Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
03/09/2024, 02:26
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-03_cfe7c41a3fdde181bbd7a26c0561141d_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-09-03_cfe7c41a3fdde181bbd7a26c0561141d_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-03_cfe7c41a3fdde181bbd7a26c0561141d_mafia.exe
-
Size
487KB
-
MD5
cfe7c41a3fdde181bbd7a26c0561141d
-
SHA1
0ba834b8fdd1c4ddbe1cb6f5ef3c3a665627b2ef
-
SHA256
0a8c44a9b2d34ed3431a462bc8e69cf52629b304675fca99de413d8bb6be7b99
-
SHA512
ad779bd81984024b9c7f2e1b3458a80f981f4528b64b97a944472d5f4d3714f4cde22c084ae67f7f20669f1304a154b67b4d8596189e8e440baed4948cc94bfa
-
SSDEEP
12288:yU5rCOTeiNaCvO+iRllplx5qfubxqhy7fbZ:yUQOJNPEllDifubkyrb
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2712 6DE0.tmp 1932 6E5D.tmp 2636 6ECA.tmp 2772 6F27.tmp 2612 6FA4.tmp 2684 7021.tmp 2288 708E.tmp 596 70EC.tmp 1152 7159.tmp 572 71C6.tmp 556 7233.tmp 2208 72A1.tmp 2088 730E.tmp 2784 736B.tmp 1956 73D9.tmp 2676 7446.tmp 1160 74A3.tmp 2432 7511.tmp 2960 758D.tmp 1832 75EB.tmp 1604 7658.tmp 2008 76D5.tmp 3048 7733.tmp 2268 7771.tmp 2196 77AF.tmp 1156 77EE.tmp 2440 782C.tmp 2496 786B.tmp 1116 78A9.tmp 1808 78E7.tmp 444 7926.tmp 2328 7964.tmp 2072 79A3.tmp 708 79E1.tmp 344 7A1F.tmp 1952 7A5E.tmp 1368 7A9C.tmp 1544 7ADB.tmp 1276 7B19.tmp 916 7B57.tmp 564 7B96.tmp 1532 7BD4.tmp 1788 7C13.tmp 2376 7C51.tmp 2584 7C8F.tmp 316 7CCE.tmp 2408 7D0C.tmp 2016 7D4B.tmp 1072 7D89.tmp 1088 7DC7.tmp 1636 7E06.tmp 2852 7E44.tmp 1596 7E83.tmp 2740 7EC1.tmp 2732 7EFF.tmp 2632 7F3E.tmp 2296 7F7C.tmp 2656 7FBB.tmp 2624 7FF9.tmp 2620 8037.tmp 1800 8076.tmp 2140 80C4.tmp 2452 8102.tmp 480 8141.tmp -
Loads dropped DLL 64 IoCs
pid Process 3028 2024-09-03_cfe7c41a3fdde181bbd7a26c0561141d_mafia.exe 2712 6DE0.tmp 1932 6E5D.tmp 2636 6ECA.tmp 2772 6F27.tmp 2612 6FA4.tmp 2684 7021.tmp 2288 708E.tmp 596 70EC.tmp 1152 7159.tmp 572 71C6.tmp 556 7233.tmp 2208 72A1.tmp 2088 730E.tmp 2784 736B.tmp 1956 73D9.tmp 2676 7446.tmp 1160 74A3.tmp 2432 7511.tmp 2960 758D.tmp 1832 75EB.tmp 1604 7658.tmp 2008 76D5.tmp 3048 7733.tmp 2268 7771.tmp 2196 77AF.tmp 1156 77EE.tmp 2440 782C.tmp 2496 786B.tmp 1116 78A9.tmp 1808 78E7.tmp 444 7926.tmp 2328 7964.tmp 2072 79A3.tmp 708 79E1.tmp 344 7A1F.tmp 1952 7A5E.tmp 1368 7A9C.tmp 1544 7ADB.tmp 1276 7B19.tmp 916 7B57.tmp 564 7B96.tmp 1532 7BD4.tmp 1788 7C13.tmp 2376 7C51.tmp 2584 7C8F.tmp 316 7CCE.tmp 2408 7D0C.tmp 2016 7D4B.tmp 1072 7D89.tmp 1088 7DC7.tmp 1636 7E06.tmp 2852 7E44.tmp 1596 7E83.tmp 2740 7EC1.tmp 2732 7EFF.tmp 2632 7F3E.tmp 2296 7F7C.tmp 2656 7FBB.tmp 2624 7FF9.tmp 2620 8037.tmp 1800 8076.tmp 2140 80C4.tmp 2452 8102.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 384F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5274.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BF7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BD4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 256B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 847B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2896.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E2A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2626.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E659.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D28B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9119.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9405.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F44.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B413.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F058.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3028 wrote to memory of 2712 3028 2024-09-03_cfe7c41a3fdde181bbd7a26c0561141d_mafia.exe 30 PID 3028 wrote to memory of 2712 3028 2024-09-03_cfe7c41a3fdde181bbd7a26c0561141d_mafia.exe 30 PID 3028 wrote to memory of 2712 3028 2024-09-03_cfe7c41a3fdde181bbd7a26c0561141d_mafia.exe 30 PID 3028 wrote to memory of 2712 3028 2024-09-03_cfe7c41a3fdde181bbd7a26c0561141d_mafia.exe 30 PID 2712 wrote to memory of 1932 2712 6DE0.tmp 31 PID 2712 wrote to memory of 1932 2712 6DE0.tmp 31 PID 2712 wrote to memory of 1932 2712 6DE0.tmp 31 PID 2712 wrote to memory of 1932 2712 6DE0.tmp 31 PID 1932 wrote to memory of 2636 1932 6E5D.tmp 32 PID 1932 wrote to memory of 2636 1932 6E5D.tmp 32 PID 1932 wrote to memory of 2636 1932 6E5D.tmp 32 PID 1932 wrote to memory of 2636 1932 6E5D.tmp 32 PID 2636 wrote to memory of 2772 2636 6ECA.tmp 33 PID 2636 wrote to memory of 2772 2636 6ECA.tmp 33 PID 2636 wrote to memory of 2772 2636 6ECA.tmp 33 PID 2636 wrote to memory of 2772 2636 6ECA.tmp 33 PID 2772 wrote to memory of 2612 2772 6F27.tmp 34 PID 2772 wrote to memory of 2612 2772 6F27.tmp 34 PID 2772 wrote to memory of 2612 2772 6F27.tmp 34 PID 2772 wrote to memory of 2612 2772 6F27.tmp 34 PID 2612 wrote to memory of 2684 2612 6FA4.tmp 35 PID 2612 wrote to memory of 2684 2612 6FA4.tmp 35 PID 2612 wrote to memory of 2684 2612 6FA4.tmp 35 PID 2612 wrote to memory of 2684 2612 6FA4.tmp 35 PID 2684 wrote to memory of 2288 2684 7021.tmp 36 PID 2684 wrote to memory of 2288 2684 7021.tmp 36 PID 2684 wrote to memory of 2288 2684 7021.tmp 36 PID 2684 wrote to memory of 2288 2684 7021.tmp 36 PID 2288 wrote to memory of 596 2288 708E.tmp 37 PID 2288 wrote to memory of 596 2288 708E.tmp 37 PID 2288 wrote to memory of 596 2288 708E.tmp 37 PID 2288 wrote to memory of 596 2288 708E.tmp 37 PID 596 wrote to memory of 1152 596 70EC.tmp 38 PID 596 wrote to memory of 1152 596 70EC.tmp 38 PID 596 wrote to memory of 1152 596 70EC.tmp 38 PID 596 wrote to memory of 1152 596 70EC.tmp 38 PID 1152 wrote to memory of 572 1152 7159.tmp 39 PID 1152 wrote to memory of 572 1152 7159.tmp 39 PID 1152 wrote to memory of 572 1152 7159.tmp 39 PID 1152 wrote to memory of 572 1152 7159.tmp 39 PID 572 wrote to memory of 556 572 71C6.tmp 40 PID 572 wrote to memory of 556 572 71C6.tmp 40 PID 572 wrote to memory of 556 572 71C6.tmp 40 PID 572 wrote to memory of 556 572 71C6.tmp 40 PID 556 wrote to memory of 2208 556 7233.tmp 41 PID 556 wrote to memory of 2208 556 7233.tmp 41 PID 556 wrote to memory of 2208 556 7233.tmp 41 PID 556 wrote to memory of 2208 556 7233.tmp 41 PID 2208 wrote to memory of 2088 2208 72A1.tmp 42 PID 2208 wrote to memory of 2088 2208 72A1.tmp 42 PID 2208 wrote to memory of 2088 2208 72A1.tmp 42 PID 2208 wrote to memory of 2088 2208 72A1.tmp 42 PID 2088 wrote to memory of 2784 2088 730E.tmp 43 PID 2088 wrote to memory of 2784 2088 730E.tmp 43 PID 2088 wrote to memory of 2784 2088 730E.tmp 43 PID 2088 wrote to memory of 2784 2088 730E.tmp 43 PID 2784 wrote to memory of 1956 2784 736B.tmp 44 PID 2784 wrote to memory of 1956 2784 736B.tmp 44 PID 2784 wrote to memory of 1956 2784 736B.tmp 44 PID 2784 wrote to memory of 1956 2784 736B.tmp 44 PID 1956 wrote to memory of 2676 1956 73D9.tmp 45 PID 1956 wrote to memory of 2676 1956 73D9.tmp 45 PID 1956 wrote to memory of 2676 1956 73D9.tmp 45 PID 1956 wrote to memory of 2676 1956 73D9.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-03_cfe7c41a3fdde181bbd7a26c0561141d_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-03_cfe7c41a3fdde181bbd7a26c0561141d_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\6DE0.tmp"C:\Users\Admin\AppData\Local\Temp\6DE0.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\6E5D.tmp"C:\Users\Admin\AppData\Local\Temp\6E5D.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\6ECA.tmp"C:\Users\Admin\AppData\Local\Temp\6ECA.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\6F27.tmp"C:\Users\Admin\AppData\Local\Temp\6F27.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\6FA4.tmp"C:\Users\Admin\AppData\Local\Temp\6FA4.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\7021.tmp"C:\Users\Admin\AppData\Local\Temp\7021.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\708E.tmp"C:\Users\Admin\AppData\Local\Temp\708E.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\70EC.tmp"C:\Users\Admin\AppData\Local\Temp\70EC.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Users\Admin\AppData\Local\Temp\7159.tmp"C:\Users\Admin\AppData\Local\Temp\7159.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\71C6.tmp"C:\Users\Admin\AppData\Local\Temp\71C6.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Users\Admin\AppData\Local\Temp\7233.tmp"C:\Users\Admin\AppData\Local\Temp\7233.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\72A1.tmp"C:\Users\Admin\AppData\Local\Temp\72A1.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\730E.tmp"C:\Users\Admin\AppData\Local\Temp\730E.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\736B.tmp"C:\Users\Admin\AppData\Local\Temp\736B.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\73D9.tmp"C:\Users\Admin\AppData\Local\Temp\73D9.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\7446.tmp"C:\Users\Admin\AppData\Local\Temp\7446.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\74A3.tmp"C:\Users\Admin\AppData\Local\Temp\74A3.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\758D.tmp"C:\Users\Admin\AppData\Local\Temp\758D.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\75EB.tmp"C:\Users\Admin\AppData\Local\Temp\75EB.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\7658.tmp"C:\Users\Admin\AppData\Local\Temp\7658.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\76D5.tmp"C:\Users\Admin\AppData\Local\Temp\76D5.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\7771.tmp"C:\Users\Admin\AppData\Local\Temp\7771.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\77AF.tmp"C:\Users\Admin\AppData\Local\Temp\77AF.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\77EE.tmp"C:\Users\Admin\AppData\Local\Temp\77EE.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\782C.tmp"C:\Users\Admin\AppData\Local\Temp\782C.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\786B.tmp"C:\Users\Admin\AppData\Local\Temp\786B.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\78A9.tmp"C:\Users\Admin\AppData\Local\Temp\78A9.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\78E7.tmp"C:\Users\Admin\AppData\Local\Temp\78E7.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\7926.tmp"C:\Users\Admin\AppData\Local\Temp\7926.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:444 -
C:\Users\Admin\AppData\Local\Temp\7964.tmp"C:\Users\Admin\AppData\Local\Temp\7964.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\79A3.tmp"C:\Users\Admin\AppData\Local\Temp\79A3.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\79E1.tmp"C:\Users\Admin\AppData\Local\Temp\79E1.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:708 -
C:\Users\Admin\AppData\Local\Temp\7A1F.tmp"C:\Users\Admin\AppData\Local\Temp\7A1F.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:344 -
C:\Users\Admin\AppData\Local\Temp\7A5E.tmp"C:\Users\Admin\AppData\Local\Temp\7A5E.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\7A9C.tmp"C:\Users\Admin\AppData\Local\Temp\7A9C.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\7ADB.tmp"C:\Users\Admin\AppData\Local\Temp\7ADB.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\7B19.tmp"C:\Users\Admin\AppData\Local\Temp\7B19.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\7B57.tmp"C:\Users\Admin\AppData\Local\Temp\7B57.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:916 -
C:\Users\Admin\AppData\Local\Temp\7B96.tmp"C:\Users\Admin\AppData\Local\Temp\7B96.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:564 -
C:\Users\Admin\AppData\Local\Temp\7BD4.tmp"C:\Users\Admin\AppData\Local\Temp\7BD4.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\7C13.tmp"C:\Users\Admin\AppData\Local\Temp\7C13.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\7C51.tmp"C:\Users\Admin\AppData\Local\Temp\7C51.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\7C8F.tmp"C:\Users\Admin\AppData\Local\Temp\7C8F.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\7CCE.tmp"C:\Users\Admin\AppData\Local\Temp\7CCE.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:316 -
C:\Users\Admin\AppData\Local\Temp\7D0C.tmp"C:\Users\Admin\AppData\Local\Temp\7D0C.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\7D4B.tmp"C:\Users\Admin\AppData\Local\Temp\7D4B.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\7D89.tmp"C:\Users\Admin\AppData\Local\Temp\7D89.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\7DC7.tmp"C:\Users\Admin\AppData\Local\Temp\7DC7.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\7E06.tmp"C:\Users\Admin\AppData\Local\Temp\7E06.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\7E44.tmp"C:\Users\Admin\AppData\Local\Temp\7E44.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\7E83.tmp"C:\Users\Admin\AppData\Local\Temp\7E83.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\7EC1.tmp"C:\Users\Admin\AppData\Local\Temp\7EC1.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\7EFF.tmp"C:\Users\Admin\AppData\Local\Temp\7EFF.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\7F3E.tmp"C:\Users\Admin\AppData\Local\Temp\7F3E.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\7F7C.tmp"C:\Users\Admin\AppData\Local\Temp\7F7C.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\7FBB.tmp"C:\Users\Admin\AppData\Local\Temp\7FBB.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\7FF9.tmp"C:\Users\Admin\AppData\Local\Temp\7FF9.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\8037.tmp"C:\Users\Admin\AppData\Local\Temp\8037.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\8076.tmp"C:\Users\Admin\AppData\Local\Temp\8076.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\80C4.tmp"C:\Users\Admin\AppData\Local\Temp\80C4.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\8102.tmp"C:\Users\Admin\AppData\Local\Temp\8102.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\8141.tmp"C:\Users\Admin\AppData\Local\Temp\8141.tmp"65⤵
- Executes dropped EXE
PID:480 -
C:\Users\Admin\AppData\Local\Temp\818F.tmp"C:\Users\Admin\AppData\Local\Temp\818F.tmp"66⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\81CD.tmp"C:\Users\Admin\AppData\Local\Temp\81CD.tmp"67⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\820B.tmp"C:\Users\Admin\AppData\Local\Temp\820B.tmp"68⤵PID:660
-
C:\Users\Admin\AppData\Local\Temp\824A.tmp"C:\Users\Admin\AppData\Local\Temp\824A.tmp"69⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\8288.tmp"C:\Users\Admin\AppData\Local\Temp\8288.tmp"70⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\82C7.tmp"C:\Users\Admin\AppData\Local\Temp\82C7.tmp"71⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\8305.tmp"C:\Users\Admin\AppData\Local\Temp\8305.tmp"72⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\8343.tmp"C:\Users\Admin\AppData\Local\Temp\8343.tmp"73⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\8382.tmp"C:\Users\Admin\AppData\Local\Temp\8382.tmp"74⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\83C0.tmp"C:\Users\Admin\AppData\Local\Temp\83C0.tmp"75⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\83FF.tmp"C:\Users\Admin\AppData\Local\Temp\83FF.tmp"76⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\843D.tmp"C:\Users\Admin\AppData\Local\Temp\843D.tmp"77⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\847B.tmp"C:\Users\Admin\AppData\Local\Temp\847B.tmp"78⤵
- System Location Discovery: System Language Discovery
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\84BA.tmp"C:\Users\Admin\AppData\Local\Temp\84BA.tmp"79⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\84F8.tmp"C:\Users\Admin\AppData\Local\Temp\84F8.tmp"80⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\8537.tmp"C:\Users\Admin\AppData\Local\Temp\8537.tmp"81⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\8575.tmp"C:\Users\Admin\AppData\Local\Temp\8575.tmp"82⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\85B3.tmp"C:\Users\Admin\AppData\Local\Temp\85B3.tmp"83⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\85F2.tmp"C:\Users\Admin\AppData\Local\Temp\85F2.tmp"84⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\8630.tmp"C:\Users\Admin\AppData\Local\Temp\8630.tmp"85⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\866F.tmp"C:\Users\Admin\AppData\Local\Temp\866F.tmp"86⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\86AD.tmp"C:\Users\Admin\AppData\Local\Temp\86AD.tmp"87⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\86EB.tmp"C:\Users\Admin\AppData\Local\Temp\86EB.tmp"88⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\872A.tmp"C:\Users\Admin\AppData\Local\Temp\872A.tmp"89⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\8768.tmp"C:\Users\Admin\AppData\Local\Temp\8768.tmp"90⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\87A7.tmp"C:\Users\Admin\AppData\Local\Temp\87A7.tmp"91⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\87F5.tmp"C:\Users\Admin\AppData\Local\Temp\87F5.tmp"92⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\8833.tmp"C:\Users\Admin\AppData\Local\Temp\8833.tmp"93⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\8871.tmp"C:\Users\Admin\AppData\Local\Temp\8871.tmp"94⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\88B0.tmp"C:\Users\Admin\AppData\Local\Temp\88B0.tmp"95⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\88EE.tmp"C:\Users\Admin\AppData\Local\Temp\88EE.tmp"96⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\892D.tmp"C:\Users\Admin\AppData\Local\Temp\892D.tmp"97⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\896B.tmp"C:\Users\Admin\AppData\Local\Temp\896B.tmp"98⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\89A9.tmp"C:\Users\Admin\AppData\Local\Temp\89A9.tmp"99⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\89E8.tmp"C:\Users\Admin\AppData\Local\Temp\89E8.tmp"100⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\8A26.tmp"C:\Users\Admin\AppData\Local\Temp\8A26.tmp"101⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\8A65.tmp"C:\Users\Admin\AppData\Local\Temp\8A65.tmp"102⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\8AA3.tmp"C:\Users\Admin\AppData\Local\Temp\8AA3.tmp"103⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\8AE1.tmp"C:\Users\Admin\AppData\Local\Temp\8AE1.tmp"104⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\8B20.tmp"C:\Users\Admin\AppData\Local\Temp\8B20.tmp"105⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\8B5E.tmp"C:\Users\Admin\AppData\Local\Temp\8B5E.tmp"106⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\8B9D.tmp"C:\Users\Admin\AppData\Local\Temp\8B9D.tmp"107⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\8BDB.tmp"C:\Users\Admin\AppData\Local\Temp\8BDB.tmp"108⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\8C19.tmp"C:\Users\Admin\AppData\Local\Temp\8C19.tmp"109⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\8C58.tmp"C:\Users\Admin\AppData\Local\Temp\8C58.tmp"110⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\8C96.tmp"C:\Users\Admin\AppData\Local\Temp\8C96.tmp"111⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\8CD5.tmp"C:\Users\Admin\AppData\Local\Temp\8CD5.tmp"112⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\8D13.tmp"C:\Users\Admin\AppData\Local\Temp\8D13.tmp"113⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\8D51.tmp"C:\Users\Admin\AppData\Local\Temp\8D51.tmp"114⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\8D90.tmp"C:\Users\Admin\AppData\Local\Temp\8D90.tmp"115⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\8DCE.tmp"C:\Users\Admin\AppData\Local\Temp\8DCE.tmp"116⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"117⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\8E6A.tmp"C:\Users\Admin\AppData\Local\Temp\8E6A.tmp"118⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\8EA9.tmp"C:\Users\Admin\AppData\Local\Temp\8EA9.tmp"119⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\8EE7.tmp"C:\Users\Admin\AppData\Local\Temp\8EE7.tmp"120⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\8F25.tmp"C:\Users\Admin\AppData\Local\Temp\8F25.tmp"121⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\8F64.tmp"C:\Users\Admin\AppData\Local\Temp\8F64.tmp"122⤵PID:2296
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-