Analysis
-
max time kernel
151s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
09-01-2024 06:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-01-08_cbe42da18a691578bbd192005e00f269_mafia.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-01-08_cbe42da18a691578bbd192005e00f269_mafia.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-01-08_cbe42da18a691578bbd192005e00f269_mafia.exe
-
Size
486KB
-
MD5
cbe42da18a691578bbd192005e00f269
-
SHA1
6755d9119beea0baff9c06dfcf95b13e825c088c
-
SHA256
1b3f756154e6e1b84f9f13f3ea6d06e7a03354f9c7474433e97087552a33caa6
-
SHA512
f47d553b39cfb47484cb7cdc3cae394d97db25d7d8d1a5360204156c7b1fd4ae3a170fabd49a3456efccecd42de0f12dbd34a2884b6fd2d14c0c04bc072cd4c9
-
SSDEEP
12288:/U5rCOTeiDuDNO5f81N4iIjWg9ltsfNZ:/UQOJDuof81aiI6gnmfN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2328 7C03.tmp 2652 7CCE.tmp 2792 7DC7.tmp 2332 7EA2.tmp 2704 7F8C.tmp 2696 8047.tmp 2904 80D3.tmp 2712 81BD.tmp 2588 82A7.tmp 2568 8372.tmp 596 844D.tmp 2508 8527.tmp 1176 8621.tmp 1496 870B.tmp 2512 87A7.tmp 2864 88BF.tmp 2892 89B9.tmp 3012 8AC2.tmp 1164 8CA6.tmp 1936 8DBF.tmp 2004 8E7A.tmp 1700 8F83.tmp 1656 901F.tmp 1616 909C.tmp 1644 9119.tmp 1584 91A5.tmp 1100 9212.tmp 1512 92AE.tmp 2464 931B.tmp 2280 9398.tmp 2244 9405.tmp 2192 9482.tmp 1960 94EF.tmp 2392 959B.tmp 2416 9618.tmp 2400 9695.tmp 1188 9702.tmp 2124 978E.tmp 696 980B.tmp 992 9897.tmp 2372 9914.tmp 988 99A1.tmp 1208 9A0E.tmp 1804 9A8B.tmp 904 9AF8.tmp 580 9B84.tmp 2412 9BF1.tmp 2072 9C6E.tmp 1752 9D0A.tmp 1192 9D77.tmp 1500 9DE5.tmp 1516 9E61.tmp 2032 9EDE.tmp 2168 9F7A.tmp 1980 A045.tmp 2764 A209.tmp 2748 A313.tmp 2680 A380.tmp 2628 A40C.tmp 2720 A479.tmp 2796 A515.tmp 2896 A592.tmp 2844 A61F.tmp 2688 A69B.tmp -
Loads dropped DLL 64 IoCs
pid Process 2912 2024-01-08_cbe42da18a691578bbd192005e00f269_mafia.exe 2328 7C03.tmp 2652 7CCE.tmp 2792 7DC7.tmp 2332 7EA2.tmp 2704 7F8C.tmp 2696 8047.tmp 2904 80D3.tmp 2712 81BD.tmp 2588 82A7.tmp 2568 8372.tmp 596 844D.tmp 2508 8527.tmp 1176 8621.tmp 1496 870B.tmp 2512 87A7.tmp 2864 88BF.tmp 2892 89B9.tmp 3012 8AC2.tmp 1164 8CA6.tmp 1936 8DBF.tmp 2004 8E7A.tmp 1700 8F83.tmp 1656 901F.tmp 1616 909C.tmp 1644 9119.tmp 1584 91A5.tmp 1100 9212.tmp 1512 92AE.tmp 2464 931B.tmp 2280 9398.tmp 2244 9405.tmp 2192 9482.tmp 1960 94EF.tmp 2392 959B.tmp 2416 9618.tmp 2400 9695.tmp 1188 9702.tmp 2124 978E.tmp 696 980B.tmp 992 9897.tmp 2372 9914.tmp 988 99A1.tmp 1208 9A0E.tmp 1804 9A8B.tmp 904 9AF8.tmp 580 9B84.tmp 2412 9BF1.tmp 2072 9C6E.tmp 1752 9D0A.tmp 1192 9D77.tmp 1500 9DE5.tmp 1516 9E61.tmp 2032 9EDE.tmp 2996 9FE7.tmp 1980 A045.tmp 2764 A209.tmp 2748 A313.tmp 2680 A380.tmp 2628 A40C.tmp 2720 A479.tmp 2796 A515.tmp 2896 A592.tmp 2844 A61F.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2912 wrote to memory of 2328 2912 2024-01-08_cbe42da18a691578bbd192005e00f269_mafia.exe 28 PID 2912 wrote to memory of 2328 2912 2024-01-08_cbe42da18a691578bbd192005e00f269_mafia.exe 28 PID 2912 wrote to memory of 2328 2912 2024-01-08_cbe42da18a691578bbd192005e00f269_mafia.exe 28 PID 2912 wrote to memory of 2328 2912 2024-01-08_cbe42da18a691578bbd192005e00f269_mafia.exe 28 PID 2328 wrote to memory of 2652 2328 7C03.tmp 29 PID 2328 wrote to memory of 2652 2328 7C03.tmp 29 PID 2328 wrote to memory of 2652 2328 7C03.tmp 29 PID 2328 wrote to memory of 2652 2328 7C03.tmp 29 PID 2652 wrote to memory of 2792 2652 7CCE.tmp 30 PID 2652 wrote to memory of 2792 2652 7CCE.tmp 30 PID 2652 wrote to memory of 2792 2652 7CCE.tmp 30 PID 2652 wrote to memory of 2792 2652 7CCE.tmp 30 PID 2792 wrote to memory of 2332 2792 7DC7.tmp 31 PID 2792 wrote to memory of 2332 2792 7DC7.tmp 31 PID 2792 wrote to memory of 2332 2792 7DC7.tmp 31 PID 2792 wrote to memory of 2332 2792 7DC7.tmp 31 PID 2332 wrote to memory of 2704 2332 7EA2.tmp 32 PID 2332 wrote to memory of 2704 2332 7EA2.tmp 32 PID 2332 wrote to memory of 2704 2332 7EA2.tmp 32 PID 2332 wrote to memory of 2704 2332 7EA2.tmp 32 PID 2704 wrote to memory of 2696 2704 7F8C.tmp 33 PID 2704 wrote to memory of 2696 2704 7F8C.tmp 33 PID 2704 wrote to memory of 2696 2704 7F8C.tmp 33 PID 2704 wrote to memory of 2696 2704 7F8C.tmp 33 PID 2696 wrote to memory of 2904 2696 8047.tmp 34 PID 2696 wrote to memory of 2904 2696 8047.tmp 34 PID 2696 wrote to memory of 2904 2696 8047.tmp 34 PID 2696 wrote to memory of 2904 2696 8047.tmp 34 PID 2904 wrote to memory of 2712 2904 80D3.tmp 35 PID 2904 wrote to memory of 2712 2904 80D3.tmp 35 PID 2904 wrote to memory of 2712 2904 80D3.tmp 35 PID 2904 wrote to memory of 2712 2904 80D3.tmp 35 PID 2712 wrote to memory of 2588 2712 81BD.tmp 36 PID 2712 wrote to memory of 2588 2712 81BD.tmp 36 PID 2712 wrote to memory of 2588 2712 81BD.tmp 36 PID 2712 wrote to memory of 2588 2712 81BD.tmp 36 PID 2588 wrote to memory of 2568 2588 82A7.tmp 37 PID 2588 wrote to memory of 2568 2588 82A7.tmp 37 PID 2588 wrote to memory of 2568 2588 82A7.tmp 37 PID 2588 wrote to memory of 2568 2588 82A7.tmp 37 PID 2568 wrote to memory of 596 2568 8372.tmp 38 PID 2568 wrote to memory of 596 2568 8372.tmp 38 PID 2568 wrote to memory of 596 2568 8372.tmp 38 PID 2568 wrote to memory of 596 2568 8372.tmp 38 PID 596 wrote to memory of 2508 596 844D.tmp 39 PID 596 wrote to memory of 2508 596 844D.tmp 39 PID 596 wrote to memory of 2508 596 844D.tmp 39 PID 596 wrote to memory of 2508 596 844D.tmp 39 PID 2508 wrote to memory of 1176 2508 8527.tmp 40 PID 2508 wrote to memory of 1176 2508 8527.tmp 40 PID 2508 wrote to memory of 1176 2508 8527.tmp 40 PID 2508 wrote to memory of 1176 2508 8527.tmp 40 PID 1176 wrote to memory of 1496 1176 8621.tmp 41 PID 1176 wrote to memory of 1496 1176 8621.tmp 41 PID 1176 wrote to memory of 1496 1176 8621.tmp 41 PID 1176 wrote to memory of 1496 1176 8621.tmp 41 PID 1496 wrote to memory of 2512 1496 870B.tmp 42 PID 1496 wrote to memory of 2512 1496 870B.tmp 42 PID 1496 wrote to memory of 2512 1496 870B.tmp 42 PID 1496 wrote to memory of 2512 1496 870B.tmp 42 PID 2512 wrote to memory of 2864 2512 87A7.tmp 43 PID 2512 wrote to memory of 2864 2512 87A7.tmp 43 PID 2512 wrote to memory of 2864 2512 87A7.tmp 43 PID 2512 wrote to memory of 2864 2512 87A7.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-08_cbe42da18a691578bbd192005e00f269_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-08_cbe42da18a691578bbd192005e00f269_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\7C03.tmp"C:\Users\Admin\AppData\Local\Temp\7C03.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\7CCE.tmp"C:\Users\Admin\AppData\Local\Temp\7CCE.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\7DC7.tmp"C:\Users\Admin\AppData\Local\Temp\7DC7.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\7EA2.tmp"C:\Users\Admin\AppData\Local\Temp\7EA2.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\7F8C.tmp"C:\Users\Admin\AppData\Local\Temp\7F8C.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\8047.tmp"C:\Users\Admin\AppData\Local\Temp\8047.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\80D3.tmp"C:\Users\Admin\AppData\Local\Temp\80D3.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\81BD.tmp"C:\Users\Admin\AppData\Local\Temp\81BD.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\82A7.tmp"C:\Users\Admin\AppData\Local\Temp\82A7.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\8372.tmp"C:\Users\Admin\AppData\Local\Temp\8372.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\844D.tmp"C:\Users\Admin\AppData\Local\Temp\844D.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Users\Admin\AppData\Local\Temp\8527.tmp"C:\Users\Admin\AppData\Local\Temp\8527.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\8621.tmp"C:\Users\Admin\AppData\Local\Temp\8621.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\870B.tmp"C:\Users\Admin\AppData\Local\Temp\870B.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\87A7.tmp"C:\Users\Admin\AppData\Local\Temp\87A7.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\88BF.tmp"C:\Users\Admin\AppData\Local\Temp\88BF.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\89B9.tmp"C:\Users\Admin\AppData\Local\Temp\89B9.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\8AC2.tmp"C:\Users\Admin\AppData\Local\Temp\8AC2.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\8CA6.tmp"C:\Users\Admin\AppData\Local\Temp\8CA6.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\8DBF.tmp"C:\Users\Admin\AppData\Local\Temp\8DBF.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\8E7A.tmp"C:\Users\Admin\AppData\Local\Temp\8E7A.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\8F83.tmp"C:\Users\Admin\AppData\Local\Temp\8F83.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\901F.tmp"C:\Users\Admin\AppData\Local\Temp\901F.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\909C.tmp"C:\Users\Admin\AppData\Local\Temp\909C.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\9119.tmp"C:\Users\Admin\AppData\Local\Temp\9119.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\91A5.tmp"C:\Users\Admin\AppData\Local\Temp\91A5.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\9212.tmp"C:\Users\Admin\AppData\Local\Temp\9212.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\92AE.tmp"C:\Users\Admin\AppData\Local\Temp\92AE.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\931B.tmp"C:\Users\Admin\AppData\Local\Temp\931B.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\9398.tmp"C:\Users\Admin\AppData\Local\Temp\9398.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\9405.tmp"C:\Users\Admin\AppData\Local\Temp\9405.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\9482.tmp"C:\Users\Admin\AppData\Local\Temp\9482.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\94EF.tmp"C:\Users\Admin\AppData\Local\Temp\94EF.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\959B.tmp"C:\Users\Admin\AppData\Local\Temp\959B.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\9618.tmp"C:\Users\Admin\AppData\Local\Temp\9618.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\9695.tmp"C:\Users\Admin\AppData\Local\Temp\9695.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\9702.tmp"C:\Users\Admin\AppData\Local\Temp\9702.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\978E.tmp"C:\Users\Admin\AppData\Local\Temp\978E.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\980B.tmp"C:\Users\Admin\AppData\Local\Temp\980B.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:696 -
C:\Users\Admin\AppData\Local\Temp\9897.tmp"C:\Users\Admin\AppData\Local\Temp\9897.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:992 -
C:\Users\Admin\AppData\Local\Temp\9914.tmp"C:\Users\Admin\AppData\Local\Temp\9914.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\99A1.tmp"C:\Users\Admin\AppData\Local\Temp\99A1.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:988 -
C:\Users\Admin\AppData\Local\Temp\9A0E.tmp"C:\Users\Admin\AppData\Local\Temp\9A0E.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\9A8B.tmp"C:\Users\Admin\AppData\Local\Temp\9A8B.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:904 -
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:580 -
C:\Users\Admin\AppData\Local\Temp\9BF1.tmp"C:\Users\Admin\AppData\Local\Temp\9BF1.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\9C6E.tmp"C:\Users\Admin\AppData\Local\Temp\9C6E.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\9D0A.tmp"C:\Users\Admin\AppData\Local\Temp\9D0A.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\9D77.tmp"C:\Users\Admin\AppData\Local\Temp\9D77.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\9DE5.tmp"C:\Users\Admin\AppData\Local\Temp\9DE5.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\9E61.tmp"C:\Users\Admin\AppData\Local\Temp\9E61.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\9EDE.tmp"C:\Users\Admin\AppData\Local\Temp\9EDE.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\9F7A.tmp"C:\Users\Admin\AppData\Local\Temp\9F7A.tmp"55⤵
- Executes dropped EXE
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\9FE7.tmp"C:\Users\Admin\AppData\Local\Temp\9FE7.tmp"56⤵
- Loads dropped DLL
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\A045.tmp"C:\Users\Admin\AppData\Local\Temp\A045.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\A209.tmp"C:\Users\Admin\AppData\Local\Temp\A209.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\A313.tmp"C:\Users\Admin\AppData\Local\Temp\A313.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\A380.tmp"C:\Users\Admin\AppData\Local\Temp\A380.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\A40C.tmp"C:\Users\Admin\AppData\Local\Temp\A40C.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\A479.tmp"C:\Users\Admin\AppData\Local\Temp\A479.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\A515.tmp"C:\Users\Admin\AppData\Local\Temp\A515.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\A592.tmp"C:\Users\Admin\AppData\Local\Temp\A592.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\A61F.tmp"C:\Users\Admin\AppData\Local\Temp\A61F.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\A69B.tmp"C:\Users\Admin\AppData\Local\Temp\A69B.tmp"66⤵
- Executes dropped EXE
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\A718.tmp"C:\Users\Admin\AppData\Local\Temp\A718.tmp"67⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\A795.tmp"C:\Users\Admin\AppData\Local\Temp\A795.tmp"68⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\A802.tmp"C:\Users\Admin\AppData\Local\Temp\A802.tmp"69⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\A86F.tmp"C:\Users\Admin\AppData\Local\Temp\A86F.tmp"70⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\A8DD.tmp"C:\Users\Admin\AppData\Local\Temp\A8DD.tmp"71⤵PID:524
-
C:\Users\Admin\AppData\Local\Temp\A93A.tmp"C:\Users\Admin\AppData\Local\Temp\A93A.tmp"72⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\A9D6.tmp"C:\Users\Admin\AppData\Local\Temp\A9D6.tmp"73⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\AA63.tmp"C:\Users\Admin\AppData\Local\Temp\AA63.tmp"74⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\AAEF.tmp"C:\Users\Admin\AppData\Local\Temp\AAEF.tmp"75⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\AB6C.tmp"C:\Users\Admin\AppData\Local\Temp\AB6C.tmp"76⤵PID:240
-
C:\Users\Admin\AppData\Local\Temp\ABC9.tmp"C:\Users\Admin\AppData\Local\Temp\ABC9.tmp"77⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\AC46.tmp"C:\Users\Admin\AppData\Local\Temp\AC46.tmp"78⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\ACB3.tmp"C:\Users\Admin\AppData\Local\Temp\ACB3.tmp"79⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\AD40.tmp"C:\Users\Admin\AppData\Local\Temp\AD40.tmp"80⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\ADBD.tmp"C:\Users\Admin\AppData\Local\Temp\ADBD.tmp"81⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\AE39.tmp"C:\Users\Admin\AppData\Local\Temp\AE39.tmp"82⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\AE97.tmp"C:\Users\Admin\AppData\Local\Temp\AE97.tmp"83⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\AF04.tmp"C:\Users\Admin\AppData\Local\Temp\AF04.tmp"84⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\AF91.tmp"C:\Users\Admin\AppData\Local\Temp\AF91.tmp"85⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\AFFE.tmp"C:\Users\Admin\AppData\Local\Temp\AFFE.tmp"86⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\B06B.tmp"C:\Users\Admin\AppData\Local\Temp\B06B.tmp"87⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"88⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\B193.tmp"C:\Users\Admin\AppData\Local\Temp\B193.tmp"89⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\B201.tmp"C:\Users\Admin\AppData\Local\Temp\B201.tmp"90⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\B27D.tmp"C:\Users\Admin\AppData\Local\Temp\B27D.tmp"91⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\B30A.tmp"C:\Users\Admin\AppData\Local\Temp\B30A.tmp"92⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\B387.tmp"C:\Users\Admin\AppData\Local\Temp\B387.tmp"93⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\B3F4.tmp"C:\Users\Admin\AppData\Local\Temp\B3F4.tmp"94⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\B461.tmp"C:\Users\Admin\AppData\Local\Temp\B461.tmp"95⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\B4DE.tmp"C:\Users\Admin\AppData\Local\Temp\B4DE.tmp"96⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\B53B.tmp"C:\Users\Admin\AppData\Local\Temp\B53B.tmp"97⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\B5A9.tmp"C:\Users\Admin\AppData\Local\Temp\B5A9.tmp"98⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\B625.tmp"C:\Users\Admin\AppData\Local\Temp\B625.tmp"99⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\B886.tmp"C:\Users\Admin\AppData\Local\Temp\B886.tmp"100⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\B8E3.tmp"C:\Users\Admin\AppData\Local\Temp\B8E3.tmp"101⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\B951.tmp"C:\Users\Admin\AppData\Local\Temp\B951.tmp"102⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\B9DD.tmp"C:\Users\Admin\AppData\Local\Temp\B9DD.tmp"103⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\BA69.tmp"C:\Users\Admin\AppData\Local\Temp\BA69.tmp"104⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\BAD7.tmp"C:\Users\Admin\AppData\Local\Temp\BAD7.tmp"105⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\BB34.tmp"C:\Users\Admin\AppData\Local\Temp\BB34.tmp"106⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\BBC1.tmp"C:\Users\Admin\AppData\Local\Temp\BBC1.tmp"107⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\BC7C.tmp"C:\Users\Admin\AppData\Local\Temp\BC7C.tmp"108⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\BCE9.tmp"C:\Users\Admin\AppData\Local\Temp\BCE9.tmp"109⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\BD75.tmp"C:\Users\Admin\AppData\Local\Temp\BD75.tmp"110⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\BDF2.tmp"C:\Users\Admin\AppData\Local\Temp\BDF2.tmp"111⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\BE6F.tmp"C:\Users\Admin\AppData\Local\Temp\BE6F.tmp"112⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\BEEC.tmp"C:\Users\Admin\AppData\Local\Temp\BEEC.tmp"113⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\BF59.tmp"C:\Users\Admin\AppData\Local\Temp\BF59.tmp"114⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"115⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\C053.tmp"C:\Users\Admin\AppData\Local\Temp\C053.tmp"116⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"117⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\C13D.tmp"C:\Users\Admin\AppData\Local\Temp\C13D.tmp"118⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"119⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\C217.tmp"C:\Users\Admin\AppData\Local\Temp\C217.tmp"120⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\C294.tmp"C:\Users\Admin\AppData\Local\Temp\C294.tmp"121⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\C320.tmp"C:\Users\Admin\AppData\Local\Temp\C320.tmp"122⤵PID:1724
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-