Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29/01/2024, 11:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-01-29_9dff3271025af9cf32877727948a8d0a_mafia.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-01-29_9dff3271025af9cf32877727948a8d0a_mafia.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
2024-01-29_9dff3271025af9cf32877727948a8d0a_mafia.exe
-
Size
488KB
-
MD5
9dff3271025af9cf32877727948a8d0a
-
SHA1
6d1ae8876c2e0c9a23e43e9a248ecb3d23657832
-
SHA256
b7a7af75b2c200a72ceeb7e17f3784860db8224d17b67387a7233a822e17cd40
-
SHA512
dc4711b80127f69da773b8a27ece690a7729847b05dfc615ae3a353b2987ba98ae5cd6cb0d00ab4433ccd5497c1593c2df0c3ed6dcee75a9fad681b8f0cbda8c
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7SFQ/NK2t9GorykeCPL6zzj40s0QrQujusH3j:/U5rCOTeiDSOt9GoWkeCPL6+Q4NZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1724 471E.tmp 2896 47BA.tmp 2140 48B4.tmp 2828 496F.tmp 2752 4A3A.tmp 2944 4B14.tmp 2852 4BEE.tmp 2764 4CF8.tmp 2796 4DD2.tmp 2660 4E9D.tmp 3064 4F68.tmp 2088 5013.tmp 1624 50EE.tmp 1524 5199.tmp 2884 5274.tmp 1680 532F.tmp 1080 5428.tmp 1656 54E4.tmp 2540 55AE.tmp 1228 566A.tmp 472 5725.tmp 2044 57E0.tmp 568 59C4.tmp 1484 5A6F.tmp 2404 5ADC.tmp 1156 5B69.tmp 1340 5BE6.tmp 2032 5C53.tmp 1752 5CD0.tmp 2020 5D4C.tmp 2016 5DC9.tmp 2376 5E56.tmp 2040 5ED2.tmp 836 5F30.tmp 1632 5F9D.tmp 1800 601A.tmp 432 60A6.tmp 2280 6104.tmp 2488 6181.tmp 1956 61FE.tmp 1840 627A.tmp 1388 62E8.tmp 980 6374.tmp 2056 63E1.tmp 768 644F.tmp 1996 64BC.tmp 1732 6548.tmp 2684 65B5.tmp 304 6623.tmp 1740 6690.tmp 2000 66FD.tmp 2176 677A.tmp 2996 67F7.tmp 1364 6864.tmp 1600 68E1.tmp 1888 694E.tmp 3060 69BB.tmp 2696 6A28.tmp 2896 6A95.tmp 2140 6AF3.tmp 2960 6B60.tmp 2872 6BCD.tmp 2464 6C69.tmp 2716 6CD7.tmp -
Loads dropped DLL 64 IoCs
pid Process 1888 2024-01-29_9dff3271025af9cf32877727948a8d0a_mafia.exe 1724 471E.tmp 2896 47BA.tmp 2140 48B4.tmp 2828 496F.tmp 2752 4A3A.tmp 2944 4B14.tmp 2852 4BEE.tmp 2764 4CF8.tmp 2796 4DD2.tmp 2660 4E9D.tmp 3064 4F68.tmp 2088 5013.tmp 1624 50EE.tmp 1524 5199.tmp 2884 5274.tmp 1680 532F.tmp 1080 5428.tmp 1656 54E4.tmp 2540 55AE.tmp 1228 566A.tmp 472 5725.tmp 2044 57E0.tmp 568 59C4.tmp 1484 5A6F.tmp 2404 5ADC.tmp 1156 5B69.tmp 1340 5BE6.tmp 2032 5C53.tmp 1752 5CD0.tmp 2020 5D4C.tmp 2016 5DC9.tmp 2376 5E56.tmp 2040 5ED2.tmp 836 5F30.tmp 1632 5F9D.tmp 1800 601A.tmp 432 60A6.tmp 2280 6104.tmp 2488 6181.tmp 1956 61FE.tmp 1840 627A.tmp 1388 62E8.tmp 980 6374.tmp 2056 63E1.tmp 768 644F.tmp 1996 64BC.tmp 1732 6548.tmp 2684 65B5.tmp 304 6623.tmp 1740 6690.tmp 2000 66FD.tmp 2176 677A.tmp 2996 67F7.tmp 1364 6864.tmp 1600 68E1.tmp 1888 694E.tmp 3060 69BB.tmp 2696 6A28.tmp 2896 6A95.tmp 2140 6AF3.tmp 2960 6B60.tmp 2872 6BCD.tmp 2464 6C69.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1888 wrote to memory of 1724 1888 2024-01-29_9dff3271025af9cf32877727948a8d0a_mafia.exe 28 PID 1888 wrote to memory of 1724 1888 2024-01-29_9dff3271025af9cf32877727948a8d0a_mafia.exe 28 PID 1888 wrote to memory of 1724 1888 2024-01-29_9dff3271025af9cf32877727948a8d0a_mafia.exe 28 PID 1888 wrote to memory of 1724 1888 2024-01-29_9dff3271025af9cf32877727948a8d0a_mafia.exe 28 PID 1724 wrote to memory of 2896 1724 471E.tmp 29 PID 1724 wrote to memory of 2896 1724 471E.tmp 29 PID 1724 wrote to memory of 2896 1724 471E.tmp 29 PID 1724 wrote to memory of 2896 1724 471E.tmp 29 PID 2896 wrote to memory of 2140 2896 47BA.tmp 30 PID 2896 wrote to memory of 2140 2896 47BA.tmp 30 PID 2896 wrote to memory of 2140 2896 47BA.tmp 30 PID 2896 wrote to memory of 2140 2896 47BA.tmp 30 PID 2140 wrote to memory of 2828 2140 48B4.tmp 31 PID 2140 wrote to memory of 2828 2140 48B4.tmp 31 PID 2140 wrote to memory of 2828 2140 48B4.tmp 31 PID 2140 wrote to memory of 2828 2140 48B4.tmp 31 PID 2828 wrote to memory of 2752 2828 496F.tmp 32 PID 2828 wrote to memory of 2752 2828 496F.tmp 32 PID 2828 wrote to memory of 2752 2828 496F.tmp 32 PID 2828 wrote to memory of 2752 2828 496F.tmp 32 PID 2752 wrote to memory of 2944 2752 4A3A.tmp 33 PID 2752 wrote to memory of 2944 2752 4A3A.tmp 33 PID 2752 wrote to memory of 2944 2752 4A3A.tmp 33 PID 2752 wrote to memory of 2944 2752 4A3A.tmp 33 PID 2944 wrote to memory of 2852 2944 4B14.tmp 34 PID 2944 wrote to memory of 2852 2944 4B14.tmp 34 PID 2944 wrote to memory of 2852 2944 4B14.tmp 34 PID 2944 wrote to memory of 2852 2944 4B14.tmp 34 PID 2852 wrote to memory of 2764 2852 4BEE.tmp 35 PID 2852 wrote to memory of 2764 2852 4BEE.tmp 35 PID 2852 wrote to memory of 2764 2852 4BEE.tmp 35 PID 2852 wrote to memory of 2764 2852 4BEE.tmp 35 PID 2764 wrote to memory of 2796 2764 4CF8.tmp 36 PID 2764 wrote to memory of 2796 2764 4CF8.tmp 36 PID 2764 wrote to memory of 2796 2764 4CF8.tmp 36 PID 2764 wrote to memory of 2796 2764 4CF8.tmp 36 PID 2796 wrote to memory of 2660 2796 4DD2.tmp 37 PID 2796 wrote to memory of 2660 2796 4DD2.tmp 37 PID 2796 wrote to memory of 2660 2796 4DD2.tmp 37 PID 2796 wrote to memory of 2660 2796 4DD2.tmp 37 PID 2660 wrote to memory of 3064 2660 4E9D.tmp 38 PID 2660 wrote to memory of 3064 2660 4E9D.tmp 38 PID 2660 wrote to memory of 3064 2660 4E9D.tmp 38 PID 2660 wrote to memory of 3064 2660 4E9D.tmp 38 PID 3064 wrote to memory of 2088 3064 4F68.tmp 39 PID 3064 wrote to memory of 2088 3064 4F68.tmp 39 PID 3064 wrote to memory of 2088 3064 4F68.tmp 39 PID 3064 wrote to memory of 2088 3064 4F68.tmp 39 PID 2088 wrote to memory of 1624 2088 5013.tmp 40 PID 2088 wrote to memory of 1624 2088 5013.tmp 40 PID 2088 wrote to memory of 1624 2088 5013.tmp 40 PID 2088 wrote to memory of 1624 2088 5013.tmp 40 PID 1624 wrote to memory of 1524 1624 50EE.tmp 41 PID 1624 wrote to memory of 1524 1624 50EE.tmp 41 PID 1624 wrote to memory of 1524 1624 50EE.tmp 41 PID 1624 wrote to memory of 1524 1624 50EE.tmp 41 PID 1524 wrote to memory of 2884 1524 5199.tmp 42 PID 1524 wrote to memory of 2884 1524 5199.tmp 42 PID 1524 wrote to memory of 2884 1524 5199.tmp 42 PID 1524 wrote to memory of 2884 1524 5199.tmp 42 PID 2884 wrote to memory of 1680 2884 5274.tmp 43 PID 2884 wrote to memory of 1680 2884 5274.tmp 43 PID 2884 wrote to memory of 1680 2884 5274.tmp 43 PID 2884 wrote to memory of 1680 2884 5274.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-29_9dff3271025af9cf32877727948a8d0a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-29_9dff3271025af9cf32877727948a8d0a_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\471E.tmp"C:\Users\Admin\AppData\Local\Temp\471E.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\47BA.tmp"C:\Users\Admin\AppData\Local\Temp\47BA.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\48B4.tmp"C:\Users\Admin\AppData\Local\Temp\48B4.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\496F.tmp"C:\Users\Admin\AppData\Local\Temp\496F.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\4A3A.tmp"C:\Users\Admin\AppData\Local\Temp\4A3A.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\4B14.tmp"C:\Users\Admin\AppData\Local\Temp\4B14.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\4BEE.tmp"C:\Users\Admin\AppData\Local\Temp\4BEE.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\4CF8.tmp"C:\Users\Admin\AppData\Local\Temp\4CF8.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\5013.tmp"C:\Users\Admin\AppData\Local\Temp\5013.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\50EE.tmp"C:\Users\Admin\AppData\Local\Temp\50EE.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\5199.tmp"C:\Users\Admin\AppData\Local\Temp\5199.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\5274.tmp"C:\Users\Admin\AppData\Local\Temp\5274.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\532F.tmp"C:\Users\Admin\AppData\Local\Temp\532F.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\5428.tmp"C:\Users\Admin\AppData\Local\Temp\5428.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\54E4.tmp"C:\Users\Admin\AppData\Local\Temp\54E4.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\55AE.tmp"C:\Users\Admin\AppData\Local\Temp\55AE.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\566A.tmp"C:\Users\Admin\AppData\Local\Temp\566A.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\5725.tmp"C:\Users\Admin\AppData\Local\Temp\5725.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:472 -
C:\Users\Admin\AppData\Local\Temp\57E0.tmp"C:\Users\Admin\AppData\Local\Temp\57E0.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\59C4.tmp"C:\Users\Admin\AppData\Local\Temp\59C4.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:568 -
C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\5ADC.tmp"C:\Users\Admin\AppData\Local\Temp\5ADC.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\5B69.tmp"C:\Users\Admin\AppData\Local\Temp\5B69.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\5BE6.tmp"C:\Users\Admin\AppData\Local\Temp\5BE6.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\5C53.tmp"C:\Users\Admin\AppData\Local\Temp\5C53.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\5CD0.tmp"C:\Users\Admin\AppData\Local\Temp\5CD0.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\5D4C.tmp"C:\Users\Admin\AppData\Local\Temp\5D4C.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\5DC9.tmp"C:\Users\Admin\AppData\Local\Temp\5DC9.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\5E56.tmp"C:\Users\Admin\AppData\Local\Temp\5E56.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\5ED2.tmp"C:\Users\Admin\AppData\Local\Temp\5ED2.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\5F30.tmp"C:\Users\Admin\AppData\Local\Temp\5F30.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:836 -
C:\Users\Admin\AppData\Local\Temp\5F9D.tmp"C:\Users\Admin\AppData\Local\Temp\5F9D.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\601A.tmp"C:\Users\Admin\AppData\Local\Temp\601A.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\60A6.tmp"C:\Users\Admin\AppData\Local\Temp\60A6.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:432 -
C:\Users\Admin\AppData\Local\Temp\6104.tmp"C:\Users\Admin\AppData\Local\Temp\6104.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\6181.tmp"C:\Users\Admin\AppData\Local\Temp\6181.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\61FE.tmp"C:\Users\Admin\AppData\Local\Temp\61FE.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\627A.tmp"C:\Users\Admin\AppData\Local\Temp\627A.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\62E8.tmp"C:\Users\Admin\AppData\Local\Temp\62E8.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\6374.tmp"C:\Users\Admin\AppData\Local\Temp\6374.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:980 -
C:\Users\Admin\AppData\Local\Temp\63E1.tmp"C:\Users\Admin\AppData\Local\Temp\63E1.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\644F.tmp"C:\Users\Admin\AppData\Local\Temp\644F.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:768 -
C:\Users\Admin\AppData\Local\Temp\64BC.tmp"C:\Users\Admin\AppData\Local\Temp\64BC.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\6548.tmp"C:\Users\Admin\AppData\Local\Temp\6548.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\65B5.tmp"C:\Users\Admin\AppData\Local\Temp\65B5.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\6623.tmp"C:\Users\Admin\AppData\Local\Temp\6623.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:304 -
C:\Users\Admin\AppData\Local\Temp\6690.tmp"C:\Users\Admin\AppData\Local\Temp\6690.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\66FD.tmp"C:\Users\Admin\AppData\Local\Temp\66FD.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\677A.tmp"C:\Users\Admin\AppData\Local\Temp\677A.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\67F7.tmp"C:\Users\Admin\AppData\Local\Temp\67F7.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\6864.tmp"C:\Users\Admin\AppData\Local\Temp\6864.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\68E1.tmp"C:\Users\Admin\AppData\Local\Temp\68E1.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\694E.tmp"C:\Users\Admin\AppData\Local\Temp\694E.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\69BB.tmp"C:\Users\Admin\AppData\Local\Temp\69BB.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\6A28.tmp"C:\Users\Admin\AppData\Local\Temp\6A28.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\6A95.tmp"C:\Users\Admin\AppData\Local\Temp\6A95.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\6AF3.tmp"C:\Users\Admin\AppData\Local\Temp\6AF3.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\6B60.tmp"C:\Users\Admin\AppData\Local\Temp\6B60.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\6BCD.tmp"C:\Users\Admin\AppData\Local\Temp\6BCD.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\6C69.tmp"C:\Users\Admin\AppData\Local\Temp\6C69.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\6CD7.tmp"C:\Users\Admin\AppData\Local\Temp\6CD7.tmp"65⤵
- Executes dropped EXE
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\6D34.tmp"C:\Users\Admin\AppData\Local\Temp\6D34.tmp"66⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\6F08.tmp"C:\Users\Admin\AppData\Local\Temp\6F08.tmp"67⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\6F85.tmp"C:\Users\Admin\AppData\Local\Temp\6F85.tmp"68⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\7002.tmp"C:\Users\Admin\AppData\Local\Temp\7002.tmp"69⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\706F.tmp"C:\Users\Admin\AppData\Local\Temp\706F.tmp"70⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\70CD.tmp"C:\Users\Admin\AppData\Local\Temp\70CD.tmp"71⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\713A.tmp"C:\Users\Admin\AppData\Local\Temp\713A.tmp"72⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\71A7.tmp"C:\Users\Admin\AppData\Local\Temp\71A7.tmp"73⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\7233.tmp"C:\Users\Admin\AppData\Local\Temp\7233.tmp"74⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\72B0.tmp"C:\Users\Admin\AppData\Local\Temp\72B0.tmp"75⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"76⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\738B.tmp"C:\Users\Admin\AppData\Local\Temp\738B.tmp"77⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"78⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\7475.tmp"C:\Users\Admin\AppData\Local\Temp\7475.tmp"79⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"80⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\753F.tmp"C:\Users\Admin\AppData\Local\Temp\753F.tmp"81⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\75AD.tmp"C:\Users\Admin\AppData\Local\Temp\75AD.tmp"82⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\7629.tmp"C:\Users\Admin\AppData\Local\Temp\7629.tmp"83⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\76A6.tmp"C:\Users\Admin\AppData\Local\Temp\76A6.tmp"84⤵PID:484
-
C:\Users\Admin\AppData\Local\Temp\7713.tmp"C:\Users\Admin\AppData\Local\Temp\7713.tmp"85⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\7781.tmp"C:\Users\Admin\AppData\Local\Temp\7781.tmp"86⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\77EE.tmp"C:\Users\Admin\AppData\Local\Temp\77EE.tmp"87⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\785B.tmp"C:\Users\Admin\AppData\Local\Temp\785B.tmp"88⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\78C8.tmp"C:\Users\Admin\AppData\Local\Temp\78C8.tmp"89⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\7945.tmp"C:\Users\Admin\AppData\Local\Temp\7945.tmp"90⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\79B2.tmp"C:\Users\Admin\AppData\Local\Temp\79B2.tmp"91⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\7A1F.tmp"C:\Users\Admin\AppData\Local\Temp\7A1F.tmp"92⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\7A7D.tmp"C:\Users\Admin\AppData\Local\Temp\7A7D.tmp"93⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\7AFA.tmp"C:\Users\Admin\AppData\Local\Temp\7AFA.tmp"94⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\7B67.tmp"C:\Users\Admin\AppData\Local\Temp\7B67.tmp"95⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\7BD4.tmp"C:\Users\Admin\AppData\Local\Temp\7BD4.tmp"96⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\7C41.tmp"C:\Users\Admin\AppData\Local\Temp\7C41.tmp"97⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\7CBE.tmp"C:\Users\Admin\AppData\Local\Temp\7CBE.tmp"98⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\7D2B.tmp"C:\Users\Admin\AppData\Local\Temp\7D2B.tmp"99⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\7D89.tmp"C:\Users\Admin\AppData\Local\Temp\7D89.tmp"100⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\7E06.tmp"C:\Users\Admin\AppData\Local\Temp\7E06.tmp"101⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\7E83.tmp"C:\Users\Admin\AppData\Local\Temp\7E83.tmp"102⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\7EE0.tmp"C:\Users\Admin\AppData\Local\Temp\7EE0.tmp"103⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\7F5D.tmp"C:\Users\Admin\AppData\Local\Temp\7F5D.tmp"104⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\7FCA.tmp"C:\Users\Admin\AppData\Local\Temp\7FCA.tmp"105⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\8047.tmp"C:\Users\Admin\AppData\Local\Temp\8047.tmp"106⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\80B4.tmp"C:\Users\Admin\AppData\Local\Temp\80B4.tmp"107⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\8121.tmp"C:\Users\Admin\AppData\Local\Temp\8121.tmp"108⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\818F.tmp"C:\Users\Admin\AppData\Local\Temp\818F.tmp"109⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\820B.tmp"C:\Users\Admin\AppData\Local\Temp\820B.tmp"110⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\8279.tmp"C:\Users\Admin\AppData\Local\Temp\8279.tmp"111⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\82F5.tmp"C:\Users\Admin\AppData\Local\Temp\82F5.tmp"112⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\83FF.tmp"C:\Users\Admin\AppData\Local\Temp\83FF.tmp"113⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\84C9.tmp"C:\Users\Admin\AppData\Local\Temp\84C9.tmp"114⤵PID:608
-
C:\Users\Admin\AppData\Local\Temp\8556.tmp"C:\Users\Admin\AppData\Local\Temp\8556.tmp"115⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\85C3.tmp"C:\Users\Admin\AppData\Local\Temp\85C3.tmp"116⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\8630.tmp"C:\Users\Admin\AppData\Local\Temp\8630.tmp"117⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\869D.tmp"C:\Users\Admin\AppData\Local\Temp\869D.tmp"118⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\870B.tmp"C:\Users\Admin\AppData\Local\Temp\870B.tmp"119⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\8778.tmp"C:\Users\Admin\AppData\Local\Temp\8778.tmp"120⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\87D5.tmp"C:\Users\Admin\AppData\Local\Temp\87D5.tmp"121⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\8843.tmp"C:\Users\Admin\AppData\Local\Temp\8843.tmp"122⤵PID:1608
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-