Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24-01-2024 06:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-01-24_24d884883616a28071d51f35711b5bf6_mafia.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-01-24_24d884883616a28071d51f35711b5bf6_mafia.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-01-24_24d884883616a28071d51f35711b5bf6_mafia.exe
-
Size
486KB
-
MD5
24d884883616a28071d51f35711b5bf6
-
SHA1
cfa0add1adccf1ba1af6ea8ae0d3eaad72c5282d
-
SHA256
74075420458590f230142db193f89efc81dbdd230299eab810a79e0cdb6ff1b8
-
SHA512
c5d70758c9d090422efcd5836907ce52e4e316807dc477d62c0675bcbd3b5fbf4d452615ed79deefb6ce81a15ef774928db27fac8ded504785559453614f92b8
-
SSDEEP
12288:/U5rCOTeiDAanCOUZvCMHgN6+HifFZqraXPNZ:/UQOJDA+CO8vzHgN6+CyraXPN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2772 3C36.tmp 2728 3D10.tmp 2788 3E0A.tmp 2744 3E96.tmp 2824 3F32.tmp 2836 3FCE.tmp 2752 40A8.tmp 2584 4192.tmp 2664 424E.tmp 2644 42BB.tmp 1980 4347.tmp 2892 43F3.tmp 2912 447F.tmp 3060 44FC.tmp 2536 45E6.tmp 1792 46A1.tmp 2040 470E.tmp 2252 478B.tmp 520 4875.tmp 2832 4930.tmp 588 4A1A.tmp 1420 4A97.tmp 272 4B24.tmp 1672 4BB0.tmp 1764 4BFE.tmp 1572 4C6B.tmp 2352 4CD8.tmp 1220 4D46.tmp 320 4DB3.tmp 2544 4EAC.tmp 3008 4F29.tmp 1172 4F96.tmp 3036 4FF4.tmp 1044 5061.tmp 1472 50CE.tmp 1704 513C.tmp 296 5199.tmp 1688 5245.tmp 2996 533E.tmp 1804 53BB.tmp 1160 5448.tmp 1832 5512.tmp 2300 55AE.tmp 1940 561C.tmp 680 56B8.tmp 2304 5725.tmp 2672 57A2.tmp 580 581E.tmp 2556 589B.tmp 1520 5928.tmp 2448 59B4.tmp 1692 5A31.tmp 2476 5A8E.tmp 1592 5AFC.tmp 1568 5B69.tmp 2376 5BC6.tmp 2772 5C24.tmp 2816 5CA1.tmp 2828 5D0E.tmp 2976 5D8B.tmp 2060 5DE8.tmp 624 5E46.tmp 2608 5ED2.tmp 2940 5F4F.tmp -
Loads dropped DLL 64 IoCs
pid Process 2428 2024-01-24_24d884883616a28071d51f35711b5bf6_mafia.exe 2772 3C36.tmp 2728 3D10.tmp 2788 3E0A.tmp 2744 3E96.tmp 2824 3F32.tmp 2836 3FCE.tmp 2752 40A8.tmp 2584 4192.tmp 2664 424E.tmp 2644 42BB.tmp 1980 4347.tmp 2892 43F3.tmp 2912 447F.tmp 3060 44FC.tmp 2536 45E6.tmp 1792 46A1.tmp 2040 470E.tmp 2252 478B.tmp 520 4875.tmp 2832 4930.tmp 588 4A1A.tmp 1420 4A97.tmp 272 4B24.tmp 1672 4BB0.tmp 1764 4BFE.tmp 1572 4C6B.tmp 2352 4CD8.tmp 1220 4D46.tmp 320 4DB3.tmp 2544 4EAC.tmp 3008 4F29.tmp 1172 4F96.tmp 3036 4FF4.tmp 1044 5061.tmp 1472 50CE.tmp 1704 513C.tmp 296 5199.tmp 1688 5245.tmp 2996 533E.tmp 1804 53BB.tmp 1160 5448.tmp 1832 5512.tmp 2300 55AE.tmp 1940 561C.tmp 680 56B8.tmp 2304 5725.tmp 2672 57A2.tmp 580 581E.tmp 2556 589B.tmp 1520 5928.tmp 2448 59B4.tmp 1692 5A31.tmp 2476 5A8E.tmp 1592 5AFC.tmp 1568 5B69.tmp 2376 5BC6.tmp 2772 5C24.tmp 2816 5CA1.tmp 2828 5D0E.tmp 2976 5D8B.tmp 2060 5DE8.tmp 624 5E46.tmp 2608 5ED2.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2428 wrote to memory of 2772 2428 2024-01-24_24d884883616a28071d51f35711b5bf6_mafia.exe 28 PID 2428 wrote to memory of 2772 2428 2024-01-24_24d884883616a28071d51f35711b5bf6_mafia.exe 28 PID 2428 wrote to memory of 2772 2428 2024-01-24_24d884883616a28071d51f35711b5bf6_mafia.exe 28 PID 2428 wrote to memory of 2772 2428 2024-01-24_24d884883616a28071d51f35711b5bf6_mafia.exe 28 PID 2772 wrote to memory of 2728 2772 3C36.tmp 29 PID 2772 wrote to memory of 2728 2772 3C36.tmp 29 PID 2772 wrote to memory of 2728 2772 3C36.tmp 29 PID 2772 wrote to memory of 2728 2772 3C36.tmp 29 PID 2728 wrote to memory of 2788 2728 3D10.tmp 30 PID 2728 wrote to memory of 2788 2728 3D10.tmp 30 PID 2728 wrote to memory of 2788 2728 3D10.tmp 30 PID 2728 wrote to memory of 2788 2728 3D10.tmp 30 PID 2788 wrote to memory of 2744 2788 3E0A.tmp 31 PID 2788 wrote to memory of 2744 2788 3E0A.tmp 31 PID 2788 wrote to memory of 2744 2788 3E0A.tmp 31 PID 2788 wrote to memory of 2744 2788 3E0A.tmp 31 PID 2744 wrote to memory of 2824 2744 3E96.tmp 32 PID 2744 wrote to memory of 2824 2744 3E96.tmp 32 PID 2744 wrote to memory of 2824 2744 3E96.tmp 32 PID 2744 wrote to memory of 2824 2744 3E96.tmp 32 PID 2824 wrote to memory of 2836 2824 3F32.tmp 33 PID 2824 wrote to memory of 2836 2824 3F32.tmp 33 PID 2824 wrote to memory of 2836 2824 3F32.tmp 33 PID 2824 wrote to memory of 2836 2824 3F32.tmp 33 PID 2836 wrote to memory of 2752 2836 3FCE.tmp 34 PID 2836 wrote to memory of 2752 2836 3FCE.tmp 34 PID 2836 wrote to memory of 2752 2836 3FCE.tmp 34 PID 2836 wrote to memory of 2752 2836 3FCE.tmp 34 PID 2752 wrote to memory of 2584 2752 40A8.tmp 35 PID 2752 wrote to memory of 2584 2752 40A8.tmp 35 PID 2752 wrote to memory of 2584 2752 40A8.tmp 35 PID 2752 wrote to memory of 2584 2752 40A8.tmp 35 PID 2584 wrote to memory of 2664 2584 4192.tmp 36 PID 2584 wrote to memory of 2664 2584 4192.tmp 36 PID 2584 wrote to memory of 2664 2584 4192.tmp 36 PID 2584 wrote to memory of 2664 2584 4192.tmp 36 PID 2664 wrote to memory of 2644 2664 424E.tmp 37 PID 2664 wrote to memory of 2644 2664 424E.tmp 37 PID 2664 wrote to memory of 2644 2664 424E.tmp 37 PID 2664 wrote to memory of 2644 2664 424E.tmp 37 PID 2644 wrote to memory of 1980 2644 42BB.tmp 38 PID 2644 wrote to memory of 1980 2644 42BB.tmp 38 PID 2644 wrote to memory of 1980 2644 42BB.tmp 38 PID 2644 wrote to memory of 1980 2644 42BB.tmp 38 PID 1980 wrote to memory of 2892 1980 4347.tmp 39 PID 1980 wrote to memory of 2892 1980 4347.tmp 39 PID 1980 wrote to memory of 2892 1980 4347.tmp 39 PID 1980 wrote to memory of 2892 1980 4347.tmp 39 PID 2892 wrote to memory of 2912 2892 43F3.tmp 41 PID 2892 wrote to memory of 2912 2892 43F3.tmp 41 PID 2892 wrote to memory of 2912 2892 43F3.tmp 41 PID 2892 wrote to memory of 2912 2892 43F3.tmp 41 PID 2912 wrote to memory of 3060 2912 447F.tmp 40 PID 2912 wrote to memory of 3060 2912 447F.tmp 40 PID 2912 wrote to memory of 3060 2912 447F.tmp 40 PID 2912 wrote to memory of 3060 2912 447F.tmp 40 PID 3060 wrote to memory of 2536 3060 44FC.tmp 42 PID 3060 wrote to memory of 2536 3060 44FC.tmp 42 PID 3060 wrote to memory of 2536 3060 44FC.tmp 42 PID 3060 wrote to memory of 2536 3060 44FC.tmp 42 PID 2536 wrote to memory of 1792 2536 45E6.tmp 45 PID 2536 wrote to memory of 1792 2536 45E6.tmp 45 PID 2536 wrote to memory of 1792 2536 45E6.tmp 45 PID 2536 wrote to memory of 1792 2536 45E6.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-24_24d884883616a28071d51f35711b5bf6_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-24_24d884883616a28071d51f35711b5bf6_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\3C36.tmp"C:\Users\Admin\AppData\Local\Temp\3C36.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\3D10.tmp"C:\Users\Admin\AppData\Local\Temp\3D10.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\3E0A.tmp"C:\Users\Admin\AppData\Local\Temp\3E0A.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\3E96.tmp"C:\Users\Admin\AppData\Local\Temp\3E96.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\3F32.tmp"C:\Users\Admin\AppData\Local\Temp\3F32.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\3FCE.tmp"C:\Users\Admin\AppData\Local\Temp\3FCE.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\40A8.tmp"C:\Users\Admin\AppData\Local\Temp\40A8.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\4192.tmp"C:\Users\Admin\AppData\Local\Temp\4192.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\424E.tmp"C:\Users\Admin\AppData\Local\Temp\424E.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\42BB.tmp"C:\Users\Admin\AppData\Local\Temp\42BB.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\4347.tmp"C:\Users\Admin\AppData\Local\Temp\4347.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\43F3.tmp"C:\Users\Admin\AppData\Local\Temp\43F3.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\447F.tmp"C:\Users\Admin\AppData\Local\Temp\447F.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2912
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\44FC.tmp"C:\Users\Admin\AppData\Local\Temp\44FC.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\45E6.tmp"C:\Users\Admin\AppData\Local\Temp\45E6.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\46A1.tmp"C:\Users\Admin\AppData\Local\Temp\46A1.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1792
-
-
-
C:\Users\Admin\AppData\Local\Temp\470E.tmp"C:\Users\Admin\AppData\Local\Temp\470E.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\478B.tmp"C:\Users\Admin\AppData\Local\Temp\478B.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\4875.tmp"C:\Users\Admin\AppData\Local\Temp\4875.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:520 -
C:\Users\Admin\AppData\Local\Temp\4930.tmp"C:\Users\Admin\AppData\Local\Temp\4930.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\4A1A.tmp"C:\Users\Admin\AppData\Local\Temp\4A1A.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:588 -
C:\Users\Admin\AppData\Local\Temp\4A97.tmp"C:\Users\Admin\AppData\Local\Temp\4A97.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\4B24.tmp"C:\Users\Admin\AppData\Local\Temp\4B24.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:272 -
C:\Users\Admin\AppData\Local\Temp\4BB0.tmp"C:\Users\Admin\AppData\Local\Temp\4BB0.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\4BFE.tmp"C:\Users\Admin\AppData\Local\Temp\4BFE.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\4C6B.tmp"C:\Users\Admin\AppData\Local\Temp\4C6B.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\4D46.tmp"C:\Users\Admin\AppData\Local\Temp\4D46.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\4DB3.tmp"C:\Users\Admin\AppData\Local\Temp\4DB3.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
PID:320 -
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\4F96.tmp"C:\Users\Admin\AppData\Local\Temp\4F96.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\4FF4.tmp"C:\Users\Admin\AppData\Local\Temp\4FF4.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\5061.tmp"C:\Users\Admin\AppData\Local\Temp\5061.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\50CE.tmp"C:\Users\Admin\AppData\Local\Temp\50CE.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\513C.tmp"C:\Users\Admin\AppData\Local\Temp\513C.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\5199.tmp"C:\Users\Admin\AppData\Local\Temp\5199.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:296 -
C:\Users\Admin\AppData\Local\Temp\5245.tmp"C:\Users\Admin\AppData\Local\Temp\5245.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\533E.tmp"C:\Users\Admin\AppData\Local\Temp\533E.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\53BB.tmp"C:\Users\Admin\AppData\Local\Temp\53BB.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\5448.tmp"C:\Users\Admin\AppData\Local\Temp\5448.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\5512.tmp"C:\Users\Admin\AppData\Local\Temp\5512.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\55AE.tmp"C:\Users\Admin\AppData\Local\Temp\55AE.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\561C.tmp"C:\Users\Admin\AppData\Local\Temp\561C.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\56B8.tmp"C:\Users\Admin\AppData\Local\Temp\56B8.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:680 -
C:\Users\Admin\AppData\Local\Temp\5725.tmp"C:\Users\Admin\AppData\Local\Temp\5725.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\57A2.tmp"C:\Users\Admin\AppData\Local\Temp\57A2.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\581E.tmp"C:\Users\Admin\AppData\Local\Temp\581E.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:580 -
C:\Users\Admin\AppData\Local\Temp\589B.tmp"C:\Users\Admin\AppData\Local\Temp\589B.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\5928.tmp"C:\Users\Admin\AppData\Local\Temp\5928.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\59B4.tmp"C:\Users\Admin\AppData\Local\Temp\59B4.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\5A31.tmp"C:\Users\Admin\AppData\Local\Temp\5A31.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\5A8E.tmp"C:\Users\Admin\AppData\Local\Temp\5A8E.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\5AFC.tmp"C:\Users\Admin\AppData\Local\Temp\5AFC.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\5B69.tmp"C:\Users\Admin\AppData\Local\Temp\5B69.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\5BC6.tmp"C:\Users\Admin\AppData\Local\Temp\5BC6.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\5C24.tmp"C:\Users\Admin\AppData\Local\Temp\5C24.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\5CA1.tmp"C:\Users\Admin\AppData\Local\Temp\5CA1.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\5D0E.tmp"C:\Users\Admin\AppData\Local\Temp\5D0E.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\5D8B.tmp"C:\Users\Admin\AppData\Local\Temp\5D8B.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\5DE8.tmp"C:\Users\Admin\AppData\Local\Temp\5DE8.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\5E46.tmp"C:\Users\Admin\AppData\Local\Temp\5E46.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:624 -
C:\Users\Admin\AppData\Local\Temp\5ED2.tmp"C:\Users\Admin\AppData\Local\Temp\5ED2.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\5F4F.tmp"C:\Users\Admin\AppData\Local\Temp\5F4F.tmp"48⤵
- Executes dropped EXE
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\5FCC.tmp"C:\Users\Admin\AppData\Local\Temp\5FCC.tmp"49⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\6039.tmp"C:\Users\Admin\AppData\Local\Temp\6039.tmp"50⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\6097.tmp"C:\Users\Admin\AppData\Local\Temp\6097.tmp"51⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\6114.tmp"C:\Users\Admin\AppData\Local\Temp\6114.tmp"52⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\6171.tmp"C:\Users\Admin\AppData\Local\Temp\6171.tmp"53⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\61DE.tmp"C:\Users\Admin\AppData\Local\Temp\61DE.tmp"54⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\624C.tmp"C:\Users\Admin\AppData\Local\Temp\624C.tmp"55⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\63A3.tmp"C:\Users\Admin\AppData\Local\Temp\63A3.tmp"56⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\645E.tmp"C:\Users\Admin\AppData\Local\Temp\645E.tmp"57⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\64CB.tmp"C:\Users\Admin\AppData\Local\Temp\64CB.tmp"58⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\6529.tmp"C:\Users\Admin\AppData\Local\Temp\6529.tmp"59⤵PID:364
-
C:\Users\Admin\AppData\Local\Temp\6596.tmp"C:\Users\Admin\AppData\Local\Temp\6596.tmp"60⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\6613.tmp"C:\Users\Admin\AppData\Local\Temp\6613.tmp"61⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\6680.tmp"C:\Users\Admin\AppData\Local\Temp\6680.tmp"62⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\66ED.tmp"C:\Users\Admin\AppData\Local\Temp\66ED.tmp"63⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\676A.tmp"C:\Users\Admin\AppData\Local\Temp\676A.tmp"64⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\67C8.tmp"C:\Users\Admin\AppData\Local\Temp\67C8.tmp"65⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\6835.tmp"C:\Users\Admin\AppData\Local\Temp\6835.tmp"66⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\6893.tmp"C:\Users\Admin\AppData\Local\Temp\6893.tmp"67⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\68F0.tmp"C:\Users\Admin\AppData\Local\Temp\68F0.tmp"68⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\696D.tmp"C:\Users\Admin\AppData\Local\Temp\696D.tmp"69⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\69EA.tmp"C:\Users\Admin\AppData\Local\Temp\69EA.tmp"70⤵PID:588
-
C:\Users\Admin\AppData\Local\Temp\6A67.tmp"C:\Users\Admin\AppData\Local\Temp\6A67.tmp"71⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\6AD4.tmp"C:\Users\Admin\AppData\Local\Temp\6AD4.tmp"72⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\6B41.tmp"C:\Users\Admin\AppData\Local\Temp\6B41.tmp"73⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\6B9F.tmp"C:\Users\Admin\AppData\Local\Temp\6B9F.tmp"74⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\6C0C.tmp"C:\Users\Admin\AppData\Local\Temp\6C0C.tmp"75⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\6C69.tmp"C:\Users\Admin\AppData\Local\Temp\6C69.tmp"76⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\6CC7.tmp"C:\Users\Admin\AppData\Local\Temp\6CC7.tmp"77⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\6D34.tmp"C:\Users\Admin\AppData\Local\Temp\6D34.tmp"78⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\6DC1.tmp"C:\Users\Admin\AppData\Local\Temp\6DC1.tmp"79⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\6E2E.tmp"C:\Users\Admin\AppData\Local\Temp\6E2E.tmp"80⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\6EAB.tmp"C:\Users\Admin\AppData\Local\Temp\6EAB.tmp"81⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\6F27.tmp"C:\Users\Admin\AppData\Local\Temp\6F27.tmp"82⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\6FA4.tmp"C:\Users\Admin\AppData\Local\Temp\6FA4.tmp"83⤵PID:524
-
C:\Users\Admin\AppData\Local\Temp\7011.tmp"C:\Users\Admin\AppData\Local\Temp\7011.tmp"84⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\706F.tmp"C:\Users\Admin\AppData\Local\Temp\706F.tmp"85⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\70DC.tmp"C:\Users\Admin\AppData\Local\Temp\70DC.tmp"86⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\7149.tmp"C:\Users\Admin\AppData\Local\Temp\7149.tmp"87⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\71C6.tmp"C:\Users\Admin\AppData\Local\Temp\71C6.tmp"88⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\7224.tmp"C:\Users\Admin\AppData\Local\Temp\7224.tmp"89⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\7291.tmp"C:\Users\Admin\AppData\Local\Temp\7291.tmp"90⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\730E.tmp"C:\Users\Admin\AppData\Local\Temp\730E.tmp"91⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\736B.tmp"C:\Users\Admin\AppData\Local\Temp\736B.tmp"92⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\73D9.tmp"C:\Users\Admin\AppData\Local\Temp\73D9.tmp"93⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\7446.tmp"C:\Users\Admin\AppData\Local\Temp\7446.tmp"94⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"95⤵PID:604
-
C:\Users\Admin\AppData\Local\Temp\753F.tmp"C:\Users\Admin\AppData\Local\Temp\753F.tmp"96⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\75BC.tmp"C:\Users\Admin\AppData\Local\Temp\75BC.tmp"97⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\7629.tmp"C:\Users\Admin\AppData\Local\Temp\7629.tmp"98⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\76A6.tmp"C:\Users\Admin\AppData\Local\Temp\76A6.tmp"99⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\7704.tmp"C:\Users\Admin\AppData\Local\Temp\7704.tmp"100⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\7781.tmp"C:\Users\Admin\AppData\Local\Temp\7781.tmp"101⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\77FD.tmp"C:\Users\Admin\AppData\Local\Temp\77FD.tmp"102⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\78E7.tmp"C:\Users\Admin\AppData\Local\Temp\78E7.tmp"103⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\7955.tmp"C:\Users\Admin\AppData\Local\Temp\7955.tmp"104⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\79C2.tmp"C:\Users\Admin\AppData\Local\Temp\79C2.tmp"105⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\7A2F.tmp"C:\Users\Admin\AppData\Local\Temp\7A2F.tmp"106⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\7A9C.tmp"C:\Users\Admin\AppData\Local\Temp\7A9C.tmp"107⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\7B19.tmp"C:\Users\Admin\AppData\Local\Temp\7B19.tmp"108⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\7B67.tmp"C:\Users\Admin\AppData\Local\Temp\7B67.tmp"109⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\7BD4.tmp"C:\Users\Admin\AppData\Local\Temp\7BD4.tmp"110⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\7C41.tmp"C:\Users\Admin\AppData\Local\Temp\7C41.tmp"111⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\7CAF.tmp"C:\Users\Admin\AppData\Local\Temp\7CAF.tmp"112⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\7D3B.tmp"C:\Users\Admin\AppData\Local\Temp\7D3B.tmp"113⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\7DB8.tmp"C:\Users\Admin\AppData\Local\Temp\7DB8.tmp"114⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\7E35.tmp"C:\Users\Admin\AppData\Local\Temp\7E35.tmp"115⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\7EB1.tmp"C:\Users\Admin\AppData\Local\Temp\7EB1.tmp"116⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\7F2E.tmp"C:\Users\Admin\AppData\Local\Temp\7F2E.tmp"117⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\7FBB.tmp"C:\Users\Admin\AppData\Local\Temp\7FBB.tmp"118⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\8018.tmp"C:\Users\Admin\AppData\Local\Temp\8018.tmp"119⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\8095.tmp"C:\Users\Admin\AppData\Local\Temp\8095.tmp"120⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\80F3.tmp"C:\Users\Admin\AppData\Local\Temp\80F3.tmp"121⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\817F.tmp"C:\Users\Admin\AppData\Local\Temp\817F.tmp"122⤵PID:2896
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-