Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24-01-2024 14:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-01-24_1ef5ecc5a00502cbd7f2df412b7244e5_mafia.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-01-24_1ef5ecc5a00502cbd7f2df412b7244e5_mafia.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-01-24_1ef5ecc5a00502cbd7f2df412b7244e5_mafia.exe
-
Size
486KB
-
MD5
1ef5ecc5a00502cbd7f2df412b7244e5
-
SHA1
adf4a64a4f04b579f3cc78bcf1b8ecd7b72591f6
-
SHA256
38b105ad21428338e0041be57ff9a91a45cb77543f61c2b38ea950939634818b
-
SHA512
eaf13ed6db942fe44546508668b62268b7ab742264789d7403fdad26addbb2cca3110b65651816382b452822f72e4355a43f781e8fa4ffcab25202159878e100
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7Qi1yQye4qoeBYok9aAJo0utyWHG7NjaJLbKt:/U5rCOTeiDjyQyDqk9d53p1NN9NZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 5052 6C08.tmp 2252 6C85.tmp 4888 6D21.tmp 3536 6DAE.tmp 4112 8731.tmp 1444 6EE6.tmp 2236 6F44.tmp 3284 6FB2.tmp 2008 701F.tmp 1288 707D.tmp 3608 70EA.tmp 3340 71B5.tmp 1656 7232.tmp 1048 730D.tmp 2188 8C71.tmp 1896 7445.tmp 5116 74E2.tmp 2788 758E.tmp 4268 761A.tmp 4796 7753.tmp 1196 77D0.tmp 3376 783D.tmp 4224 78E9.tmp 3164 7995.tmp 3592 7A02.tmp 1156 7A9E.tmp 4708 7B3B.tmp 4484 7BE7.tmp 1404 7CC1.tmp 536 7D7D.tmp 3996 7E29.tmp 3620 7EB5.tmp 408 7F23.tmp 4608 7FA0.tmp 1512 802C.tmp 4472 80E8.tmp 5044 8184.tmp 1956 8211.tmp 2168 828E.tmp 4408 831A.tmp 404 8388.tmp 2392 83F5.tmp 1712 8491.tmp 2532 850E.tmp 1152 858B.tmp 4584 8628.tmp 60 86C4.tmp 4112 8731.tmp 1988 87BE.tmp 4524 884A.tmp 4496 88D7.tmp 4568 8954.tmp 2072 89D1.tmp 1436 A3F1.tmp 4964 A45E.tmp 4220 A4DB.tmp 5032 8B87.tmp 1264 8BF4.tmp 2188 8C71.tmp 2696 8CEE.tmp 3648 8D5B.tmp 4660 8DD8.tmp 2952 8E46.tmp 3124 8EC3.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4408 wrote to memory of 5052 4408 831A.tmp 87 PID 4408 wrote to memory of 5052 4408 831A.tmp 87 PID 4408 wrote to memory of 5052 4408 831A.tmp 87 PID 5052 wrote to memory of 2252 5052 6C08.tmp 89 PID 5052 wrote to memory of 2252 5052 6C08.tmp 89 PID 5052 wrote to memory of 2252 5052 6C08.tmp 89 PID 2252 wrote to memory of 4888 2252 6C85.tmp 90 PID 2252 wrote to memory of 4888 2252 6C85.tmp 90 PID 2252 wrote to memory of 4888 2252 6C85.tmp 90 PID 4888 wrote to memory of 3536 4888 6D21.tmp 91 PID 4888 wrote to memory of 3536 4888 6D21.tmp 91 PID 4888 wrote to memory of 3536 4888 6D21.tmp 91 PID 3536 wrote to memory of 4112 3536 6DAE.tmp 139 PID 3536 wrote to memory of 4112 3536 6DAE.tmp 139 PID 3536 wrote to memory of 4112 3536 6DAE.tmp 139 PID 4112 wrote to memory of 1444 4112 8731.tmp 105 PID 4112 wrote to memory of 1444 4112 8731.tmp 105 PID 4112 wrote to memory of 1444 4112 8731.tmp 105 PID 1444 wrote to memory of 2236 1444 6EE6.tmp 92 PID 1444 wrote to memory of 2236 1444 6EE6.tmp 92 PID 1444 wrote to memory of 2236 1444 6EE6.tmp 92 PID 2236 wrote to memory of 3284 2236 6F44.tmp 103 PID 2236 wrote to memory of 3284 2236 6F44.tmp 103 PID 2236 wrote to memory of 3284 2236 6F44.tmp 103 PID 3284 wrote to memory of 2008 3284 6FB2.tmp 97 PID 3284 wrote to memory of 2008 3284 6FB2.tmp 97 PID 3284 wrote to memory of 2008 3284 6FB2.tmp 97 PID 2008 wrote to memory of 1288 2008 701F.tmp 93 PID 2008 wrote to memory of 1288 2008 701F.tmp 93 PID 2008 wrote to memory of 1288 2008 701F.tmp 93 PID 1288 wrote to memory of 3608 1288 707D.tmp 94 PID 1288 wrote to memory of 3608 1288 707D.tmp 94 PID 1288 wrote to memory of 3608 1288 707D.tmp 94 PID 3608 wrote to memory of 3340 3608 70EA.tmp 95 PID 3608 wrote to memory of 3340 3608 70EA.tmp 95 PID 3608 wrote to memory of 3340 3608 70EA.tmp 95 PID 3340 wrote to memory of 1656 3340 71B5.tmp 96 PID 3340 wrote to memory of 1656 3340 71B5.tmp 96 PID 3340 wrote to memory of 1656 3340 71B5.tmp 96 PID 1656 wrote to memory of 1048 1656 7232.tmp 98 PID 1656 wrote to memory of 1048 1656 7232.tmp 98 PID 1656 wrote to memory of 1048 1656 7232.tmp 98 PID 1048 wrote to memory of 2188 1048 730D.tmp 151 PID 1048 wrote to memory of 2188 1048 730D.tmp 151 PID 1048 wrote to memory of 2188 1048 730D.tmp 151 PID 2188 wrote to memory of 1896 2188 8C71.tmp 100 PID 2188 wrote to memory of 1896 2188 8C71.tmp 100 PID 2188 wrote to memory of 1896 2188 8C71.tmp 100 PID 1896 wrote to memory of 5116 1896 7445.tmp 101 PID 1896 wrote to memory of 5116 1896 7445.tmp 101 PID 1896 wrote to memory of 5116 1896 7445.tmp 101 PID 5116 wrote to memory of 2788 5116 74E2.tmp 102 PID 5116 wrote to memory of 2788 5116 74E2.tmp 102 PID 5116 wrote to memory of 2788 5116 74E2.tmp 102 PID 2788 wrote to memory of 4268 2788 758E.tmp 104 PID 2788 wrote to memory of 4268 2788 758E.tmp 104 PID 2788 wrote to memory of 4268 2788 758E.tmp 104 PID 4268 wrote to memory of 4796 4268 761A.tmp 106 PID 4268 wrote to memory of 4796 4268 761A.tmp 106 PID 4268 wrote to memory of 4796 4268 761A.tmp 106 PID 4796 wrote to memory of 1196 4796 7753.tmp 108 PID 4796 wrote to memory of 1196 4796 7753.tmp 108 PID 4796 wrote to memory of 1196 4796 7753.tmp 108 PID 1196 wrote to memory of 3376 1196 77D0.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-24_1ef5ecc5a00502cbd7f2df412b7244e5_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-24_1ef5ecc5a00502cbd7f2df412b7244e5_mafia.exe"1⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\6C08.tmp"C:\Users\Admin\AppData\Local\Temp\6C08.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\6C85.tmp"C:\Users\Admin\AppData\Local\Temp\6C85.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"6⤵PID:4112
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\6F44.tmp"C:\Users\Admin\AppData\Local\Temp\6F44.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284
-
-
C:\Users\Admin\AppData\Local\Temp\707D.tmp"C:\Users\Admin\AppData\Local\Temp\707D.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\71B5.tmp"C:\Users\Admin\AppData\Local\Temp\71B5.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\7232.tmp"C:\Users\Admin\AppData\Local\Temp\7232.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\730D.tmp"C:\Users\Admin\AppData\Local\Temp\730D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\739A.tmp"C:\Users\Admin\AppData\Local\Temp\739A.tmp"6⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\7445.tmp"C:\Users\Admin\AppData\Local\Temp\7445.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\758E.tmp"C:\Users\Admin\AppData\Local\Temp\758E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\7753.tmp"C:\Users\Admin\AppData\Local\Temp\7753.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\77D0.tmp"C:\Users\Admin\AppData\Local\Temp\77D0.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\783D.tmp"C:\Users\Admin\AppData\Local\Temp\783D.tmp"13⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\78E9.tmp"C:\Users\Admin\AppData\Local\Temp\78E9.tmp"14⤵
- Executes dropped EXE
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\7995.tmp"C:\Users\Admin\AppData\Local\Temp\7995.tmp"15⤵
- Executes dropped EXE
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\7A02.tmp"C:\Users\Admin\AppData\Local\Temp\7A02.tmp"16⤵
- Executes dropped EXE
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"17⤵
- Executes dropped EXE
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"18⤵
- Executes dropped EXE
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"19⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"20⤵
- Executes dropped EXE
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"21⤵
- Executes dropped EXE
PID:536 -
C:\Users\Admin\AppData\Local\Temp\7E29.tmp"C:\Users\Admin\AppData\Local\Temp\7E29.tmp"22⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\7EB5.tmp"C:\Users\Admin\AppData\Local\Temp\7EB5.tmp"23⤵
- Executes dropped EXE
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\7F23.tmp"C:\Users\Admin\AppData\Local\Temp\7F23.tmp"24⤵
- Executes dropped EXE
PID:408 -
C:\Users\Admin\AppData\Local\Temp\7FA0.tmp"C:\Users\Admin\AppData\Local\Temp\7FA0.tmp"25⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\802C.tmp"C:\Users\Admin\AppData\Local\Temp\802C.tmp"26⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\80E8.tmp"C:\Users\Admin\AppData\Local\Temp\80E8.tmp"27⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\8184.tmp"C:\Users\Admin\AppData\Local\Temp\8184.tmp"28⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\8211.tmp"C:\Users\Admin\AppData\Local\Temp\8211.tmp"29⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\828E.tmp"C:\Users\Admin\AppData\Local\Temp\828E.tmp"30⤵
- Executes dropped EXE
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\831A.tmp"C:\Users\Admin\AppData\Local\Temp\831A.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\8388.tmp"C:\Users\Admin\AppData\Local\Temp\8388.tmp"32⤵
- Executes dropped EXE
PID:404 -
C:\Users\Admin\AppData\Local\Temp\83F5.tmp"C:\Users\Admin\AppData\Local\Temp\83F5.tmp"33⤵
- Executes dropped EXE
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\8491.tmp"C:\Users\Admin\AppData\Local\Temp\8491.tmp"34⤵
- Executes dropped EXE
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\850E.tmp"C:\Users\Admin\AppData\Local\Temp\850E.tmp"35⤵
- Executes dropped EXE
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\858B.tmp"C:\Users\Admin\AppData\Local\Temp\858B.tmp"36⤵
- Executes dropped EXE
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\8628.tmp"C:\Users\Admin\AppData\Local\Temp\8628.tmp"37⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\86C4.tmp"C:\Users\Admin\AppData\Local\Temp\86C4.tmp"38⤵
- Executes dropped EXE
PID:60 -
C:\Users\Admin\AppData\Local\Temp\8731.tmp"C:\Users\Admin\AppData\Local\Temp\8731.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\87BE.tmp"C:\Users\Admin\AppData\Local\Temp\87BE.tmp"40⤵
- Executes dropped EXE
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\884A.tmp"C:\Users\Admin\AppData\Local\Temp\884A.tmp"41⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\88D7.tmp"C:\Users\Admin\AppData\Local\Temp\88D7.tmp"42⤵
- Executes dropped EXE
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\8954.tmp"C:\Users\Admin\AppData\Local\Temp\8954.tmp"43⤵
- Executes dropped EXE
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\89D1.tmp"C:\Users\Admin\AppData\Local\Temp\89D1.tmp"44⤵
- Executes dropped EXE
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"45⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"46⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\8B19.tmp"C:\Users\Admin\AppData\Local\Temp\8B19.tmp"47⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\8B87.tmp"C:\Users\Admin\AppData\Local\Temp\8B87.tmp"48⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"49⤵
- Executes dropped EXE
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\8C71.tmp"C:\Users\Admin\AppData\Local\Temp\8C71.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"51⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\8D5B.tmp"C:\Users\Admin\AppData\Local\Temp\8D5B.tmp"52⤵
- Executes dropped EXE
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"53⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\8E46.tmp"C:\Users\Admin\AppData\Local\Temp\8E46.tmp"54⤵
- Executes dropped EXE
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"55⤵
- Executes dropped EXE
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\8F40.tmp"C:\Users\Admin\AppData\Local\Temp\8F40.tmp"56⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\8FBD.tmp"C:\Users\Admin\AppData\Local\Temp\8FBD.tmp"57⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\9049.tmp"C:\Users\Admin\AppData\Local\Temp\9049.tmp"58⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\90E6.tmp"C:\Users\Admin\AppData\Local\Temp\90E6.tmp"59⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\9153.tmp"C:\Users\Admin\AppData\Local\Temp\9153.tmp"60⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\91D0.tmp"C:\Users\Admin\AppData\Local\Temp\91D0.tmp"61⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\923D.tmp"C:\Users\Admin\AppData\Local\Temp\923D.tmp"62⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\9318.tmp"C:\Users\Admin\AppData\Local\Temp\9318.tmp"63⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\93E3.tmp"C:\Users\Admin\AppData\Local\Temp\93E3.tmp"64⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\951C.tmp"C:\Users\Admin\AppData\Local\Temp\951C.tmp"65⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\9599.tmp"C:\Users\Admin\AppData\Local\Temp\9599.tmp"66⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\9606.tmp"C:\Users\Admin\AppData\Local\Temp\9606.tmp"67⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\9693.tmp"C:\Users\Admin\AppData\Local\Temp\9693.tmp"68⤵PID:716
-
C:\Users\Admin\AppData\Local\Temp\96F0.tmp"C:\Users\Admin\AppData\Local\Temp\96F0.tmp"69⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\975E.tmp"C:\Users\Admin\AppData\Local\Temp\975E.tmp"70⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\97CB.tmp"C:\Users\Admin\AppData\Local\Temp\97CB.tmp"71⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\9896.tmp"C:\Users\Admin\AppData\Local\Temp\9896.tmp"72⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\9981.tmp"C:\Users\Admin\AppData\Local\Temp\9981.tmp"73⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\99EE.tmp"C:\Users\Admin\AppData\Local\Temp\99EE.tmp"74⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"75⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"76⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\9B27.tmp"C:\Users\Admin\AppData\Local\Temp\9B27.tmp"77⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"78⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"79⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"80⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"81⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\9D49.tmp"C:\Users\Admin\AppData\Local\Temp\9D49.tmp"82⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"83⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\9E53.tmp"C:\Users\Admin\AppData\Local\Temp\9E53.tmp"84⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"85⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"86⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"87⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\A047.tmp"C:\Users\Admin\AppData\Local\Temp\A047.tmp"88⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"89⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\A141.tmp"C:\Users\Admin\AppData\Local\Temp\A141.tmp"90⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"91⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\A23B.tmp"C:\Users\Admin\AppData\Local\Temp\A23B.tmp"92⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\A299.tmp"C:\Users\Admin\AppData\Local\Temp\A299.tmp"93⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\A306.tmp"C:\Users\Admin\AppData\Local\Temp\A306.tmp"94⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\A374.tmp"C:\Users\Admin\AppData\Local\Temp\A374.tmp"95⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"96⤵
- Executes dropped EXE
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\A45E.tmp"C:\Users\Admin\AppData\Local\Temp\A45E.tmp"97⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"98⤵
- Executes dropped EXE
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\A548.tmp"C:\Users\Admin\AppData\Local\Temp\A548.tmp"99⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"100⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\A690.tmp"C:\Users\Admin\AppData\Local\Temp\A690.tmp"101⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\A70D.tmp"C:\Users\Admin\AppData\Local\Temp\A70D.tmp"102⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\A79A.tmp"C:\Users\Admin\AppData\Local\Temp\A79A.tmp"103⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\A807.tmp"C:\Users\Admin\AppData\Local\Temp\A807.tmp"104⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\A875.tmp"C:\Users\Admin\AppData\Local\Temp\A875.tmp"105⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"106⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\A95F.tmp"C:\Users\Admin\AppData\Local\Temp\A95F.tmp"107⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"108⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"109⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"110⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\AB24.tmp"C:\Users\Admin\AppData\Local\Temp\AB24.tmp"111⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\AB92.tmp"C:\Users\Admin\AppData\Local\Temp\AB92.tmp"112⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"113⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"114⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\AD18.tmp"C:\Users\Admin\AppData\Local\Temp\AD18.tmp"115⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\AD95.tmp"C:\Users\Admin\AppData\Local\Temp\AD95.tmp"116⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"117⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\AE51.tmp"C:\Users\Admin\AppData\Local\Temp\AE51.tmp"118⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"119⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"120⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"121⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\B045.tmp"C:\Users\Admin\AppData\Local\Temp\B045.tmp"122⤵PID:2276
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-