Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25/02/2024, 06:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-25_4a9380901d8e2766c7d6fd6df3959fcd_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-25_4a9380901d8e2766c7d6fd6df3959fcd_mafia.exe
Resource
win10v2004-20240221-en
2 signatures
150 seconds
General
-
Target
2024-02-25_4a9380901d8e2766c7d6fd6df3959fcd_mafia.exe
-
Size
536KB
-
MD5
4a9380901d8e2766c7d6fd6df3959fcd
-
SHA1
e50874ccb7597c27e2de5b330c4553de6a553abb
-
SHA256
105b0185a886baa359810151793767acdbb3fae468c1f53d99f7fcd176242c79
-
SHA512
9ea04ceafb8bf2035db5ebd04962ef0c4602745f605dc26f979922f4e541181d60331fbc6015b3eac1bb772ae328c64516d322a2095d31586c9207423c29a44d
-
SSDEEP
12288:wU5rCOTeiUQnM3Q+kW4kZMPOnhnIZxVJ0ZT9:wUQOJUQnM3Q70KmVIRJ0ZT9
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2896 1258.tmp 2964 12A6.tmp 3064 1342.tmp 2652 13DE.tmp 2852 144C.tmp 2708 1507.tmp 2584 1574.tmp 2448 162F.tmp 2376 16CB.tmp 2460 1748.tmp 2760 1813.tmp 2788 18AF.tmp 1948 196A.tmp 1744 1A06.tmp 2160 1AF0.tmp 1092 1B7C.tmp 1676 1BCA.tmp 1344 1C57.tmp 756 1CC4.tmp 2052 1D31.tmp 2028 1DBE.tmp 1824 1E4A.tmp 788 1E98.tmp 1500 1ED6.tmp 956 1F15.tmp 532 1F53.tmp 776 1F92.tmp 1184 1FFF.tmp 2144 205C.tmp 1804 20BA.tmp 2036 20F8.tmp 1876 2137.tmp 2040 2175.tmp 828 21D3.tmp 2116 2211.tmp 2252 2250.tmp 2256 228E.tmp 1284 22EC.tmp 2324 2359.tmp 1660 2397.tmp 1616 23F5.tmp 1940 2433.tmp 2960 24CF.tmp 2588 250E.tmp 2644 254C.tmp 2600 258A.tmp 2564 25C9.tmp 2712 2617.tmp 2972 2674.tmp 2616 26B3.tmp 2456 2720.tmp 2976 275E.tmp 2108 279D.tmp 1984 27DB.tmp 2948 281A.tmp 2780 2858.tmp 2808 2896.tmp 2752 28D5.tmp 1428 2923.tmp 1672 2961.tmp 2216 29A0.tmp 1964 29FD.tmp 908 2A3C.tmp 1460 2A99.tmp -
Loads dropped DLL 64 IoCs
pid Process 1940 2024-02-25_4a9380901d8e2766c7d6fd6df3959fcd_mafia.exe 2896 1258.tmp 2964 12A6.tmp 3064 1342.tmp 2652 13DE.tmp 2852 144C.tmp 2708 1507.tmp 2584 1574.tmp 2448 162F.tmp 2376 16CB.tmp 2460 1748.tmp 2760 1813.tmp 2788 18AF.tmp 1948 196A.tmp 1744 1A06.tmp 2160 1AF0.tmp 1092 1B7C.tmp 1676 1BCA.tmp 1344 1C57.tmp 756 1CC4.tmp 2052 1D31.tmp 2028 1DBE.tmp 1824 1E4A.tmp 788 1E98.tmp 1500 1ED6.tmp 956 1F15.tmp 532 1F53.tmp 776 1F92.tmp 1184 1FFF.tmp 2144 205C.tmp 1804 20BA.tmp 2036 20F8.tmp 1876 2137.tmp 2040 2175.tmp 828 21D3.tmp 2116 2211.tmp 2252 2250.tmp 2256 228E.tmp 1284 22EC.tmp 2324 2359.tmp 1660 2397.tmp 1616 23F5.tmp 1940 2433.tmp 2960 24CF.tmp 2588 250E.tmp 2644 254C.tmp 2600 258A.tmp 2564 25C9.tmp 2712 2617.tmp 2972 2674.tmp 2616 26B3.tmp 2456 2720.tmp 2976 275E.tmp 2108 279D.tmp 1984 27DB.tmp 2948 281A.tmp 2780 2858.tmp 2808 2896.tmp 2752 28D5.tmp 1428 2923.tmp 1672 2961.tmp 2216 29A0.tmp 1964 29FD.tmp 908 2A3C.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1940 wrote to memory of 2896 1940 2024-02-25_4a9380901d8e2766c7d6fd6df3959fcd_mafia.exe 28 PID 1940 wrote to memory of 2896 1940 2024-02-25_4a9380901d8e2766c7d6fd6df3959fcd_mafia.exe 28 PID 1940 wrote to memory of 2896 1940 2024-02-25_4a9380901d8e2766c7d6fd6df3959fcd_mafia.exe 28 PID 1940 wrote to memory of 2896 1940 2024-02-25_4a9380901d8e2766c7d6fd6df3959fcd_mafia.exe 28 PID 2896 wrote to memory of 2964 2896 1258.tmp 29 PID 2896 wrote to memory of 2964 2896 1258.tmp 29 PID 2896 wrote to memory of 2964 2896 1258.tmp 29 PID 2896 wrote to memory of 2964 2896 1258.tmp 29 PID 2964 wrote to memory of 3064 2964 12A6.tmp 30 PID 2964 wrote to memory of 3064 2964 12A6.tmp 30 PID 2964 wrote to memory of 3064 2964 12A6.tmp 30 PID 2964 wrote to memory of 3064 2964 12A6.tmp 30 PID 3064 wrote to memory of 2652 3064 1342.tmp 31 PID 3064 wrote to memory of 2652 3064 1342.tmp 31 PID 3064 wrote to memory of 2652 3064 1342.tmp 31 PID 3064 wrote to memory of 2652 3064 1342.tmp 31 PID 2652 wrote to memory of 2852 2652 13DE.tmp 32 PID 2652 wrote to memory of 2852 2652 13DE.tmp 32 PID 2652 wrote to memory of 2852 2652 13DE.tmp 32 PID 2652 wrote to memory of 2852 2652 13DE.tmp 32 PID 2852 wrote to memory of 2708 2852 144C.tmp 33 PID 2852 wrote to memory of 2708 2852 144C.tmp 33 PID 2852 wrote to memory of 2708 2852 144C.tmp 33 PID 2852 wrote to memory of 2708 2852 144C.tmp 33 PID 2708 wrote to memory of 2584 2708 1507.tmp 34 PID 2708 wrote to memory of 2584 2708 1507.tmp 34 PID 2708 wrote to memory of 2584 2708 1507.tmp 34 PID 2708 wrote to memory of 2584 2708 1507.tmp 34 PID 2584 wrote to memory of 2448 2584 1574.tmp 35 PID 2584 wrote to memory of 2448 2584 1574.tmp 35 PID 2584 wrote to memory of 2448 2584 1574.tmp 35 PID 2584 wrote to memory of 2448 2584 1574.tmp 35 PID 2448 wrote to memory of 2376 2448 162F.tmp 36 PID 2448 wrote to memory of 2376 2448 162F.tmp 36 PID 2448 wrote to memory of 2376 2448 162F.tmp 36 PID 2448 wrote to memory of 2376 2448 162F.tmp 36 PID 2376 wrote to memory of 2460 2376 16CB.tmp 37 PID 2376 wrote to memory of 2460 2376 16CB.tmp 37 PID 2376 wrote to memory of 2460 2376 16CB.tmp 37 PID 2376 wrote to memory of 2460 2376 16CB.tmp 37 PID 2460 wrote to memory of 2760 2460 1748.tmp 38 PID 2460 wrote to memory of 2760 2460 1748.tmp 38 PID 2460 wrote to memory of 2760 2460 1748.tmp 38 PID 2460 wrote to memory of 2760 2460 1748.tmp 38 PID 2760 wrote to memory of 2788 2760 1813.tmp 39 PID 2760 wrote to memory of 2788 2760 1813.tmp 39 PID 2760 wrote to memory of 2788 2760 1813.tmp 39 PID 2760 wrote to memory of 2788 2760 1813.tmp 39 PID 2788 wrote to memory of 1948 2788 18AF.tmp 40 PID 2788 wrote to memory of 1948 2788 18AF.tmp 40 PID 2788 wrote to memory of 1948 2788 18AF.tmp 40 PID 2788 wrote to memory of 1948 2788 18AF.tmp 40 PID 1948 wrote to memory of 1744 1948 196A.tmp 41 PID 1948 wrote to memory of 1744 1948 196A.tmp 41 PID 1948 wrote to memory of 1744 1948 196A.tmp 41 PID 1948 wrote to memory of 1744 1948 196A.tmp 41 PID 1744 wrote to memory of 2160 1744 1A06.tmp 42 PID 1744 wrote to memory of 2160 1744 1A06.tmp 42 PID 1744 wrote to memory of 2160 1744 1A06.tmp 42 PID 1744 wrote to memory of 2160 1744 1A06.tmp 42 PID 2160 wrote to memory of 1092 2160 1AF0.tmp 43 PID 2160 wrote to memory of 1092 2160 1AF0.tmp 43 PID 2160 wrote to memory of 1092 2160 1AF0.tmp 43 PID 2160 wrote to memory of 1092 2160 1AF0.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-25_4a9380901d8e2766c7d6fd6df3959fcd_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-25_4a9380901d8e2766c7d6fd6df3959fcd_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\1258.tmp"C:\Users\Admin\AppData\Local\Temp\1258.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\12A6.tmp"C:\Users\Admin\AppData\Local\Temp\12A6.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\1342.tmp"C:\Users\Admin\AppData\Local\Temp\1342.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\13DE.tmp"C:\Users\Admin\AppData\Local\Temp\13DE.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\144C.tmp"C:\Users\Admin\AppData\Local\Temp\144C.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\1507.tmp"C:\Users\Admin\AppData\Local\Temp\1507.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\1574.tmp"C:\Users\Admin\AppData\Local\Temp\1574.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\162F.tmp"C:\Users\Admin\AppData\Local\Temp\162F.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\16CB.tmp"C:\Users\Admin\AppData\Local\Temp\16CB.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\1748.tmp"C:\Users\Admin\AppData\Local\Temp\1748.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\1813.tmp"C:\Users\Admin\AppData\Local\Temp\1813.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\18AF.tmp"C:\Users\Admin\AppData\Local\Temp\18AF.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\196A.tmp"C:\Users\Admin\AppData\Local\Temp\196A.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\1A06.tmp"C:\Users\Admin\AppData\Local\Temp\1A06.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\1C57.tmp"C:\Users\Admin\AppData\Local\Temp\1C57.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:756 -
C:\Users\Admin\AppData\Local\Temp\1D31.tmp"C:\Users\Admin\AppData\Local\Temp\1D31.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\1E4A.tmp"C:\Users\Admin\AppData\Local\Temp\1E4A.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\1E98.tmp"C:\Users\Admin\AppData\Local\Temp\1E98.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:788 -
C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\1F15.tmp"C:\Users\Admin\AppData\Local\Temp\1F15.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:956 -
C:\Users\Admin\AppData\Local\Temp\1F53.tmp"C:\Users\Admin\AppData\Local\Temp\1F53.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:532 -
C:\Users\Admin\AppData\Local\Temp\1F92.tmp"C:\Users\Admin\AppData\Local\Temp\1F92.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:776 -
C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\205C.tmp"C:\Users\Admin\AppData\Local\Temp\205C.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\20BA.tmp"C:\Users\Admin\AppData\Local\Temp\20BA.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\20F8.tmp"C:\Users\Admin\AppData\Local\Temp\20F8.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\2137.tmp"C:\Users\Admin\AppData\Local\Temp\2137.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\2175.tmp"C:\Users\Admin\AppData\Local\Temp\2175.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\21D3.tmp"C:\Users\Admin\AppData\Local\Temp\21D3.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:828 -
C:\Users\Admin\AppData\Local\Temp\2211.tmp"C:\Users\Admin\AppData\Local\Temp\2211.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\2250.tmp"C:\Users\Admin\AppData\Local\Temp\2250.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\228E.tmp"C:\Users\Admin\AppData\Local\Temp\228E.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\22EC.tmp"C:\Users\Admin\AppData\Local\Temp\22EC.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\2359.tmp"C:\Users\Admin\AppData\Local\Temp\2359.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\2397.tmp"C:\Users\Admin\AppData\Local\Temp\2397.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\23F5.tmp"C:\Users\Admin\AppData\Local\Temp\23F5.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\2433.tmp"C:\Users\Admin\AppData\Local\Temp\2433.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\24CF.tmp"C:\Users\Admin\AppData\Local\Temp\24CF.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\250E.tmp"C:\Users\Admin\AppData\Local\Temp\250E.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\254C.tmp"C:\Users\Admin\AppData\Local\Temp\254C.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\258A.tmp"C:\Users\Admin\AppData\Local\Temp\258A.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\25C9.tmp"C:\Users\Admin\AppData\Local\Temp\25C9.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\2674.tmp"C:\Users\Admin\AppData\Local\Temp\2674.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\26B3.tmp"C:\Users\Admin\AppData\Local\Temp\26B3.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\2720.tmp"C:\Users\Admin\AppData\Local\Temp\2720.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\275E.tmp"C:\Users\Admin\AppData\Local\Temp\275E.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\279D.tmp"C:\Users\Admin\AppData\Local\Temp\279D.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\27DB.tmp"C:\Users\Admin\AppData\Local\Temp\27DB.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\281A.tmp"C:\Users\Admin\AppData\Local\Temp\281A.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\2858.tmp"C:\Users\Admin\AppData\Local\Temp\2858.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\2896.tmp"C:\Users\Admin\AppData\Local\Temp\2896.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\28D5.tmp"C:\Users\Admin\AppData\Local\Temp\28D5.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\2923.tmp"C:\Users\Admin\AppData\Local\Temp\2923.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\2961.tmp"C:\Users\Admin\AppData\Local\Temp\2961.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\29A0.tmp"C:\Users\Admin\AppData\Local\Temp\29A0.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\29FD.tmp"C:\Users\Admin\AppData\Local\Temp\29FD.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:908 -
C:\Users\Admin\AppData\Local\Temp\2A99.tmp"C:\Users\Admin\AppData\Local\Temp\2A99.tmp"65⤵
- Executes dropped EXE
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\2B26.tmp"C:\Users\Admin\AppData\Local\Temp\2B26.tmp"66⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\2B64.tmp"C:\Users\Admin\AppData\Local\Temp\2B64.tmp"67⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"68⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\2BE1.tmp"C:\Users\Admin\AppData\Local\Temp\2BE1.tmp"69⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"70⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\2C9C.tmp"C:\Users\Admin\AppData\Local\Temp\2C9C.tmp"71⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"72⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\2D28.tmp"C:\Users\Admin\AppData\Local\Temp\2D28.tmp"73⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\2D67.tmp"C:\Users\Admin\AppData\Local\Temp\2D67.tmp"74⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"75⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\2E32.tmp"C:\Users\Admin\AppData\Local\Temp\2E32.tmp"76⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\2E70.tmp"C:\Users\Admin\AppData\Local\Temp\2E70.tmp"77⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"78⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"79⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\2FD7.tmp"C:\Users\Admin\AppData\Local\Temp\2FD7.tmp"80⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\3006.tmp"C:\Users\Admin\AppData\Local\Temp\3006.tmp"81⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\3044.tmp"C:\Users\Admin\AppData\Local\Temp\3044.tmp"82⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\3082.tmp"C:\Users\Admin\AppData\Local\Temp\3082.tmp"83⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\30C1.tmp"C:\Users\Admin\AppData\Local\Temp\30C1.tmp"84⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\30FF.tmp"C:\Users\Admin\AppData\Local\Temp\30FF.tmp"85⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\313E.tmp"C:\Users\Admin\AppData\Local\Temp\313E.tmp"86⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\317C.tmp"C:\Users\Admin\AppData\Local\Temp\317C.tmp"87⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\31BA.tmp"C:\Users\Admin\AppData\Local\Temp\31BA.tmp"88⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\3208.tmp"C:\Users\Admin\AppData\Local\Temp\3208.tmp"89⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"90⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\3285.tmp"C:\Users\Admin\AppData\Local\Temp\3285.tmp"91⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\32C4.tmp"C:\Users\Admin\AppData\Local\Temp\32C4.tmp"92⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\3302.tmp"C:\Users\Admin\AppData\Local\Temp\3302.tmp"93⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\3340.tmp"C:\Users\Admin\AppData\Local\Temp\3340.tmp"94⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\337F.tmp"C:\Users\Admin\AppData\Local\Temp\337F.tmp"95⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\33BD.tmp"C:\Users\Admin\AppData\Local\Temp\33BD.tmp"96⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\33FC.tmp"C:\Users\Admin\AppData\Local\Temp\33FC.tmp"97⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\344A.tmp"C:\Users\Admin\AppData\Local\Temp\344A.tmp"98⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"99⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\34E6.tmp"C:\Users\Admin\AppData\Local\Temp\34E6.tmp"100⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\3524.tmp"C:\Users\Admin\AppData\Local\Temp\3524.tmp"101⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\3562.tmp"C:\Users\Admin\AppData\Local\Temp\3562.tmp"102⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\35C0.tmp"C:\Users\Admin\AppData\Local\Temp\35C0.tmp"103⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\35FE.tmp"C:\Users\Admin\AppData\Local\Temp\35FE.tmp"104⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\365C.tmp"C:\Users\Admin\AppData\Local\Temp\365C.tmp"105⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\369A.tmp"C:\Users\Admin\AppData\Local\Temp\369A.tmp"106⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\36D9.tmp"C:\Users\Admin\AppData\Local\Temp\36D9.tmp"107⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\3736.tmp"C:\Users\Admin\AppData\Local\Temp\3736.tmp"108⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\3784.tmp"C:\Users\Admin\AppData\Local\Temp\3784.tmp"109⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\37C3.tmp"C:\Users\Admin\AppData\Local\Temp\37C3.tmp"110⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\3820.tmp"C:\Users\Admin\AppData\Local\Temp\3820.tmp"111⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\385F.tmp"C:\Users\Admin\AppData\Local\Temp\385F.tmp"112⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\389D.tmp"C:\Users\Admin\AppData\Local\Temp\389D.tmp"113⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\38DC.tmp"C:\Users\Admin\AppData\Local\Temp\38DC.tmp"114⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\3968.tmp"C:\Users\Admin\AppData\Local\Temp\3968.tmp"115⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\39A6.tmp"C:\Users\Admin\AppData\Local\Temp\39A6.tmp"116⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\3A04.tmp"C:\Users\Admin\AppData\Local\Temp\3A04.tmp"117⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\3A42.tmp"C:\Users\Admin\AppData\Local\Temp\3A42.tmp"118⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\3AB0.tmp"C:\Users\Admin\AppData\Local\Temp\3AB0.tmp"119⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\3AEE.tmp"C:\Users\Admin\AppData\Local\Temp\3AEE.tmp"120⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\3B2C.tmp"C:\Users\Admin\AppData\Local\Temp\3B2C.tmp"121⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\3BB9.tmp"C:\Users\Admin\AppData\Local\Temp\3BB9.tmp"122⤵PID:1824
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-