Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23/02/2024, 12:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-23_b6dca6de56f3d4bc1a42999665f4e8b7_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-23_b6dca6de56f3d4bc1a42999665f4e8b7_mafia.exe
Resource
win10v2004-20240221-en
2 signatures
150 seconds
General
-
Target
2024-02-23_b6dca6de56f3d4bc1a42999665f4e8b7_mafia.exe
-
Size
488KB
-
MD5
b6dca6de56f3d4bc1a42999665f4e8b7
-
SHA1
24ed6dc3331a826e8d3d4334195e0b2f1406694e
-
SHA256
a20af7b32ddcbb8908cb64cc904d5112bd918b1165c4960ef4a72bbe99354240
-
SHA512
cf9eb6dd9ffd4f0aff09087afa172680e125178bc72cabdfc25ac0f54916f75a0ea924f8466c951709c689bcb9a1f1e14e8184d51fb073706877d7a95c65961b
-
SSDEEP
12288:/U5rCOTeiDkqfEs/ddZYHqf1giVATrXaoJNZ:/UQOJDkq8sRUhKoJN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2004 2B26.tmp 3012 2BA2.tmp 2656 2C4E.tmp 2872 2CDA.tmp 2708 2D38.tmp 2548 2DC4.tmp 2408 2E12.tmp 2440 2E9F.tmp 2404 2F1C.tmp 2944 2FA8.tmp 2956 3044.tmp 1508 30D0.tmp 2592 314D.tmp 2728 31DA.tmp 2800 3247.tmp 336 32E3.tmp 1912 3360.tmp 2200 33DC.tmp 1624 3459.tmp 1536 34E6.tmp 488 3562.tmp 632 35EF.tmp 1416 365C.tmp 2748 36AA.tmp 880 36F8.tmp 2816 3746.tmp 2744 3794.tmp 2932 37E2.tmp 1656 3820.tmp 2820 385F.tmp 1948 38AD.tmp 2952 38FB.tmp 1744 3949.tmp 2784 3997.tmp 2336 39E5.tmp 2092 3A33.tmp 2300 3A81.tmp 3032 3ACF.tmp 3008 3B1D.tmp 552 3B6B.tmp 980 3BC8.tmp 1284 3C16.tmp 240 3C64.tmp 1712 3CB2.tmp 852 3D00.tmp 1420 3D4E.tmp 2924 3D8D.tmp 2964 3DCB.tmp 2140 3E19.tmp 1256 3E58.tmp 2044 3E96.tmp 1432 3EE4.tmp 768 3F22.tmp 2020 3F61.tmp 2188 3F9F.tmp 2168 3FED.tmp 3016 402C.tmp 2228 407A.tmp 3068 40B8.tmp 2684 4106.tmp 2712 4144.tmp 1976 4192.tmp 2628 41D1.tmp 2640 420F.tmp -
Loads dropped DLL 64 IoCs
pid Process 2156 2024-02-23_b6dca6de56f3d4bc1a42999665f4e8b7_mafia.exe 2004 2B26.tmp 3012 2BA2.tmp 2656 2C4E.tmp 2872 2CDA.tmp 2708 2D38.tmp 2548 2DC4.tmp 2408 2E12.tmp 2440 2E9F.tmp 2404 2F1C.tmp 2944 2FA8.tmp 2956 3044.tmp 1508 30D0.tmp 2592 314D.tmp 2728 31DA.tmp 2800 3247.tmp 336 32E3.tmp 1912 3360.tmp 2200 33DC.tmp 1624 3459.tmp 1536 34E6.tmp 488 3562.tmp 632 35EF.tmp 1416 365C.tmp 2748 36AA.tmp 880 36F8.tmp 2816 3746.tmp 2744 3794.tmp 2932 37E2.tmp 1656 3820.tmp 2820 385F.tmp 1948 38AD.tmp 2952 38FB.tmp 1744 3949.tmp 2784 3997.tmp 2336 39E5.tmp 2092 3A33.tmp 2300 3A81.tmp 3032 3ACF.tmp 3008 3B1D.tmp 552 3B6B.tmp 980 3BC8.tmp 1284 3C16.tmp 240 3C64.tmp 1712 3CB2.tmp 852 3D00.tmp 1420 3D4E.tmp 2924 3D8D.tmp 2964 3DCB.tmp 2140 3E19.tmp 1256 3E58.tmp 2044 3E96.tmp 1432 3EE4.tmp 768 3F22.tmp 2020 3F61.tmp 2188 3F9F.tmp 2168 3FED.tmp 3016 402C.tmp 2228 407A.tmp 3068 40B8.tmp 2684 4106.tmp 2712 4144.tmp 1976 4192.tmp 2628 41D1.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2156 wrote to memory of 2004 2156 2024-02-23_b6dca6de56f3d4bc1a42999665f4e8b7_mafia.exe 28 PID 2156 wrote to memory of 2004 2156 2024-02-23_b6dca6de56f3d4bc1a42999665f4e8b7_mafia.exe 28 PID 2156 wrote to memory of 2004 2156 2024-02-23_b6dca6de56f3d4bc1a42999665f4e8b7_mafia.exe 28 PID 2156 wrote to memory of 2004 2156 2024-02-23_b6dca6de56f3d4bc1a42999665f4e8b7_mafia.exe 28 PID 2004 wrote to memory of 3012 2004 2B26.tmp 29 PID 2004 wrote to memory of 3012 2004 2B26.tmp 29 PID 2004 wrote to memory of 3012 2004 2B26.tmp 29 PID 2004 wrote to memory of 3012 2004 2B26.tmp 29 PID 3012 wrote to memory of 2656 3012 2BA2.tmp 30 PID 3012 wrote to memory of 2656 3012 2BA2.tmp 30 PID 3012 wrote to memory of 2656 3012 2BA2.tmp 30 PID 3012 wrote to memory of 2656 3012 2BA2.tmp 30 PID 2656 wrote to memory of 2872 2656 2C4E.tmp 31 PID 2656 wrote to memory of 2872 2656 2C4E.tmp 31 PID 2656 wrote to memory of 2872 2656 2C4E.tmp 31 PID 2656 wrote to memory of 2872 2656 2C4E.tmp 31 PID 2872 wrote to memory of 2708 2872 2CDA.tmp 32 PID 2872 wrote to memory of 2708 2872 2CDA.tmp 32 PID 2872 wrote to memory of 2708 2872 2CDA.tmp 32 PID 2872 wrote to memory of 2708 2872 2CDA.tmp 32 PID 2708 wrote to memory of 2548 2708 2D38.tmp 33 PID 2708 wrote to memory of 2548 2708 2D38.tmp 33 PID 2708 wrote to memory of 2548 2708 2D38.tmp 33 PID 2708 wrote to memory of 2548 2708 2D38.tmp 33 PID 2548 wrote to memory of 2408 2548 2DC4.tmp 34 PID 2548 wrote to memory of 2408 2548 2DC4.tmp 34 PID 2548 wrote to memory of 2408 2548 2DC4.tmp 34 PID 2548 wrote to memory of 2408 2548 2DC4.tmp 34 PID 2408 wrote to memory of 2440 2408 2E12.tmp 35 PID 2408 wrote to memory of 2440 2408 2E12.tmp 35 PID 2408 wrote to memory of 2440 2408 2E12.tmp 35 PID 2408 wrote to memory of 2440 2408 2E12.tmp 35 PID 2440 wrote to memory of 2404 2440 2E9F.tmp 36 PID 2440 wrote to memory of 2404 2440 2E9F.tmp 36 PID 2440 wrote to memory of 2404 2440 2E9F.tmp 36 PID 2440 wrote to memory of 2404 2440 2E9F.tmp 36 PID 2404 wrote to memory of 2944 2404 2F1C.tmp 37 PID 2404 wrote to memory of 2944 2404 2F1C.tmp 37 PID 2404 wrote to memory of 2944 2404 2F1C.tmp 37 PID 2404 wrote to memory of 2944 2404 2F1C.tmp 37 PID 2944 wrote to memory of 2956 2944 2FA8.tmp 38 PID 2944 wrote to memory of 2956 2944 2FA8.tmp 38 PID 2944 wrote to memory of 2956 2944 2FA8.tmp 38 PID 2944 wrote to memory of 2956 2944 2FA8.tmp 38 PID 2956 wrote to memory of 1508 2956 3044.tmp 39 PID 2956 wrote to memory of 1508 2956 3044.tmp 39 PID 2956 wrote to memory of 1508 2956 3044.tmp 39 PID 2956 wrote to memory of 1508 2956 3044.tmp 39 PID 1508 wrote to memory of 2592 1508 30D0.tmp 40 PID 1508 wrote to memory of 2592 1508 30D0.tmp 40 PID 1508 wrote to memory of 2592 1508 30D0.tmp 40 PID 1508 wrote to memory of 2592 1508 30D0.tmp 40 PID 2592 wrote to memory of 2728 2592 314D.tmp 41 PID 2592 wrote to memory of 2728 2592 314D.tmp 41 PID 2592 wrote to memory of 2728 2592 314D.tmp 41 PID 2592 wrote to memory of 2728 2592 314D.tmp 41 PID 2728 wrote to memory of 2800 2728 31DA.tmp 42 PID 2728 wrote to memory of 2800 2728 31DA.tmp 42 PID 2728 wrote to memory of 2800 2728 31DA.tmp 42 PID 2728 wrote to memory of 2800 2728 31DA.tmp 42 PID 2800 wrote to memory of 336 2800 3247.tmp 43 PID 2800 wrote to memory of 336 2800 3247.tmp 43 PID 2800 wrote to memory of 336 2800 3247.tmp 43 PID 2800 wrote to memory of 336 2800 3247.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_b6dca6de56f3d4bc1a42999665f4e8b7_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-23_b6dca6de56f3d4bc1a42999665f4e8b7_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\2B26.tmp"C:\Users\Admin\AppData\Local\Temp\2B26.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\2D38.tmp"C:\Users\Admin\AppData\Local\Temp\2D38.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\2E12.tmp"C:\Users\Admin\AppData\Local\Temp\2E12.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\2E9F.tmp"C:\Users\Admin\AppData\Local\Temp\2E9F.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\2F1C.tmp"C:\Users\Admin\AppData\Local\Temp\2F1C.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\3044.tmp"C:\Users\Admin\AppData\Local\Temp\3044.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\30D0.tmp"C:\Users\Admin\AppData\Local\Temp\30D0.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\314D.tmp"C:\Users\Admin\AppData\Local\Temp\314D.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\31DA.tmp"C:\Users\Admin\AppData\Local\Temp\31DA.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\3247.tmp"C:\Users\Admin\AppData\Local\Temp\3247.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\32E3.tmp"C:\Users\Admin\AppData\Local\Temp\32E3.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:336 -
C:\Users\Admin\AppData\Local\Temp\3360.tmp"C:\Users\Admin\AppData\Local\Temp\3360.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\33DC.tmp"C:\Users\Admin\AppData\Local\Temp\33DC.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\3459.tmp"C:\Users\Admin\AppData\Local\Temp\3459.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\34E6.tmp"C:\Users\Admin\AppData\Local\Temp\34E6.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\3562.tmp"C:\Users\Admin\AppData\Local\Temp\3562.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:488 -
C:\Users\Admin\AppData\Local\Temp\35EF.tmp"C:\Users\Admin\AppData\Local\Temp\35EF.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:632 -
C:\Users\Admin\AppData\Local\Temp\365C.tmp"C:\Users\Admin\AppData\Local\Temp\365C.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\36AA.tmp"C:\Users\Admin\AppData\Local\Temp\36AA.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\36F8.tmp"C:\Users\Admin\AppData\Local\Temp\36F8.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:880 -
C:\Users\Admin\AppData\Local\Temp\3746.tmp"C:\Users\Admin\AppData\Local\Temp\3746.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\3794.tmp"C:\Users\Admin\AppData\Local\Temp\3794.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\37E2.tmp"C:\Users\Admin\AppData\Local\Temp\37E2.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\3820.tmp"C:\Users\Admin\AppData\Local\Temp\3820.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\385F.tmp"C:\Users\Admin\AppData\Local\Temp\385F.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\38AD.tmp"C:\Users\Admin\AppData\Local\Temp\38AD.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\38FB.tmp"C:\Users\Admin\AppData\Local\Temp\38FB.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\3949.tmp"C:\Users\Admin\AppData\Local\Temp\3949.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\3997.tmp"C:\Users\Admin\AppData\Local\Temp\3997.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\39E5.tmp"C:\Users\Admin\AppData\Local\Temp\39E5.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\3A33.tmp"C:\Users\Admin\AppData\Local\Temp\3A33.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\3A81.tmp"C:\Users\Admin\AppData\Local\Temp\3A81.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\3ACF.tmp"C:\Users\Admin\AppData\Local\Temp\3ACF.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\3B1D.tmp"C:\Users\Admin\AppData\Local\Temp\3B1D.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\3B6B.tmp"C:\Users\Admin\AppData\Local\Temp\3B6B.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:552 -
C:\Users\Admin\AppData\Local\Temp\3BC8.tmp"C:\Users\Admin\AppData\Local\Temp\3BC8.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:980 -
C:\Users\Admin\AppData\Local\Temp\3C16.tmp"C:\Users\Admin\AppData\Local\Temp\3C16.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\3C64.tmp"C:\Users\Admin\AppData\Local\Temp\3C64.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:240 -
C:\Users\Admin\AppData\Local\Temp\3CB2.tmp"C:\Users\Admin\AppData\Local\Temp\3CB2.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\3D00.tmp"C:\Users\Admin\AppData\Local\Temp\3D00.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:852 -
C:\Users\Admin\AppData\Local\Temp\3D4E.tmp"C:\Users\Admin\AppData\Local\Temp\3D4E.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\3D8D.tmp"C:\Users\Admin\AppData\Local\Temp\3D8D.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\3DCB.tmp"C:\Users\Admin\AppData\Local\Temp\3DCB.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\3E19.tmp"C:\Users\Admin\AppData\Local\Temp\3E19.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\3E58.tmp"C:\Users\Admin\AppData\Local\Temp\3E58.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\3E96.tmp"C:\Users\Admin\AppData\Local\Temp\3E96.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\3F22.tmp"C:\Users\Admin\AppData\Local\Temp\3F22.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:768 -
C:\Users\Admin\AppData\Local\Temp\3F61.tmp"C:\Users\Admin\AppData\Local\Temp\3F61.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\3F9F.tmp"C:\Users\Admin\AppData\Local\Temp\3F9F.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\3FED.tmp"C:\Users\Admin\AppData\Local\Temp\3FED.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\402C.tmp"C:\Users\Admin\AppData\Local\Temp\402C.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\407A.tmp"C:\Users\Admin\AppData\Local\Temp\407A.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\40B8.tmp"C:\Users\Admin\AppData\Local\Temp\40B8.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\4106.tmp"C:\Users\Admin\AppData\Local\Temp\4106.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\4144.tmp"C:\Users\Admin\AppData\Local\Temp\4144.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\4192.tmp"C:\Users\Admin\AppData\Local\Temp\4192.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\41D1.tmp"C:\Users\Admin\AppData\Local\Temp\41D1.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\420F.tmp"C:\Users\Admin\AppData\Local\Temp\420F.tmp"65⤵
- Executes dropped EXE
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\424E.tmp"C:\Users\Admin\AppData\Local\Temp\424E.tmp"66⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\429C.tmp"C:\Users\Admin\AppData\Local\Temp\429C.tmp"67⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\42DA.tmp"C:\Users\Admin\AppData\Local\Temp\42DA.tmp"68⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\4328.tmp"C:\Users\Admin\AppData\Local\Temp\4328.tmp"69⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\4366.tmp"C:\Users\Admin\AppData\Local\Temp\4366.tmp"70⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\43B4.tmp"C:\Users\Admin\AppData\Local\Temp\43B4.tmp"71⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\43F3.tmp"C:\Users\Admin\AppData\Local\Temp\43F3.tmp"72⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\4441.tmp"C:\Users\Admin\AppData\Local\Temp\4441.tmp"73⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\447F.tmp"C:\Users\Admin\AppData\Local\Temp\447F.tmp"74⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\44CD.tmp"C:\Users\Admin\AppData\Local\Temp\44CD.tmp"75⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\450C.tmp"C:\Users\Admin\AppData\Local\Temp\450C.tmp"76⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\455A.tmp"C:\Users\Admin\AppData\Local\Temp\455A.tmp"77⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\4598.tmp"C:\Users\Admin\AppData\Local\Temp\4598.tmp"78⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\45E6.tmp"C:\Users\Admin\AppData\Local\Temp\45E6.tmp"79⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\4634.tmp"C:\Users\Admin\AppData\Local\Temp\4634.tmp"80⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\4682.tmp"C:\Users\Admin\AppData\Local\Temp\4682.tmp"81⤵PID:328
-
C:\Users\Admin\AppData\Local\Temp\46D0.tmp"C:\Users\Admin\AppData\Local\Temp\46D0.tmp"82⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\471E.tmp"C:\Users\Admin\AppData\Local\Temp\471E.tmp"83⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\475C.tmp"C:\Users\Admin\AppData\Local\Temp\475C.tmp"84⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\47AA.tmp"C:\Users\Admin\AppData\Local\Temp\47AA.tmp"85⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\47E9.tmp"C:\Users\Admin\AppData\Local\Temp\47E9.tmp"86⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\4837.tmp"C:\Users\Admin\AppData\Local\Temp\4837.tmp"87⤵PID:268
-
C:\Users\Admin\AppData\Local\Temp\4885.tmp"C:\Users\Admin\AppData\Local\Temp\4885.tmp"88⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\48D3.tmp"C:\Users\Admin\AppData\Local\Temp\48D3.tmp"89⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\4911.tmp"C:\Users\Admin\AppData\Local\Temp\4911.tmp"90⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\495F.tmp"C:\Users\Admin\AppData\Local\Temp\495F.tmp"91⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\499E.tmp"C:\Users\Admin\AppData\Local\Temp\499E.tmp"92⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\49EC.tmp"C:\Users\Admin\AppData\Local\Temp\49EC.tmp"93⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\4A2A.tmp"C:\Users\Admin\AppData\Local\Temp\4A2A.tmp"94⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\4A78.tmp"C:\Users\Admin\AppData\Local\Temp\4A78.tmp"95⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\4AC6.tmp"C:\Users\Admin\AppData\Local\Temp\4AC6.tmp"96⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\4B04.tmp"C:\Users\Admin\AppData\Local\Temp\4B04.tmp"97⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\4B43.tmp"C:\Users\Admin\AppData\Local\Temp\4B43.tmp"98⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\4B81.tmp"C:\Users\Admin\AppData\Local\Temp\4B81.tmp"99⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\4BC0.tmp"C:\Users\Admin\AppData\Local\Temp\4BC0.tmp"100⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\4BFE.tmp"C:\Users\Admin\AppData\Local\Temp\4BFE.tmp"101⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\4C3C.tmp"C:\Users\Admin\AppData\Local\Temp\4C3C.tmp"102⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\4C7B.tmp"C:\Users\Admin\AppData\Local\Temp\4C7B.tmp"103⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\4CB9.tmp"C:\Users\Admin\AppData\Local\Temp\4CB9.tmp"104⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"105⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\4D46.tmp"C:\Users\Admin\AppData\Local\Temp\4D46.tmp"106⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\4D94.tmp"C:\Users\Admin\AppData\Local\Temp\4D94.tmp"107⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"108⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"109⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"110⤵PID:352
-
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"111⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"112⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"113⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\4F77.tmp"C:\Users\Admin\AppData\Local\Temp\4F77.tmp"114⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\4FC5.tmp"C:\Users\Admin\AppData\Local\Temp\4FC5.tmp"115⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"116⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\5042.tmp"C:\Users\Admin\AppData\Local\Temp\5042.tmp"117⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\5090.tmp"C:\Users\Admin\AppData\Local\Temp\5090.tmp"118⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\50DE.tmp"C:\Users\Admin\AppData\Local\Temp\50DE.tmp"119⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\511C.tmp"C:\Users\Admin\AppData\Local\Temp\511C.tmp"120⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\516A.tmp"C:\Users\Admin\AppData\Local\Temp\516A.tmp"121⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\51B8.tmp"C:\Users\Admin\AppData\Local\Temp\51B8.tmp"122⤵PID:1668
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-