Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
28-08-2023 19:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ca6624b3d94ab1d1fab6978e2bfbdf5a_mafia_JC.exe
Resource
win7-20230712-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
ca6624b3d94ab1d1fab6978e2bfbdf5a_mafia_JC.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
ca6624b3d94ab1d1fab6978e2bfbdf5a_mafia_JC.exe
-
Size
520KB
-
MD5
ca6624b3d94ab1d1fab6978e2bfbdf5a
-
SHA1
3cee287b78deb39ebe0b9bbc1e886b8947a152f1
-
SHA256
efd344ddad89ecad5b7bf6e7b241379d489d89e24ce60d654c1b44368e7bdba9
-
SHA512
8b75858579ae44f69416fa95bd4cb59b8a90ab8674b95e8cd7353fdad07875c24d5b2e8326bdaa872841d2a9ad9ebed869bdc216208ad8eb4ad0341387244ed0
-
SSDEEP
12288:gj8fuxR21t5i8fH8l66sYtKWiZ6rghZUu6hKO4GyNZ:gj8fuK1GYHENUVZQghaubjhN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 276 739A.tmp 2400 7475.tmp 2836 759D.tmp 2932 76B6.tmp 2820 7790.tmp 2920 788A.tmp 2980 7964.tmp 2868 7A4E.tmp 2692 7B48.tmp 2760 7C13.tmp 2360 7D0C.tmp 672 7DE7.tmp 972 7EE0.tmp 1480 7FCA.tmp 528 80A5.tmp 3028 8121.tmp 3012 820B.tmp 2964 8315.tmp 1728 83FF.tmp 1724 8527.tmp 2596 8611.tmp 2940 870B.tmp 3008 87D5.tmp 2968 8843.tmp 332 88BF.tmp 1060 893C.tmp 544 899A.tmp 2592 8A17.tmp 2336 8A84.tmp 2248 8B01.tmp 2608 8B7D.tmp 1424 8BEB.tmp 1348 8C58.tmp 2120 8CD5.tmp 1160 8D61.tmp 820 8DED.tmp 1660 8E6A.tmp 1740 8EF7.tmp 1780 8F73.tmp 1716 9000.tmp 1600 907D.tmp 1804 90F9.tmp 1192 9157.tmp 1744 91D4.tmp 876 9241.tmp 1056 92BE.tmp 1996 932B.tmp 1688 9398.tmp 2580 9405.tmp 576 9473.tmp 844 94C1.tmp 960 951E.tmp 2152 958B.tmp 2008 95F9.tmp 2232 9656.tmp 1588 96E3.tmp 2552 9750.tmp 1968 97AD.tmp 2328 981B.tmp 2844 9897.tmp 2896 98F5.tmp 2836 9962.tmp 1708 9B55.tmp 2828 9C11.tmp -
Loads dropped DLL 64 IoCs
pid Process 1568 ca6624b3d94ab1d1fab6978e2bfbdf5a_mafia_JC.exe 276 739A.tmp 2400 7475.tmp 2836 759D.tmp 2932 76B6.tmp 2820 7790.tmp 2920 788A.tmp 2980 7964.tmp 2868 7A4E.tmp 2692 7B48.tmp 2760 7C13.tmp 2360 7D0C.tmp 672 7DE7.tmp 972 7EE0.tmp 1480 7FCA.tmp 528 80A5.tmp 3028 8121.tmp 3012 820B.tmp 2964 8315.tmp 1728 83FF.tmp 1724 8527.tmp 2596 8611.tmp 2940 870B.tmp 3008 87D5.tmp 2968 8843.tmp 332 88BF.tmp 1060 893C.tmp 544 899A.tmp 2592 8A17.tmp 2336 8A84.tmp 2248 8B01.tmp 2608 8B7D.tmp 1424 8BEB.tmp 1348 8C58.tmp 2120 8CD5.tmp 1160 8D61.tmp 820 8DED.tmp 1660 8E6A.tmp 1740 8EF7.tmp 1780 8F73.tmp 1716 9000.tmp 1600 907D.tmp 1804 90F9.tmp 1192 9157.tmp 1744 91D4.tmp 876 9241.tmp 1056 92BE.tmp 1996 932B.tmp 1688 9398.tmp 2580 9405.tmp 576 9473.tmp 844 94C1.tmp 960 951E.tmp 2152 958B.tmp 2008 95F9.tmp 2232 9656.tmp 1588 96E3.tmp 2552 9750.tmp 1968 97AD.tmp 2328 981B.tmp 2844 9897.tmp 2896 98F5.tmp 2836 9962.tmp 1708 9B55.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1568 wrote to memory of 276 1568 ca6624b3d94ab1d1fab6978e2bfbdf5a_mafia_JC.exe 28 PID 1568 wrote to memory of 276 1568 ca6624b3d94ab1d1fab6978e2bfbdf5a_mafia_JC.exe 28 PID 1568 wrote to memory of 276 1568 ca6624b3d94ab1d1fab6978e2bfbdf5a_mafia_JC.exe 28 PID 1568 wrote to memory of 276 1568 ca6624b3d94ab1d1fab6978e2bfbdf5a_mafia_JC.exe 28 PID 276 wrote to memory of 2400 276 739A.tmp 29 PID 276 wrote to memory of 2400 276 739A.tmp 29 PID 276 wrote to memory of 2400 276 739A.tmp 29 PID 276 wrote to memory of 2400 276 739A.tmp 29 PID 2400 wrote to memory of 2836 2400 7475.tmp 30 PID 2400 wrote to memory of 2836 2400 7475.tmp 30 PID 2400 wrote to memory of 2836 2400 7475.tmp 30 PID 2400 wrote to memory of 2836 2400 7475.tmp 30 PID 2836 wrote to memory of 2932 2836 759D.tmp 31 PID 2836 wrote to memory of 2932 2836 759D.tmp 31 PID 2836 wrote to memory of 2932 2836 759D.tmp 31 PID 2836 wrote to memory of 2932 2836 759D.tmp 31 PID 2932 wrote to memory of 2820 2932 76B6.tmp 32 PID 2932 wrote to memory of 2820 2932 76B6.tmp 32 PID 2932 wrote to memory of 2820 2932 76B6.tmp 32 PID 2932 wrote to memory of 2820 2932 76B6.tmp 32 PID 2820 wrote to memory of 2920 2820 7790.tmp 33 PID 2820 wrote to memory of 2920 2820 7790.tmp 33 PID 2820 wrote to memory of 2920 2820 7790.tmp 33 PID 2820 wrote to memory of 2920 2820 7790.tmp 33 PID 2920 wrote to memory of 2980 2920 788A.tmp 34 PID 2920 wrote to memory of 2980 2920 788A.tmp 34 PID 2920 wrote to memory of 2980 2920 788A.tmp 34 PID 2920 wrote to memory of 2980 2920 788A.tmp 34 PID 2980 wrote to memory of 2868 2980 7964.tmp 35 PID 2980 wrote to memory of 2868 2980 7964.tmp 35 PID 2980 wrote to memory of 2868 2980 7964.tmp 35 PID 2980 wrote to memory of 2868 2980 7964.tmp 35 PID 2868 wrote to memory of 2692 2868 7A4E.tmp 36 PID 2868 wrote to memory of 2692 2868 7A4E.tmp 36 PID 2868 wrote to memory of 2692 2868 7A4E.tmp 36 PID 2868 wrote to memory of 2692 2868 7A4E.tmp 36 PID 2692 wrote to memory of 2760 2692 7B48.tmp 37 PID 2692 wrote to memory of 2760 2692 7B48.tmp 37 PID 2692 wrote to memory of 2760 2692 7B48.tmp 37 PID 2692 wrote to memory of 2760 2692 7B48.tmp 37 PID 2760 wrote to memory of 2360 2760 7C13.tmp 38 PID 2760 wrote to memory of 2360 2760 7C13.tmp 38 PID 2760 wrote to memory of 2360 2760 7C13.tmp 38 PID 2760 wrote to memory of 2360 2760 7C13.tmp 38 PID 2360 wrote to memory of 672 2360 7D0C.tmp 39 PID 2360 wrote to memory of 672 2360 7D0C.tmp 39 PID 2360 wrote to memory of 672 2360 7D0C.tmp 39 PID 2360 wrote to memory of 672 2360 7D0C.tmp 39 PID 672 wrote to memory of 972 672 7DE7.tmp 40 PID 672 wrote to memory of 972 672 7DE7.tmp 40 PID 672 wrote to memory of 972 672 7DE7.tmp 40 PID 672 wrote to memory of 972 672 7DE7.tmp 40 PID 972 wrote to memory of 1480 972 7EE0.tmp 41 PID 972 wrote to memory of 1480 972 7EE0.tmp 41 PID 972 wrote to memory of 1480 972 7EE0.tmp 41 PID 972 wrote to memory of 1480 972 7EE0.tmp 41 PID 1480 wrote to memory of 528 1480 7FCA.tmp 42 PID 1480 wrote to memory of 528 1480 7FCA.tmp 42 PID 1480 wrote to memory of 528 1480 7FCA.tmp 42 PID 1480 wrote to memory of 528 1480 7FCA.tmp 42 PID 528 wrote to memory of 3028 528 80A5.tmp 43 PID 528 wrote to memory of 3028 528 80A5.tmp 43 PID 528 wrote to memory of 3028 528 80A5.tmp 43 PID 528 wrote to memory of 3028 528 80A5.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca6624b3d94ab1d1fab6978e2bfbdf5a_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\ca6624b3d94ab1d1fab6978e2bfbdf5a_mafia_JC.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\739A.tmp"C:\Users\Admin\AppData\Local\Temp\739A.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:276 -
C:\Users\Admin\AppData\Local\Temp\7475.tmp"C:\Users\Admin\AppData\Local\Temp\7475.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\759D.tmp"C:\Users\Admin\AppData\Local\Temp\759D.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\76B6.tmp"C:\Users\Admin\AppData\Local\Temp\76B6.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\7790.tmp"C:\Users\Admin\AppData\Local\Temp\7790.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\788A.tmp"C:\Users\Admin\AppData\Local\Temp\788A.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\7964.tmp"C:\Users\Admin\AppData\Local\Temp\7964.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\7A4E.tmp"C:\Users\Admin\AppData\Local\Temp\7A4E.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\7B48.tmp"C:\Users\Admin\AppData\Local\Temp\7B48.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\7C13.tmp"C:\Users\Admin\AppData\Local\Temp\7C13.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\7D0C.tmp"C:\Users\Admin\AppData\Local\Temp\7D0C.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\7DE7.tmp"C:\Users\Admin\AppData\Local\Temp\7DE7.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:672 -
C:\Users\Admin\AppData\Local\Temp\7EE0.tmp"C:\Users\Admin\AppData\Local\Temp\7EE0.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\7FCA.tmp"C:\Users\Admin\AppData\Local\Temp\7FCA.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\80A5.tmp"C:\Users\Admin\AppData\Local\Temp\80A5.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Users\Admin\AppData\Local\Temp\8121.tmp"C:\Users\Admin\AppData\Local\Temp\8121.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\820B.tmp"C:\Users\Admin\AppData\Local\Temp\820B.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\8315.tmp"C:\Users\Admin\AppData\Local\Temp\8315.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\83FF.tmp"C:\Users\Admin\AppData\Local\Temp\83FF.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\8527.tmp"C:\Users\Admin\AppData\Local\Temp\8527.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\8611.tmp"C:\Users\Admin\AppData\Local\Temp\8611.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\870B.tmp"C:\Users\Admin\AppData\Local\Temp\870B.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\87D5.tmp"C:\Users\Admin\AppData\Local\Temp\87D5.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\8843.tmp"C:\Users\Admin\AppData\Local\Temp\8843.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\88BF.tmp"C:\Users\Admin\AppData\Local\Temp\88BF.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:332 -
C:\Users\Admin\AppData\Local\Temp\893C.tmp"C:\Users\Admin\AppData\Local\Temp\893C.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\899A.tmp"C:\Users\Admin\AppData\Local\Temp\899A.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:544 -
C:\Users\Admin\AppData\Local\Temp\8A17.tmp"C:\Users\Admin\AppData\Local\Temp\8A17.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\8A84.tmp"C:\Users\Admin\AppData\Local\Temp\8A84.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\8B01.tmp"C:\Users\Admin\AppData\Local\Temp\8B01.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\8BEB.tmp"C:\Users\Admin\AppData\Local\Temp\8BEB.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\8C58.tmp"C:\Users\Admin\AppData\Local\Temp\8C58.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\8CD5.tmp"C:\Users\Admin\AppData\Local\Temp\8CD5.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\8D61.tmp"C:\Users\Admin\AppData\Local\Temp\8D61.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\8DED.tmp"C:\Users\Admin\AppData\Local\Temp\8DED.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:820 -
C:\Users\Admin\AppData\Local\Temp\8E6A.tmp"C:\Users\Admin\AppData\Local\Temp\8E6A.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\8EF7.tmp"C:\Users\Admin\AppData\Local\Temp\8EF7.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\8F73.tmp"C:\Users\Admin\AppData\Local\Temp\8F73.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\9000.tmp"C:\Users\Admin\AppData\Local\Temp\9000.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\907D.tmp"C:\Users\Admin\AppData\Local\Temp\907D.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\90F9.tmp"C:\Users\Admin\AppData\Local\Temp\90F9.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\9157.tmp"C:\Users\Admin\AppData\Local\Temp\9157.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\91D4.tmp"C:\Users\Admin\AppData\Local\Temp\91D4.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\9241.tmp"C:\Users\Admin\AppData\Local\Temp\9241.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:876 -
C:\Users\Admin\AppData\Local\Temp\92BE.tmp"C:\Users\Admin\AppData\Local\Temp\92BE.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\932B.tmp"C:\Users\Admin\AppData\Local\Temp\932B.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\9398.tmp"C:\Users\Admin\AppData\Local\Temp\9398.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\9405.tmp"C:\Users\Admin\AppData\Local\Temp\9405.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\9473.tmp"C:\Users\Admin\AppData\Local\Temp\9473.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:576 -
C:\Users\Admin\AppData\Local\Temp\94C1.tmp"C:\Users\Admin\AppData\Local\Temp\94C1.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:844 -
C:\Users\Admin\AppData\Local\Temp\951E.tmp"C:\Users\Admin\AppData\Local\Temp\951E.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:960 -
C:\Users\Admin\AppData\Local\Temp\958B.tmp"C:\Users\Admin\AppData\Local\Temp\958B.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\95F9.tmp"C:\Users\Admin\AppData\Local\Temp\95F9.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\9656.tmp"C:\Users\Admin\AppData\Local\Temp\9656.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\96E3.tmp"C:\Users\Admin\AppData\Local\Temp\96E3.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\9750.tmp"C:\Users\Admin\AppData\Local\Temp\9750.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\97AD.tmp"C:\Users\Admin\AppData\Local\Temp\97AD.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\981B.tmp"C:\Users\Admin\AppData\Local\Temp\981B.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\9897.tmp"C:\Users\Admin\AppData\Local\Temp\9897.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\98F5.tmp"C:\Users\Admin\AppData\Local\Temp\98F5.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\9962.tmp"C:\Users\Admin\AppData\Local\Temp\9962.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\9B55.tmp"C:\Users\Admin\AppData\Local\Temp\9B55.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\9C11.tmp"C:\Users\Admin\AppData\Local\Temp\9C11.tmp"65⤵
- Executes dropped EXE
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\9D0A.tmp"C:\Users\Admin\AppData\Local\Temp\9D0A.tmp"66⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\9D87.tmp"C:\Users\Admin\AppData\Local\Temp\9D87.tmp"67⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\9E13.tmp"C:\Users\Admin\AppData\Local\Temp\9E13.tmp"68⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\9E81.tmp"C:\Users\Admin\AppData\Local\Temp\9E81.tmp"69⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\9EDE.tmp"C:\Users\Admin\AppData\Local\Temp\9EDE.tmp"70⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\9F6B.tmp"C:\Users\Admin\AppData\Local\Temp\9F6B.tmp"71⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\9FE7.tmp"C:\Users\Admin\AppData\Local\Temp\9FE7.tmp"72⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\A074.tmp"C:\Users\Admin\AppData\Local\Temp\A074.tmp"73⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\A0E1.tmp"C:\Users\Admin\AppData\Local\Temp\A0E1.tmp"74⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\A15E.tmp"C:\Users\Admin\AppData\Local\Temp\A15E.tmp"75⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\A1BB.tmp"C:\Users\Admin\AppData\Local\Temp\A1BB.tmp"76⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\A248.tmp"C:\Users\Admin\AppData\Local\Temp\A248.tmp"77⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\A2C5.tmp"C:\Users\Admin\AppData\Local\Temp\A2C5.tmp"78⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\A341.tmp"C:\Users\Admin\AppData\Local\Temp\A341.tmp"79⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\A3BE.tmp"C:\Users\Admin\AppData\Local\Temp\A3BE.tmp"80⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\A44B.tmp"C:\Users\Admin\AppData\Local\Temp\A44B.tmp"81⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\A4D7.tmp"C:\Users\Admin\AppData\Local\Temp\A4D7.tmp"82⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\A544.tmp"C:\Users\Admin\AppData\Local\Temp\A544.tmp"83⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\A5C1.tmp"C:\Users\Admin\AppData\Local\Temp\A5C1.tmp"84⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\A61F.tmp"C:\Users\Admin\AppData\Local\Temp\A61F.tmp"85⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\A67C.tmp"C:\Users\Admin\AppData\Local\Temp\A67C.tmp"86⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\A6E9.tmp"C:\Users\Admin\AppData\Local\Temp\A6E9.tmp"87⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\A737.tmp"C:\Users\Admin\AppData\Local\Temp\A737.tmp"88⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"89⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\A812.tmp"C:\Users\Admin\AppData\Local\Temp\A812.tmp"90⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\A87F.tmp"C:\Users\Admin\AppData\Local\Temp\A87F.tmp"91⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\A8FC.tmp"C:\Users\Admin\AppData\Local\Temp\A8FC.tmp"92⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\A969.tmp"C:\Users\Admin\AppData\Local\Temp\A969.tmp"93⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\A9D6.tmp"C:\Users\Admin\AppData\Local\Temp\A9D6.tmp"94⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\AA43.tmp"C:\Users\Admin\AppData\Local\Temp\AA43.tmp"95⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\AAB1.tmp"C:\Users\Admin\AppData\Local\Temp\AAB1.tmp"96⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\AB3D.tmp"C:\Users\Admin\AppData\Local\Temp\AB3D.tmp"97⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\ABAA.tmp"C:\Users\Admin\AppData\Local\Temp\ABAA.tmp"98⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\AC08.tmp"C:\Users\Admin\AppData\Local\Temp\AC08.tmp"99⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\AC65.tmp"C:\Users\Admin\AppData\Local\Temp\AC65.tmp"100⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\ACE2.tmp"C:\Users\Admin\AppData\Local\Temp\ACE2.tmp"101⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\AD4F.tmp"C:\Users\Admin\AppData\Local\Temp\AD4F.tmp"102⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\ADCC.tmp"C:\Users\Admin\AppData\Local\Temp\ADCC.tmp"103⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\AE39.tmp"C:\Users\Admin\AppData\Local\Temp\AE39.tmp"104⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\AEC6.tmp"C:\Users\Admin\AppData\Local\Temp\AEC6.tmp"105⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\AF43.tmp"C:\Users\Admin\AppData\Local\Temp\AF43.tmp"106⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\AFB0.tmp"C:\Users\Admin\AppData\Local\Temp\AFB0.tmp"107⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\B01D.tmp"C:\Users\Admin\AppData\Local\Temp\B01D.tmp"108⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\B09A.tmp"C:\Users\Admin\AppData\Local\Temp\B09A.tmp"109⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\B1E1.tmp"C:\Users\Admin\AppData\Local\Temp\B1E1.tmp"110⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\B25E.tmp"C:\Users\Admin\AppData\Local\Temp\B25E.tmp"111⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\B2DB.tmp"C:\Users\Admin\AppData\Local\Temp\B2DB.tmp"112⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\B348.tmp"C:\Users\Admin\AppData\Local\Temp\B348.tmp"113⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\B3C5.tmp"C:\Users\Admin\AppData\Local\Temp\B3C5.tmp"114⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\B442.tmp"C:\Users\Admin\AppData\Local\Temp\B442.tmp"115⤵PID:272
-
C:\Users\Admin\AppData\Local\Temp\B4AF.tmp"C:\Users\Admin\AppData\Local\Temp\B4AF.tmp"116⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\B52C.tmp"C:\Users\Admin\AppData\Local\Temp\B52C.tmp"117⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\B599.tmp"C:\Users\Admin\AppData\Local\Temp\B599.tmp"118⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\B606.tmp"C:\Users\Admin\AppData\Local\Temp\B606.tmp"119⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\B664.tmp"C:\Users\Admin\AppData\Local\Temp\B664.tmp"120⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\B6E1.tmp"C:\Users\Admin\AppData\Local\Temp\B6E1.tmp"121⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\B74E.tmp"C:\Users\Admin\AppData\Local\Temp\B74E.tmp"122⤵PID:736
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-