Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
13-02-2024 15:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-13_ad2d7ec2ad8ddef4134fdfe9c6a82a01_mafia.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-13_ad2d7ec2ad8ddef4134fdfe9c6a82a01_mafia.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-02-13_ad2d7ec2ad8ddef4134fdfe9c6a82a01_mafia.exe
-
Size
488KB
-
MD5
ad2d7ec2ad8ddef4134fdfe9c6a82a01
-
SHA1
908185f48224608b7cdf40bfc055303b67f6b66a
-
SHA256
f65b4006eb0296635050bace8715d0a5c85fcb9f7c0183fb8d6c27c24c9ce3a5
-
SHA512
87f61c062801b8bb9912616dd169c9f47ee6e6118e13c1a6685d8ad1abcd4638d0d9bff186b16e4259c27e3d880633444f97d35d7b2e2ae125b4d69dfc72bdef
-
SSDEEP
12288:/U5rCOTeiDhU+POiv9jcztwfRw968j0MNZ:/UQOJDlP3eW5+68IMN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1252 4089.tmp 2632 4135.tmp 2648 424E.tmp 2768 4318.tmp 2668 4412.tmp 2316 44FC.tmp 2832 45E6.tmp 2716 46A1.tmp 2536 477C.tmp 2616 4856.tmp 1724 4911.tmp 1564 49BD.tmp 2340 4A97.tmp 1304 4B62.tmp 1120 4C1D.tmp 2588 4D07.tmp 2828 4DE2.tmp 2896 4E9D.tmp 2032 4F77.tmp 2904 5052.tmp 2924 511C.tmp 308 51C8.tmp 1472 534E.tmp 1568 53DA.tmp 1956 5496.tmp 1236 5522.tmp 1936 55AE.tmp 1488 562B.tmp 1628 56A8.tmp 2392 5725.tmp 2204 57A2.tmp 800 57FF.tmp 1776 585D.tmp 2280 58E9.tmp 1524 5947.tmp 2212 59C4.tmp 1288 5A40.tmp 1044 5ABD.tmp 1672 5B2A.tmp 1764 5BC6.tmp 1632 5C34.tmp 856 5CC0.tmp 1980 5D1E.tmp 892 5D9A.tmp 672 5E08.tmp 1916 5E75.tmp 2012 5EF2.tmp 2448 5F4F.tmp 736 5FAD.tmp 556 6039.tmp 1512 6097.tmp 2436 6114.tmp 1328 6181.tmp 1580 61EE.tmp 1732 625B.tmp 3052 62C8.tmp 1624 6336.tmp 2336 6393.tmp 2632 6410.tmp 2792 646E.tmp 2700 64DB.tmp 2780 6539.tmp 2704 65B5.tmp 2576 6613.tmp -
Loads dropped DLL 64 IoCs
pid Process 3052 2024-02-13_ad2d7ec2ad8ddef4134fdfe9c6a82a01_mafia.exe 1252 4089.tmp 2632 4135.tmp 2648 424E.tmp 2768 4318.tmp 2668 4412.tmp 2316 44FC.tmp 2832 45E6.tmp 2716 46A1.tmp 2536 477C.tmp 2616 4856.tmp 1724 4911.tmp 1564 49BD.tmp 2340 4A97.tmp 1304 4B62.tmp 1120 4C1D.tmp 2588 4D07.tmp 2828 4DE2.tmp 2896 4E9D.tmp 2032 4F77.tmp 2904 5052.tmp 2924 511C.tmp 308 51C8.tmp 1472 534E.tmp 1568 53DA.tmp 1956 5496.tmp 1236 5522.tmp 1936 55AE.tmp 1488 562B.tmp 1628 56A8.tmp 2392 5725.tmp 2204 57A2.tmp 800 57FF.tmp 1776 585D.tmp 2280 58E9.tmp 1524 5947.tmp 2212 59C4.tmp 1288 5A40.tmp 1044 5ABD.tmp 1672 5B2A.tmp 1764 5BC6.tmp 1632 5C34.tmp 856 5CC0.tmp 1980 5D1E.tmp 892 5D9A.tmp 672 5E08.tmp 1916 5E75.tmp 2012 5EF2.tmp 2448 5F4F.tmp 736 5FAD.tmp 556 6039.tmp 1512 6097.tmp 2436 6114.tmp 1328 6181.tmp 1580 61EE.tmp 1732 625B.tmp 3052 62C8.tmp 1624 6336.tmp 2336 6393.tmp 2632 6410.tmp 2792 646E.tmp 2700 64DB.tmp 2780 6539.tmp 2704 65B5.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3052 wrote to memory of 1252 3052 2024-02-13_ad2d7ec2ad8ddef4134fdfe9c6a82a01_mafia.exe 28 PID 3052 wrote to memory of 1252 3052 2024-02-13_ad2d7ec2ad8ddef4134fdfe9c6a82a01_mafia.exe 28 PID 3052 wrote to memory of 1252 3052 2024-02-13_ad2d7ec2ad8ddef4134fdfe9c6a82a01_mafia.exe 28 PID 3052 wrote to memory of 1252 3052 2024-02-13_ad2d7ec2ad8ddef4134fdfe9c6a82a01_mafia.exe 28 PID 1252 wrote to memory of 2632 1252 4089.tmp 29 PID 1252 wrote to memory of 2632 1252 4089.tmp 29 PID 1252 wrote to memory of 2632 1252 4089.tmp 29 PID 1252 wrote to memory of 2632 1252 4089.tmp 29 PID 2632 wrote to memory of 2648 2632 4135.tmp 30 PID 2632 wrote to memory of 2648 2632 4135.tmp 30 PID 2632 wrote to memory of 2648 2632 4135.tmp 30 PID 2632 wrote to memory of 2648 2632 4135.tmp 30 PID 2648 wrote to memory of 2768 2648 424E.tmp 31 PID 2648 wrote to memory of 2768 2648 424E.tmp 31 PID 2648 wrote to memory of 2768 2648 424E.tmp 31 PID 2648 wrote to memory of 2768 2648 424E.tmp 31 PID 2768 wrote to memory of 2668 2768 4318.tmp 32 PID 2768 wrote to memory of 2668 2768 4318.tmp 32 PID 2768 wrote to memory of 2668 2768 4318.tmp 32 PID 2768 wrote to memory of 2668 2768 4318.tmp 32 PID 2668 wrote to memory of 2316 2668 4412.tmp 33 PID 2668 wrote to memory of 2316 2668 4412.tmp 33 PID 2668 wrote to memory of 2316 2668 4412.tmp 33 PID 2668 wrote to memory of 2316 2668 4412.tmp 33 PID 2316 wrote to memory of 2832 2316 44FC.tmp 34 PID 2316 wrote to memory of 2832 2316 44FC.tmp 34 PID 2316 wrote to memory of 2832 2316 44FC.tmp 34 PID 2316 wrote to memory of 2832 2316 44FC.tmp 34 PID 2832 wrote to memory of 2716 2832 45E6.tmp 35 PID 2832 wrote to memory of 2716 2832 45E6.tmp 35 PID 2832 wrote to memory of 2716 2832 45E6.tmp 35 PID 2832 wrote to memory of 2716 2832 45E6.tmp 35 PID 2716 wrote to memory of 2536 2716 46A1.tmp 36 PID 2716 wrote to memory of 2536 2716 46A1.tmp 36 PID 2716 wrote to memory of 2536 2716 46A1.tmp 36 PID 2716 wrote to memory of 2536 2716 46A1.tmp 36 PID 2536 wrote to memory of 2616 2536 477C.tmp 37 PID 2536 wrote to memory of 2616 2536 477C.tmp 37 PID 2536 wrote to memory of 2616 2536 477C.tmp 37 PID 2536 wrote to memory of 2616 2536 477C.tmp 37 PID 2616 wrote to memory of 1724 2616 4856.tmp 38 PID 2616 wrote to memory of 1724 2616 4856.tmp 38 PID 2616 wrote to memory of 1724 2616 4856.tmp 38 PID 2616 wrote to memory of 1724 2616 4856.tmp 38 PID 1724 wrote to memory of 1564 1724 4911.tmp 39 PID 1724 wrote to memory of 1564 1724 4911.tmp 39 PID 1724 wrote to memory of 1564 1724 4911.tmp 39 PID 1724 wrote to memory of 1564 1724 4911.tmp 39 PID 1564 wrote to memory of 2340 1564 49BD.tmp 40 PID 1564 wrote to memory of 2340 1564 49BD.tmp 40 PID 1564 wrote to memory of 2340 1564 49BD.tmp 40 PID 1564 wrote to memory of 2340 1564 49BD.tmp 40 PID 2340 wrote to memory of 1304 2340 4A97.tmp 41 PID 2340 wrote to memory of 1304 2340 4A97.tmp 41 PID 2340 wrote to memory of 1304 2340 4A97.tmp 41 PID 2340 wrote to memory of 1304 2340 4A97.tmp 41 PID 1304 wrote to memory of 1120 1304 4B62.tmp 42 PID 1304 wrote to memory of 1120 1304 4B62.tmp 42 PID 1304 wrote to memory of 1120 1304 4B62.tmp 42 PID 1304 wrote to memory of 1120 1304 4B62.tmp 42 PID 1120 wrote to memory of 2588 1120 4C1D.tmp 43 PID 1120 wrote to memory of 2588 1120 4C1D.tmp 43 PID 1120 wrote to memory of 2588 1120 4C1D.tmp 43 PID 1120 wrote to memory of 2588 1120 4C1D.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-13_ad2d7ec2ad8ddef4134fdfe9c6a82a01_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-13_ad2d7ec2ad8ddef4134fdfe9c6a82a01_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\4089.tmp"C:\Users\Admin\AppData\Local\Temp\4089.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\4135.tmp"C:\Users\Admin\AppData\Local\Temp\4135.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\424E.tmp"C:\Users\Admin\AppData\Local\Temp\424E.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\4318.tmp"C:\Users\Admin\AppData\Local\Temp\4318.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\4412.tmp"C:\Users\Admin\AppData\Local\Temp\4412.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\44FC.tmp"C:\Users\Admin\AppData\Local\Temp\44FC.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\45E6.tmp"C:\Users\Admin\AppData\Local\Temp\45E6.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\46A1.tmp"C:\Users\Admin\AppData\Local\Temp\46A1.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\477C.tmp"C:\Users\Admin\AppData\Local\Temp\477C.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\4856.tmp"C:\Users\Admin\AppData\Local\Temp\4856.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\4911.tmp"C:\Users\Admin\AppData\Local\Temp\4911.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\49BD.tmp"C:\Users\Admin\AppData\Local\Temp\49BD.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\4A97.tmp"C:\Users\Admin\AppData\Local\Temp\4A97.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\4B62.tmp"C:\Users\Admin\AppData\Local\Temp\4B62.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\4C1D.tmp"C:\Users\Admin\AppData\Local\Temp\4C1D.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\4DE2.tmp"C:\Users\Admin\AppData\Local\Temp\4DE2.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\4F77.tmp"C:\Users\Admin\AppData\Local\Temp\4F77.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\511C.tmp"C:\Users\Admin\AppData\Local\Temp\511C.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\51C8.tmp"C:\Users\Admin\AppData\Local\Temp\51C8.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:308 -
C:\Users\Admin\AppData\Local\Temp\534E.tmp"C:\Users\Admin\AppData\Local\Temp\534E.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\53DA.tmp"C:\Users\Admin\AppData\Local\Temp\53DA.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\5496.tmp"C:\Users\Admin\AppData\Local\Temp\5496.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\5522.tmp"C:\Users\Admin\AppData\Local\Temp\5522.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\55AE.tmp"C:\Users\Admin\AppData\Local\Temp\55AE.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\562B.tmp"C:\Users\Admin\AppData\Local\Temp\562B.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\56A8.tmp"C:\Users\Admin\AppData\Local\Temp\56A8.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\5725.tmp"C:\Users\Admin\AppData\Local\Temp\5725.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\57A2.tmp"C:\Users\Admin\AppData\Local\Temp\57A2.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\57FF.tmp"C:\Users\Admin\AppData\Local\Temp\57FF.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:800 -
C:\Users\Admin\AppData\Local\Temp\585D.tmp"C:\Users\Admin\AppData\Local\Temp\585D.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\58E9.tmp"C:\Users\Admin\AppData\Local\Temp\58E9.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\5947.tmp"C:\Users\Admin\AppData\Local\Temp\5947.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\59C4.tmp"C:\Users\Admin\AppData\Local\Temp\59C4.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\5A40.tmp"C:\Users\Admin\AppData\Local\Temp\5A40.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\5ABD.tmp"C:\Users\Admin\AppData\Local\Temp\5ABD.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\5B2A.tmp"C:\Users\Admin\AppData\Local\Temp\5B2A.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\5BC6.tmp"C:\Users\Admin\AppData\Local\Temp\5BC6.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\5C34.tmp"C:\Users\Admin\AppData\Local\Temp\5C34.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\5CC0.tmp"C:\Users\Admin\AppData\Local\Temp\5CC0.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:856 -
C:\Users\Admin\AppData\Local\Temp\5D1E.tmp"C:\Users\Admin\AppData\Local\Temp\5D1E.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\5D9A.tmp"C:\Users\Admin\AppData\Local\Temp\5D9A.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:892 -
C:\Users\Admin\AppData\Local\Temp\5E08.tmp"C:\Users\Admin\AppData\Local\Temp\5E08.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:672 -
C:\Users\Admin\AppData\Local\Temp\5E75.tmp"C:\Users\Admin\AppData\Local\Temp\5E75.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\5EF2.tmp"C:\Users\Admin\AppData\Local\Temp\5EF2.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\5F4F.tmp"C:\Users\Admin\AppData\Local\Temp\5F4F.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\5FAD.tmp"C:\Users\Admin\AppData\Local\Temp\5FAD.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:736 -
C:\Users\Admin\AppData\Local\Temp\6039.tmp"C:\Users\Admin\AppData\Local\Temp\6039.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:556 -
C:\Users\Admin\AppData\Local\Temp\6097.tmp"C:\Users\Admin\AppData\Local\Temp\6097.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\6114.tmp"C:\Users\Admin\AppData\Local\Temp\6114.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\6181.tmp"C:\Users\Admin\AppData\Local\Temp\6181.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\61EE.tmp"C:\Users\Admin\AppData\Local\Temp\61EE.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\625B.tmp"C:\Users\Admin\AppData\Local\Temp\625B.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\62C8.tmp"C:\Users\Admin\AppData\Local\Temp\62C8.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\6336.tmp"C:\Users\Admin\AppData\Local\Temp\6336.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\6393.tmp"C:\Users\Admin\AppData\Local\Temp\6393.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\6410.tmp"C:\Users\Admin\AppData\Local\Temp\6410.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\646E.tmp"C:\Users\Admin\AppData\Local\Temp\646E.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\64DB.tmp"C:\Users\Admin\AppData\Local\Temp\64DB.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\6539.tmp"C:\Users\Admin\AppData\Local\Temp\6539.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\65B5.tmp"C:\Users\Admin\AppData\Local\Temp\65B5.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\6613.tmp"C:\Users\Admin\AppData\Local\Temp\6613.tmp"65⤵
- Executes dropped EXE
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\669F.tmp"C:\Users\Admin\AppData\Local\Temp\669F.tmp"66⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\670D.tmp"C:\Users\Admin\AppData\Local\Temp\670D.tmp"67⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\6883.tmp"C:\Users\Admin\AppData\Local\Temp\6883.tmp"68⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\690F.tmp"C:\Users\Admin\AppData\Local\Temp\690F.tmp"69⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\69AB.tmp"C:\Users\Admin\AppData\Local\Temp\69AB.tmp"70⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\6A19.tmp"C:\Users\Admin\AppData\Local\Temp\6A19.tmp"71⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\6A86.tmp"C:\Users\Admin\AppData\Local\Temp\6A86.tmp"72⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\6AF3.tmp"C:\Users\Admin\AppData\Local\Temp\6AF3.tmp"73⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\6B70.tmp"C:\Users\Admin\AppData\Local\Temp\6B70.tmp"74⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\6BDD.tmp"C:\Users\Admin\AppData\Local\Temp\6BDD.tmp"75⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\6C3B.tmp"C:\Users\Admin\AppData\Local\Temp\6C3B.tmp"76⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\6CA8.tmp"C:\Users\Admin\AppData\Local\Temp\6CA8.tmp"77⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\6D25.tmp"C:\Users\Admin\AppData\Local\Temp\6D25.tmp"78⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\6D82.tmp"C:\Users\Admin\AppData\Local\Temp\6D82.tmp"79⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\6DE0.tmp"C:\Users\Admin\AppData\Local\Temp\6DE0.tmp"80⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\6E5D.tmp"C:\Users\Admin\AppData\Local\Temp\6E5D.tmp"81⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\6EBA.tmp"C:\Users\Admin\AppData\Local\Temp\6EBA.tmp"82⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\6F47.tmp"C:\Users\Admin\AppData\Local\Temp\6F47.tmp"83⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\6FB4.tmp"C:\Users\Admin\AppData\Local\Temp\6FB4.tmp"84⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\7031.tmp"C:\Users\Admin\AppData\Local\Temp\7031.tmp"85⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\707F.tmp"C:\Users\Admin\AppData\Local\Temp\707F.tmp"86⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\70DC.tmp"C:\Users\Admin\AppData\Local\Temp\70DC.tmp"87⤵PID:268
-
C:\Users\Admin\AppData\Local\Temp\7149.tmp"C:\Users\Admin\AppData\Local\Temp\7149.tmp"88⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\71D6.tmp"C:\Users\Admin\AppData\Local\Temp\71D6.tmp"89⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\7243.tmp"C:\Users\Admin\AppData\Local\Temp\7243.tmp"90⤵PID:608
-
C:\Users\Admin\AppData\Local\Temp\72B0.tmp"C:\Users\Admin\AppData\Local\Temp\72B0.tmp"91⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"92⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\739A.tmp"C:\Users\Admin\AppData\Local\Temp\739A.tmp"93⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"94⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\7475.tmp"C:\Users\Admin\AppData\Local\Temp\7475.tmp"95⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"96⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\754F.tmp"C:\Users\Admin\AppData\Local\Temp\754F.tmp"97⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\75CC.tmp"C:\Users\Admin\AppData\Local\Temp\75CC.tmp"98⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\7649.tmp"C:\Users\Admin\AppData\Local\Temp\7649.tmp"99⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\76B6.tmp"C:\Users\Admin\AppData\Local\Temp\76B6.tmp"100⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"101⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\7790.tmp"C:\Users\Admin\AppData\Local\Temp\7790.tmp"102⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\77FD.tmp"C:\Users\Admin\AppData\Local\Temp\77FD.tmp"103⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\787A.tmp"C:\Users\Admin\AppData\Local\Temp\787A.tmp"104⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\7916.tmp"C:\Users\Admin\AppData\Local\Temp\7916.tmp"105⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\7993.tmp"C:\Users\Admin\AppData\Local\Temp\7993.tmp"106⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\79F1.tmp"C:\Users\Admin\AppData\Local\Temp\79F1.tmp"107⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\7A5E.tmp"C:\Users\Admin\AppData\Local\Temp\7A5E.tmp"108⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\7ACB.tmp"C:\Users\Admin\AppData\Local\Temp\7ACB.tmp"109⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\7B57.tmp"C:\Users\Admin\AppData\Local\Temp\7B57.tmp"110⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\7BC5.tmp"C:\Users\Admin\AppData\Local\Temp\7BC5.tmp"111⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\7C51.tmp"C:\Users\Admin\AppData\Local\Temp\7C51.tmp"112⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\7CCE.tmp"C:\Users\Admin\AppData\Local\Temp\7CCE.tmp"113⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\7DB8.tmp"C:\Users\Admin\AppData\Local\Temp\7DB8.tmp"114⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\7E83.tmp"C:\Users\Admin\AppData\Local\Temp\7E83.tmp"115⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\7EFF.tmp"C:\Users\Admin\AppData\Local\Temp\7EFF.tmp"116⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\7F5D.tmp"C:\Users\Admin\AppData\Local\Temp\7F5D.tmp"117⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\7FBB.tmp"C:\Users\Admin\AppData\Local\Temp\7FBB.tmp"118⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\8047.tmp"C:\Users\Admin\AppData\Local\Temp\8047.tmp"119⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\80B4.tmp"C:\Users\Admin\AppData\Local\Temp\80B4.tmp"120⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\8131.tmp"C:\Users\Admin\AppData\Local\Temp\8131.tmp"121⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\81BD.tmp"C:\Users\Admin\AppData\Local\Temp\81BD.tmp"122⤵PID:2980
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-