Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
23-01-2024 14:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-01-23_0cddd84120001dee4ac2c2409689aef1_mafia.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-01-23_0cddd84120001dee4ac2c2409689aef1_mafia.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-01-23_0cddd84120001dee4ac2c2409689aef1_mafia.exe
-
Size
765KB
-
MD5
0cddd84120001dee4ac2c2409689aef1
-
SHA1
a0875f6a9e2c7da3f41201c6f667d98cb84ba574
-
SHA256
cbb850f4442a61fefd0ce06c97802d6d8b5cb1b8071cc79396d2788f7d058f7b
-
SHA512
d5cf0ce730837d04abfd2ceacd44ac3b9e850ddf97ba7721c9b8459069040d182ff4ce66a5a7b4d487b4ffb8cebaf1e464390c2375f532fc23af13ea2ca2d77e
-
SSDEEP
12288:ZU5rCOTeiDauiZ9l65NvjNqnA+93ZF5rn5rLOa54U5w5A:ZUQOJDaZa5NvjYnAw3vh5Oa+UOS
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1504 3A14.tmp 2376 3ACF.tmp 2828 3C16.tmp 3032 3D20.tmp 2732 3D9C.tmp 2780 3EE4.tmp 2960 3FED.tmp 2648 40A8.tmp 2612 41C1.tmp 2768 424E.tmp 1204 4357.tmp 2192 4422.tmp 2972 44DD.tmp 3004 45D6.tmp 2912 4672.tmp 2496 477C.tmp 1624 4875.tmp 1824 4950.tmp 828 4A2A.tmp 564 4AF5.tmp 340 4CF8.tmp 2936 4E6E.tmp 1636 4F87.tmp 456 5042.tmp 1544 50AF.tmp 568 512C.tmp 2072 51A9.tmp 2108 5206.tmp 2228 5274.tmp 3040 5300.tmp 2308 535E.tmp 2212 53DA.tmp 580 5448.tmp 2464 54B5.tmp 1892 5522.tmp 2184 558F.tmp 2092 55FC.tmp 1100 5679.tmp 1760 56E6.tmp 2440 5754.tmp 1452 57B1.tmp 1616 582E.tmp 1736 588C.tmp 1044 58E9.tmp 904 5966.tmp 640 59C4.tmp 2872 5A21.tmp 1744 5AAE.tmp 1960 5B0B.tmp 1312 5B69.tmp 1756 5C14.tmp 1888 5C72.tmp 1936 5CD0.tmp 2544 5D3D.tmp 1572 5DC9.tmp 3008 5E36.tmp 2352 5EA4.tmp 2080 5F30.tmp 2832 5FBC.tmp 2828 6039.tmp 2708 60A6.tmp 2356 6123.tmp 2732 61A0.tmp 2628 6364.tmp -
Loads dropped DLL 64 IoCs
pid Process 1104 2024-01-23_0cddd84120001dee4ac2c2409689aef1_mafia.exe 1504 3A14.tmp 2376 3ACF.tmp 2828 3C16.tmp 3032 3D20.tmp 2732 3D9C.tmp 2780 3EE4.tmp 2960 3FED.tmp 2648 40A8.tmp 2612 41C1.tmp 2768 424E.tmp 1204 4357.tmp 2192 4422.tmp 2972 44DD.tmp 3004 45D6.tmp 2912 4672.tmp 2496 477C.tmp 1624 4875.tmp 1824 4950.tmp 828 4A2A.tmp 564 4AF5.tmp 340 4CF8.tmp 2936 4E6E.tmp 1636 4F87.tmp 456 5042.tmp 1544 50AF.tmp 568 512C.tmp 2072 51A9.tmp 2108 5206.tmp 2228 5274.tmp 3040 5300.tmp 2308 535E.tmp 2212 53DA.tmp 580 5448.tmp 2464 54B5.tmp 1892 5522.tmp 2184 558F.tmp 2092 55FC.tmp 1100 5679.tmp 1760 56E6.tmp 2440 5754.tmp 1452 57B1.tmp 1616 582E.tmp 1736 588C.tmp 1044 58E9.tmp 904 5966.tmp 640 59C4.tmp 2872 5A21.tmp 1744 5AAE.tmp 1960 5B0B.tmp 1312 5B69.tmp 1756 5C14.tmp 1888 5C72.tmp 1936 5CD0.tmp 2544 5D3D.tmp 1572 5DC9.tmp 3008 5E36.tmp 2352 5EA4.tmp 2080 5F30.tmp 2832 5FBC.tmp 2828 6039.tmp 2708 60A6.tmp 2356 6123.tmp 2732 61A0.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1104 wrote to memory of 1504 1104 2024-01-23_0cddd84120001dee4ac2c2409689aef1_mafia.exe 28 PID 1104 wrote to memory of 1504 1104 2024-01-23_0cddd84120001dee4ac2c2409689aef1_mafia.exe 28 PID 1104 wrote to memory of 1504 1104 2024-01-23_0cddd84120001dee4ac2c2409689aef1_mafia.exe 28 PID 1104 wrote to memory of 1504 1104 2024-01-23_0cddd84120001dee4ac2c2409689aef1_mafia.exe 28 PID 1504 wrote to memory of 2376 1504 3A14.tmp 29 PID 1504 wrote to memory of 2376 1504 3A14.tmp 29 PID 1504 wrote to memory of 2376 1504 3A14.tmp 29 PID 1504 wrote to memory of 2376 1504 3A14.tmp 29 PID 2376 wrote to memory of 2828 2376 3ACF.tmp 30 PID 2376 wrote to memory of 2828 2376 3ACF.tmp 30 PID 2376 wrote to memory of 2828 2376 3ACF.tmp 30 PID 2376 wrote to memory of 2828 2376 3ACF.tmp 30 PID 2828 wrote to memory of 3032 2828 3C16.tmp 31 PID 2828 wrote to memory of 3032 2828 3C16.tmp 31 PID 2828 wrote to memory of 3032 2828 3C16.tmp 31 PID 2828 wrote to memory of 3032 2828 3C16.tmp 31 PID 3032 wrote to memory of 2732 3032 3D20.tmp 32 PID 3032 wrote to memory of 2732 3032 3D20.tmp 32 PID 3032 wrote to memory of 2732 3032 3D20.tmp 32 PID 3032 wrote to memory of 2732 3032 3D20.tmp 32 PID 2732 wrote to memory of 2780 2732 3D9C.tmp 33 PID 2732 wrote to memory of 2780 2732 3D9C.tmp 33 PID 2732 wrote to memory of 2780 2732 3D9C.tmp 33 PID 2732 wrote to memory of 2780 2732 3D9C.tmp 33 PID 2780 wrote to memory of 2960 2780 3EE4.tmp 34 PID 2780 wrote to memory of 2960 2780 3EE4.tmp 34 PID 2780 wrote to memory of 2960 2780 3EE4.tmp 34 PID 2780 wrote to memory of 2960 2780 3EE4.tmp 34 PID 2960 wrote to memory of 2648 2960 3FED.tmp 35 PID 2960 wrote to memory of 2648 2960 3FED.tmp 35 PID 2960 wrote to memory of 2648 2960 3FED.tmp 35 PID 2960 wrote to memory of 2648 2960 3FED.tmp 35 PID 2648 wrote to memory of 2612 2648 40A8.tmp 36 PID 2648 wrote to memory of 2612 2648 40A8.tmp 36 PID 2648 wrote to memory of 2612 2648 40A8.tmp 36 PID 2648 wrote to memory of 2612 2648 40A8.tmp 36 PID 2612 wrote to memory of 2768 2612 41C1.tmp 37 PID 2612 wrote to memory of 2768 2612 41C1.tmp 37 PID 2612 wrote to memory of 2768 2612 41C1.tmp 37 PID 2612 wrote to memory of 2768 2612 41C1.tmp 37 PID 2768 wrote to memory of 1204 2768 424E.tmp 38 PID 2768 wrote to memory of 1204 2768 424E.tmp 38 PID 2768 wrote to memory of 1204 2768 424E.tmp 38 PID 2768 wrote to memory of 1204 2768 424E.tmp 38 PID 1204 wrote to memory of 2192 1204 4357.tmp 39 PID 1204 wrote to memory of 2192 1204 4357.tmp 39 PID 1204 wrote to memory of 2192 1204 4357.tmp 39 PID 1204 wrote to memory of 2192 1204 4357.tmp 39 PID 2192 wrote to memory of 2972 2192 4422.tmp 40 PID 2192 wrote to memory of 2972 2192 4422.tmp 40 PID 2192 wrote to memory of 2972 2192 4422.tmp 40 PID 2192 wrote to memory of 2972 2192 4422.tmp 40 PID 2972 wrote to memory of 3004 2972 44DD.tmp 41 PID 2972 wrote to memory of 3004 2972 44DD.tmp 41 PID 2972 wrote to memory of 3004 2972 44DD.tmp 41 PID 2972 wrote to memory of 3004 2972 44DD.tmp 41 PID 3004 wrote to memory of 2912 3004 45D6.tmp 42 PID 3004 wrote to memory of 2912 3004 45D6.tmp 42 PID 3004 wrote to memory of 2912 3004 45D6.tmp 42 PID 3004 wrote to memory of 2912 3004 45D6.tmp 42 PID 2912 wrote to memory of 2496 2912 4672.tmp 43 PID 2912 wrote to memory of 2496 2912 4672.tmp 43 PID 2912 wrote to memory of 2496 2912 4672.tmp 43 PID 2912 wrote to memory of 2496 2912 4672.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-23_0cddd84120001dee4ac2c2409689aef1_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-23_0cddd84120001dee4ac2c2409689aef1_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\3A14.tmp"C:\Users\Admin\AppData\Local\Temp\3A14.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\3ACF.tmp"C:\Users\Admin\AppData\Local\Temp\3ACF.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\3C16.tmp"C:\Users\Admin\AppData\Local\Temp\3C16.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\3D20.tmp"C:\Users\Admin\AppData\Local\Temp\3D20.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\3FED.tmp"C:\Users\Admin\AppData\Local\Temp\3FED.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\40A8.tmp"C:\Users\Admin\AppData\Local\Temp\40A8.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\41C1.tmp"C:\Users\Admin\AppData\Local\Temp\41C1.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\424E.tmp"C:\Users\Admin\AppData\Local\Temp\424E.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\4357.tmp"C:\Users\Admin\AppData\Local\Temp\4357.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\4422.tmp"C:\Users\Admin\AppData\Local\Temp\4422.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\44DD.tmp"C:\Users\Admin\AppData\Local\Temp\44DD.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\45D6.tmp"C:\Users\Admin\AppData\Local\Temp\45D6.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\4672.tmp"C:\Users\Admin\AppData\Local\Temp\4672.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\477C.tmp"C:\Users\Admin\AppData\Local\Temp\477C.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\4875.tmp"C:\Users\Admin\AppData\Local\Temp\4875.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\4950.tmp"C:\Users\Admin\AppData\Local\Temp\4950.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\4A2A.tmp"C:\Users\Admin\AppData\Local\Temp\4A2A.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:828 -
C:\Users\Admin\AppData\Local\Temp\4AF5.tmp"C:\Users\Admin\AppData\Local\Temp\4AF5.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:564 -
C:\Users\Admin\AppData\Local\Temp\4CF8.tmp"C:\Users\Admin\AppData\Local\Temp\4CF8.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:340 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\5042.tmp"C:\Users\Admin\AppData\Local\Temp\5042.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:456 -
C:\Users\Admin\AppData\Local\Temp\50AF.tmp"C:\Users\Admin\AppData\Local\Temp\50AF.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\512C.tmp"C:\Users\Admin\AppData\Local\Temp\512C.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:568 -
C:\Users\Admin\AppData\Local\Temp\51A9.tmp"C:\Users\Admin\AppData\Local\Temp\51A9.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\5206.tmp"C:\Users\Admin\AppData\Local\Temp\5206.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\5274.tmp"C:\Users\Admin\AppData\Local\Temp\5274.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\5300.tmp"C:\Users\Admin\AppData\Local\Temp\5300.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\535E.tmp"C:\Users\Admin\AppData\Local\Temp\535E.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\53DA.tmp"C:\Users\Admin\AppData\Local\Temp\53DA.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\5448.tmp"C:\Users\Admin\AppData\Local\Temp\5448.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:580 -
C:\Users\Admin\AppData\Local\Temp\54B5.tmp"C:\Users\Admin\AppData\Local\Temp\54B5.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\5522.tmp"C:\Users\Admin\AppData\Local\Temp\5522.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\558F.tmp"C:\Users\Admin\AppData\Local\Temp\558F.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\55FC.tmp"C:\Users\Admin\AppData\Local\Temp\55FC.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\5679.tmp"C:\Users\Admin\AppData\Local\Temp\5679.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\56E6.tmp"C:\Users\Admin\AppData\Local\Temp\56E6.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\5754.tmp"C:\Users\Admin\AppData\Local\Temp\5754.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\57B1.tmp"C:\Users\Admin\AppData\Local\Temp\57B1.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\582E.tmp"C:\Users\Admin\AppData\Local\Temp\582E.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\588C.tmp"C:\Users\Admin\AppData\Local\Temp\588C.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\58E9.tmp"C:\Users\Admin\AppData\Local\Temp\58E9.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\5966.tmp"C:\Users\Admin\AppData\Local\Temp\5966.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:904 -
C:\Users\Admin\AppData\Local\Temp\59C4.tmp"C:\Users\Admin\AppData\Local\Temp\59C4.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:640 -
C:\Users\Admin\AppData\Local\Temp\5A21.tmp"C:\Users\Admin\AppData\Local\Temp\5A21.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\5AAE.tmp"C:\Users\Admin\AppData\Local\Temp\5AAE.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\5B0B.tmp"C:\Users\Admin\AppData\Local\Temp\5B0B.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\5B69.tmp"C:\Users\Admin\AppData\Local\Temp\5B69.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\5C14.tmp"C:\Users\Admin\AppData\Local\Temp\5C14.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\5C72.tmp"C:\Users\Admin\AppData\Local\Temp\5C72.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\5CD0.tmp"C:\Users\Admin\AppData\Local\Temp\5CD0.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\5D3D.tmp"C:\Users\Admin\AppData\Local\Temp\5D3D.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\5DC9.tmp"C:\Users\Admin\AppData\Local\Temp\5DC9.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\5E36.tmp"C:\Users\Admin\AppData\Local\Temp\5E36.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\5EA4.tmp"C:\Users\Admin\AppData\Local\Temp\5EA4.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\5F30.tmp"C:\Users\Admin\AppData\Local\Temp\5F30.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\5FBC.tmp"C:\Users\Admin\AppData\Local\Temp\5FBC.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\6039.tmp"C:\Users\Admin\AppData\Local\Temp\6039.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\60A6.tmp"C:\Users\Admin\AppData\Local\Temp\60A6.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\6123.tmp"C:\Users\Admin\AppData\Local\Temp\6123.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\61A0.tmp"C:\Users\Admin\AppData\Local\Temp\61A0.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\6364.tmp"C:\Users\Admin\AppData\Local\Temp\6364.tmp"65⤵
- Executes dropped EXE
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\63D2.tmp"C:\Users\Admin\AppData\Local\Temp\63D2.tmp"66⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\644F.tmp"C:\Users\Admin\AppData\Local\Temp\644F.tmp"67⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\64BC.tmp"C:\Users\Admin\AppData\Local\Temp\64BC.tmp"68⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\6529.tmp"C:\Users\Admin\AppData\Local\Temp\6529.tmp"69⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\65B5.tmp"C:\Users\Admin\AppData\Local\Temp\65B5.tmp"70⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\6623.tmp"C:\Users\Admin\AppData\Local\Temp\6623.tmp"71⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\6690.tmp"C:\Users\Admin\AppData\Local\Temp\6690.tmp"72⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\670D.tmp"C:\Users\Admin\AppData\Local\Temp\670D.tmp"73⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\6789.tmp"C:\Users\Admin\AppData\Local\Temp\6789.tmp"74⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\67F7.tmp"C:\Users\Admin\AppData\Local\Temp\67F7.tmp"75⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\6864.tmp"C:\Users\Admin\AppData\Local\Temp\6864.tmp"76⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\68D1.tmp"C:\Users\Admin\AppData\Local\Temp\68D1.tmp"77⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\693E.tmp"C:\Users\Admin\AppData\Local\Temp\693E.tmp"78⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\69CB.tmp"C:\Users\Admin\AppData\Local\Temp\69CB.tmp"79⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\6A47.tmp"C:\Users\Admin\AppData\Local\Temp\6A47.tmp"80⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\6AB5.tmp"C:\Users\Admin\AppData\Local\Temp\6AB5.tmp"81⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\6B22.tmp"C:\Users\Admin\AppData\Local\Temp\6B22.tmp"82⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\6B7F.tmp"C:\Users\Admin\AppData\Local\Temp\6B7F.tmp"83⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\6BED.tmp"C:\Users\Admin\AppData\Local\Temp\6BED.tmp"84⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\6C4A.tmp"C:\Users\Admin\AppData\Local\Temp\6C4A.tmp"85⤵PID:268
-
C:\Users\Admin\AppData\Local\Temp\6CB7.tmp"C:\Users\Admin\AppData\Local\Temp\6CB7.tmp"86⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\6D25.tmp"C:\Users\Admin\AppData\Local\Temp\6D25.tmp"87⤵PID:588
-
C:\Users\Admin\AppData\Local\Temp\6D92.tmp"C:\Users\Admin\AppData\Local\Temp\6D92.tmp"88⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\6E0F.tmp"C:\Users\Admin\AppData\Local\Temp\6E0F.tmp"89⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\6E9B.tmp"C:\Users\Admin\AppData\Local\Temp\6E9B.tmp"90⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\6EF9.tmp"C:\Users\Admin\AppData\Local\Temp\6EF9.tmp"91⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\6F75.tmp"C:\Users\Admin\AppData\Local\Temp\6F75.tmp"92⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\7002.tmp"C:\Users\Admin\AppData\Local\Temp\7002.tmp"93⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\707F.tmp"C:\Users\Admin\AppData\Local\Temp\707F.tmp"94⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\70EC.tmp"C:\Users\Admin\AppData\Local\Temp\70EC.tmp"95⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\7169.tmp"C:\Users\Admin\AppData\Local\Temp\7169.tmp"96⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\71E5.tmp"C:\Users\Admin\AppData\Local\Temp\71E5.tmp"97⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\7262.tmp"C:\Users\Admin\AppData\Local\Temp\7262.tmp"98⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\72EF.tmp"C:\Users\Admin\AppData\Local\Temp\72EF.tmp"99⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\737B.tmp"C:\Users\Admin\AppData\Local\Temp\737B.tmp"100⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\73D9.tmp"C:\Users\Admin\AppData\Local\Temp\73D9.tmp"101⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"102⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"103⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\753F.tmp"C:\Users\Admin\AppData\Local\Temp\753F.tmp"104⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\759D.tmp"C:\Users\Admin\AppData\Local\Temp\759D.tmp"105⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\760A.tmp"C:\Users\Admin\AppData\Local\Temp\760A.tmp"106⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\7668.tmp"C:\Users\Admin\AppData\Local\Temp\7668.tmp"107⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\76D5.tmp"C:\Users\Admin\AppData\Local\Temp\76D5.tmp"108⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"109⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\77FD.tmp"C:\Users\Admin\AppData\Local\Temp\77FD.tmp"110⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\786B.tmp"C:\Users\Admin\AppData\Local\Temp\786B.tmp"111⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\78D8.tmp"C:\Users\Admin\AppData\Local\Temp\78D8.tmp"112⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\7945.tmp"C:\Users\Admin\AppData\Local\Temp\7945.tmp"113⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\79C2.tmp"C:\Users\Admin\AppData\Local\Temp\79C2.tmp"114⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\7A3F.tmp"C:\Users\Admin\AppData\Local\Temp\7A3F.tmp"115⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\7A9C.tmp"C:\Users\Admin\AppData\Local\Temp\7A9C.tmp"116⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\7B19.tmp"C:\Users\Admin\AppData\Local\Temp\7B19.tmp"117⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\7B96.tmp"C:\Users\Admin\AppData\Local\Temp\7B96.tmp"118⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\7C03.tmp"C:\Users\Admin\AppData\Local\Temp\7C03.tmp"119⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\7C70.tmp"C:\Users\Admin\AppData\Local\Temp\7C70.tmp"120⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\7CDD.tmp"C:\Users\Admin\AppData\Local\Temp\7CDD.tmp"121⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\7D3B.tmp"C:\Users\Admin\AppData\Local\Temp\7D3B.tmp"122⤵PID:1600
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-