Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/09/2024, 06:06
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-05_cac48cd2685caeb01f5161998238a701_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-05_cac48cd2685caeb01f5161998238a701_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-05_cac48cd2685caeb01f5161998238a701_mafia.exe
-
Size
529KB
-
MD5
cac48cd2685caeb01f5161998238a701
-
SHA1
89a7576b59ab36b4143c62435d21fe3f9118b4a1
-
SHA256
f360d62a930a309b2f5cf66deff2bd0308af2f3b6aba7e0b5602fba1bbd27b21
-
SHA512
601804329df62a548386d1ea880fd6967a9abc7c1824d1f80401aee2f3dfa0884436d74b8fa170c55163d5a85d380ab1b97ea45a9da5f49cb2870d2304b24fd6
-
SSDEEP
12288:NU5rCOTeijtVyCZIJTi1CY6s6TZwlH4Hp:NUQOJjtVyCZINQCLs6TSlH4Hp
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2100 C311.tmp 1892 C34F.tmp 2660 C3EB.tmp 2080 C458.tmp 1920 C4D5.tmp 2484 C542.tmp 2864 C5BF.tmp 2684 C62C.tmp 2804 C6A9.tmp 2704 C716.tmp 2852 C793.tmp 2612 C810.tmp 2712 C86D.tmp 2632 C8DB.tmp 2648 C919.tmp 2628 C967.tmp 2024 C9E4.tmp 1676 CA51.tmp 1508 CABE.tmp 1704 CB3B.tmp 1496 CBA8.tmp 1308 CC15.tmp 1768 CC73.tmp 2644 CCB1.tmp 1708 CCF0.tmp 2876 CD2E.tmp 2996 CD6D.tmp 2452 CDAB.tmp 2884 CDE9.tmp 2456 CE28.tmp 584 CE66.tmp 1084 CEA5.tmp 2760 CEE3.tmp 684 CF21.tmp 1356 CF60.tmp 1368 CF9E.tmp 2036 CFDD.tmp 1640 D01B.tmp 848 D059.tmp 3040 D098.tmp 952 D0D6.tmp 1524 D115.tmp 292 D153.tmp 924 D191.tmp 300 D1D0.tmp 2420 D20E.tmp 760 D24D.tmp 3004 D28B.tmp 2468 D2C9.tmp 2388 D308.tmp 1684 D346.tmp 1792 D385.tmp 2500 D3C3.tmp 2488 D401.tmp 2924 D440.tmp 1912 D47E.tmp 2660 D4BD.tmp 1592 D4FB.tmp 2520 D539.tmp 2344 D578.tmp 2348 D5B6.tmp 2300 D614.tmp 2724 D652.tmp 2792 D691.tmp -
Loads dropped DLL 64 IoCs
pid Process 2236 2024-09-05_cac48cd2685caeb01f5161998238a701_mafia.exe 2100 C311.tmp 1892 C34F.tmp 2660 C3EB.tmp 2080 C458.tmp 1920 C4D5.tmp 2484 C542.tmp 2864 C5BF.tmp 2684 C62C.tmp 2804 C6A9.tmp 2704 C716.tmp 2852 C793.tmp 2612 C810.tmp 2712 C86D.tmp 2632 C8DB.tmp 2648 C919.tmp 2628 C967.tmp 2024 C9E4.tmp 1676 CA51.tmp 1508 CABE.tmp 1704 CB3B.tmp 1496 CBA8.tmp 1308 CC15.tmp 1768 CC73.tmp 2644 CCB1.tmp 1708 CCF0.tmp 2876 CD2E.tmp 2996 CD6D.tmp 2452 CDAB.tmp 2884 CDE9.tmp 2456 CE28.tmp 584 CE66.tmp 1084 CEA5.tmp 2760 CEE3.tmp 684 CF21.tmp 1356 CF60.tmp 1368 CF9E.tmp 2036 CFDD.tmp 1640 D01B.tmp 848 D059.tmp 3040 D098.tmp 952 D0D6.tmp 1524 D115.tmp 292 D153.tmp 924 D191.tmp 300 D1D0.tmp 2420 D20E.tmp 760 D24D.tmp 3004 D28B.tmp 2468 D2C9.tmp 2388 D308.tmp 1684 D346.tmp 1792 D385.tmp 2500 D3C3.tmp 2488 D401.tmp 2924 D440.tmp 1912 D47E.tmp 2660 D4BD.tmp 1592 D4FB.tmp 2520 D539.tmp 2344 D578.tmp 2348 D5B6.tmp 2300 D614.tmp 2724 D652.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7790.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8804.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A19C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A979.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C014.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B201.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E77.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6049.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2100 2236 2024-09-05_cac48cd2685caeb01f5161998238a701_mafia.exe 30 PID 2236 wrote to memory of 2100 2236 2024-09-05_cac48cd2685caeb01f5161998238a701_mafia.exe 30 PID 2236 wrote to memory of 2100 2236 2024-09-05_cac48cd2685caeb01f5161998238a701_mafia.exe 30 PID 2236 wrote to memory of 2100 2236 2024-09-05_cac48cd2685caeb01f5161998238a701_mafia.exe 30 PID 2100 wrote to memory of 1892 2100 C311.tmp 31 PID 2100 wrote to memory of 1892 2100 C311.tmp 31 PID 2100 wrote to memory of 1892 2100 C311.tmp 31 PID 2100 wrote to memory of 1892 2100 C311.tmp 31 PID 1892 wrote to memory of 2660 1892 C34F.tmp 32 PID 1892 wrote to memory of 2660 1892 C34F.tmp 32 PID 1892 wrote to memory of 2660 1892 C34F.tmp 32 PID 1892 wrote to memory of 2660 1892 C34F.tmp 32 PID 2660 wrote to memory of 2080 2660 C3EB.tmp 33 PID 2660 wrote to memory of 2080 2660 C3EB.tmp 33 PID 2660 wrote to memory of 2080 2660 C3EB.tmp 33 PID 2660 wrote to memory of 2080 2660 C3EB.tmp 33 PID 2080 wrote to memory of 1920 2080 C458.tmp 34 PID 2080 wrote to memory of 1920 2080 C458.tmp 34 PID 2080 wrote to memory of 1920 2080 C458.tmp 34 PID 2080 wrote to memory of 1920 2080 C458.tmp 34 PID 1920 wrote to memory of 2484 1920 C4D5.tmp 35 PID 1920 wrote to memory of 2484 1920 C4D5.tmp 35 PID 1920 wrote to memory of 2484 1920 C4D5.tmp 35 PID 1920 wrote to memory of 2484 1920 C4D5.tmp 35 PID 2484 wrote to memory of 2864 2484 C542.tmp 36 PID 2484 wrote to memory of 2864 2484 C542.tmp 36 PID 2484 wrote to memory of 2864 2484 C542.tmp 36 PID 2484 wrote to memory of 2864 2484 C542.tmp 36 PID 2864 wrote to memory of 2684 2864 C5BF.tmp 37 PID 2864 wrote to memory of 2684 2864 C5BF.tmp 37 PID 2864 wrote to memory of 2684 2864 C5BF.tmp 37 PID 2864 wrote to memory of 2684 2864 C5BF.tmp 37 PID 2684 wrote to memory of 2804 2684 C62C.tmp 38 PID 2684 wrote to memory of 2804 2684 C62C.tmp 38 PID 2684 wrote to memory of 2804 2684 C62C.tmp 38 PID 2684 wrote to memory of 2804 2684 C62C.tmp 38 PID 2804 wrote to memory of 2704 2804 C6A9.tmp 39 PID 2804 wrote to memory of 2704 2804 C6A9.tmp 39 PID 2804 wrote to memory of 2704 2804 C6A9.tmp 39 PID 2804 wrote to memory of 2704 2804 C6A9.tmp 39 PID 2704 wrote to memory of 2852 2704 C716.tmp 40 PID 2704 wrote to memory of 2852 2704 C716.tmp 40 PID 2704 wrote to memory of 2852 2704 C716.tmp 40 PID 2704 wrote to memory of 2852 2704 C716.tmp 40 PID 2852 wrote to memory of 2612 2852 C793.tmp 41 PID 2852 wrote to memory of 2612 2852 C793.tmp 41 PID 2852 wrote to memory of 2612 2852 C793.tmp 41 PID 2852 wrote to memory of 2612 2852 C793.tmp 41 PID 2612 wrote to memory of 2712 2612 C810.tmp 42 PID 2612 wrote to memory of 2712 2612 C810.tmp 42 PID 2612 wrote to memory of 2712 2612 C810.tmp 42 PID 2612 wrote to memory of 2712 2612 C810.tmp 42 PID 2712 wrote to memory of 2632 2712 C86D.tmp 43 PID 2712 wrote to memory of 2632 2712 C86D.tmp 43 PID 2712 wrote to memory of 2632 2712 C86D.tmp 43 PID 2712 wrote to memory of 2632 2712 C86D.tmp 43 PID 2632 wrote to memory of 2648 2632 C8DB.tmp 44 PID 2632 wrote to memory of 2648 2632 C8DB.tmp 44 PID 2632 wrote to memory of 2648 2632 C8DB.tmp 44 PID 2632 wrote to memory of 2648 2632 C8DB.tmp 44 PID 2648 wrote to memory of 2628 2648 C919.tmp 45 PID 2648 wrote to memory of 2628 2648 C919.tmp 45 PID 2648 wrote to memory of 2628 2648 C919.tmp 45 PID 2648 wrote to memory of 2628 2648 C919.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-05_cac48cd2685caeb01f5161998238a701_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-05_cac48cd2685caeb01f5161998238a701_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\C311.tmp"C:\Users\Admin\AppData\Local\Temp\C311.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\C34F.tmp"C:\Users\Admin\AppData\Local\Temp\C34F.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\C3EB.tmp"C:\Users\Admin\AppData\Local\Temp\C3EB.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\C458.tmp"C:\Users\Admin\AppData\Local\Temp\C458.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\C4D5.tmp"C:\Users\Admin\AppData\Local\Temp\C4D5.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\C542.tmp"C:\Users\Admin\AppData\Local\Temp\C542.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\C5BF.tmp"C:\Users\Admin\AppData\Local\Temp\C5BF.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\C62C.tmp"C:\Users\Admin\AppData\Local\Temp\C62C.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\C6A9.tmp"C:\Users\Admin\AppData\Local\Temp\C6A9.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\C716.tmp"C:\Users\Admin\AppData\Local\Temp\C716.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\C793.tmp"C:\Users\Admin\AppData\Local\Temp\C793.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\C810.tmp"C:\Users\Admin\AppData\Local\Temp\C810.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\C86D.tmp"C:\Users\Admin\AppData\Local\Temp\C86D.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\C8DB.tmp"C:\Users\Admin\AppData\Local\Temp\C8DB.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\C919.tmp"C:\Users\Admin\AppData\Local\Temp\C919.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\C967.tmp"C:\Users\Admin\AppData\Local\Temp\C967.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\C9E4.tmp"C:\Users\Admin\AppData\Local\Temp\C9E4.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\CA51.tmp"C:\Users\Admin\AppData\Local\Temp\CA51.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\CABE.tmp"C:\Users\Admin\AppData\Local\Temp\CABE.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\CB3B.tmp"C:\Users\Admin\AppData\Local\Temp\CB3B.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\CBA8.tmp"C:\Users\Admin\AppData\Local\Temp\CBA8.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\CC15.tmp"C:\Users\Admin\AppData\Local\Temp\CC15.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\CC73.tmp"C:\Users\Admin\AppData\Local\Temp\CC73.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\CCB1.tmp"C:\Users\Admin\AppData\Local\Temp\CCB1.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\CCF0.tmp"C:\Users\Admin\AppData\Local\Temp\CCF0.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\CD2E.tmp"C:\Users\Admin\AppData\Local\Temp\CD2E.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\CD6D.tmp"C:\Users\Admin\AppData\Local\Temp\CD6D.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\CDAB.tmp"C:\Users\Admin\AppData\Local\Temp\CDAB.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\CDE9.tmp"C:\Users\Admin\AppData\Local\Temp\CDE9.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\CE28.tmp"C:\Users\Admin\AppData\Local\Temp\CE28.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\CE66.tmp"C:\Users\Admin\AppData\Local\Temp\CE66.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:584 -
C:\Users\Admin\AppData\Local\Temp\CEA5.tmp"C:\Users\Admin\AppData\Local\Temp\CEA5.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\CEE3.tmp"C:\Users\Admin\AppData\Local\Temp\CEE3.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\CF21.tmp"C:\Users\Admin\AppData\Local\Temp\CF21.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:684 -
C:\Users\Admin\AppData\Local\Temp\CF60.tmp"C:\Users\Admin\AppData\Local\Temp\CF60.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\CF9E.tmp"C:\Users\Admin\AppData\Local\Temp\CF9E.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\CFDD.tmp"C:\Users\Admin\AppData\Local\Temp\CFDD.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\D01B.tmp"C:\Users\Admin\AppData\Local\Temp\D01B.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\D059.tmp"C:\Users\Admin\AppData\Local\Temp\D059.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:848 -
C:\Users\Admin\AppData\Local\Temp\D098.tmp"C:\Users\Admin\AppData\Local\Temp\D098.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\D0D6.tmp"C:\Users\Admin\AppData\Local\Temp\D0D6.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:952 -
C:\Users\Admin\AppData\Local\Temp\D115.tmp"C:\Users\Admin\AppData\Local\Temp\D115.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\D153.tmp"C:\Users\Admin\AppData\Local\Temp\D153.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:292 -
C:\Users\Admin\AppData\Local\Temp\D191.tmp"C:\Users\Admin\AppData\Local\Temp\D191.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:924 -
C:\Users\Admin\AppData\Local\Temp\D1D0.tmp"C:\Users\Admin\AppData\Local\Temp\D1D0.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:300 -
C:\Users\Admin\AppData\Local\Temp\D20E.tmp"C:\Users\Admin\AppData\Local\Temp\D20E.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\D24D.tmp"C:\Users\Admin\AppData\Local\Temp\D24D.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:760 -
C:\Users\Admin\AppData\Local\Temp\D28B.tmp"C:\Users\Admin\AppData\Local\Temp\D28B.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\D2C9.tmp"C:\Users\Admin\AppData\Local\Temp\D2C9.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\D308.tmp"C:\Users\Admin\AppData\Local\Temp\D308.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\D346.tmp"C:\Users\Admin\AppData\Local\Temp\D346.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\D385.tmp"C:\Users\Admin\AppData\Local\Temp\D385.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\D3C3.tmp"C:\Users\Admin\AppData\Local\Temp\D3C3.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\D401.tmp"C:\Users\Admin\AppData\Local\Temp\D401.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\D440.tmp"C:\Users\Admin\AppData\Local\Temp\D440.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\D47E.tmp"C:\Users\Admin\AppData\Local\Temp\D47E.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\D4BD.tmp"C:\Users\Admin\AppData\Local\Temp\D4BD.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\D4FB.tmp"C:\Users\Admin\AppData\Local\Temp\D4FB.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\D539.tmp"C:\Users\Admin\AppData\Local\Temp\D539.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\D578.tmp"C:\Users\Admin\AppData\Local\Temp\D578.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\D5B6.tmp"C:\Users\Admin\AppData\Local\Temp\D5B6.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\D614.tmp"C:\Users\Admin\AppData\Local\Temp\D614.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\D652.tmp"C:\Users\Admin\AppData\Local\Temp\D652.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\D691.tmp"C:\Users\Admin\AppData\Local\Temp\D691.tmp"65⤵
- Executes dropped EXE
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\D6CF.tmp"C:\Users\Admin\AppData\Local\Temp\D6CF.tmp"66⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\D70D.tmp"C:\Users\Admin\AppData\Local\Temp\D70D.tmp"67⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\D74C.tmp"C:\Users\Admin\AppData\Local\Temp\D74C.tmp"68⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\D78A.tmp"C:\Users\Admin\AppData\Local\Temp\D78A.tmp"69⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\D7C9.tmp"C:\Users\Admin\AppData\Local\Temp\D7C9.tmp"70⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\D807.tmp"C:\Users\Admin\AppData\Local\Temp\D807.tmp"71⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\D845.tmp"C:\Users\Admin\AppData\Local\Temp\D845.tmp"72⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\D884.tmp"C:\Users\Admin\AppData\Local\Temp\D884.tmp"73⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\D8C2.tmp"C:\Users\Admin\AppData\Local\Temp\D8C2.tmp"74⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\D901.tmp"C:\Users\Admin\AppData\Local\Temp\D901.tmp"75⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\D93F.tmp"C:\Users\Admin\AppData\Local\Temp\D93F.tmp"76⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\D97D.tmp"C:\Users\Admin\AppData\Local\Temp\D97D.tmp"77⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\D9BC.tmp"C:\Users\Admin\AppData\Local\Temp\D9BC.tmp"78⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\D9FA.tmp"C:\Users\Admin\AppData\Local\Temp\D9FA.tmp"79⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\DA39.tmp"C:\Users\Admin\AppData\Local\Temp\DA39.tmp"80⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\DA77.tmp"C:\Users\Admin\AppData\Local\Temp\DA77.tmp"81⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\DAB5.tmp"C:\Users\Admin\AppData\Local\Temp\DAB5.tmp"82⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\DAF4.tmp"C:\Users\Admin\AppData\Local\Temp\DAF4.tmp"83⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\DB32.tmp"C:\Users\Admin\AppData\Local\Temp\DB32.tmp"84⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\DB71.tmp"C:\Users\Admin\AppData\Local\Temp\DB71.tmp"85⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\DBAF.tmp"C:\Users\Admin\AppData\Local\Temp\DBAF.tmp"86⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\DBED.tmp"C:\Users\Admin\AppData\Local\Temp\DBED.tmp"87⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\DC2C.tmp"C:\Users\Admin\AppData\Local\Temp\DC2C.tmp"88⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\DC6A.tmp"C:\Users\Admin\AppData\Local\Temp\DC6A.tmp"89⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\DCA9.tmp"C:\Users\Admin\AppData\Local\Temp\DCA9.tmp"90⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\DCE7.tmp"C:\Users\Admin\AppData\Local\Temp\DCE7.tmp"91⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\DD25.tmp"C:\Users\Admin\AppData\Local\Temp\DD25.tmp"92⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\DD64.tmp"C:\Users\Admin\AppData\Local\Temp\DD64.tmp"93⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\DDA2.tmp"C:\Users\Admin\AppData\Local\Temp\DDA2.tmp"94⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\DDE1.tmp"C:\Users\Admin\AppData\Local\Temp\DDE1.tmp"95⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\DE1F.tmp"C:\Users\Admin\AppData\Local\Temp\DE1F.tmp"96⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\DE5E.tmp"C:\Users\Admin\AppData\Local\Temp\DE5E.tmp"97⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\DE9C.tmp"C:\Users\Admin\AppData\Local\Temp\DE9C.tmp"98⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\DEDA.tmp"C:\Users\Admin\AppData\Local\Temp\DEDA.tmp"99⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\DF19.tmp"C:\Users\Admin\AppData\Local\Temp\DF19.tmp"100⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\DF57.tmp"C:\Users\Admin\AppData\Local\Temp\DF57.tmp"101⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\DF96.tmp"C:\Users\Admin\AppData\Local\Temp\DF96.tmp"102⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\DFE4.tmp"C:\Users\Admin\AppData\Local\Temp\DFE4.tmp"103⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\E022.tmp"C:\Users\Admin\AppData\Local\Temp\E022.tmp"104⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\E060.tmp"C:\Users\Admin\AppData\Local\Temp\E060.tmp"105⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\E09F.tmp"C:\Users\Admin\AppData\Local\Temp\E09F.tmp"106⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\E0DD.tmp"C:\Users\Admin\AppData\Local\Temp\E0DD.tmp"107⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\E11C.tmp"C:\Users\Admin\AppData\Local\Temp\E11C.tmp"108⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\E15A.tmp"C:\Users\Admin\AppData\Local\Temp\E15A.tmp"109⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\E198.tmp"C:\Users\Admin\AppData\Local\Temp\E198.tmp"110⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\E1D7.tmp"C:\Users\Admin\AppData\Local\Temp\E1D7.tmp"111⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\E215.tmp"C:\Users\Admin\AppData\Local\Temp\E215.tmp"112⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\E254.tmp"C:\Users\Admin\AppData\Local\Temp\E254.tmp"113⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\E292.tmp"C:\Users\Admin\AppData\Local\Temp\E292.tmp"114⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\E2D0.tmp"C:\Users\Admin\AppData\Local\Temp\E2D0.tmp"115⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\E30F.tmp"C:\Users\Admin\AppData\Local\Temp\E30F.tmp"116⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\E34D.tmp"C:\Users\Admin\AppData\Local\Temp\E34D.tmp"117⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\E38C.tmp"C:\Users\Admin\AppData\Local\Temp\E38C.tmp"118⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\E3CA.tmp"C:\Users\Admin\AppData\Local\Temp\E3CA.tmp"119⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\E408.tmp"C:\Users\Admin\AppData\Local\Temp\E408.tmp"120⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\E447.tmp"C:\Users\Admin\AppData\Local\Temp\E447.tmp"121⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\E485.tmp"C:\Users\Admin\AppData\Local\Temp\E485.tmp"122⤵PID:2232
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-