Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
14-02-2024 02:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-14_7c867bdfc148ef0833e575a59181c68c_mafia.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-14_7c867bdfc148ef0833e575a59181c68c_mafia.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-02-14_7c867bdfc148ef0833e575a59181c68c_mafia.exe
-
Size
486KB
-
MD5
7c867bdfc148ef0833e575a59181c68c
-
SHA1
10d51516b879da974f797e95767c3447479beaa9
-
SHA256
845747fdfa04b73a98971b4d0711fa54229b7986e417d181dc48eea0dadeb41e
-
SHA512
5ad5aff23c4c0ac35b24f372280d56ea9e41ced4430e5a7fffddf0eaee7a64559742525725606b3043740d1d96ee63cf9cbd3e4eca7811a3cd09c258cc5cfaef
-
SSDEEP
12288:oU5rCOTeiDDcbXKDk7i3PzaM1fCX16frZihRbNZ:oUQOJDDNV1qX104N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1680 FA75.tmp 2180 FAC3.tmp 1152 FB30.tmp 2292 FB7E.tmp 2692 FBDC.tmp 2760 FC49.tmp 2772 FCA7.tmp 2652 FCF5.tmp 2532 FD52.tmp 2604 FDB0.tmp 2524 FE0E.tmp 2928 FE6B.tmp 2112 FEC9.tmp 1244 FF26.tmp 2584 FF84.tmp 2480 FFD2.tmp 2788 30.tmp 1584 8D.tmp 2892 FA.tmp 2880 158.tmp 1980 1B6.tmp 1444 223.tmp 3044 280.tmp 1296 2CE.tmp 3036 30D.tmp 2064 34B.tmp 2360 38A.tmp 1996 3C8.tmp 2868 406.tmp 540 445.tmp 1160 483.tmp 1060 4C2.tmp 1492 500.tmp 1824 53E.tmp 1968 57D.tmp 696 5BB.tmp 472 609.tmp 1208 657.tmp 1088 696.tmp 1456 6D4.tmp 1552 712.tmp 1616 751.tmp 2680 79F.tmp 404 7DD.tmp 1752 82B.tmp 1684 86A.tmp 3008 8A8.tmp 2220 8E6.tmp 1832 925.tmp 708 963.tmp 2184 9A2.tmp 2212 9E0.tmp 880 A1E.tmp 1524 A5D.tmp 1572 A9B.tmp 1600 ADA.tmp 1680 B28.tmp 2348 B66.tmp 2036 BB4.tmp 2924 BF2.tmp 2648 C40.tmp 2640 C7F.tmp 2740 CBD.tmp 2816 CFC.tmp -
Loads dropped DLL 64 IoCs
pid Process 944 2024-02-14_7c867bdfc148ef0833e575a59181c68c_mafia.exe 1680 FA75.tmp 2180 FAC3.tmp 1152 FB30.tmp 2292 FB7E.tmp 2692 FBDC.tmp 2760 FC49.tmp 2772 FCA7.tmp 2652 FCF5.tmp 2532 FD52.tmp 2604 FDB0.tmp 2524 FE0E.tmp 2928 FE6B.tmp 2112 FEC9.tmp 1244 FF26.tmp 2584 FF84.tmp 2480 FFD2.tmp 2788 30.tmp 1584 8D.tmp 2892 FA.tmp 2880 158.tmp 1980 1B6.tmp 1444 223.tmp 3044 280.tmp 1296 2CE.tmp 3036 30D.tmp 2064 34B.tmp 2360 38A.tmp 1996 3C8.tmp 2868 406.tmp 540 445.tmp 1160 483.tmp 1060 4C2.tmp 1492 500.tmp 1824 53E.tmp 1968 57D.tmp 696 5BB.tmp 472 609.tmp 1208 657.tmp 1088 696.tmp 1456 6D4.tmp 1552 712.tmp 1616 751.tmp 2680 79F.tmp 404 7DD.tmp 1752 82B.tmp 1684 86A.tmp 3008 8A8.tmp 2220 8E6.tmp 1832 925.tmp 708 963.tmp 2184 9A2.tmp 2212 9E0.tmp 880 A1E.tmp 1524 A5D.tmp 1572 A9B.tmp 1600 ADA.tmp 1680 B28.tmp 2348 B66.tmp 2036 BB4.tmp 2924 BF2.tmp 2648 C40.tmp 2640 C7F.tmp 2740 CBD.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 944 wrote to memory of 1680 944 2024-02-14_7c867bdfc148ef0833e575a59181c68c_mafia.exe 28 PID 944 wrote to memory of 1680 944 2024-02-14_7c867bdfc148ef0833e575a59181c68c_mafia.exe 28 PID 944 wrote to memory of 1680 944 2024-02-14_7c867bdfc148ef0833e575a59181c68c_mafia.exe 28 PID 944 wrote to memory of 1680 944 2024-02-14_7c867bdfc148ef0833e575a59181c68c_mafia.exe 28 PID 1680 wrote to memory of 2180 1680 FA75.tmp 29 PID 1680 wrote to memory of 2180 1680 FA75.tmp 29 PID 1680 wrote to memory of 2180 1680 FA75.tmp 29 PID 1680 wrote to memory of 2180 1680 FA75.tmp 29 PID 2180 wrote to memory of 1152 2180 FAC3.tmp 30 PID 2180 wrote to memory of 1152 2180 FAC3.tmp 30 PID 2180 wrote to memory of 1152 2180 FAC3.tmp 30 PID 2180 wrote to memory of 1152 2180 FAC3.tmp 30 PID 1152 wrote to memory of 2292 1152 FB30.tmp 31 PID 1152 wrote to memory of 2292 1152 FB30.tmp 31 PID 1152 wrote to memory of 2292 1152 FB30.tmp 31 PID 1152 wrote to memory of 2292 1152 FB30.tmp 31 PID 2292 wrote to memory of 2692 2292 FB7E.tmp 32 PID 2292 wrote to memory of 2692 2292 FB7E.tmp 32 PID 2292 wrote to memory of 2692 2292 FB7E.tmp 32 PID 2292 wrote to memory of 2692 2292 FB7E.tmp 32 PID 2692 wrote to memory of 2760 2692 FBDC.tmp 33 PID 2692 wrote to memory of 2760 2692 FBDC.tmp 33 PID 2692 wrote to memory of 2760 2692 FBDC.tmp 33 PID 2692 wrote to memory of 2760 2692 FBDC.tmp 33 PID 2760 wrote to memory of 2772 2760 FC49.tmp 34 PID 2760 wrote to memory of 2772 2760 FC49.tmp 34 PID 2760 wrote to memory of 2772 2760 FC49.tmp 34 PID 2760 wrote to memory of 2772 2760 FC49.tmp 34 PID 2772 wrote to memory of 2652 2772 FCA7.tmp 35 PID 2772 wrote to memory of 2652 2772 FCA7.tmp 35 PID 2772 wrote to memory of 2652 2772 FCA7.tmp 35 PID 2772 wrote to memory of 2652 2772 FCA7.tmp 35 PID 2652 wrote to memory of 2532 2652 FCF5.tmp 36 PID 2652 wrote to memory of 2532 2652 FCF5.tmp 36 PID 2652 wrote to memory of 2532 2652 FCF5.tmp 36 PID 2652 wrote to memory of 2532 2652 FCF5.tmp 36 PID 2532 wrote to memory of 2604 2532 FD52.tmp 37 PID 2532 wrote to memory of 2604 2532 FD52.tmp 37 PID 2532 wrote to memory of 2604 2532 FD52.tmp 37 PID 2532 wrote to memory of 2604 2532 FD52.tmp 37 PID 2604 wrote to memory of 2524 2604 FDB0.tmp 38 PID 2604 wrote to memory of 2524 2604 FDB0.tmp 38 PID 2604 wrote to memory of 2524 2604 FDB0.tmp 38 PID 2604 wrote to memory of 2524 2604 FDB0.tmp 38 PID 2524 wrote to memory of 2928 2524 FE0E.tmp 39 PID 2524 wrote to memory of 2928 2524 FE0E.tmp 39 PID 2524 wrote to memory of 2928 2524 FE0E.tmp 39 PID 2524 wrote to memory of 2928 2524 FE0E.tmp 39 PID 2928 wrote to memory of 2112 2928 FE6B.tmp 40 PID 2928 wrote to memory of 2112 2928 FE6B.tmp 40 PID 2928 wrote to memory of 2112 2928 FE6B.tmp 40 PID 2928 wrote to memory of 2112 2928 FE6B.tmp 40 PID 2112 wrote to memory of 1244 2112 FEC9.tmp 41 PID 2112 wrote to memory of 1244 2112 FEC9.tmp 41 PID 2112 wrote to memory of 1244 2112 FEC9.tmp 41 PID 2112 wrote to memory of 1244 2112 FEC9.tmp 41 PID 1244 wrote to memory of 2584 1244 FF26.tmp 42 PID 1244 wrote to memory of 2584 1244 FF26.tmp 42 PID 1244 wrote to memory of 2584 1244 FF26.tmp 42 PID 1244 wrote to memory of 2584 1244 FF26.tmp 42 PID 2584 wrote to memory of 2480 2584 FF84.tmp 43 PID 2584 wrote to memory of 2480 2584 FF84.tmp 43 PID 2584 wrote to memory of 2480 2584 FF84.tmp 43 PID 2584 wrote to memory of 2480 2584 FF84.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-14_7c867bdfc148ef0833e575a59181c68c_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-14_7c867bdfc148ef0833e575a59181c68c_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\FA75.tmp"C:\Users\Admin\AppData\Local\Temp\FA75.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\FAC3.tmp"C:\Users\Admin\AppData\Local\Temp\FAC3.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\FB30.tmp"C:\Users\Admin\AppData\Local\Temp\FB30.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\FB7E.tmp"C:\Users\Admin\AppData\Local\Temp\FB7E.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\FBDC.tmp"C:\Users\Admin\AppData\Local\Temp\FBDC.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\FC49.tmp"C:\Users\Admin\AppData\Local\Temp\FC49.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\FCA7.tmp"C:\Users\Admin\AppData\Local\Temp\FCA7.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\FCF5.tmp"C:\Users\Admin\AppData\Local\Temp\FCF5.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\FD52.tmp"C:\Users\Admin\AppData\Local\Temp\FD52.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\FDB0.tmp"C:\Users\Admin\AppData\Local\Temp\FDB0.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\FE0E.tmp"C:\Users\Admin\AppData\Local\Temp\FE0E.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\FE6B.tmp"C:\Users\Admin\AppData\Local\Temp\FE6B.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\FEC9.tmp"C:\Users\Admin\AppData\Local\Temp\FEC9.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\FF26.tmp"C:\Users\Admin\AppData\Local\Temp\FF26.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\FF84.tmp"C:\Users\Admin\AppData\Local\Temp\FF84.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\FFD2.tmp"C:\Users\Admin\AppData\Local\Temp\FFD2.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\30.tmp"C:\Users\Admin\AppData\Local\Temp\30.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\8D.tmp"C:\Users\Admin\AppData\Local\Temp\8D.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\FA.tmp"C:\Users\Admin\AppData\Local\Temp\FA.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\158.tmp"C:\Users\Admin\AppData\Local\Temp\158.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\1B6.tmp"C:\Users\Admin\AppData\Local\Temp\1B6.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\223.tmp"C:\Users\Admin\AppData\Local\Temp\223.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\280.tmp"C:\Users\Admin\AppData\Local\Temp\280.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\2CE.tmp"C:\Users\Admin\AppData\Local\Temp\2CE.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\30D.tmp"C:\Users\Admin\AppData\Local\Temp\30D.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\34B.tmp"C:\Users\Admin\AppData\Local\Temp\34B.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\38A.tmp"C:\Users\Admin\AppData\Local\Temp\38A.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\3C8.tmp"C:\Users\Admin\AppData\Local\Temp\3C8.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\406.tmp"C:\Users\Admin\AppData\Local\Temp\406.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\445.tmp"C:\Users\Admin\AppData\Local\Temp\445.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:540 -
C:\Users\Admin\AppData\Local\Temp\483.tmp"C:\Users\Admin\AppData\Local\Temp\483.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\4C2.tmp"C:\Users\Admin\AppData\Local\Temp\4C2.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\500.tmp"C:\Users\Admin\AppData\Local\Temp\500.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\53E.tmp"C:\Users\Admin\AppData\Local\Temp\53E.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\57D.tmp"C:\Users\Admin\AppData\Local\Temp\57D.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\5BB.tmp"C:\Users\Admin\AppData\Local\Temp\5BB.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:696 -
C:\Users\Admin\AppData\Local\Temp\609.tmp"C:\Users\Admin\AppData\Local\Temp\609.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:472 -
C:\Users\Admin\AppData\Local\Temp\657.tmp"C:\Users\Admin\AppData\Local\Temp\657.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\696.tmp"C:\Users\Admin\AppData\Local\Temp\696.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\6D4.tmp"C:\Users\Admin\AppData\Local\Temp\6D4.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\712.tmp"C:\Users\Admin\AppData\Local\Temp\712.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\751.tmp"C:\Users\Admin\AppData\Local\Temp\751.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\79F.tmp"C:\Users\Admin\AppData\Local\Temp\79F.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\7DD.tmp"C:\Users\Admin\AppData\Local\Temp\7DD.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:404 -
C:\Users\Admin\AppData\Local\Temp\82B.tmp"C:\Users\Admin\AppData\Local\Temp\82B.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\86A.tmp"C:\Users\Admin\AppData\Local\Temp\86A.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\8A8.tmp"C:\Users\Admin\AppData\Local\Temp\8A8.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\8E6.tmp"C:\Users\Admin\AppData\Local\Temp\8E6.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\925.tmp"C:\Users\Admin\AppData\Local\Temp\925.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\963.tmp"C:\Users\Admin\AppData\Local\Temp\963.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:708 -
C:\Users\Admin\AppData\Local\Temp\9A2.tmp"C:\Users\Admin\AppData\Local\Temp\9A2.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\9E0.tmp"C:\Users\Admin\AppData\Local\Temp\9E0.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\A1E.tmp"C:\Users\Admin\AppData\Local\Temp\A1E.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:880 -
C:\Users\Admin\AppData\Local\Temp\A5D.tmp"C:\Users\Admin\AppData\Local\Temp\A5D.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\A9B.tmp"C:\Users\Admin\AppData\Local\Temp\A9B.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\ADA.tmp"C:\Users\Admin\AppData\Local\Temp\ADA.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\B28.tmp"C:\Users\Admin\AppData\Local\Temp\B28.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\B66.tmp"C:\Users\Admin\AppData\Local\Temp\B66.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\BB4.tmp"C:\Users\Admin\AppData\Local\Temp\BB4.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\BF2.tmp"C:\Users\Admin\AppData\Local\Temp\BF2.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\C40.tmp"C:\Users\Admin\AppData\Local\Temp\C40.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\C7F.tmp"C:\Users\Admin\AppData\Local\Temp\C7F.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\CBD.tmp"C:\Users\Admin\AppData\Local\Temp\CBD.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\CFC.tmp"C:\Users\Admin\AppData\Local\Temp\CFC.tmp"65⤵
- Executes dropped EXE
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\D3A.tmp"C:\Users\Admin\AppData\Local\Temp\D3A.tmp"66⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\D88.tmp"C:\Users\Admin\AppData\Local\Temp\D88.tmp"67⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\DC6.tmp"C:\Users\Admin\AppData\Local\Temp\DC6.tmp"68⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\E05.tmp"C:\Users\Admin\AppData\Local\Temp\E05.tmp"69⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\E43.tmp"C:\Users\Admin\AppData\Local\Temp\E43.tmp"70⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\E82.tmp"C:\Users\Admin\AppData\Local\Temp\E82.tmp"71⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\EC0.tmp"C:\Users\Admin\AppData\Local\Temp\EC0.tmp"72⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\EFE.tmp"C:\Users\Admin\AppData\Local\Temp\EFE.tmp"73⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\F3D.tmp"C:\Users\Admin\AppData\Local\Temp\F3D.tmp"74⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\F7B.tmp"C:\Users\Admin\AppData\Local\Temp\F7B.tmp"75⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\FBA.tmp"C:\Users\Admin\AppData\Local\Temp\FBA.tmp"76⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\FF8.tmp"C:\Users\Admin\AppData\Local\Temp\FF8.tmp"77⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\1036.tmp"C:\Users\Admin\AppData\Local\Temp\1036.tmp"78⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\1075.tmp"C:\Users\Admin\AppData\Local\Temp\1075.tmp"79⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\10C3.tmp"C:\Users\Admin\AppData\Local\Temp\10C3.tmp"80⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\1101.tmp"C:\Users\Admin\AppData\Local\Temp\1101.tmp"81⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\1140.tmp"C:\Users\Admin\AppData\Local\Temp\1140.tmp"82⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\117E.tmp"C:\Users\Admin\AppData\Local\Temp\117E.tmp"83⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\11BC.tmp"C:\Users\Admin\AppData\Local\Temp\11BC.tmp"84⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\11FB.tmp"C:\Users\Admin\AppData\Local\Temp\11FB.tmp"85⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\1239.tmp"C:\Users\Admin\AppData\Local\Temp\1239.tmp"86⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\1287.tmp"C:\Users\Admin\AppData\Local\Temp\1287.tmp"87⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\12C6.tmp"C:\Users\Admin\AppData\Local\Temp\12C6.tmp"88⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\1304.tmp"C:\Users\Admin\AppData\Local\Temp\1304.tmp"89⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\1342.tmp"C:\Users\Admin\AppData\Local\Temp\1342.tmp"90⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\1381.tmp"C:\Users\Admin\AppData\Local\Temp\1381.tmp"91⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\13BF.tmp"C:\Users\Admin\AppData\Local\Temp\13BF.tmp"92⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\13FE.tmp"C:\Users\Admin\AppData\Local\Temp\13FE.tmp"93⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\143C.tmp"C:\Users\Admin\AppData\Local\Temp\143C.tmp"94⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\147A.tmp"C:\Users\Admin\AppData\Local\Temp\147A.tmp"95⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\14B9.tmp"C:\Users\Admin\AppData\Local\Temp\14B9.tmp"96⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\14F7.tmp"C:\Users\Admin\AppData\Local\Temp\14F7.tmp"97⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\1536.tmp"C:\Users\Admin\AppData\Local\Temp\1536.tmp"98⤵PID:356
-
C:\Users\Admin\AppData\Local\Temp\1574.tmp"C:\Users\Admin\AppData\Local\Temp\1574.tmp"99⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\15B2.tmp"C:\Users\Admin\AppData\Local\Temp\15B2.tmp"100⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\1600.tmp"C:\Users\Admin\AppData\Local\Temp\1600.tmp"101⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\163F.tmp"C:\Users\Admin\AppData\Local\Temp\163F.tmp"102⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\167D.tmp"C:\Users\Admin\AppData\Local\Temp\167D.tmp"103⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\16BC.tmp"C:\Users\Admin\AppData\Local\Temp\16BC.tmp"104⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\16FA.tmp"C:\Users\Admin\AppData\Local\Temp\16FA.tmp"105⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\1738.tmp"C:\Users\Admin\AppData\Local\Temp\1738.tmp"106⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\1777.tmp"C:\Users\Admin\AppData\Local\Temp\1777.tmp"107⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\17B5.tmp"C:\Users\Admin\AppData\Local\Temp\17B5.tmp"108⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\17F4.tmp"C:\Users\Admin\AppData\Local\Temp\17F4.tmp"109⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\1832.tmp"C:\Users\Admin\AppData\Local\Temp\1832.tmp"110⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\1870.tmp"C:\Users\Admin\AppData\Local\Temp\1870.tmp"111⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\18AF.tmp"C:\Users\Admin\AppData\Local\Temp\18AF.tmp"112⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\18ED.tmp"C:\Users\Admin\AppData\Local\Temp\18ED.tmp"113⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\192C.tmp"C:\Users\Admin\AppData\Local\Temp\192C.tmp"114⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\196A.tmp"C:\Users\Admin\AppData\Local\Temp\196A.tmp"115⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\19B8.tmp"C:\Users\Admin\AppData\Local\Temp\19B8.tmp"116⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\19F6.tmp"C:\Users\Admin\AppData\Local\Temp\19F6.tmp"117⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\1A35.tmp"C:\Users\Admin\AppData\Local\Temp\1A35.tmp"118⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\1A73.tmp"C:\Users\Admin\AppData\Local\Temp\1A73.tmp"119⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"120⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"121⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"122⤵PID:1572
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-