Analysis
-
max time kernel
149s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25/04/2024, 13:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-25_988db4a63fe86dab1044bb9353bc939c_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-25_988db4a63fe86dab1044bb9353bc939c_mafia.exe
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
2024-04-25_988db4a63fe86dab1044bb9353bc939c_mafia.exe
-
Size
712KB
-
MD5
988db4a63fe86dab1044bb9353bc939c
-
SHA1
92c2185fddc4082c9d9f835b88585bb27ef6e923
-
SHA256
49356660df61b2c7928c8f1f2d0c0c001b0cb5945a3a8edcc3f02073bb3415c1
-
SHA512
ee2af12d40d46e46f492cae6d61b0ef242311b12a821e879c239e6be905b573979a50c426b59e14925e3b901e73f66a7089eb7242bec2cd74ff8429a2b9e1143
-
SSDEEP
12288:FU5rCOTeiDAibm/LpPITkdNrAVWDh+NZdCvq5TJLCvY90D8/LVBlVk736Y79GWzC:FUQOJDAiK/tPAkdNrAA1+NnCvq5TJLC0
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1676 8BEB.tmp 2744 8C58.tmp 2984 8CE4.tmp 2620 8DFD.tmp 2764 8EB8.tmp 2660 8F45.tmp 2756 90AB.tmp 2452 9176.tmp 2560 9222.tmp 2420 934A.tmp 2544 93B7.tmp 2848 9482.tmp 1060 952E.tmp 1524 95CA.tmp 584 96A4.tmp 836 9750.tmp 2512 97CD.tmp 2736 9878.tmp 2236 9933.tmp 1984 99A1.tmp 1964 9A4C.tmp 2240 9B07.tmp 1176 9CFB.tmp 1368 9F4B.tmp 948 9FB9.tmp 2228 A055.tmp 944 A0D1.tmp 1616 A16D.tmp 2280 A219.tmp 2108 A296.tmp 2292 A313.tmp 596 A3AF.tmp 2920 A41C.tmp 3004 A489.tmp 2772 A4F6.tmp 2316 A554.tmp 2056 A5C1.tmp 2972 A62E.tmp 2044 A69B.tmp 1828 A718.tmp 960 A776.tmp 1076 A7D3.tmp 1888 A841.tmp 1288 A8AE.tmp 1844 A92B.tmp 612 A998.tmp 704 AA05.tmp 3020 AA72.tmp 2956 AAEF.tmp 1460 AB6C.tmp 2324 ABD9.tmp 1768 AC46.tmp 2356 ACC3.tmp 1408 AD21.tmp 2344 ADFB.tmp 1676 AE68.tmp 2744 AED5.tmp 2552 AF52.tmp 2516 AFBF.tmp 3044 B03C.tmp 2556 B0A9.tmp 2572 B0F7.tmp 2664 B155.tmp 2828 B1C2.tmp -
Loads dropped DLL 64 IoCs
pid Process 1440 2024-04-25_988db4a63fe86dab1044bb9353bc939c_mafia.exe 1676 8BEB.tmp 2744 8C58.tmp 2984 8CE4.tmp 2620 8DFD.tmp 2764 8EB8.tmp 2660 8F45.tmp 2756 90AB.tmp 2452 9176.tmp 2560 9222.tmp 2420 934A.tmp 2544 93B7.tmp 2848 9482.tmp 1060 952E.tmp 1524 95CA.tmp 584 96A4.tmp 836 9750.tmp 2512 97CD.tmp 2736 9878.tmp 2236 9933.tmp 1984 99A1.tmp 1964 9A4C.tmp 2240 9B07.tmp 1176 9CFB.tmp 1368 9F4B.tmp 948 9FB9.tmp 2228 A055.tmp 944 A0D1.tmp 1616 A16D.tmp 2280 A219.tmp 2108 A296.tmp 2292 A313.tmp 596 A3AF.tmp 2920 A41C.tmp 3004 A489.tmp 2772 A4F6.tmp 2316 A554.tmp 2056 A5C1.tmp 2972 A62E.tmp 2044 A69B.tmp 1828 A718.tmp 960 A776.tmp 1076 A7D3.tmp 1888 A841.tmp 1288 A8AE.tmp 1844 A92B.tmp 612 A998.tmp 704 AA05.tmp 3020 AA72.tmp 2956 AAEF.tmp 1460 AB6C.tmp 2324 ABD9.tmp 1768 AC46.tmp 2356 ACC3.tmp 2116 AD8E.tmp 2344 ADFB.tmp 1676 AE68.tmp 2744 AED5.tmp 2552 AF52.tmp 2516 AFBF.tmp 3044 B03C.tmp 2556 B0A9.tmp 2572 B0F7.tmp 2664 B155.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1440 wrote to memory of 1676 1440 2024-04-25_988db4a63fe86dab1044bb9353bc939c_mafia.exe 28 PID 1440 wrote to memory of 1676 1440 2024-04-25_988db4a63fe86dab1044bb9353bc939c_mafia.exe 28 PID 1440 wrote to memory of 1676 1440 2024-04-25_988db4a63fe86dab1044bb9353bc939c_mafia.exe 28 PID 1440 wrote to memory of 1676 1440 2024-04-25_988db4a63fe86dab1044bb9353bc939c_mafia.exe 28 PID 1676 wrote to memory of 2744 1676 8BEB.tmp 85 PID 1676 wrote to memory of 2744 1676 8BEB.tmp 85 PID 1676 wrote to memory of 2744 1676 8BEB.tmp 85 PID 1676 wrote to memory of 2744 1676 8BEB.tmp 85 PID 2744 wrote to memory of 2984 2744 8C58.tmp 30 PID 2744 wrote to memory of 2984 2744 8C58.tmp 30 PID 2744 wrote to memory of 2984 2744 8C58.tmp 30 PID 2744 wrote to memory of 2984 2744 8C58.tmp 30 PID 2984 wrote to memory of 2620 2984 8CE4.tmp 31 PID 2984 wrote to memory of 2620 2984 8CE4.tmp 31 PID 2984 wrote to memory of 2620 2984 8CE4.tmp 31 PID 2984 wrote to memory of 2620 2984 8CE4.tmp 31 PID 2620 wrote to memory of 2764 2620 8DFD.tmp 32 PID 2620 wrote to memory of 2764 2620 8DFD.tmp 32 PID 2620 wrote to memory of 2764 2620 8DFD.tmp 32 PID 2620 wrote to memory of 2764 2620 8DFD.tmp 32 PID 2764 wrote to memory of 2660 2764 8EB8.tmp 33 PID 2764 wrote to memory of 2660 2764 8EB8.tmp 33 PID 2764 wrote to memory of 2660 2764 8EB8.tmp 33 PID 2764 wrote to memory of 2660 2764 8EB8.tmp 33 PID 2660 wrote to memory of 2756 2660 8F45.tmp 34 PID 2660 wrote to memory of 2756 2660 8F45.tmp 34 PID 2660 wrote to memory of 2756 2660 8F45.tmp 34 PID 2660 wrote to memory of 2756 2660 8F45.tmp 34 PID 2756 wrote to memory of 2452 2756 90AB.tmp 35 PID 2756 wrote to memory of 2452 2756 90AB.tmp 35 PID 2756 wrote to memory of 2452 2756 90AB.tmp 35 PID 2756 wrote to memory of 2452 2756 90AB.tmp 35 PID 2452 wrote to memory of 2560 2452 9176.tmp 36 PID 2452 wrote to memory of 2560 2452 9176.tmp 36 PID 2452 wrote to memory of 2560 2452 9176.tmp 36 PID 2452 wrote to memory of 2560 2452 9176.tmp 36 PID 2560 wrote to memory of 2420 2560 9222.tmp 37 PID 2560 wrote to memory of 2420 2560 9222.tmp 37 PID 2560 wrote to memory of 2420 2560 9222.tmp 37 PID 2560 wrote to memory of 2420 2560 9222.tmp 37 PID 2420 wrote to memory of 2544 2420 934A.tmp 38 PID 2420 wrote to memory of 2544 2420 934A.tmp 38 PID 2420 wrote to memory of 2544 2420 934A.tmp 38 PID 2420 wrote to memory of 2544 2420 934A.tmp 38 PID 2544 wrote to memory of 2848 2544 93B7.tmp 99 PID 2544 wrote to memory of 2848 2544 93B7.tmp 99 PID 2544 wrote to memory of 2848 2544 93B7.tmp 99 PID 2544 wrote to memory of 2848 2544 93B7.tmp 99 PID 2848 wrote to memory of 1060 2848 9482.tmp 40 PID 2848 wrote to memory of 1060 2848 9482.tmp 40 PID 2848 wrote to memory of 1060 2848 9482.tmp 40 PID 2848 wrote to memory of 1060 2848 9482.tmp 40 PID 1060 wrote to memory of 1524 1060 952E.tmp 41 PID 1060 wrote to memory of 1524 1060 952E.tmp 41 PID 1060 wrote to memory of 1524 1060 952E.tmp 41 PID 1060 wrote to memory of 1524 1060 952E.tmp 41 PID 1524 wrote to memory of 584 1524 95CA.tmp 103 PID 1524 wrote to memory of 584 1524 95CA.tmp 103 PID 1524 wrote to memory of 584 1524 95CA.tmp 103 PID 1524 wrote to memory of 584 1524 95CA.tmp 103 PID 584 wrote to memory of 836 584 96A4.tmp 43 PID 584 wrote to memory of 836 584 96A4.tmp 43 PID 584 wrote to memory of 836 584 96A4.tmp 43 PID 584 wrote to memory of 836 584 96A4.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_988db4a63fe86dab1044bb9353bc939c_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-25_988db4a63fe86dab1044bb9353bc939c_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\8BEB.tmp"C:\Users\Admin\AppData\Local\Temp\8BEB.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\8C58.tmp"C:\Users\Admin\AppData\Local\Temp\8C58.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\8CE4.tmp"C:\Users\Admin\AppData\Local\Temp\8CE4.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\8DFD.tmp"C:\Users\Admin\AppData\Local\Temp\8DFD.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\8EB8.tmp"C:\Users\Admin\AppData\Local\Temp\8EB8.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\8F45.tmp"C:\Users\Admin\AppData\Local\Temp\8F45.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\90AB.tmp"C:\Users\Admin\AppData\Local\Temp\90AB.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\9176.tmp"C:\Users\Admin\AppData\Local\Temp\9176.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\9222.tmp"C:\Users\Admin\AppData\Local\Temp\9222.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\934A.tmp"C:\Users\Admin\AppData\Local\Temp\934A.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\93B7.tmp"C:\Users\Admin\AppData\Local\Temp\93B7.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\9482.tmp"C:\Users\Admin\AppData\Local\Temp\9482.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\952E.tmp"C:\Users\Admin\AppData\Local\Temp\952E.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\95CA.tmp"C:\Users\Admin\AppData\Local\Temp\95CA.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\96A4.tmp"C:\Users\Admin\AppData\Local\Temp\96A4.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:584 -
C:\Users\Admin\AppData\Local\Temp\9750.tmp"C:\Users\Admin\AppData\Local\Temp\9750.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:836 -
C:\Users\Admin\AppData\Local\Temp\97CD.tmp"C:\Users\Admin\AppData\Local\Temp\97CD.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\9878.tmp"C:\Users\Admin\AppData\Local\Temp\9878.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\9933.tmp"C:\Users\Admin\AppData\Local\Temp\9933.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\99A1.tmp"C:\Users\Admin\AppData\Local\Temp\99A1.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\9B07.tmp"C:\Users\Admin\AppData\Local\Temp\9B07.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\9F4B.tmp"C:\Users\Admin\AppData\Local\Temp\9F4B.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\9FB9.tmp"C:\Users\Admin\AppData\Local\Temp\9FB9.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:948 -
C:\Users\Admin\AppData\Local\Temp\A055.tmp"C:\Users\Admin\AppData\Local\Temp\A055.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\A0D1.tmp"C:\Users\Admin\AppData\Local\Temp\A0D1.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:944 -
C:\Users\Admin\AppData\Local\Temp\A16D.tmp"C:\Users\Admin\AppData\Local\Temp\A16D.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\A219.tmp"C:\Users\Admin\AppData\Local\Temp\A219.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\A296.tmp"C:\Users\Admin\AppData\Local\Temp\A296.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\A313.tmp"C:\Users\Admin\AppData\Local\Temp\A313.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\A3AF.tmp"C:\Users\Admin\AppData\Local\Temp\A3AF.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:596 -
C:\Users\Admin\AppData\Local\Temp\A41C.tmp"C:\Users\Admin\AppData\Local\Temp\A41C.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\A489.tmp"C:\Users\Admin\AppData\Local\Temp\A489.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\A4F6.tmp"C:\Users\Admin\AppData\Local\Temp\A4F6.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\A554.tmp"C:\Users\Admin\AppData\Local\Temp\A554.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\A5C1.tmp"C:\Users\Admin\AppData\Local\Temp\A5C1.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\A62E.tmp"C:\Users\Admin\AppData\Local\Temp\A62E.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\A69B.tmp"C:\Users\Admin\AppData\Local\Temp\A69B.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\A718.tmp"C:\Users\Admin\AppData\Local\Temp\A718.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\A776.tmp"C:\Users\Admin\AppData\Local\Temp\A776.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:960 -
C:\Users\Admin\AppData\Local\Temp\A7D3.tmp"C:\Users\Admin\AppData\Local\Temp\A7D3.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\A841.tmp"C:\Users\Admin\AppData\Local\Temp\A841.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\A8AE.tmp"C:\Users\Admin\AppData\Local\Temp\A8AE.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\A92B.tmp"C:\Users\Admin\AppData\Local\Temp\A92B.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\A998.tmp"C:\Users\Admin\AppData\Local\Temp\A998.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:612 -
C:\Users\Admin\AppData\Local\Temp\AA05.tmp"C:\Users\Admin\AppData\Local\Temp\AA05.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:704 -
C:\Users\Admin\AppData\Local\Temp\AA72.tmp"C:\Users\Admin\AppData\Local\Temp\AA72.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\AAEF.tmp"C:\Users\Admin\AppData\Local\Temp\AAEF.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\AB6C.tmp"C:\Users\Admin\AppData\Local\Temp\AB6C.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\ABD9.tmp"C:\Users\Admin\AppData\Local\Temp\ABD9.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\AC46.tmp"C:\Users\Admin\AppData\Local\Temp\AC46.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\ACC3.tmp"C:\Users\Admin\AppData\Local\Temp\ACC3.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\AD21.tmp"C:\Users\Admin\AppData\Local\Temp\AD21.tmp"55⤵
- Executes dropped EXE
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\AD8E.tmp"C:\Users\Admin\AppData\Local\Temp\AD8E.tmp"56⤵
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\ADFB.tmp"C:\Users\Admin\AppData\Local\Temp\ADFB.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\AE68.tmp"C:\Users\Admin\AppData\Local\Temp\AE68.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\AED5.tmp"C:\Users\Admin\AppData\Local\Temp\AED5.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\AF52.tmp"C:\Users\Admin\AppData\Local\Temp\AF52.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\AFBF.tmp"C:\Users\Admin\AppData\Local\Temp\AFBF.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\B03C.tmp"C:\Users\Admin\AppData\Local\Temp\B03C.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\B0A9.tmp"C:\Users\Admin\AppData\Local\Temp\B0A9.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\B155.tmp"C:\Users\Admin\AppData\Local\Temp\B155.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\B1C2.tmp"C:\Users\Admin\AppData\Local\Temp\B1C2.tmp"66⤵
- Executes dropped EXE
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\B23F.tmp"C:\Users\Admin\AppData\Local\Temp\B23F.tmp"67⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\B2AC.tmp"C:\Users\Admin\AppData\Local\Temp\B2AC.tmp"68⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\B403.tmp"C:\Users\Admin\AppData\Local\Temp\B403.tmp"69⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\B461.tmp"C:\Users\Admin\AppData\Local\Temp\B461.tmp"70⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\B4DE.tmp"C:\Users\Admin\AppData\Local\Temp\B4DE.tmp"71⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\B53B.tmp"C:\Users\Admin\AppData\Local\Temp\B53B.tmp"72⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\B5B8.tmp"C:\Users\Admin\AppData\Local\Temp\B5B8.tmp"73⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\B616.tmp"C:\Users\Admin\AppData\Local\Temp\B616.tmp"74⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\B673.tmp"C:\Users\Admin\AppData\Local\Temp\B673.tmp"75⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\B6E1.tmp"C:\Users\Admin\AppData\Local\Temp\B6E1.tmp"76⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\B73E.tmp"C:\Users\Admin\AppData\Local\Temp\B73E.tmp"77⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\B79C.tmp"C:\Users\Admin\AppData\Local\Temp\B79C.tmp"78⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\B7F9.tmp"C:\Users\Admin\AppData\Local\Temp\B7F9.tmp"79⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\B867.tmp"C:\Users\Admin\AppData\Local\Temp\B867.tmp"80⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\B8F3.tmp"C:\Users\Admin\AppData\Local\Temp\B8F3.tmp"81⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\B97F.tmp"C:\Users\Admin\AppData\Local\Temp\B97F.tmp"82⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\B9ED.tmp"C:\Users\Admin\AppData\Local\Temp\B9ED.tmp"83⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\BA5A.tmp"C:\Users\Admin\AppData\Local\Temp\BA5A.tmp"84⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\BAC7.tmp"C:\Users\Admin\AppData\Local\Temp\BAC7.tmp"85⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\BB25.tmp"C:\Users\Admin\AppData\Local\Temp\BB25.tmp"86⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\BBA1.tmp"C:\Users\Admin\AppData\Local\Temp\BBA1.tmp"87⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\BC1E.tmp"C:\Users\Admin\AppData\Local\Temp\BC1E.tmp"88⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\BC7C.tmp"C:\Users\Admin\AppData\Local\Temp\BC7C.tmp"89⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\BCE9.tmp"C:\Users\Admin\AppData\Local\Temp\BCE9.tmp"90⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\BD56.tmp"C:\Users\Admin\AppData\Local\Temp\BD56.tmp"91⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\BDE3.tmp"C:\Users\Admin\AppData\Local\Temp\BDE3.tmp"92⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\BE40.tmp"C:\Users\Admin\AppData\Local\Temp\BE40.tmp"93⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\BEDC.tmp"C:\Users\Admin\AppData\Local\Temp\BEDC.tmp"94⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\BF69.tmp"C:\Users\Admin\AppData\Local\Temp\BF69.tmp"95⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"96⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\C053.tmp"C:\Users\Admin\AppData\Local\Temp\C053.tmp"97⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"98⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\C14C.tmp"C:\Users\Admin\AppData\Local\Temp\C14C.tmp"99⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"100⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\C255.tmp"C:\Users\Admin\AppData\Local\Temp\C255.tmp"101⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\C2F1.tmp"C:\Users\Admin\AppData\Local\Temp\C2F1.tmp"102⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\C3AD.tmp"C:\Users\Admin\AppData\Local\Temp\C3AD.tmp"103⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\C41A.tmp"C:\Users\Admin\AppData\Local\Temp\C41A.tmp"104⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\C497.tmp"C:\Users\Admin\AppData\Local\Temp\C497.tmp"105⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\C4F4.tmp"C:\Users\Admin\AppData\Local\Temp\C4F4.tmp"106⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\C571.tmp"C:\Users\Admin\AppData\Local\Temp\C571.tmp"107⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\C65B.tmp"C:\Users\Admin\AppData\Local\Temp\C65B.tmp"108⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\C6A9.tmp"C:\Users\Admin\AppData\Local\Temp\C6A9.tmp"109⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\C726.tmp"C:\Users\Admin\AppData\Local\Temp\C726.tmp"110⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\C7A3.tmp"C:\Users\Admin\AppData\Local\Temp\C7A3.tmp"111⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\C929.tmp"C:\Users\Admin\AppData\Local\Temp\C929.tmp"112⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\C9D4.tmp"C:\Users\Admin\AppData\Local\Temp\C9D4.tmp"113⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\CA41.tmp"C:\Users\Admin\AppData\Local\Temp\CA41.tmp"114⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\CABE.tmp"C:\Users\Admin\AppData\Local\Temp\CABE.tmp"115⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\CB2B.tmp"C:\Users\Admin\AppData\Local\Temp\CB2B.tmp"116⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\CB99.tmp"C:\Users\Admin\AppData\Local\Temp\CB99.tmp"117⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\CC06.tmp"C:\Users\Admin\AppData\Local\Temp\CC06.tmp"118⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\CCC1.tmp"C:\Users\Admin\AppData\Local\Temp\CCC1.tmp"119⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\CD2E.tmp"C:\Users\Admin\AppData\Local\Temp\CD2E.tmp"120⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\CDBB.tmp"C:\Users\Admin\AppData\Local\Temp\CDBB.tmp"121⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\CE28.tmp"C:\Users\Admin\AppData\Local\Temp\CE28.tmp"122⤵PID:1572
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-