Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08-04-2024 18:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-08_40b94fc094b008948fe6d64b31c05cef_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-08_40b94fc094b008948fe6d64b31c05cef_mafia.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-04-08_40b94fc094b008948fe6d64b31c05cef_mafia.exe
-
Size
488KB
-
MD5
40b94fc094b008948fe6d64b31c05cef
-
SHA1
747e196ddf054f36ff1cd64eb3c50f30951418df
-
SHA256
c82b471e7eee0d744379200893abfc0d92a2237d56ede1c25e8a47a63ffbe1e8
-
SHA512
ae3ccd50a2499a76988241c7c8f8fdfacaad04a17a9d47a7a7e964028db4f905bd79134a1722b650332bc434dca0ec2b3ea8153619e962af708da06f9bc1e764
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7sMpaQzQdsM12PINhAjqdajMbITu4807GuLhB:/U5rCOTeiDsM/PsANnuL07fFVNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2272 A8EC.tmp 2304 A998.tmp 2836 AA05.tmp 2776 AADF.tmp 2908 AB3D.tmp 3044 ABE9.tmp 2920 AC56.tmp 2528 ACE2.tmp 2600 AD6F.tmp 2772 ADFB.tmp 2500 AE68.tmp 2416 AF14.tmp 1296 AF91.tmp 2496 AFFE.tmp 2424 B07B.tmp 2840 B0E8.tmp 2860 B145.tmp 1044 B1C2.tmp 1512 B23F.tmp 1892 B2DB.tmp 1652 B339.tmp 1720 B3C5.tmp 908 B432.tmp 1728 B490.tmp 528 B50D.tmp 768 B57A.tmp 1784 B616.tmp 2676 B693.tmp 588 B71F.tmp 548 B79C.tmp 2748 B828.tmp 2084 B8B5.tmp 2112 B912.tmp 2944 B9FC.tmp 2664 BB73.tmp 400 BC7C.tmp 2064 BCE9.tmp 852 BD47.tmp 1896 BDC3.tmp 1304 BE21.tmp 632 BE7F.tmp 1056 BEFB.tmp 1772 BF69.tmp 2192 BFD6.tmp 996 C033.tmp 864 C0B0.tmp 1052 C10E.tmp 2892 C16B.tmp 2108 C1C9.tmp 3060 C246.tmp 928 C2A3.tmp 2976 C301.tmp 1584 C36E.tmp 2980 C3DB.tmp 1524 C458.tmp 1608 C4E5.tmp 1568 C561.tmp 1508 C5EE.tmp 2300 C65B.tmp 2760 C716.tmp 2900 C7C2.tmp 3036 C83F.tmp 2824 C8CB.tmp 2572 C986.tmp -
Loads dropped DLL 64 IoCs
pid Process 2236 2024-04-08_40b94fc094b008948fe6d64b31c05cef_mafia.exe 2272 A8EC.tmp 2304 A998.tmp 2836 AA05.tmp 2776 AADF.tmp 2908 AB3D.tmp 3044 ABE9.tmp 2920 AC56.tmp 2528 ACE2.tmp 2600 AD6F.tmp 2772 ADFB.tmp 2500 AE68.tmp 2416 AF14.tmp 1296 AF91.tmp 2496 AFFE.tmp 2424 B07B.tmp 2840 B0E8.tmp 2860 B145.tmp 1044 B1C2.tmp 1512 B23F.tmp 1892 B2DB.tmp 1652 B339.tmp 1720 B3C5.tmp 908 B432.tmp 1728 B490.tmp 528 B50D.tmp 768 B57A.tmp 1784 B616.tmp 2676 B693.tmp 588 B71F.tmp 548 B79C.tmp 2748 B828.tmp 2084 B8B5.tmp 2112 B912.tmp 2944 B9FC.tmp 2664 BB73.tmp 400 BC7C.tmp 2064 BCE9.tmp 852 BD47.tmp 1896 BDC3.tmp 1304 BE21.tmp 632 BE7F.tmp 1056 BEFB.tmp 1772 BF69.tmp 2192 BFD6.tmp 996 C033.tmp 864 C0B0.tmp 1052 C10E.tmp 2892 C16B.tmp 2108 C1C9.tmp 3060 C246.tmp 928 C2A3.tmp 2976 C301.tmp 1584 C36E.tmp 2980 C3DB.tmp 1524 C458.tmp 1608 C4E5.tmp 1568 C561.tmp 1508 C5EE.tmp 2300 C65B.tmp 2760 C716.tmp 2900 C7C2.tmp 3036 C83F.tmp 2824 C8CB.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2272 2236 2024-04-08_40b94fc094b008948fe6d64b31c05cef_mafia.exe 28 PID 2236 wrote to memory of 2272 2236 2024-04-08_40b94fc094b008948fe6d64b31c05cef_mafia.exe 28 PID 2236 wrote to memory of 2272 2236 2024-04-08_40b94fc094b008948fe6d64b31c05cef_mafia.exe 28 PID 2236 wrote to memory of 2272 2236 2024-04-08_40b94fc094b008948fe6d64b31c05cef_mafia.exe 28 PID 2272 wrote to memory of 2304 2272 A8EC.tmp 29 PID 2272 wrote to memory of 2304 2272 A8EC.tmp 29 PID 2272 wrote to memory of 2304 2272 A8EC.tmp 29 PID 2272 wrote to memory of 2304 2272 A8EC.tmp 29 PID 2304 wrote to memory of 2836 2304 A998.tmp 30 PID 2304 wrote to memory of 2836 2304 A998.tmp 30 PID 2304 wrote to memory of 2836 2304 A998.tmp 30 PID 2304 wrote to memory of 2836 2304 A998.tmp 30 PID 2836 wrote to memory of 2776 2836 AA05.tmp 31 PID 2836 wrote to memory of 2776 2836 AA05.tmp 31 PID 2836 wrote to memory of 2776 2836 AA05.tmp 31 PID 2836 wrote to memory of 2776 2836 AA05.tmp 31 PID 2776 wrote to memory of 2908 2776 AADF.tmp 32 PID 2776 wrote to memory of 2908 2776 AADF.tmp 32 PID 2776 wrote to memory of 2908 2776 AADF.tmp 32 PID 2776 wrote to memory of 2908 2776 AADF.tmp 32 PID 2908 wrote to memory of 3044 2908 AB3D.tmp 33 PID 2908 wrote to memory of 3044 2908 AB3D.tmp 33 PID 2908 wrote to memory of 3044 2908 AB3D.tmp 33 PID 2908 wrote to memory of 3044 2908 AB3D.tmp 33 PID 3044 wrote to memory of 2920 3044 ABE9.tmp 34 PID 3044 wrote to memory of 2920 3044 ABE9.tmp 34 PID 3044 wrote to memory of 2920 3044 ABE9.tmp 34 PID 3044 wrote to memory of 2920 3044 ABE9.tmp 34 PID 2920 wrote to memory of 2528 2920 AC56.tmp 35 PID 2920 wrote to memory of 2528 2920 AC56.tmp 35 PID 2920 wrote to memory of 2528 2920 AC56.tmp 35 PID 2920 wrote to memory of 2528 2920 AC56.tmp 35 PID 2528 wrote to memory of 2600 2528 ACE2.tmp 36 PID 2528 wrote to memory of 2600 2528 ACE2.tmp 36 PID 2528 wrote to memory of 2600 2528 ACE2.tmp 36 PID 2528 wrote to memory of 2600 2528 ACE2.tmp 36 PID 2600 wrote to memory of 2772 2600 AD6F.tmp 37 PID 2600 wrote to memory of 2772 2600 AD6F.tmp 37 PID 2600 wrote to memory of 2772 2600 AD6F.tmp 37 PID 2600 wrote to memory of 2772 2600 AD6F.tmp 37 PID 2772 wrote to memory of 2500 2772 ADFB.tmp 38 PID 2772 wrote to memory of 2500 2772 ADFB.tmp 38 PID 2772 wrote to memory of 2500 2772 ADFB.tmp 38 PID 2772 wrote to memory of 2500 2772 ADFB.tmp 38 PID 2500 wrote to memory of 2416 2500 AE68.tmp 39 PID 2500 wrote to memory of 2416 2500 AE68.tmp 39 PID 2500 wrote to memory of 2416 2500 AE68.tmp 39 PID 2500 wrote to memory of 2416 2500 AE68.tmp 39 PID 2416 wrote to memory of 1296 2416 AF14.tmp 40 PID 2416 wrote to memory of 1296 2416 AF14.tmp 40 PID 2416 wrote to memory of 1296 2416 AF14.tmp 40 PID 2416 wrote to memory of 1296 2416 AF14.tmp 40 PID 1296 wrote to memory of 2496 1296 AF91.tmp 41 PID 1296 wrote to memory of 2496 1296 AF91.tmp 41 PID 1296 wrote to memory of 2496 1296 AF91.tmp 41 PID 1296 wrote to memory of 2496 1296 AF91.tmp 41 PID 2496 wrote to memory of 2424 2496 AFFE.tmp 42 PID 2496 wrote to memory of 2424 2496 AFFE.tmp 42 PID 2496 wrote to memory of 2424 2496 AFFE.tmp 42 PID 2496 wrote to memory of 2424 2496 AFFE.tmp 42 PID 2424 wrote to memory of 2840 2424 B07B.tmp 43 PID 2424 wrote to memory of 2840 2424 B07B.tmp 43 PID 2424 wrote to memory of 2840 2424 B07B.tmp 43 PID 2424 wrote to memory of 2840 2424 B07B.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-08_40b94fc094b008948fe6d64b31c05cef_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-08_40b94fc094b008948fe6d64b31c05cef_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\A8EC.tmp"C:\Users\Admin\AppData\Local\Temp\A8EC.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\A998.tmp"C:\Users\Admin\AppData\Local\Temp\A998.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\AA05.tmp"C:\Users\Admin\AppData\Local\Temp\AA05.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\AADF.tmp"C:\Users\Admin\AppData\Local\Temp\AADF.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\AB3D.tmp"C:\Users\Admin\AppData\Local\Temp\AB3D.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\ABE9.tmp"C:\Users\Admin\AppData\Local\Temp\ABE9.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\AC56.tmp"C:\Users\Admin\AppData\Local\Temp\AC56.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\ACE2.tmp"C:\Users\Admin\AppData\Local\Temp\ACE2.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\AD6F.tmp"C:\Users\Admin\AppData\Local\Temp\AD6F.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\ADFB.tmp"C:\Users\Admin\AppData\Local\Temp\ADFB.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\AE68.tmp"C:\Users\Admin\AppData\Local\Temp\AE68.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\AF14.tmp"C:\Users\Admin\AppData\Local\Temp\AF14.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\AF91.tmp"C:\Users\Admin\AppData\Local\Temp\AF91.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\AFFE.tmp"C:\Users\Admin\AppData\Local\Temp\AFFE.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\B07B.tmp"C:\Users\Admin\AppData\Local\Temp\B07B.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\B0E8.tmp"C:\Users\Admin\AppData\Local\Temp\B0E8.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\B145.tmp"C:\Users\Admin\AppData\Local\Temp\B145.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\B1C2.tmp"C:\Users\Admin\AppData\Local\Temp\B1C2.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\B23F.tmp"C:\Users\Admin\AppData\Local\Temp\B23F.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\B2DB.tmp"C:\Users\Admin\AppData\Local\Temp\B2DB.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\B339.tmp"C:\Users\Admin\AppData\Local\Temp\B339.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\B3C5.tmp"C:\Users\Admin\AppData\Local\Temp\B3C5.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\B432.tmp"C:\Users\Admin\AppData\Local\Temp\B432.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:908 -
C:\Users\Admin\AppData\Local\Temp\B490.tmp"C:\Users\Admin\AppData\Local\Temp\B490.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\B50D.tmp"C:\Users\Admin\AppData\Local\Temp\B50D.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:528 -
C:\Users\Admin\AppData\Local\Temp\B57A.tmp"C:\Users\Admin\AppData\Local\Temp\B57A.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:768 -
C:\Users\Admin\AppData\Local\Temp\B616.tmp"C:\Users\Admin\AppData\Local\Temp\B616.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\B693.tmp"C:\Users\Admin\AppData\Local\Temp\B693.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\B71F.tmp"C:\Users\Admin\AppData\Local\Temp\B71F.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:588 -
C:\Users\Admin\AppData\Local\Temp\B79C.tmp"C:\Users\Admin\AppData\Local\Temp\B79C.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:548 -
C:\Users\Admin\AppData\Local\Temp\B828.tmp"C:\Users\Admin\AppData\Local\Temp\B828.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\B8B5.tmp"C:\Users\Admin\AppData\Local\Temp\B8B5.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\B912.tmp"C:\Users\Admin\AppData\Local\Temp\B912.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\B9FC.tmp"C:\Users\Admin\AppData\Local\Temp\B9FC.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\BB73.tmp"C:\Users\Admin\AppData\Local\Temp\BB73.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\BC7C.tmp"C:\Users\Admin\AppData\Local\Temp\BC7C.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:400 -
C:\Users\Admin\AppData\Local\Temp\BCE9.tmp"C:\Users\Admin\AppData\Local\Temp\BCE9.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\BD47.tmp"C:\Users\Admin\AppData\Local\Temp\BD47.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:852 -
C:\Users\Admin\AppData\Local\Temp\BDC3.tmp"C:\Users\Admin\AppData\Local\Temp\BDC3.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\BE21.tmp"C:\Users\Admin\AppData\Local\Temp\BE21.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\BE7F.tmp"C:\Users\Admin\AppData\Local\Temp\BE7F.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:632 -
C:\Users\Admin\AppData\Local\Temp\BEFB.tmp"C:\Users\Admin\AppData\Local\Temp\BEFB.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\BF69.tmp"C:\Users\Admin\AppData\Local\Temp\BF69.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\BFD6.tmp"C:\Users\Admin\AppData\Local\Temp\BFD6.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\C033.tmp"C:\Users\Admin\AppData\Local\Temp\C033.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:996 -
C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:864 -
C:\Users\Admin\AppData\Local\Temp\C10E.tmp"C:\Users\Admin\AppData\Local\Temp\C10E.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\C16B.tmp"C:\Users\Admin\AppData\Local\Temp\C16B.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\C246.tmp"C:\Users\Admin\AppData\Local\Temp\C246.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\C2A3.tmp"C:\Users\Admin\AppData\Local\Temp\C2A3.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:928 -
C:\Users\Admin\AppData\Local\Temp\C301.tmp"C:\Users\Admin\AppData\Local\Temp\C301.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\C36E.tmp"C:\Users\Admin\AppData\Local\Temp\C36E.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\C3DB.tmp"C:\Users\Admin\AppData\Local\Temp\C3DB.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\C458.tmp"C:\Users\Admin\AppData\Local\Temp\C458.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\C4E5.tmp"C:\Users\Admin\AppData\Local\Temp\C4E5.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\C561.tmp"C:\Users\Admin\AppData\Local\Temp\C561.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\C5EE.tmp"C:\Users\Admin\AppData\Local\Temp\C5EE.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\C65B.tmp"C:\Users\Admin\AppData\Local\Temp\C65B.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\C716.tmp"C:\Users\Admin\AppData\Local\Temp\C716.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\C7C2.tmp"C:\Users\Admin\AppData\Local\Temp\C7C2.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\C83F.tmp"C:\Users\Admin\AppData\Local\Temp\C83F.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\C8CB.tmp"C:\Users\Admin\AppData\Local\Temp\C8CB.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\C986.tmp"C:\Users\Admin\AppData\Local\Temp\C986.tmp"65⤵
- Executes dropped EXE
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\C9F3.tmp"C:\Users\Admin\AppData\Local\Temp\C9F3.tmp"66⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\CB0C.tmp"C:\Users\Admin\AppData\Local\Temp\CB0C.tmp"67⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\CB89.tmp"C:\Users\Admin\AppData\Local\Temp\CB89.tmp"68⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\CC25.tmp"C:\Users\Admin\AppData\Local\Temp\CC25.tmp"69⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\CCD1.tmp"C:\Users\Admin\AppData\Local\Temp\CCD1.tmp"70⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\CD9B.tmp"C:\Users\Admin\AppData\Local\Temp\CD9B.tmp"71⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\CE18.tmp"C:\Users\Admin\AppData\Local\Temp\CE18.tmp"72⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\CE95.tmp"C:\Users\Admin\AppData\Local\Temp\CE95.tmp"73⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\CF02.tmp"C:\Users\Admin\AppData\Local\Temp\CF02.tmp"74⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\CF8F.tmp"C:\Users\Admin\AppData\Local\Temp\CF8F.tmp"75⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\D098.tmp"C:\Users\Admin\AppData\Local\Temp\D098.tmp"76⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\D105.tmp"C:\Users\Admin\AppData\Local\Temp\D105.tmp"77⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\D191.tmp"C:\Users\Admin\AppData\Local\Temp\D191.tmp"78⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\D1FF.tmp"C:\Users\Admin\AppData\Local\Temp\D1FF.tmp"79⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\D28B.tmp"C:\Users\Admin\AppData\Local\Temp\D28B.tmp"80⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\D327.tmp"C:\Users\Admin\AppData\Local\Temp\D327.tmp"81⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\D3A4.tmp"C:\Users\Admin\AppData\Local\Temp\D3A4.tmp"82⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\D411.tmp"C:\Users\Admin\AppData\Local\Temp\D411.tmp"83⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\D49D.tmp"C:\Users\Admin\AppData\Local\Temp\D49D.tmp"84⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\D52A.tmp"C:\Users\Admin\AppData\Local\Temp\D52A.tmp"85⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\D5A7.tmp"C:\Users\Admin\AppData\Local\Temp\D5A7.tmp"86⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\D623.tmp"C:\Users\Admin\AppData\Local\Temp\D623.tmp"87⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\D6B0.tmp"C:\Users\Admin\AppData\Local\Temp\D6B0.tmp"88⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\D71D.tmp"C:\Users\Admin\AppData\Local\Temp\D71D.tmp"89⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\D77B.tmp"C:\Users\Admin\AppData\Local\Temp\D77B.tmp"90⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\D7E8.tmp"C:\Users\Admin\AppData\Local\Temp\D7E8.tmp"91⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\D874.tmp"C:\Users\Admin\AppData\Local\Temp\D874.tmp"92⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\D8E1.tmp"C:\Users\Admin\AppData\Local\Temp\D8E1.tmp"93⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\D96E.tmp"C:\Users\Admin\AppData\Local\Temp\D96E.tmp"94⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\D9BC.tmp"C:\Users\Admin\AppData\Local\Temp\D9BC.tmp"95⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\DA29.tmp"C:\Users\Admin\AppData\Local\Temp\DA29.tmp"96⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\DAB5.tmp"C:\Users\Admin\AppData\Local\Temp\DAB5.tmp"97⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\DB23.tmp"C:\Users\Admin\AppData\Local\Temp\DB23.tmp"98⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\DBAF.tmp"C:\Users\Admin\AppData\Local\Temp\DBAF.tmp"99⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\DC1C.tmp"C:\Users\Admin\AppData\Local\Temp\DC1C.tmp"100⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\DC99.tmp"C:\Users\Admin\AppData\Local\Temp\DC99.tmp"101⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\DD16.tmp"C:\Users\Admin\AppData\Local\Temp\DD16.tmp"102⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\DD93.tmp"C:\Users\Admin\AppData\Local\Temp\DD93.tmp"103⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\DDF0.tmp"C:\Users\Admin\AppData\Local\Temp\DDF0.tmp"104⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\DE6D.tmp"C:\Users\Admin\AppData\Local\Temp\DE6D.tmp"105⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\DEDA.tmp"C:\Users\Admin\AppData\Local\Temp\DEDA.tmp"106⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\DF67.tmp"C:\Users\Admin\AppData\Local\Temp\DF67.tmp"107⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\DFF3.tmp"C:\Users\Admin\AppData\Local\Temp\DFF3.tmp"108⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\E060.tmp"C:\Users\Admin\AppData\Local\Temp\E060.tmp"109⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\E0AE.tmp"C:\Users\Admin\AppData\Local\Temp\E0AE.tmp"110⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\E12B.tmp"C:\Users\Admin\AppData\Local\Temp\E12B.tmp"111⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\E1A8.tmp"C:\Users\Admin\AppData\Local\Temp\E1A8.tmp"112⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\E225.tmp"C:\Users\Admin\AppData\Local\Temp\E225.tmp"113⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\E2B1.tmp"C:\Users\Admin\AppData\Local\Temp\E2B1.tmp"114⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\E31E.tmp"C:\Users\Admin\AppData\Local\Temp\E31E.tmp"115⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\E3AB.tmp"C:\Users\Admin\AppData\Local\Temp\E3AB.tmp"116⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\E408.tmp"C:\Users\Admin\AppData\Local\Temp\E408.tmp"117⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\E476.tmp"C:\Users\Admin\AppData\Local\Temp\E476.tmp"118⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\E57F.tmp"C:\Users\Admin\AppData\Local\Temp\E57F.tmp"119⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\E60B.tmp"C:\Users\Admin\AppData\Local\Temp\E60B.tmp"120⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\E678.tmp"C:\Users\Admin\AppData\Local\Temp\E678.tmp"121⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\E6C6.tmp"C:\Users\Admin\AppData\Local\Temp\E6C6.tmp"122⤵PID:1628
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-