Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
02/09/2024, 12:32
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-02_ccb5d7a3ad6f67a9b6a26af3dc045945_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-09-02_ccb5d7a3ad6f67a9b6a26af3dc045945_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-02_ccb5d7a3ad6f67a9b6a26af3dc045945_mafia.exe
-
Size
541KB
-
MD5
ccb5d7a3ad6f67a9b6a26af3dc045945
-
SHA1
31abbb625ef130c5740843510eb3f501a302e256
-
SHA256
127d304429e2356eec3e75b783291c4eec606ce3069f31f13ad134a4bc396ca5
-
SHA512
8e2c2012640b502a45151049a243986d9995bfb1c29bbf0b0918f28c37066863432b0492b7424f1e35095ab834eb07297f1868ccaad486aba80c8830739ae498
-
SSDEEP
12288:UU5rCOTeif0hX8AnQf4gsu/1UtdjRrljfrZa73ctO:UUQOJfSX8AnQA7utUjxBrU73ctO
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2744 EE07.tmp 2884 EE64.tmp 3032 EED2.tmp 2740 EF3F.tmp 2712 EF9C.tmp 3024 F00A.tmp 2592 F067.tmp 2572 F0F4.tmp 2544 F142.tmp 1476 F1AF.tmp 484 F20C.tmp 2824 F27A.tmp 2960 F2E7.tmp 1064 F354.tmp 1712 F3C1.tmp 2288 F41F.tmp 960 F48C.tmp 1148 F4DA.tmp 1460 F557.tmp 536 F5D4.tmp 1688 F641.tmp 2900 F6BE.tmp 2308 F70C.tmp 3056 F75A.tmp 2240 F7A8.tmp 2340 F7F6.tmp 1248 F844.tmp 1876 F882.tmp 2256 F8D0.tmp 1324 F91E.tmp 1496 F95C.tmp 1640 F99B.tmp 2116 F9D9.tmp 840 FA27.tmp 1732 FA66.tmp 932 FAB4.tmp 3004 FAF2.tmp 1808 FB30.tmp 2124 FB6F.tmp 1352 FBAD.tmp 2088 FBFB.tmp 300 FC59.tmp 2220 FCA7.tmp 1068 FCF5.tmp 1868 FD43.tmp 2364 FD81.tmp 1188 FDC0.tmp 1488 FE0E.tmp 2276 FE5C.tmp 2296 FE9A.tmp 1572 FED8.tmp 1596 FF17.tmp 2372 FF65.tmp 2788 FFA3.tmp 2212 FFF1.tmp 2812 3F.tmp 2564 7E.tmp 2556 CC.tmp 2432 129.tmp 2576 177.tmp 2580 1D5.tmp 2944 213.tmp 2996 252.tmp 2696 2A0.tmp -
Loads dropped DLL 64 IoCs
pid Process 2372 2024-09-02_ccb5d7a3ad6f67a9b6a26af3dc045945_mafia.exe 2744 EE07.tmp 2884 EE64.tmp 3032 EED2.tmp 2740 EF3F.tmp 2712 EF9C.tmp 3024 F00A.tmp 2592 F067.tmp 2572 F0F4.tmp 2544 F142.tmp 1476 F1AF.tmp 484 F20C.tmp 2824 F27A.tmp 2960 F2E7.tmp 1064 F354.tmp 1712 F3C1.tmp 2288 F41F.tmp 960 F48C.tmp 1148 F4DA.tmp 1460 F557.tmp 536 F5D4.tmp 1688 F641.tmp 2900 F6BE.tmp 2308 F70C.tmp 3056 F75A.tmp 2240 F7A8.tmp 2340 F7F6.tmp 1248 F844.tmp 1876 F882.tmp 2256 F8D0.tmp 1324 F91E.tmp 1496 F95C.tmp 1640 F99B.tmp 2116 F9D9.tmp 840 FA27.tmp 1732 FA66.tmp 932 FAB4.tmp 3004 FAF2.tmp 1808 FB30.tmp 2124 FB6F.tmp 1352 FBAD.tmp 2088 FBFB.tmp 300 FC59.tmp 2220 FCA7.tmp 1068 FCF5.tmp 1868 FD43.tmp 2364 FD81.tmp 1188 FDC0.tmp 1488 FE0E.tmp 2276 FE5C.tmp 2296 FE9A.tmp 1572 FED8.tmp 1596 FF17.tmp 2372 FF65.tmp 2788 FFA3.tmp 2212 FFF1.tmp 2812 3F.tmp 2564 7E.tmp 2556 CC.tmp 2432 129.tmp 2576 177.tmp 2580 1D5.tmp 2944 213.tmp 2996 252.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E041.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3063.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 476C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 259A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7149.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E4B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2108.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7935.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E56.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D8B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A489.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBE0.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2744 2372 2024-09-02_ccb5d7a3ad6f67a9b6a26af3dc045945_mafia.exe 31 PID 2372 wrote to memory of 2744 2372 2024-09-02_ccb5d7a3ad6f67a9b6a26af3dc045945_mafia.exe 31 PID 2372 wrote to memory of 2744 2372 2024-09-02_ccb5d7a3ad6f67a9b6a26af3dc045945_mafia.exe 31 PID 2372 wrote to memory of 2744 2372 2024-09-02_ccb5d7a3ad6f67a9b6a26af3dc045945_mafia.exe 31 PID 2744 wrote to memory of 2884 2744 EE07.tmp 32 PID 2744 wrote to memory of 2884 2744 EE07.tmp 32 PID 2744 wrote to memory of 2884 2744 EE07.tmp 32 PID 2744 wrote to memory of 2884 2744 EE07.tmp 32 PID 2884 wrote to memory of 3032 2884 EE64.tmp 33 PID 2884 wrote to memory of 3032 2884 EE64.tmp 33 PID 2884 wrote to memory of 3032 2884 EE64.tmp 33 PID 2884 wrote to memory of 3032 2884 EE64.tmp 33 PID 3032 wrote to memory of 2740 3032 EED2.tmp 34 PID 3032 wrote to memory of 2740 3032 EED2.tmp 34 PID 3032 wrote to memory of 2740 3032 EED2.tmp 34 PID 3032 wrote to memory of 2740 3032 EED2.tmp 34 PID 2740 wrote to memory of 2712 2740 EF3F.tmp 35 PID 2740 wrote to memory of 2712 2740 EF3F.tmp 35 PID 2740 wrote to memory of 2712 2740 EF3F.tmp 35 PID 2740 wrote to memory of 2712 2740 EF3F.tmp 35 PID 2712 wrote to memory of 3024 2712 EF9C.tmp 36 PID 2712 wrote to memory of 3024 2712 EF9C.tmp 36 PID 2712 wrote to memory of 3024 2712 EF9C.tmp 36 PID 2712 wrote to memory of 3024 2712 EF9C.tmp 36 PID 3024 wrote to memory of 2592 3024 F00A.tmp 37 PID 3024 wrote to memory of 2592 3024 F00A.tmp 37 PID 3024 wrote to memory of 2592 3024 F00A.tmp 37 PID 3024 wrote to memory of 2592 3024 F00A.tmp 37 PID 2592 wrote to memory of 2572 2592 F067.tmp 38 PID 2592 wrote to memory of 2572 2592 F067.tmp 38 PID 2592 wrote to memory of 2572 2592 F067.tmp 38 PID 2592 wrote to memory of 2572 2592 F067.tmp 38 PID 2572 wrote to memory of 2544 2572 F0F4.tmp 39 PID 2572 wrote to memory of 2544 2572 F0F4.tmp 39 PID 2572 wrote to memory of 2544 2572 F0F4.tmp 39 PID 2572 wrote to memory of 2544 2572 F0F4.tmp 39 PID 2544 wrote to memory of 1476 2544 F142.tmp 40 PID 2544 wrote to memory of 1476 2544 F142.tmp 40 PID 2544 wrote to memory of 1476 2544 F142.tmp 40 PID 2544 wrote to memory of 1476 2544 F142.tmp 40 PID 1476 wrote to memory of 484 1476 F1AF.tmp 41 PID 1476 wrote to memory of 484 1476 F1AF.tmp 41 PID 1476 wrote to memory of 484 1476 F1AF.tmp 41 PID 1476 wrote to memory of 484 1476 F1AF.tmp 41 PID 484 wrote to memory of 2824 484 F20C.tmp 42 PID 484 wrote to memory of 2824 484 F20C.tmp 42 PID 484 wrote to memory of 2824 484 F20C.tmp 42 PID 484 wrote to memory of 2824 484 F20C.tmp 42 PID 2824 wrote to memory of 2960 2824 F27A.tmp 43 PID 2824 wrote to memory of 2960 2824 F27A.tmp 43 PID 2824 wrote to memory of 2960 2824 F27A.tmp 43 PID 2824 wrote to memory of 2960 2824 F27A.tmp 43 PID 2960 wrote to memory of 1064 2960 F2E7.tmp 44 PID 2960 wrote to memory of 1064 2960 F2E7.tmp 44 PID 2960 wrote to memory of 1064 2960 F2E7.tmp 44 PID 2960 wrote to memory of 1064 2960 F2E7.tmp 44 PID 1064 wrote to memory of 1712 1064 F354.tmp 45 PID 1064 wrote to memory of 1712 1064 F354.tmp 45 PID 1064 wrote to memory of 1712 1064 F354.tmp 45 PID 1064 wrote to memory of 1712 1064 F354.tmp 45 PID 1712 wrote to memory of 2288 1712 F3C1.tmp 46 PID 1712 wrote to memory of 2288 1712 F3C1.tmp 46 PID 1712 wrote to memory of 2288 1712 F3C1.tmp 46 PID 1712 wrote to memory of 2288 1712 F3C1.tmp 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-02_ccb5d7a3ad6f67a9b6a26af3dc045945_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-02_ccb5d7a3ad6f67a9b6a26af3dc045945_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\EE07.tmp"C:\Users\Admin\AppData\Local\Temp\EE07.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\EE64.tmp"C:\Users\Admin\AppData\Local\Temp\EE64.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\EED2.tmp"C:\Users\Admin\AppData\Local\Temp\EED2.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\EF3F.tmp"C:\Users\Admin\AppData\Local\Temp\EF3F.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\EF9C.tmp"C:\Users\Admin\AppData\Local\Temp\EF9C.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\F00A.tmp"C:\Users\Admin\AppData\Local\Temp\F00A.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\F067.tmp"C:\Users\Admin\AppData\Local\Temp\F067.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\F0F4.tmp"C:\Users\Admin\AppData\Local\Temp\F0F4.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\F142.tmp"C:\Users\Admin\AppData\Local\Temp\F142.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\F1AF.tmp"C:\Users\Admin\AppData\Local\Temp\F1AF.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\F20C.tmp"C:\Users\Admin\AppData\Local\Temp\F20C.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:484 -
C:\Users\Admin\AppData\Local\Temp\F27A.tmp"C:\Users\Admin\AppData\Local\Temp\F27A.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\F2E7.tmp"C:\Users\Admin\AppData\Local\Temp\F2E7.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\F354.tmp"C:\Users\Admin\AppData\Local\Temp\F354.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\F3C1.tmp"C:\Users\Admin\AppData\Local\Temp\F3C1.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\F41F.tmp"C:\Users\Admin\AppData\Local\Temp\F41F.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\F48C.tmp"C:\Users\Admin\AppData\Local\Temp\F48C.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:960 -
C:\Users\Admin\AppData\Local\Temp\F4DA.tmp"C:\Users\Admin\AppData\Local\Temp\F4DA.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\F557.tmp"C:\Users\Admin\AppData\Local\Temp\F557.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\F5D4.tmp"C:\Users\Admin\AppData\Local\Temp\F5D4.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:536 -
C:\Users\Admin\AppData\Local\Temp\F641.tmp"C:\Users\Admin\AppData\Local\Temp\F641.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\F6BE.tmp"C:\Users\Admin\AppData\Local\Temp\F6BE.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\F70C.tmp"C:\Users\Admin\AppData\Local\Temp\F70C.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\F75A.tmp"C:\Users\Admin\AppData\Local\Temp\F75A.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\F7A8.tmp"C:\Users\Admin\AppData\Local\Temp\F7A8.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\F7F6.tmp"C:\Users\Admin\AppData\Local\Temp\F7F6.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\F844.tmp"C:\Users\Admin\AppData\Local\Temp\F844.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\F882.tmp"C:\Users\Admin\AppData\Local\Temp\F882.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\F8D0.tmp"C:\Users\Admin\AppData\Local\Temp\F8D0.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\F91E.tmp"C:\Users\Admin\AppData\Local\Temp\F91E.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\F95C.tmp"C:\Users\Admin\AppData\Local\Temp\F95C.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\F99B.tmp"C:\Users\Admin\AppData\Local\Temp\F99B.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\F9D9.tmp"C:\Users\Admin\AppData\Local\Temp\F9D9.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\FA27.tmp"C:\Users\Admin\AppData\Local\Temp\FA27.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:840 -
C:\Users\Admin\AppData\Local\Temp\FA66.tmp"C:\Users\Admin\AppData\Local\Temp\FA66.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\FAB4.tmp"C:\Users\Admin\AppData\Local\Temp\FAB4.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:932 -
C:\Users\Admin\AppData\Local\Temp\FAF2.tmp"C:\Users\Admin\AppData\Local\Temp\FAF2.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\FB30.tmp"C:\Users\Admin\AppData\Local\Temp\FB30.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\FB6F.tmp"C:\Users\Admin\AppData\Local\Temp\FB6F.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\FBAD.tmp"C:\Users\Admin\AppData\Local\Temp\FBAD.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\FBFB.tmp"C:\Users\Admin\AppData\Local\Temp\FBFB.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\FC59.tmp"C:\Users\Admin\AppData\Local\Temp\FC59.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:300 -
C:\Users\Admin\AppData\Local\Temp\FCA7.tmp"C:\Users\Admin\AppData\Local\Temp\FCA7.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\FCF5.tmp"C:\Users\Admin\AppData\Local\Temp\FCF5.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\FD43.tmp"C:\Users\Admin\AppData\Local\Temp\FD43.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\FD81.tmp"C:\Users\Admin\AppData\Local\Temp\FD81.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\FDC0.tmp"C:\Users\Admin\AppData\Local\Temp\FDC0.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\FE0E.tmp"C:\Users\Admin\AppData\Local\Temp\FE0E.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\FE5C.tmp"C:\Users\Admin\AppData\Local\Temp\FE5C.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\FE9A.tmp"C:\Users\Admin\AppData\Local\Temp\FE9A.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\FED8.tmp"C:\Users\Admin\AppData\Local\Temp\FED8.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\FF17.tmp"C:\Users\Admin\AppData\Local\Temp\FF17.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\FF65.tmp"C:\Users\Admin\AppData\Local\Temp\FF65.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\FFA3.tmp"C:\Users\Admin\AppData\Local\Temp\FFA3.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\FFF1.tmp"C:\Users\Admin\AppData\Local\Temp\FFF1.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\3F.tmp"C:\Users\Admin\AppData\Local\Temp\3F.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\7E.tmp"C:\Users\Admin\AppData\Local\Temp\7E.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\CC.tmp"C:\Users\Admin\AppData\Local\Temp\CC.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\129.tmp"C:\Users\Admin\AppData\Local\Temp\129.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\177.tmp"C:\Users\Admin\AppData\Local\Temp\177.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\1D5.tmp"C:\Users\Admin\AppData\Local\Temp\1D5.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\213.tmp"C:\Users\Admin\AppData\Local\Temp\213.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\252.tmp"C:\Users\Admin\AppData\Local\Temp\252.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\2A0.tmp"C:\Users\Admin\AppData\Local\Temp\2A0.tmp"65⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\2EE.tmp"C:\Users\Admin\AppData\Local\Temp\2EE.tmp"66⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\32C.tmp"C:\Users\Admin\AppData\Local\Temp\32C.tmp"67⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\36A.tmp"C:\Users\Admin\AppData\Local\Temp\36A.tmp"68⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\3B8.tmp"C:\Users\Admin\AppData\Local\Temp\3B8.tmp"69⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\3F7.tmp"C:\Users\Admin\AppData\Local\Temp\3F7.tmp"70⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\435.tmp"C:\Users\Admin\AppData\Local\Temp\435.tmp"71⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\483.tmp"C:\Users\Admin\AppData\Local\Temp\483.tmp"72⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\4D1.tmp"C:\Users\Admin\AppData\Local\Temp\4D1.tmp"73⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\510.tmp"C:\Users\Admin\AppData\Local\Temp\510.tmp"74⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\55E.tmp"C:\Users\Admin\AppData\Local\Temp\55E.tmp"75⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\5AC.tmp"C:\Users\Admin\AppData\Local\Temp\5AC.tmp"76⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\5FA.tmp"C:\Users\Admin\AppData\Local\Temp\5FA.tmp"77⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\638.tmp"C:\Users\Admin\AppData\Local\Temp\638.tmp"78⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\686.tmp"C:\Users\Admin\AppData\Local\Temp\686.tmp"79⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\6D4.tmp"C:\Users\Admin\AppData\Local\Temp\6D4.tmp"80⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\712.tmp"C:\Users\Admin\AppData\Local\Temp\712.tmp"81⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\751.tmp"C:\Users\Admin\AppData\Local\Temp\751.tmp"82⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\78F.tmp"C:\Users\Admin\AppData\Local\Temp\78F.tmp"83⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\7DD.tmp"C:\Users\Admin\AppData\Local\Temp\7DD.tmp"84⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\81C.tmp"C:\Users\Admin\AppData\Local\Temp\81C.tmp"85⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\85A.tmp"C:\Users\Admin\AppData\Local\Temp\85A.tmp"86⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\898.tmp"C:\Users\Admin\AppData\Local\Temp\898.tmp"87⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\8D7.tmp"C:\Users\Admin\AppData\Local\Temp\8D7.tmp"88⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\915.tmp"C:\Users\Admin\AppData\Local\Temp\915.tmp"89⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\963.tmp"C:\Users\Admin\AppData\Local\Temp\963.tmp"90⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\9A2.tmp"C:\Users\Admin\AppData\Local\Temp\9A2.tmp"91⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\9F0.tmp"C:\Users\Admin\AppData\Local\Temp\9F0.tmp"92⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\A2E.tmp"C:\Users\Admin\AppData\Local\Temp\A2E.tmp"93⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\A7C.tmp"C:\Users\Admin\AppData\Local\Temp\A7C.tmp"94⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\ACA.tmp"C:\Users\Admin\AppData\Local\Temp\ACA.tmp"95⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\B08.tmp"C:\Users\Admin\AppData\Local\Temp\B08.tmp"96⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\B56.tmp"C:\Users\Admin\AppData\Local\Temp\B56.tmp"97⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\BA4.tmp"C:\Users\Admin\AppData\Local\Temp\BA4.tmp"98⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\BF2.tmp"C:\Users\Admin\AppData\Local\Temp\BF2.tmp"99⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\C31.tmp"C:\Users\Admin\AppData\Local\Temp\C31.tmp"100⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\C6F.tmp"C:\Users\Admin\AppData\Local\Temp\C6F.tmp"101⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\CAE.tmp"C:\Users\Admin\AppData\Local\Temp\CAE.tmp"102⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\CEC.tmp"C:\Users\Admin\AppData\Local\Temp\CEC.tmp"103⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\D2A.tmp"C:\Users\Admin\AppData\Local\Temp\D2A.tmp"104⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\D69.tmp"C:\Users\Admin\AppData\Local\Temp\D69.tmp"105⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\DA7.tmp"C:\Users\Admin\AppData\Local\Temp\DA7.tmp"106⤵PID:300
-
C:\Users\Admin\AppData\Local\Temp\E53.tmp"C:\Users\Admin\AppData\Local\Temp\E53.tmp"107⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\E91.tmp"C:\Users\Admin\AppData\Local\Temp\E91.tmp"108⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\EDF.tmp"C:\Users\Admin\AppData\Local\Temp\EDF.tmp"109⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\F2D.tmp"C:\Users\Admin\AppData\Local\Temp\F2D.tmp"110⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\F7B.tmp"C:\Users\Admin\AppData\Local\Temp\F7B.tmp"111⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\FBA.tmp"C:\Users\Admin\AppData\Local\Temp\FBA.tmp"112⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\FF8.tmp"C:\Users\Admin\AppData\Local\Temp\FF8.tmp"113⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\1046.tmp"C:\Users\Admin\AppData\Local\Temp\1046.tmp"114⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\1084.tmp"C:\Users\Admin\AppData\Local\Temp\1084.tmp"115⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\10F2.tmp"C:\Users\Admin\AppData\Local\Temp\10F2.tmp"116⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\1130.tmp"C:\Users\Admin\AppData\Local\Temp\1130.tmp"117⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\116E.tmp"C:\Users\Admin\AppData\Local\Temp\116E.tmp"118⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\11BC.tmp"C:\Users\Admin\AppData\Local\Temp\11BC.tmp"119⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\11FB.tmp"C:\Users\Admin\AppData\Local\Temp\11FB.tmp"120⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\1239.tmp"C:\Users\Admin\AppData\Local\Temp\1239.tmp"121⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\1287.tmp"C:\Users\Admin\AppData\Local\Temp\1287.tmp"122⤵PID:2556
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-