\Local\Temp\627B.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\62B9.tmp"C:\Users\Admin\AppData\Local\Temp\62B9.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\62F7.tmp"C:\Users\Admin\AppData\Local\Temp\62F7.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\6326.tmp"C:\Users\Admin\AppData\Local\Temp\6326.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\6365.tmp"C:\Users\Admin\AppData\Local\Temp\6365.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\63A3.tmp"C:\Users\Admin\AppData\Local\Temp\63A3.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\63E1.tmp"C:\Users\Admin\AppData\Local\Temp\63E1.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:292 -
C:\Users\Admin\AppData\Local\Temp\6420.tmp"C:\Users\Admin\AppData\Local\Temp\6420.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\644F.tmp"C:\Users\Admin\AppData\Local\Temp\644F.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\648D.tmp"C:\Users\Admin\AppData\Local\Temp\648D.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\64CB.tmp"C:\Users\Admin\AppData\Local\Temp\64CB.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\650A.tmp"C:\Users\Admin\AppData\Local\Temp\650A.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\6548.tmp"C:\Users\Admin\AppData\Local\Temp\6548.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\6587.tmp"C:\Users\Admin\AppData\Local\Temp\6587.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\65C5.tmp"C:\Users\Admin\AppData\Local\Temp\65C5.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\6603.tmp"C:\Users\Admin\AppData\Local\Temp\6603.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\6642.tmp"C:\Users\Admin\AppData\Local\Temp\6642.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:872 -
C:\Users\Admin\AppData\Local\Temp\6680.tmp"C:\Users\Admin\AppData\Local\Temp\6680.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\66BF.tmp"C:\Users\Admin\AppData\Local\Temp\66BF.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\66FD.tmp"C:\Users\Admin\AppData\Local\Temp\66FD.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\673B.tmp"C:\Users\Admin\AppData\Local\Temp\673B.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\676A.tmp"C:\Users\Admin\AppData\Local\Temp\676A.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\67A9.tmp"C:\Users\Admin\AppData\Local\Temp\67A9.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\67E7.tmp"C:\Users\Admin\AppData\Local\Temp\67E7.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\6835.tmp"C:\Users\Admin\AppData\Local\Temp\6835.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\6883.tmp"C:\Users\Admin\AppData\Local\Temp\6883.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\68D1.tmp"C:\Users\Admin\AppData\Local\Temp\68D1.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\691F.tmp"C:\Users\Admin\AppData\Local\Temp\691F.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\695D.tmp"C:\Users\Admin\AppData\Local\Temp\695D.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\69AB.tmp"C:\Users\Admin\AppData\Local\Temp\69AB.tmp"65⤵
- Executes dropped EXE
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\69F9.tmp"C:\Users\Admin\AppData\Local\Temp\69F9.tmp"66⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\6A57.tmp"C:\Users\Admin\AppData\Local\Temp\6A57.tmp"67⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\6A95.tmp"C:\Users\Admin\AppData\Local\Temp\6A95.tmp"68⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\6AE3.tmp"C:\Users\Admin\AppData\Local\Temp\6AE3.tmp"69⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\6B22.tmp"C:\Users\Admin\AppData\Local\Temp\6B22.tmp"70⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\6B7F.tmp"C:\Users\Admin\AppData\Local\Temp\6B7F.tmp"71⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\6BCD.tmp"C:\Users\Admin\AppData\Local\Temp\6BCD.tmp"72⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\6C0C.tmp"C:\Users\Admin\AppData\Local\Temp\6C0C.tmp"73⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\6C4A.tmp"C:\Users\Admin\AppData\Local\Temp\6C4A.tmp"74⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\6C89.tmp"C:\Users\Admin\AppData\Local\Temp\6C89.tmp"75⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\6CC7.tmp"C:\Users\Admin\AppData\Local\Temp\6CC7.tmp"76⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\6D05.tmp"C:\Users\Admin\AppData\Local\Temp\6D05.tmp"77⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\6D44.tmp"C:\Users\Admin\AppData\Local\Temp\6D44.tmp"78⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\6D82.tmp"C:\Users\Admin\AppData\Local\Temp\6D82.tmp"79⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\6DD0.tmp"C:\Users\Admin\AppData\Local\Temp\6DD0.tmp"80⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\6E1E.tmp"C:\Users\Admin\AppData\Local\Temp\6E1E.tmp"81⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\6E6C.tmp"C:\Users\Admin\AppData\Local\Temp\6E6C.tmp"82⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\6ECA.tmp"C:\Users\Admin\AppData\Local\Temp\6ECA.tmp"83⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\6F18.tmp"C:\Users\Admin\AppData\Local\Temp\6F18.tmp"84⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\6F56.tmp"C:\Users\Admin\AppData\Local\Temp\6F56.tmp"85⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\6F95.tmp"C:\Users\Admin\AppData\Local\Temp\6F95.tmp"86⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\6FD3.tmp"C:\Users\Admin\AppData\Local\Temp\6FD3.tmp"87⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\7011.tmp"C:\Users\Admin\AppData\Local\Temp\7011.tmp"88⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\7050.tmp"C:\Users\Admin\AppData\Local\Temp\7050.tmp"89⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\708E.tmp"C:\Users\Admin\AppData\Local\Temp\708E.tmp"90⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\70CD.tmp"C:\Users\Admin\AppData\Local\Temp\70CD.tmp"91⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\710B.tmp"C:\Users\Admin\AppData\Local\Temp\710B.tmp"92⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\7149.tmp"C:\Users\Admin\AppData\Local\Temp\7149.tmp"93⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\7188.tmp"C:\Users\Admin\AppData\Local\Temp\7188.tmp"94⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\71D6.tmp"C:\Users\Admin\AppData\Local\Temp\71D6.tmp"95⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\7214.tmp"C:\Users\Admin\AppData\Local\Temp\7214.tmp"96⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\7253.tmp"C:\Users\Admin\AppData\Local\Temp\7253.tmp"97⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\7291.tmp"C:\Users\Admin\AppData\Local\Temp\7291.tmp"98⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\72CF.tmp"C:\Users\Admin\AppData\Local\Temp\72CF.tmp"99⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\730E.tmp"C:\Users\Admin\AppData\Local\Temp\730E.tmp"100⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\734C.tmp"C:\Users\Admin\AppData\Local\Temp\734C.tmp"101⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\738B.tmp"C:\Users\Admin\AppData\Local\Temp\738B.tmp"102⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\73C9.tmp"C:\Users\Admin\AppData\Local\Temp\73C9.tmp"103⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"104⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\7446.tmp"C:\Users\Admin\AppData\Local\Temp\7446.tmp"105⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\7484.tmp"C:\Users\Admin\AppData\Local\Temp\7484.tmp"106⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\74C3.tmp"C:\Users\Admin\AppData\Local\Temp\74C3.tmp"107⤵PID:292
-
C:\Users\Admin\AppData\Local\Temp\7501.tmp"C:\Users\Admin\AppData\Local\Temp\7501.tmp"108⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\753F.tmp"C:\Users\Admin\AppData\Local\Temp\753F.tmp"109⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\757E.tmp"C:\Users\Admin\AppData\Local\Temp\757E.tmp"110⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\75BC.tmp"C:\Users\Admin\AppData\Local\Temp\75BC.tmp"111⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\75FB.tmp"C:\Users\Admin\AppData\Local\Temp\75FB.tmp"112⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\7639.tmp"C:\Users\Admin\AppData\Local\Temp\7639.tmp"113⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\7677.tmp"C:\Users\Admin\AppData\Local\Temp\7677.tmp"114⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\76B6.tmp"C:\Users\Admin\AppData\Local\Temp\76B6.tmp"115⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\76F4.tmp"C:\Users\Admin\AppData\Local\Temp\76F4.tmp"116⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"117⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\7771.tmp"C:\Users\Admin\AppData\Local\Temp\7771.tmp"118⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\77AF.tmp"C:\Users\Admin\AppData\Local\Temp\77AF.tmp"119⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\77EE.tmp"C:\Users\Admin\AppData\Local\Temp\77EE.tmp"120⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\782C.tmp"C:\Users\Admin\AppData\Local\Temp\782C.tmp"121⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\786B.tmp"C:\Users\Admin\AppData\Local\Temp\786B.tmp"122⤵PID:2936
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-