Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
30/04/2024, 19:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-30_5fbc2945cd1232695f51c4a1470d33f5_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-30_5fbc2945cd1232695f51c4a1470d33f5_mafia.exe
Resource
win10v2004-20240426-en
2 signatures
150 seconds
General
-
Target
2024-04-30_5fbc2945cd1232695f51c4a1470d33f5_mafia.exe
-
Size
488KB
-
MD5
5fbc2945cd1232695f51c4a1470d33f5
-
SHA1
d5bf1ba557f88b19740f5582164b32f410bac857
-
SHA256
23c34d2a2c8b02f72e8ab9d7738877166e25d042220430ed5ec4560124fb61e7
-
SHA512
843fff0636f83d267401f2b678bb3a79b58eb0f9f9809d93c500b7dec794fd918446ffb5d6b51eb1ee5cb8ed896787503188e5e0b8c15017931c031cc1a58b08
-
SSDEEP
12288:/U5rCOTeiDMj//1Sq84dHzXxFRdRNONZ:/UQOJDy9NbXRzsN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1664 2368.tmp 2124 23C6.tmp 3004 2414.tmp 2608 2462.tmp 2568 24B0.tmp 2668 24FE.tmp 2680 253C.tmp 2440 257B.tmp 2464 25B9.tmp 2436 2607.tmp 1652 2646.tmp 2252 2694.tmp 308 26D2.tmp 2720 2710.tmp 2844 274F.tmp 2884 280A.tmp 2212 2858.tmp 2160 28A6.tmp 1248 28F4.tmp 1276 29BF.tmp 320 29FD.tmp 2344 2A4B.tmp 808 2A99.tmp 1792 2AD8.tmp 2288 2B16.tmp 2896 2B54.tmp 324 2BA2.tmp 2296 2BE1.tmp 1336 2C1F.tmp 2804 2C5E.tmp 2300 2CAC.tmp 576 2CEA.tmp 1488 2D28.tmp 2972 2D67.tmp 1772 2DB5.tmp 2372 2DF3.tmp 2072 2E41.tmp 1132 2E80.tmp 3020 2EBE.tmp 2400 2F0C.tmp 1388 2F4A.tmp 1320 2F89.tmp 1608 2FC7.tmp 1984 3006.tmp 1968 3044.tmp 852 3082.tmp 2180 30C1.tmp 2812 30FF.tmp 2120 313E.tmp 2784 317C.tmp 876 31BA.tmp 1552 31F9.tmp 884 3228.tmp 2932 3266.tmp 1588 3295.tmp 2056 32D3.tmp 2188 3312.tmp 2964 3350.tmp 2552 338E.tmp 2572 33CD.tmp 2692 340B.tmp 2608 344A.tmp 2656 3488.tmp 2640 34C6.tmp -
Loads dropped DLL 64 IoCs
pid Process 1676 2024-04-30_5fbc2945cd1232695f51c4a1470d33f5_mafia.exe 1664 2368.tmp 2124 23C6.tmp 3004 2414.tmp 2608 2462.tmp 2568 24B0.tmp 2668 24FE.tmp 2680 253C.tmp 2440 257B.tmp 2464 25B9.tmp 2436 2607.tmp 1652 2646.tmp 2252 2694.tmp 308 26D2.tmp 2720 2710.tmp 2844 274F.tmp 2884 280A.tmp 2212 2858.tmp 2160 28A6.tmp 1248 28F4.tmp 1276 29BF.tmp 320 29FD.tmp 2344 2A4B.tmp 808 2A99.tmp 1792 2AD8.tmp 2288 2B16.tmp 2896 2B54.tmp 324 2BA2.tmp 2296 2BE1.tmp 1336 2C1F.tmp 2804 2C5E.tmp 2300 2CAC.tmp 576 2CEA.tmp 1488 2D28.tmp 2972 2D67.tmp 1772 2DB5.tmp 2372 2DF3.tmp 2072 2E41.tmp 1132 2E80.tmp 3020 2EBE.tmp 2400 2F0C.tmp 1388 2F4A.tmp 1320 2F89.tmp 1608 2FC7.tmp 1984 3006.tmp 1968 3044.tmp 852 3082.tmp 2180 30C1.tmp 2812 30FF.tmp 2120 313E.tmp 2784 317C.tmp 876 31BA.tmp 1552 31F9.tmp 884 3228.tmp 2932 3266.tmp 1588 3295.tmp 2056 32D3.tmp 2188 3312.tmp 2964 3350.tmp 2552 338E.tmp 2572 33CD.tmp 2692 340B.tmp 2608 344A.tmp 2656 3488.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1676 wrote to memory of 1664 1676 2024-04-30_5fbc2945cd1232695f51c4a1470d33f5_mafia.exe 28 PID 1676 wrote to memory of 1664 1676 2024-04-30_5fbc2945cd1232695f51c4a1470d33f5_mafia.exe 28 PID 1676 wrote to memory of 1664 1676 2024-04-30_5fbc2945cd1232695f51c4a1470d33f5_mafia.exe 28 PID 1676 wrote to memory of 1664 1676 2024-04-30_5fbc2945cd1232695f51c4a1470d33f5_mafia.exe 28 PID 1664 wrote to memory of 2124 1664 2368.tmp 29 PID 1664 wrote to memory of 2124 1664 2368.tmp 29 PID 1664 wrote to memory of 2124 1664 2368.tmp 29 PID 1664 wrote to memory of 2124 1664 2368.tmp 29 PID 2124 wrote to memory of 3004 2124 23C6.tmp 30 PID 2124 wrote to memory of 3004 2124 23C6.tmp 30 PID 2124 wrote to memory of 3004 2124 23C6.tmp 30 PID 2124 wrote to memory of 3004 2124 23C6.tmp 30 PID 3004 wrote to memory of 2608 3004 2414.tmp 89 PID 3004 wrote to memory of 2608 3004 2414.tmp 89 PID 3004 wrote to memory of 2608 3004 2414.tmp 89 PID 3004 wrote to memory of 2608 3004 2414.tmp 89 PID 2608 wrote to memory of 2568 2608 2462.tmp 32 PID 2608 wrote to memory of 2568 2608 2462.tmp 32 PID 2608 wrote to memory of 2568 2608 2462.tmp 32 PID 2608 wrote to memory of 2568 2608 2462.tmp 32 PID 2568 wrote to memory of 2668 2568 24B0.tmp 33 PID 2568 wrote to memory of 2668 2568 24B0.tmp 33 PID 2568 wrote to memory of 2668 2568 24B0.tmp 33 PID 2568 wrote to memory of 2668 2568 24B0.tmp 33 PID 2668 wrote to memory of 2680 2668 24FE.tmp 93 PID 2668 wrote to memory of 2680 2668 24FE.tmp 93 PID 2668 wrote to memory of 2680 2668 24FE.tmp 93 PID 2668 wrote to memory of 2680 2668 24FE.tmp 93 PID 2680 wrote to memory of 2440 2680 253C.tmp 35 PID 2680 wrote to memory of 2440 2680 253C.tmp 35 PID 2680 wrote to memory of 2440 2680 253C.tmp 35 PID 2680 wrote to memory of 2440 2680 253C.tmp 35 PID 2440 wrote to memory of 2464 2440 257B.tmp 36 PID 2440 wrote to memory of 2464 2440 257B.tmp 36 PID 2440 wrote to memory of 2464 2440 257B.tmp 36 PID 2440 wrote to memory of 2464 2440 257B.tmp 36 PID 2464 wrote to memory of 2436 2464 25B9.tmp 37 PID 2464 wrote to memory of 2436 2464 25B9.tmp 37 PID 2464 wrote to memory of 2436 2464 25B9.tmp 37 PID 2464 wrote to memory of 2436 2464 25B9.tmp 37 PID 2436 wrote to memory of 1652 2436 2607.tmp 38 PID 2436 wrote to memory of 1652 2436 2607.tmp 38 PID 2436 wrote to memory of 1652 2436 2607.tmp 38 PID 2436 wrote to memory of 1652 2436 2607.tmp 38 PID 1652 wrote to memory of 2252 1652 2646.tmp 39 PID 1652 wrote to memory of 2252 1652 2646.tmp 39 PID 1652 wrote to memory of 2252 1652 2646.tmp 39 PID 1652 wrote to memory of 2252 1652 2646.tmp 39 PID 2252 wrote to memory of 308 2252 2694.tmp 40 PID 2252 wrote to memory of 308 2252 2694.tmp 40 PID 2252 wrote to memory of 308 2252 2694.tmp 40 PID 2252 wrote to memory of 308 2252 2694.tmp 40 PID 308 wrote to memory of 2720 308 26D2.tmp 41 PID 308 wrote to memory of 2720 308 26D2.tmp 41 PID 308 wrote to memory of 2720 308 26D2.tmp 41 PID 308 wrote to memory of 2720 308 26D2.tmp 41 PID 2720 wrote to memory of 2844 2720 2710.tmp 42 PID 2720 wrote to memory of 2844 2720 2710.tmp 42 PID 2720 wrote to memory of 2844 2720 2710.tmp 42 PID 2720 wrote to memory of 2844 2720 2710.tmp 42 PID 2844 wrote to memory of 2884 2844 274F.tmp 43 PID 2844 wrote to memory of 2884 2844 274F.tmp 43 PID 2844 wrote to memory of 2884 2844 274F.tmp 43 PID 2844 wrote to memory of 2884 2844 274F.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-30_5fbc2945cd1232695f51c4a1470d33f5_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-30_5fbc2945cd1232695f51c4a1470d33f5_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\2368.tmp"C:\Users\Admin\AppData\Local\Temp\2368.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\23C6.tmp"C:\Users\Admin\AppData\Local\Temp\23C6.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\2414.tmp"C:\Users\Admin\AppData\Local\Temp\2414.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\24B0.tmp"C:\Users\Admin\AppData\Local\Temp\24B0.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\24FE.tmp"C:\Users\Admin\AppData\Local\Temp\24FE.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\253C.tmp"C:\Users\Admin\AppData\Local\Temp\253C.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\257B.tmp"C:\Users\Admin\AppData\Local\Temp\257B.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\25B9.tmp"C:\Users\Admin\AppData\Local\Temp\25B9.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\2607.tmp"C:\Users\Admin\AppData\Local\Temp\2607.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\2646.tmp"C:\Users\Admin\AppData\Local\Temp\2646.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\2694.tmp"C:\Users\Admin\AppData\Local\Temp\2694.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\26D2.tmp"C:\Users\Admin\AppData\Local\Temp\26D2.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:308 -
C:\Users\Admin\AppData\Local\Temp\2710.tmp"C:\Users\Admin\AppData\Local\Temp\2710.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\274F.tmp"C:\Users\Admin\AppData\Local\Temp\274F.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\2858.tmp"C:\Users\Admin\AppData\Local\Temp\2858.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\28A6.tmp"C:\Users\Admin\AppData\Local\Temp\28A6.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\28F4.tmp"C:\Users\Admin\AppData\Local\Temp\28F4.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\29BF.tmp"C:\Users\Admin\AppData\Local\Temp\29BF.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\29FD.tmp"C:\Users\Admin\AppData\Local\Temp\29FD.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:320 -
C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\2A99.tmp"C:\Users\Admin\AppData\Local\Temp\2A99.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:808 -
C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\2B16.tmp"C:\Users\Admin\AppData\Local\Temp\2B16.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\2B54.tmp"C:\Users\Admin\AppData\Local\Temp\2B54.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:324 -
C:\Users\Admin\AppData\Local\Temp\2BE1.tmp"C:\Users\Admin\AppData\Local\Temp\2BE1.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\2C1F.tmp"C:\Users\Admin\AppData\Local\Temp\2C1F.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:576 -
C:\Users\Admin\AppData\Local\Temp\2D28.tmp"C:\Users\Admin\AppData\Local\Temp\2D28.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\2D67.tmp"C:\Users\Admin\AppData\Local\Temp\2D67.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\2E41.tmp"C:\Users\Admin\AppData\Local\Temp\2E41.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\2E80.tmp"C:\Users\Admin\AppData\Local\Temp\2E80.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\2F89.tmp"C:\Users\Admin\AppData\Local\Temp\2F89.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\3006.tmp"C:\Users\Admin\AppData\Local\Temp\3006.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\3044.tmp"C:\Users\Admin\AppData\Local\Temp\3044.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\3082.tmp"C:\Users\Admin\AppData\Local\Temp\3082.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:852 -
C:\Users\Admin\AppData\Local\Temp\30C1.tmp"C:\Users\Admin\AppData\Local\Temp\30C1.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\30FF.tmp"C:\Users\Admin\AppData\Local\Temp\30FF.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\313E.tmp"C:\Users\Admin\AppData\Local\Temp\313E.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\317C.tmp"C:\Users\Admin\AppData\Local\Temp\317C.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\31BA.tmp"C:\Users\Admin\AppData\Local\Temp\31BA.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:876 -
C:\Users\Admin\AppData\Local\Temp\31F9.tmp"C:\Users\Admin\AppData\Local\Temp\31F9.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\3228.tmp"C:\Users\Admin\AppData\Local\Temp\3228.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:884 -
C:\Users\Admin\AppData\Local\Temp\3266.tmp"C:\Users\Admin\AppData\Local\Temp\3266.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\3295.tmp"C:\Users\Admin\AppData\Local\Temp\3295.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\32D3.tmp"C:\Users\Admin\AppData\Local\Temp\32D3.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\3312.tmp"C:\Users\Admin\AppData\Local\Temp\3312.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\3350.tmp"C:\Users\Admin\AppData\Local\Temp\3350.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\338E.tmp"C:\Users\Admin\AppData\Local\Temp\338E.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\33CD.tmp"C:\Users\Admin\AppData\Local\Temp\33CD.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\340B.tmp"C:\Users\Admin\AppData\Local\Temp\340B.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\344A.tmp"C:\Users\Admin\AppData\Local\Temp\344A.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\34C6.tmp"C:\Users\Admin\AppData\Local\Temp\34C6.tmp"65⤵
- Executes dropped EXE
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\3505.tmp"C:\Users\Admin\AppData\Local\Temp\3505.tmp"66⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\3543.tmp"C:\Users\Admin\AppData\Local\Temp\3543.tmp"67⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\3582.tmp"C:\Users\Admin\AppData\Local\Temp\3582.tmp"68⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\35C0.tmp"C:\Users\Admin\AppData\Local\Temp\35C0.tmp"69⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\35FE.tmp"C:\Users\Admin\AppData\Local\Temp\35FE.tmp"70⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\363D.tmp"C:\Users\Admin\AppData\Local\Temp\363D.tmp"71⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\367B.tmp"C:\Users\Admin\AppData\Local\Temp\367B.tmp"72⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\36BA.tmp"C:\Users\Admin\AppData\Local\Temp\36BA.tmp"73⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\36F8.tmp"C:\Users\Admin\AppData\Local\Temp\36F8.tmp"74⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\3736.tmp"C:\Users\Admin\AppData\Local\Temp\3736.tmp"75⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\3775.tmp"C:\Users\Admin\AppData\Local\Temp\3775.tmp"76⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\37B3.tmp"C:\Users\Admin\AppData\Local\Temp\37B3.tmp"77⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\37F2.tmp"C:\Users\Admin\AppData\Local\Temp\37F2.tmp"78⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\3820.tmp"C:\Users\Admin\AppData\Local\Temp\3820.tmp"79⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\384F.tmp"C:\Users\Admin\AppData\Local\Temp\384F.tmp"80⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\388E.tmp"C:\Users\Admin\AppData\Local\Temp\388E.tmp"81⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\38CC.tmp"C:\Users\Admin\AppData\Local\Temp\38CC.tmp"82⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\390A.tmp"C:\Users\Admin\AppData\Local\Temp\390A.tmp"83⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\3968.tmp"C:\Users\Admin\AppData\Local\Temp\3968.tmp"84⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\39C6.tmp"C:\Users\Admin\AppData\Local\Temp\39C6.tmp"85⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\3A14.tmp"C:\Users\Admin\AppData\Local\Temp\3A14.tmp"86⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\3A52.tmp"C:\Users\Admin\AppData\Local\Temp\3A52.tmp"87⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\3A90.tmp"C:\Users\Admin\AppData\Local\Temp\3A90.tmp"88⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\3ADE.tmp"C:\Users\Admin\AppData\Local\Temp\3ADE.tmp"89⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\3B1D.tmp"C:\Users\Admin\AppData\Local\Temp\3B1D.tmp"90⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\3B7A.tmp"C:\Users\Admin\AppData\Local\Temp\3B7A.tmp"91⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\3BB9.tmp"C:\Users\Admin\AppData\Local\Temp\3BB9.tmp"92⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\3C16.tmp"C:\Users\Admin\AppData\Local\Temp\3C16.tmp"93⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\3C74.tmp"C:\Users\Admin\AppData\Local\Temp\3C74.tmp"94⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\3CD2.tmp"C:\Users\Admin\AppData\Local\Temp\3CD2.tmp"95⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\3D3F.tmp"C:\Users\Admin\AppData\Local\Temp\3D3F.tmp"96⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\3D7D.tmp"C:\Users\Admin\AppData\Local\Temp\3D7D.tmp"97⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\3DBC.tmp"C:\Users\Admin\AppData\Local\Temp\3DBC.tmp"98⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\3DFA.tmp"C:\Users\Admin\AppData\Local\Temp\3DFA.tmp"99⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\3E38.tmp"C:\Users\Admin\AppData\Local\Temp\3E38.tmp"100⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\3E77.tmp"C:\Users\Admin\AppData\Local\Temp\3E77.tmp"101⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\3EB5.tmp"C:\Users\Admin\AppData\Local\Temp\3EB5.tmp"102⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\3EF4.tmp"C:\Users\Admin\AppData\Local\Temp\3EF4.tmp"103⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\3F32.tmp"C:\Users\Admin\AppData\Local\Temp\3F32.tmp"104⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\3F70.tmp"C:\Users\Admin\AppData\Local\Temp\3F70.tmp"105⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\3FAF.tmp"C:\Users\Admin\AppData\Local\Temp\3FAF.tmp"106⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\3FED.tmp"C:\Users\Admin\AppData\Local\Temp\3FED.tmp"107⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\402C.tmp"C:\Users\Admin\AppData\Local\Temp\402C.tmp"108⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\406A.tmp"C:\Users\Admin\AppData\Local\Temp\406A.tmp"109⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\40A8.tmp"C:\Users\Admin\AppData\Local\Temp\40A8.tmp"110⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\40E7.tmp"C:\Users\Admin\AppData\Local\Temp\40E7.tmp"111⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\4125.tmp"C:\Users\Admin\AppData\Local\Temp\4125.tmp"112⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\4164.tmp"C:\Users\Admin\AppData\Local\Temp\4164.tmp"113⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\4192.tmp"C:\Users\Admin\AppData\Local\Temp\4192.tmp"114⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\41D1.tmp"C:\Users\Admin\AppData\Local\Temp\41D1.tmp"115⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\420F.tmp"C:\Users\Admin\AppData\Local\Temp\420F.tmp"116⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\424E.tmp"C:\Users\Admin\AppData\Local\Temp\424E.tmp"117⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\428C.tmp"C:\Users\Admin\AppData\Local\Temp\428C.tmp"118⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\42CA.tmp"C:\Users\Admin\AppData\Local\Temp\42CA.tmp"119⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\4309.tmp"C:\Users\Admin\AppData\Local\Temp\4309.tmp"120⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\4347.tmp"C:\Users\Admin\AppData\Local\Temp\4347.tmp"121⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\4386.tmp"C:\Users\Admin\AppData\Local\Temp\4386.tmp"122⤵PID:2928
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-