Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
12/10/2024, 08:10
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-12_f514fb536eb6dbd23bef3d26b09ec749_mafia.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-10-12_f514fb536eb6dbd23bef3d26b09ec749_mafia.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-12_f514fb536eb6dbd23bef3d26b09ec749_mafia.exe
-
Size
530KB
-
MD5
f514fb536eb6dbd23bef3d26b09ec749
-
SHA1
88cad5c8f2d23031a7b495abbf7d0dcc9d0679a1
-
SHA256
9925cd89225b02cda9ddf8a6de922ea41560cc29bebdf4d763b211c32b3e27f5
-
SHA512
be2414b8340d795e8cbdc2b072d0b2594863a1c3c68fa9efe9f9f08508623462f4a27439447b0e155cdfbdb9afbec4268b6780fca348a109333ea569227aaa30
-
SSDEEP
12288:AU5rCOTeioOtcCPsjR3vNoQ7ML9e5NZulFVg0M1:AUQOJoGcCPsjhvawNclFV/M1
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2144 ECA0.tmp 2652 ECFE.tmp 2772 ED7A.tmp 2796 EDF7.tmp 2944 EE64.tmp 2864 EED2.tmp 2720 EF3F.tmp 2544 EF9C.tmp 2668 EFFA.tmp 2360 F067.tmp 2432 F0D4.tmp 2892 F132.tmp 1112 F190.tmp 2856 F20C.tmp 2308 F27A.tmp 268 F2D7.tmp 2288 F335.tmp 672 F3A2.tmp 2792 F400.tmp 596 F45D.tmp 804 F4DA.tmp 1612 F557.tmp 2972 F5B4.tmp 2408 F602.tmp 1660 F641.tmp 2968 F67F.tmp 952 F6BE.tmp 428 F6FC.tmp 348 F73A.tmp 2368 F779.tmp 832 F7B7.tmp 1376 F805.tmp 1832 F844.tmp 900 F892.tmp 1320 F8D0.tmp 464 F90E.tmp 2488 F94D.tmp 2148 F98B.tmp 1600 F9CA.tmp 1724 FA08.tmp 612 FA46.tmp 2496 FA94.tmp 1972 FAD3.tmp 860 FB11.tmp 996 FB50.tmp 2080 FB8E.tmp 2332 FBCC.tmp 1192 FC0B.tmp 1752 FC49.tmp 1140 FC97.tmp 1928 FCD6.tmp 2232 FD52.tmp 2688 FDA0.tmp 2776 FDDF.tmp 2744 FE1D.tmp 2556 FE5C.tmp 2784 FEAA.tmp 2836 FEE8.tmp 2576 FF26.tmp 3016 FF65.tmp 2596 FFA3.tmp 2568 FFF1.tmp 2564 3F.tmp 3032 9D.tmp -
Loads dropped DLL 64 IoCs
pid Process 2848 2024-10-12_f514fb536eb6dbd23bef3d26b09ec749_mafia.exe 2144 ECA0.tmp 2652 ECFE.tmp 2772 ED7A.tmp 2796 EDF7.tmp 2944 EE64.tmp 2864 EED2.tmp 2720 EF3F.tmp 2544 EF9C.tmp 2668 EFFA.tmp 2360 F067.tmp 2432 F0D4.tmp 2892 F132.tmp 1112 F190.tmp 2856 F20C.tmp 2308 F27A.tmp 268 F2D7.tmp 2288 F335.tmp 672 F3A2.tmp 2792 F400.tmp 596 F45D.tmp 804 F4DA.tmp 1612 F557.tmp 2972 F5B4.tmp 2408 F602.tmp 1660 F641.tmp 2968 F67F.tmp 952 F6BE.tmp 428 F6FC.tmp 348 F73A.tmp 2368 F779.tmp 832 F7B7.tmp 1376 F805.tmp 1832 F844.tmp 900 F892.tmp 1320 F8D0.tmp 464 F90E.tmp 2488 F94D.tmp 2148 F98B.tmp 1600 F9CA.tmp 1724 FA08.tmp 612 FA46.tmp 2496 FA94.tmp 1972 FAD3.tmp 860 FB11.tmp 996 FB50.tmp 2080 FB8E.tmp 2332 FBCC.tmp 1192 FC0B.tmp 1752 FC49.tmp 1140 FC97.tmp 1596 FD14.tmp 2232 FD52.tmp 2688 FDA0.tmp 2776 FDDF.tmp 2744 FE1D.tmp 2556 FE5C.tmp 2784 FEAA.tmp 2836 FEE8.tmp 2576 FF26.tmp 3016 FF65.tmp 2596 FFA3.tmp 2568 FFF1.tmp 2564 3F.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8018.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5419.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9943.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E032.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 316C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 872A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C948.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDF9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 472E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CEB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1593.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C88D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 671C.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2848 wrote to memory of 2144 2848 2024-10-12_f514fb536eb6dbd23bef3d26b09ec749_mafia.exe 31 PID 2848 wrote to memory of 2144 2848 2024-10-12_f514fb536eb6dbd23bef3d26b09ec749_mafia.exe 31 PID 2848 wrote to memory of 2144 2848 2024-10-12_f514fb536eb6dbd23bef3d26b09ec749_mafia.exe 31 PID 2848 wrote to memory of 2144 2848 2024-10-12_f514fb536eb6dbd23bef3d26b09ec749_mafia.exe 31 PID 2144 wrote to memory of 2652 2144 ECA0.tmp 32 PID 2144 wrote to memory of 2652 2144 ECA0.tmp 32 PID 2144 wrote to memory of 2652 2144 ECA0.tmp 32 PID 2144 wrote to memory of 2652 2144 ECA0.tmp 32 PID 2652 wrote to memory of 2772 2652 ECFE.tmp 33 PID 2652 wrote to memory of 2772 2652 ECFE.tmp 33 PID 2652 wrote to memory of 2772 2652 ECFE.tmp 33 PID 2652 wrote to memory of 2772 2652 ECFE.tmp 33 PID 2772 wrote to memory of 2796 2772 ED7A.tmp 34 PID 2772 wrote to memory of 2796 2772 ED7A.tmp 34 PID 2772 wrote to memory of 2796 2772 ED7A.tmp 34 PID 2772 wrote to memory of 2796 2772 ED7A.tmp 34 PID 2796 wrote to memory of 2944 2796 EDF7.tmp 35 PID 2796 wrote to memory of 2944 2796 EDF7.tmp 35 PID 2796 wrote to memory of 2944 2796 EDF7.tmp 35 PID 2796 wrote to memory of 2944 2796 EDF7.tmp 35 PID 2944 wrote to memory of 2864 2944 EE64.tmp 36 PID 2944 wrote to memory of 2864 2944 EE64.tmp 36 PID 2944 wrote to memory of 2864 2944 EE64.tmp 36 PID 2944 wrote to memory of 2864 2944 EE64.tmp 36 PID 2864 wrote to memory of 2720 2864 EED2.tmp 37 PID 2864 wrote to memory of 2720 2864 EED2.tmp 37 PID 2864 wrote to memory of 2720 2864 EED2.tmp 37 PID 2864 wrote to memory of 2720 2864 EED2.tmp 37 PID 2720 wrote to memory of 2544 2720 EF3F.tmp 38 PID 2720 wrote to memory of 2544 2720 EF3F.tmp 38 PID 2720 wrote to memory of 2544 2720 EF3F.tmp 38 PID 2720 wrote to memory of 2544 2720 EF3F.tmp 38 PID 2544 wrote to memory of 2668 2544 EF9C.tmp 39 PID 2544 wrote to memory of 2668 2544 EF9C.tmp 39 PID 2544 wrote to memory of 2668 2544 EF9C.tmp 39 PID 2544 wrote to memory of 2668 2544 EF9C.tmp 39 PID 2668 wrote to memory of 2360 2668 EFFA.tmp 40 PID 2668 wrote to memory of 2360 2668 EFFA.tmp 40 PID 2668 wrote to memory of 2360 2668 EFFA.tmp 40 PID 2668 wrote to memory of 2360 2668 EFFA.tmp 40 PID 2360 wrote to memory of 2432 2360 F067.tmp 41 PID 2360 wrote to memory of 2432 2360 F067.tmp 41 PID 2360 wrote to memory of 2432 2360 F067.tmp 41 PID 2360 wrote to memory of 2432 2360 F067.tmp 41 PID 2432 wrote to memory of 2892 2432 F0D4.tmp 42 PID 2432 wrote to memory of 2892 2432 F0D4.tmp 42 PID 2432 wrote to memory of 2892 2432 F0D4.tmp 42 PID 2432 wrote to memory of 2892 2432 F0D4.tmp 42 PID 2892 wrote to memory of 1112 2892 F132.tmp 43 PID 2892 wrote to memory of 1112 2892 F132.tmp 43 PID 2892 wrote to memory of 1112 2892 F132.tmp 43 PID 2892 wrote to memory of 1112 2892 F132.tmp 43 PID 1112 wrote to memory of 2856 1112 F190.tmp 44 PID 1112 wrote to memory of 2856 1112 F190.tmp 44 PID 1112 wrote to memory of 2856 1112 F190.tmp 44 PID 1112 wrote to memory of 2856 1112 F190.tmp 44 PID 2856 wrote to memory of 2308 2856 F20C.tmp 45 PID 2856 wrote to memory of 2308 2856 F20C.tmp 45 PID 2856 wrote to memory of 2308 2856 F20C.tmp 45 PID 2856 wrote to memory of 2308 2856 F20C.tmp 45 PID 2308 wrote to memory of 268 2308 F27A.tmp 46 PID 2308 wrote to memory of 268 2308 F27A.tmp 46 PID 2308 wrote to memory of 268 2308 F27A.tmp 46 PID 2308 wrote to memory of 268 2308 F27A.tmp 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-12_f514fb536eb6dbd23bef3d26b09ec749_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-12_f514fb536eb6dbd23bef3d26b09ec749_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\ECA0.tmp"C:\Users\Admin\AppData\Local\Temp\ECA0.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\ECFE.tmp"C:\Users\Admin\AppData\Local\Temp\ECFE.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\ED7A.tmp"C:\Users\Admin\AppData\Local\Temp\ED7A.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\EDF7.tmp"C:\Users\Admin\AppData\Local\Temp\EDF7.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\EE64.tmp"C:\Users\Admin\AppData\Local\Temp\EE64.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\EED2.tmp"C:\Users\Admin\AppData\Local\Temp\EED2.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\EF3F.tmp"C:\Users\Admin\AppData\Local\Temp\EF3F.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\EF9C.tmp"C:\Users\Admin\AppData\Local\Temp\EF9C.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\EFFA.tmp"C:\Users\Admin\AppData\Local\Temp\EFFA.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\F067.tmp"C:\Users\Admin\AppData\Local\Temp\F067.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\F0D4.tmp"C:\Users\Admin\AppData\Local\Temp\F0D4.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\F132.tmp"C:\Users\Admin\AppData\Local\Temp\F132.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\F190.tmp"C:\Users\Admin\AppData\Local\Temp\F190.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\F20C.tmp"C:\Users\Admin\AppData\Local\Temp\F20C.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\F27A.tmp"C:\Users\Admin\AppData\Local\Temp\F27A.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\F2D7.tmp"C:\Users\Admin\AppData\Local\Temp\F2D7.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:268 -
C:\Users\Admin\AppData\Local\Temp\F335.tmp"C:\Users\Admin\AppData\Local\Temp\F335.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\F3A2.tmp"C:\Users\Admin\AppData\Local\Temp\F3A2.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:672 -
C:\Users\Admin\AppData\Local\Temp\F400.tmp"C:\Users\Admin\AppData\Local\Temp\F400.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\F45D.tmp"C:\Users\Admin\AppData\Local\Temp\F45D.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:596 -
C:\Users\Admin\AppData\Local\Temp\F4DA.tmp"C:\Users\Admin\AppData\Local\Temp\F4DA.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:804 -
C:\Users\Admin\AppData\Local\Temp\F557.tmp"C:\Users\Admin\AppData\Local\Temp\F557.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\F5B4.tmp"C:\Users\Admin\AppData\Local\Temp\F5B4.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\F602.tmp"C:\Users\Admin\AppData\Local\Temp\F602.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\F641.tmp"C:\Users\Admin\AppData\Local\Temp\F641.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\F67F.tmp"C:\Users\Admin\AppData\Local\Temp\F67F.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\F6BE.tmp"C:\Users\Admin\AppData\Local\Temp\F6BE.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:952 -
C:\Users\Admin\AppData\Local\Temp\F6FC.tmp"C:\Users\Admin\AppData\Local\Temp\F6FC.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:428 -
C:\Users\Admin\AppData\Local\Temp\F73A.tmp"C:\Users\Admin\AppData\Local\Temp\F73A.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:348 -
C:\Users\Admin\AppData\Local\Temp\F779.tmp"C:\Users\Admin\AppData\Local\Temp\F779.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\F7B7.tmp"C:\Users\Admin\AppData\Local\Temp\F7B7.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:832 -
C:\Users\Admin\AppData\Local\Temp\F805.tmp"C:\Users\Admin\AppData\Local\Temp\F805.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\F844.tmp"C:\Users\Admin\AppData\Local\Temp\F844.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\F892.tmp"C:\Users\Admin\AppData\Local\Temp\F892.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:900 -
C:\Users\Admin\AppData\Local\Temp\F8D0.tmp"C:\Users\Admin\AppData\Local\Temp\F8D0.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\F90E.tmp"C:\Users\Admin\AppData\Local\Temp\F90E.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:464 -
C:\Users\Admin\AppData\Local\Temp\F94D.tmp"C:\Users\Admin\AppData\Local\Temp\F94D.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\F98B.tmp"C:\Users\Admin\AppData\Local\Temp\F98B.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\F9CA.tmp"C:\Users\Admin\AppData\Local\Temp\F9CA.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\FA08.tmp"C:\Users\Admin\AppData\Local\Temp\FA08.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\FA46.tmp"C:\Users\Admin\AppData\Local\Temp\FA46.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:612 -
C:\Users\Admin\AppData\Local\Temp\FA94.tmp"C:\Users\Admin\AppData\Local\Temp\FA94.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\FAD3.tmp"C:\Users\Admin\AppData\Local\Temp\FAD3.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\FB11.tmp"C:\Users\Admin\AppData\Local\Temp\FB11.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:860 -
C:\Users\Admin\AppData\Local\Temp\FB50.tmp"C:\Users\Admin\AppData\Local\Temp\FB50.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:996 -
C:\Users\Admin\AppData\Local\Temp\FB8E.tmp"C:\Users\Admin\AppData\Local\Temp\FB8E.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\FBCC.tmp"C:\Users\Admin\AppData\Local\Temp\FBCC.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\FC0B.tmp"C:\Users\Admin\AppData\Local\Temp\FC0B.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\FC49.tmp"C:\Users\Admin\AppData\Local\Temp\FC49.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\FC97.tmp"C:\Users\Admin\AppData\Local\Temp\FC97.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\FCD6.tmp"C:\Users\Admin\AppData\Local\Temp\FCD6.tmp"52⤵
- Executes dropped EXE
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\FD14.tmp"C:\Users\Admin\AppData\Local\Temp\FD14.tmp"53⤵
- Loads dropped DLL
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\FD52.tmp"C:\Users\Admin\AppData\Local\Temp\FD52.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\FDA0.tmp"C:\Users\Admin\AppData\Local\Temp\FDA0.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\FDDF.tmp"C:\Users\Admin\AppData\Local\Temp\FDDF.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\FE1D.tmp"C:\Users\Admin\AppData\Local\Temp\FE1D.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\FE5C.tmp"C:\Users\Admin\AppData\Local\Temp\FE5C.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\FEAA.tmp"C:\Users\Admin\AppData\Local\Temp\FEAA.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\FEE8.tmp"C:\Users\Admin\AppData\Local\Temp\FEE8.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\FF26.tmp"C:\Users\Admin\AppData\Local\Temp\FF26.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\FF65.tmp"C:\Users\Admin\AppData\Local\Temp\FF65.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\FFA3.tmp"C:\Users\Admin\AppData\Local\Temp\FFA3.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\FFF1.tmp"C:\Users\Admin\AppData\Local\Temp\FFF1.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\3F.tmp"C:\Users\Admin\AppData\Local\Temp\3F.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\9D.tmp"C:\Users\Admin\AppData\Local\Temp\9D.tmp"66⤵
- Executes dropped EXE
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\DB.tmp"C:\Users\Admin\AppData\Local\Temp\DB.tmp"67⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\11A.tmp"C:\Users\Admin\AppData\Local\Temp\11A.tmp"68⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\168.tmp"C:\Users\Admin\AppData\Local\Temp\168.tmp"69⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\1A6.tmp"C:\Users\Admin\AppData\Local\Temp\1A6.tmp"70⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\1F4.tmp"C:\Users\Admin\AppData\Local\Temp\1F4.tmp"71⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\232.tmp"C:\Users\Admin\AppData\Local\Temp\232.tmp"72⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\271.tmp"C:\Users\Admin\AppData\Local\Temp\271.tmp"73⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\2AF.tmp"C:\Users\Admin\AppData\Local\Temp\2AF.tmp"74⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\2FD.tmp"C:\Users\Admin\AppData\Local\Temp\2FD.tmp"75⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\33C.tmp"C:\Users\Admin\AppData\Local\Temp\33C.tmp"76⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\37A.tmp"C:\Users\Admin\AppData\Local\Temp\37A.tmp"77⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\3B8.tmp"C:\Users\Admin\AppData\Local\Temp\3B8.tmp"78⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\3F7.tmp"C:\Users\Admin\AppData\Local\Temp\3F7.tmp"79⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\435.tmp"C:\Users\Admin\AppData\Local\Temp\435.tmp"80⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\483.tmp"C:\Users\Admin\AppData\Local\Temp\483.tmp"81⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\4C2.tmp"C:\Users\Admin\AppData\Local\Temp\4C2.tmp"82⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\500.tmp"C:\Users\Admin\AppData\Local\Temp\500.tmp"83⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\53E.tmp"C:\Users\Admin\AppData\Local\Temp\53E.tmp"84⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\57D.tmp"C:\Users\Admin\AppData\Local\Temp\57D.tmp"85⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\5BB.tmp"C:\Users\Admin\AppData\Local\Temp\5BB.tmp"86⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\5FA.tmp"C:\Users\Admin\AppData\Local\Temp\5FA.tmp"87⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\638.tmp"C:\Users\Admin\AppData\Local\Temp\638.tmp"88⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\676.tmp"C:\Users\Admin\AppData\Local\Temp\676.tmp"89⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\6B5.tmp"C:\Users\Admin\AppData\Local\Temp\6B5.tmp"90⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\6F3.tmp"C:\Users\Admin\AppData\Local\Temp\6F3.tmp"91⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\732.tmp"C:\Users\Admin\AppData\Local\Temp\732.tmp"92⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\770.tmp"C:\Users\Admin\AppData\Local\Temp\770.tmp"93⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\7AE.tmp"C:\Users\Admin\AppData\Local\Temp\7AE.tmp"94⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\7ED.tmp"C:\Users\Admin\AppData\Local\Temp\7ED.tmp"95⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\82B.tmp"C:\Users\Admin\AppData\Local\Temp\82B.tmp"96⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\86A.tmp"C:\Users\Admin\AppData\Local\Temp\86A.tmp"97⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\8A8.tmp"C:\Users\Admin\AppData\Local\Temp\8A8.tmp"98⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\8E6.tmp"C:\Users\Admin\AppData\Local\Temp\8E6.tmp"99⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\925.tmp"C:\Users\Admin\AppData\Local\Temp\925.tmp"100⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\973.tmp"C:\Users\Admin\AppData\Local\Temp\973.tmp"101⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\9B1.tmp"C:\Users\Admin\AppData\Local\Temp\9B1.tmp"102⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\9FF.tmp"C:\Users\Admin\AppData\Local\Temp\9FF.tmp"103⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\A3E.tmp"C:\Users\Admin\AppData\Local\Temp\A3E.tmp"104⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\A7C.tmp"C:\Users\Admin\AppData\Local\Temp\A7C.tmp"105⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\ABA.tmp"C:\Users\Admin\AppData\Local\Temp\ABA.tmp"106⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\AF9.tmp"C:\Users\Admin\AppData\Local\Temp\AF9.tmp"107⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\B37.tmp"C:\Users\Admin\AppData\Local\Temp\B37.tmp"108⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\B76.tmp"C:\Users\Admin\AppData\Local\Temp\B76.tmp"109⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\BB4.tmp"C:\Users\Admin\AppData\Local\Temp\BB4.tmp"110⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\BF2.tmp"C:\Users\Admin\AppData\Local\Temp\BF2.tmp"111⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\C31.tmp"C:\Users\Admin\AppData\Local\Temp\C31.tmp"112⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\C7F.tmp"C:\Users\Admin\AppData\Local\Temp\C7F.tmp"113⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\CBD.tmp"C:\Users\Admin\AppData\Local\Temp\CBD.tmp"114⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\CFC.tmp"C:\Users\Admin\AppData\Local\Temp\CFC.tmp"115⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\D3A.tmp"C:\Users\Admin\AppData\Local\Temp\D3A.tmp"116⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\D78.tmp"C:\Users\Admin\AppData\Local\Temp\D78.tmp"117⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\DB7.tmp"C:\Users\Admin\AppData\Local\Temp\DB7.tmp"118⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\DF5.tmp"C:\Users\Admin\AppData\Local\Temp\DF5.tmp"119⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\E34.tmp"C:\Users\Admin\AppData\Local\Temp\E34.tmp"120⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\E72.tmp"C:\Users\Admin\AppData\Local\Temp\E72.tmp"121⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\EB0.tmp"C:\Users\Admin\AppData\Local\Temp\EB0.tmp"122⤵PID:2780
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-