Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
23-01-2024 16:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-01-23_e5e85a6933d715ad58300697a0826ad2_mafia.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-01-23_e5e85a6933d715ad58300697a0826ad2_mafia.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-01-23_e5e85a6933d715ad58300697a0826ad2_mafia.exe
-
Size
486KB
-
MD5
e5e85a6933d715ad58300697a0826ad2
-
SHA1
705992be05be90bc166020797c257de6bb3d71b9
-
SHA256
7d21c3dbc210f5374b9e8e1e197c1393c39d6837b217a65a41f9d7d6983136cd
-
SHA512
801a6d0b39114690824156eecede2ec54cca886bbac7a5679e4012268243457f5297461af85500db9bf17612952f8bfb1de77e389425f08d3598756cf7ae7815
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7tfanUs8gDPDRezUvTdlanR4q9ehj73zosH3j:/U5rCOTeiDt4U3gHmULdl4R4EwnDxNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3904 8BA6.tmp 4608 76B6.tmp 1976 7782.tmp 5020 783D.tmp 1636 78D9.tmp 540 7976.tmp 2460 7A02.tmp 4088 7A8F.tmp 3136 7AFC.tmp 1608 7B79.tmp 4928 7BF6.tmp 5092 92AB.tmp 1464 7CC1.tmp 1244 7D5E.tmp 460 7DDB.tmp 2888 7EB5.tmp 4932 7F61.tmp 2744 7FDE.tmp 2108 806B.tmp 1252 973F.tmp 1340 81A3.tmp 4328 8220.tmp 4896 828E.tmp 4372 82FB.tmp 2780 8397.tmp 3964 8434.tmp 1288 84DF.tmp 4188 854D.tmp 4820 85E9.tmp 828 8656.tmp 4620 86D3.tmp 3684 8741.tmp 4468 87CD.tmp 396 886A.tmp 3140 88D7.tmp 4356 8935.tmp 1676 89C1.tmp 3008 8A3E.tmp 4764 8ABB.tmp 3704 8B48.tmp 3904 8BA6.tmp 2068 8C13.tmp 4156 A335.tmp 1452 8CFE.tmp 1764 8D8A.tmp 3740 8E17.tmp 1916 8E94.tmp 4456 8F4F.tmp 1180 8FCC.tmp 4756 9049.tmp 4004 90C6.tmp 1320 9143.tmp 4796 91C0.tmp 1376 923D.tmp 5092 92AB.tmp 4204 9318.tmp 2868 9385.tmp 4588 93F3.tmp 3652 948F.tmp 1712 950C.tmp 3788 956A.tmp 3540 95D7.tmp 2128 9645.tmp 3152 96D1.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3396 wrote to memory of 3904 3396 2024-01-23_e5e85a6933d715ad58300697a0826ad2_mafia.exe 123 PID 3396 wrote to memory of 3904 3396 2024-01-23_e5e85a6933d715ad58300697a0826ad2_mafia.exe 123 PID 3396 wrote to memory of 3904 3396 2024-01-23_e5e85a6933d715ad58300697a0826ad2_mafia.exe 123 PID 3904 wrote to memory of 4608 3904 8BA6.tmp 88 PID 3904 wrote to memory of 4608 3904 8BA6.tmp 88 PID 3904 wrote to memory of 4608 3904 8BA6.tmp 88 PID 4608 wrote to memory of 1976 4608 76B6.tmp 90 PID 4608 wrote to memory of 1976 4608 76B6.tmp 90 PID 4608 wrote to memory of 1976 4608 76B6.tmp 90 PID 1976 wrote to memory of 5020 1976 7782.tmp 91 PID 1976 wrote to memory of 5020 1976 7782.tmp 91 PID 1976 wrote to memory of 5020 1976 7782.tmp 91 PID 5020 wrote to memory of 1636 5020 783D.tmp 92 PID 5020 wrote to memory of 1636 5020 783D.tmp 92 PID 5020 wrote to memory of 1636 5020 783D.tmp 92 PID 1636 wrote to memory of 540 1636 78D9.tmp 93 PID 1636 wrote to memory of 540 1636 78D9.tmp 93 PID 1636 wrote to memory of 540 1636 78D9.tmp 93 PID 540 wrote to memory of 2460 540 7976.tmp 152 PID 540 wrote to memory of 2460 540 7976.tmp 152 PID 540 wrote to memory of 2460 540 7976.tmp 152 PID 2460 wrote to memory of 4088 2460 7A02.tmp 150 PID 2460 wrote to memory of 4088 2460 7A02.tmp 150 PID 2460 wrote to memory of 4088 2460 7A02.tmp 150 PID 4088 wrote to memory of 3136 4088 7A8F.tmp 94 PID 4088 wrote to memory of 3136 4088 7A8F.tmp 94 PID 4088 wrote to memory of 3136 4088 7A8F.tmp 94 PID 3136 wrote to memory of 1608 3136 7AFC.tmp 101 PID 3136 wrote to memory of 1608 3136 7AFC.tmp 101 PID 3136 wrote to memory of 1608 3136 7AFC.tmp 101 PID 1608 wrote to memory of 4928 1608 7B79.tmp 95 PID 1608 wrote to memory of 4928 1608 7B79.tmp 95 PID 1608 wrote to memory of 4928 1608 7B79.tmp 95 PID 4928 wrote to memory of 5092 4928 7BF6.tmp 144 PID 4928 wrote to memory of 5092 4928 7BF6.tmp 144 PID 4928 wrote to memory of 5092 4928 7BF6.tmp 144 PID 5092 wrote to memory of 1464 5092 92AB.tmp 99 PID 5092 wrote to memory of 1464 5092 92AB.tmp 99 PID 5092 wrote to memory of 1464 5092 92AB.tmp 99 PID 1464 wrote to memory of 1244 1464 7CC1.tmp 97 PID 1464 wrote to memory of 1244 1464 7CC1.tmp 97 PID 1464 wrote to memory of 1244 1464 7CC1.tmp 97 PID 1244 wrote to memory of 460 1244 7D5E.tmp 98 PID 1244 wrote to memory of 460 1244 7D5E.tmp 98 PID 1244 wrote to memory of 460 1244 7D5E.tmp 98 PID 460 wrote to memory of 2888 460 7DDB.tmp 100 PID 460 wrote to memory of 2888 460 7DDB.tmp 100 PID 460 wrote to memory of 2888 460 7DDB.tmp 100 PID 2888 wrote to memory of 4932 2888 7EB5.tmp 145 PID 2888 wrote to memory of 4932 2888 7EB5.tmp 145 PID 2888 wrote to memory of 4932 2888 7EB5.tmp 145 PID 4932 wrote to memory of 2744 4932 7F61.tmp 141 PID 4932 wrote to memory of 2744 4932 7F61.tmp 141 PID 4932 wrote to memory of 2744 4932 7F61.tmp 141 PID 2744 wrote to memory of 2108 2744 7FDE.tmp 102 PID 2744 wrote to memory of 2108 2744 7FDE.tmp 102 PID 2744 wrote to memory of 2108 2744 7FDE.tmp 102 PID 2108 wrote to memory of 1252 2108 806B.tmp 157 PID 2108 wrote to memory of 1252 2108 806B.tmp 157 PID 2108 wrote to memory of 1252 2108 806B.tmp 157 PID 1252 wrote to memory of 1340 1252 973F.tmp 136 PID 1252 wrote to memory of 1340 1252 973F.tmp 136 PID 1252 wrote to memory of 1340 1252 973F.tmp 136 PID 1340 wrote to memory of 4328 1340 81A3.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-23_e5e85a6933d715ad58300697a0826ad2_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-23_e5e85a6933d715ad58300697a0826ad2_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\75FB.tmp"C:\Users\Admin\AppData\Local\Temp\75FB.tmp"2⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\76B6.tmp"C:\Users\Admin\AppData\Local\Temp\76B6.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\7782.tmp"C:\Users\Admin\AppData\Local\Temp\7782.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\783D.tmp"C:\Users\Admin\AppData\Local\Temp\783D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\78D9.tmp"C:\Users\Admin\AppData\Local\Temp\78D9.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\7976.tmp"C:\Users\Admin\AppData\Local\Temp\7976.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\AppData\Local\Temp\7A02.tmp"C:\Users\Admin\AppData\Local\Temp\7A02.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\7B79.tmp"C:\Users\Admin\AppData\Local\Temp\7B79.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608
-
-
C:\Users\Admin\AppData\Local\Temp\7BF6.tmp"C:\Users\Admin\AppData\Local\Temp\7BF6.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\7C54.tmp"C:\Users\Admin\AppData\Local\Temp\7C54.tmp"2⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464
-
-
-
C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Users\Admin\AppData\Local\Temp\7EB5.tmp"C:\Users\Admin\AppData\Local\Temp\7EB5.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\7F61.tmp"C:\Users\Admin\AppData\Local\Temp\7F61.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\806B.tmp"C:\Users\Admin\AppData\Local\Temp\806B.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\8117.tmp"C:\Users\Admin\AppData\Local\Temp\8117.tmp"2⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\81A3.tmp"C:\Users\Admin\AppData\Local\Temp\81A3.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340
-
-
-
C:\Users\Admin\AppData\Local\Temp\8220.tmp"C:\Users\Admin\AppData\Local\Temp\8220.tmp"1⤵
- Executes dropped EXE
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\828E.tmp"C:\Users\Admin\AppData\Local\Temp\828E.tmp"2⤵
- Executes dropped EXE
PID:4896
-
-
C:\Users\Admin\AppData\Local\Temp\8434.tmp"C:\Users\Admin\AppData\Local\Temp\8434.tmp"1⤵
- Executes dropped EXE
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\84DF.tmp"C:\Users\Admin\AppData\Local\Temp\84DF.tmp"2⤵
- Executes dropped EXE
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\854D.tmp"C:\Users\Admin\AppData\Local\Temp\854D.tmp"3⤵
- Executes dropped EXE
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\85E9.tmp"C:\Users\Admin\AppData\Local\Temp\85E9.tmp"4⤵
- Executes dropped EXE
PID:4820
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\86D3.tmp"C:\Users\Admin\AppData\Local\Temp\86D3.tmp"1⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\8741.tmp"C:\Users\Admin\AppData\Local\Temp\8741.tmp"2⤵
- Executes dropped EXE
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\87CD.tmp"C:\Users\Admin\AppData\Local\Temp\87CD.tmp"3⤵
- Executes dropped EXE
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\886A.tmp"C:\Users\Admin\AppData\Local\Temp\886A.tmp"4⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\88D7.tmp"C:\Users\Admin\AppData\Local\Temp\88D7.tmp"5⤵
- Executes dropped EXE
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\8935.tmp"C:\Users\Admin\AppData\Local\Temp\8935.tmp"6⤵
- Executes dropped EXE
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\89C1.tmp"C:\Users\Admin\AppData\Local\Temp\89C1.tmp"7⤵
- Executes dropped EXE
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"8⤵
- Executes dropped EXE
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"9⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\8B48.tmp"C:\Users\Admin\AppData\Local\Temp\8B48.tmp"10⤵
- Executes dropped EXE
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\8C13.tmp"C:\Users\Admin\AppData\Local\Temp\8C13.tmp"12⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\8C81.tmp"C:\Users\Admin\AppData\Local\Temp\8C81.tmp"13⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"14⤵
- Executes dropped EXE
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"15⤵
- Executes dropped EXE
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\8E17.tmp"C:\Users\Admin\AppData\Local\Temp\8E17.tmp"16⤵
- Executes dropped EXE
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\8E94.tmp"C:\Users\Admin\AppData\Local\Temp\8E94.tmp"17⤵
- Executes dropped EXE
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"18⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"19⤵
- Executes dropped EXE
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\9049.tmp"C:\Users\Admin\AppData\Local\Temp\9049.tmp"20⤵
- Executes dropped EXE
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\90C6.tmp"C:\Users\Admin\AppData\Local\Temp\90C6.tmp"21⤵
- Executes dropped EXE
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\9143.tmp"C:\Users\Admin\AppData\Local\Temp\9143.tmp"22⤵
- Executes dropped EXE
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\91C0.tmp"C:\Users\Admin\AppData\Local\Temp\91C0.tmp"23⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\923D.tmp"C:\Users\Admin\AppData\Local\Temp\923D.tmp"24⤵
- Executes dropped EXE
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\92AB.tmp"C:\Users\Admin\AppData\Local\Temp\92AB.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\9318.tmp"C:\Users\Admin\AppData\Local\Temp\9318.tmp"26⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\9385.tmp"C:\Users\Admin\AppData\Local\Temp\9385.tmp"27⤵
- Executes dropped EXE
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\93F3.tmp"C:\Users\Admin\AppData\Local\Temp\93F3.tmp"28⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\948F.tmp"C:\Users\Admin\AppData\Local\Temp\948F.tmp"29⤵
- Executes dropped EXE
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\950C.tmp"C:\Users\Admin\AppData\Local\Temp\950C.tmp"30⤵
- Executes dropped EXE
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\956A.tmp"C:\Users\Admin\AppData\Local\Temp\956A.tmp"31⤵
- Executes dropped EXE
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\95D7.tmp"C:\Users\Admin\AppData\Local\Temp\95D7.tmp"32⤵
- Executes dropped EXE
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\9645.tmp"C:\Users\Admin\AppData\Local\Temp\9645.tmp"33⤵
- Executes dropped EXE
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\96D1.tmp"C:\Users\Admin\AppData\Local\Temp\96D1.tmp"34⤵
- Executes dropped EXE
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\973F.tmp"C:\Users\Admin\AppData\Local\Temp\973F.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\97AC.tmp"C:\Users\Admin\AppData\Local\Temp\97AC.tmp"36⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\9819.tmp"C:\Users\Admin\AppData\Local\Temp\9819.tmp"37⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\98A6.tmp"C:\Users\Admin\AppData\Local\Temp\98A6.tmp"38⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\9923.tmp"C:\Users\Admin\AppData\Local\Temp\9923.tmp"39⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\9990.tmp"C:\Users\Admin\AppData\Local\Temp\9990.tmp"40⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\99FE.tmp"C:\Users\Admin\AppData\Local\Temp\99FE.tmp"41⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"42⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"43⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\9B65.tmp"C:\Users\Admin\AppData\Local\Temp\9B65.tmp"44⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"45⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\9C30.tmp"C:\Users\Admin\AppData\Local\Temp\9C30.tmp"46⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"47⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"48⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\9D88.tmp"C:\Users\Admin\AppData\Local\Temp\9D88.tmp"49⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\9E05.tmp"C:\Users\Admin\AppData\Local\Temp\9E05.tmp"50⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"51⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"52⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"53⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\A009.tmp"C:\Users\Admin\AppData\Local\Temp\A009.tmp"54⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\A076.tmp"C:\Users\Admin\AppData\Local\Temp\A076.tmp"55⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"56⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\A141.tmp"C:\Users\Admin\AppData\Local\Temp\A141.tmp"57⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"58⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\A23B.tmp"C:\Users\Admin\AppData\Local\Temp\A23B.tmp"59⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"60⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\A335.tmp"C:\Users\Admin\AppData\Local\Temp\A335.tmp"61⤵
- Executes dropped EXE
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\A42F.tmp"C:\Users\Admin\AppData\Local\Temp\A42F.tmp"62⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"63⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"64⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\A633.tmp"C:\Users\Admin\AppData\Local\Temp\A633.tmp"65⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\A78A.tmp"C:\Users\Admin\AppData\Local\Temp\A78A.tmp"66⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"67⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"68⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\A9AD.tmp"C:\Users\Admin\AppData\Local\Temp\A9AD.tmp"69⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\AA88.tmp"C:\Users\Admin\AppData\Local\Temp\AA88.tmp"70⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\AB24.tmp"C:\Users\Admin\AppData\Local\Temp\AB24.tmp"71⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\AB72.tmp"C:\Users\Admin\AppData\Local\Temp\AB72.tmp"72⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"73⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"74⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"75⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"76⤵PID:460
-
C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"77⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"78⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"79⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\B083.tmp"C:\Users\Admin\AppData\Local\Temp\B083.tmp"80⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"81⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\B17D.tmp"C:\Users\Admin\AppData\Local\Temp\B17D.tmp"82⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"83⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\B277.tmp"C:\Users\Admin\AppData\Local\Temp\B277.tmp"84⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\B342.tmp"C:\Users\Admin\AppData\Local\Temp\B342.tmp"85⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"86⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\B40E.tmp"C:\Users\Admin\AppData\Local\Temp\B40E.tmp"87⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\B48B.tmp"C:\Users\Admin\AppData\Local\Temp\B48B.tmp"88⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\B508.tmp"C:\Users\Admin\AppData\Local\Temp\B508.tmp"89⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\B594.tmp"C:\Users\Admin\AppData\Local\Temp\B594.tmp"90⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\B611.tmp"C:\Users\Admin\AppData\Local\Temp\B611.tmp"91⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\B67F.tmp"C:\Users\Admin\AppData\Local\Temp\B67F.tmp"92⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"93⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\B788.tmp"C:\Users\Admin\AppData\Local\Temp\B788.tmp"94⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\B805.tmp"C:\Users\Admin\AppData\Local\Temp\B805.tmp"95⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\B882.tmp"C:\Users\Admin\AppData\Local\Temp\B882.tmp"96⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\B90F.tmp"C:\Users\Admin\AppData\Local\Temp\B90F.tmp"97⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"98⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\BA47.tmp"C:\Users\Admin\AppData\Local\Temp\BA47.tmp"99⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"100⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\BB51.tmp"C:\Users\Admin\AppData\Local\Temp\BB51.tmp"101⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"102⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"103⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"104⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\BD64.tmp"C:\Users\Admin\AppData\Local\Temp\BD64.tmp"105⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"106⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\BE5E.tmp"C:\Users\Admin\AppData\Local\Temp\BE5E.tmp"107⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\BECC.tmp"C:\Users\Admin\AppData\Local\Temp\BECC.tmp"108⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\BF58.tmp"C:\Users\Admin\AppData\Local\Temp\BF58.tmp"109⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\BFD5.tmp"C:\Users\Admin\AppData\Local\Temp\BFD5.tmp"110⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\C071.tmp"C:\Users\Admin\AppData\Local\Temp\C071.tmp"111⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"112⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\C19A.tmp"C:\Users\Admin\AppData\Local\Temp\C19A.tmp"113⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\C217.tmp"C:\Users\Admin\AppData\Local\Temp\C217.tmp"114⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\C285.tmp"C:\Users\Admin\AppData\Local\Temp\C285.tmp"115⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\C302.tmp"C:\Users\Admin\AppData\Local\Temp\C302.tmp"116⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\C38E.tmp"C:\Users\Admin\AppData\Local\Temp\C38E.tmp"117⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\C40B.tmp"C:\Users\Admin\AppData\Local\Temp\C40B.tmp"118⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\C498.tmp"C:\Users\Admin\AppData\Local\Temp\C498.tmp"119⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\C515.tmp"C:\Users\Admin\AppData\Local\Temp\C515.tmp"120⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"121⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\C65D.tmp"C:\Users\Admin\AppData\Local\Temp\C65D.tmp"122⤵PID:3128
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-