Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14/05/2024, 17:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-14_64ee48fbefe93907ff6d54c080c4d12e_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-14_64ee48fbefe93907ff6d54c080c4d12e_mafia.exe
Resource
win10v2004-20240426-en
2 signatures
150 seconds
General
-
Target
2024-05-14_64ee48fbefe93907ff6d54c080c4d12e_mafia.exe
-
Size
541KB
-
MD5
64ee48fbefe93907ff6d54c080c4d12e
-
SHA1
8bbdb4e049a8b51960ec1c32c90733b7a0d74ec6
-
SHA256
4ed1daec6265ef7467c4e45c2fd2cc9ce7bca9bfcf22e1619ec76bd612fe6798
-
SHA512
214e7bc9d00c70a0d13e08c3f8e520cffbfb48e44d148d3778cba770045628ad8351bd563027fbe2ca7d6200f7466568f67f55b05b2963c0bf15272034174bf8
-
SSDEEP
12288:UU5rCOTeifVUzhSo9gNwD2RCrZa73ctO:UUQOJfVgh77KRCrU73ctO
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1988 1870.tmp 2952 18DE.tmp 3008 196A.tmp 2596 19C8.tmp 2768 1A25.tmp 2500 1A83.tmp 2736 1AE0.tmp 2548 1B4E.tmp 2384 1B9C.tmp 2456 1BF9.tmp 2844 1C57.tmp 1248 1CB4.tmp 1376 1D22.tmp 2560 1D8F.tmp 2712 1DEC.tmp 2732 1E3A.tmp 1568 1E79.tmp 1508 1EC7.tmp 1032 1F15.tmp 1252 1F53.tmp 2312 1F92.tmp 2044 1FE0.tmp 2008 203D.tmp 2880 207C.tmp 2824 20BA.tmp 2884 20F8.tmp 2236 2146.tmp 1936 21B4.tmp 2120 2202.tmp 596 2250.tmp 720 229E.tmp 380 22DC.tmp 576 231A.tmp 2368 2359.tmp 1476 23A7.tmp 2340 23F5.tmp 2112 2433.tmp 2980 2472.tmp 448 24B0.tmp 1228 24FE.tmp 1684 254C.tmp 1300 259A.tmp 1692 25E8.tmp 1804 2636.tmp 344 2684.tmp 1620 26C2.tmp 1064 2701.tmp 2956 273F.tmp 1740 277E.tmp 1664 27BC.tmp 1756 280A.tmp 2272 2848.tmp 2908 2887.tmp 896 28C5.tmp 1280 2913.tmp 2240 2961.tmp 2672 29AF.tmp 1652 29EE.tmp 2568 2A3C.tmp 2476 2A7A.tmp 2488 2AC8.tmp 2588 2B06.tmp 2592 2B54.tmp 2612 2B93.tmp -
Loads dropped DLL 64 IoCs
pid Process 2096 2024-05-14_64ee48fbefe93907ff6d54c080c4d12e_mafia.exe 1988 1870.tmp 2952 18DE.tmp 3008 196A.tmp 2596 19C8.tmp 2768 1A25.tmp 2500 1A83.tmp 2736 1AE0.tmp 2548 1B4E.tmp 2384 1B9C.tmp 2456 1BF9.tmp 2844 1C57.tmp 1248 1CB4.tmp 1376 1D22.tmp 2560 1D8F.tmp 2712 1DEC.tmp 2732 1E3A.tmp 1568 1E79.tmp 1508 1EC7.tmp 1032 1F15.tmp 1252 1F53.tmp 2312 1F92.tmp 2044 1FE0.tmp 2008 203D.tmp 2880 207C.tmp 2824 20BA.tmp 2884 20F8.tmp 2236 2146.tmp 1936 21B4.tmp 2120 2202.tmp 596 2250.tmp 720 229E.tmp 380 22DC.tmp 576 231A.tmp 2368 2359.tmp 1476 23A7.tmp 2340 23F5.tmp 2112 2433.tmp 2980 2472.tmp 448 24B0.tmp 1228 24FE.tmp 1684 254C.tmp 1300 259A.tmp 1692 25E8.tmp 1804 2636.tmp 344 2684.tmp 1620 26C2.tmp 1064 2701.tmp 2956 273F.tmp 1740 277E.tmp 1664 27BC.tmp 1756 280A.tmp 2272 2848.tmp 2908 2887.tmp 896 28C5.tmp 1280 2913.tmp 2240 2961.tmp 2672 29AF.tmp 1652 29EE.tmp 2568 2A3C.tmp 2476 2A7A.tmp 2488 2AC8.tmp 2588 2B06.tmp 2592 2B54.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2096 wrote to memory of 1988 2096 2024-05-14_64ee48fbefe93907ff6d54c080c4d12e_mafia.exe 28 PID 2096 wrote to memory of 1988 2096 2024-05-14_64ee48fbefe93907ff6d54c080c4d12e_mafia.exe 28 PID 2096 wrote to memory of 1988 2096 2024-05-14_64ee48fbefe93907ff6d54c080c4d12e_mafia.exe 28 PID 2096 wrote to memory of 1988 2096 2024-05-14_64ee48fbefe93907ff6d54c080c4d12e_mafia.exe 28 PID 1988 wrote to memory of 2952 1988 1870.tmp 29 PID 1988 wrote to memory of 2952 1988 1870.tmp 29 PID 1988 wrote to memory of 2952 1988 1870.tmp 29 PID 1988 wrote to memory of 2952 1988 1870.tmp 29 PID 2952 wrote to memory of 3008 2952 18DE.tmp 30 PID 2952 wrote to memory of 3008 2952 18DE.tmp 30 PID 2952 wrote to memory of 3008 2952 18DE.tmp 30 PID 2952 wrote to memory of 3008 2952 18DE.tmp 30 PID 3008 wrote to memory of 2596 3008 196A.tmp 31 PID 3008 wrote to memory of 2596 3008 196A.tmp 31 PID 3008 wrote to memory of 2596 3008 196A.tmp 31 PID 3008 wrote to memory of 2596 3008 196A.tmp 31 PID 2596 wrote to memory of 2768 2596 19C8.tmp 32 PID 2596 wrote to memory of 2768 2596 19C8.tmp 32 PID 2596 wrote to memory of 2768 2596 19C8.tmp 32 PID 2596 wrote to memory of 2768 2596 19C8.tmp 32 PID 2768 wrote to memory of 2500 2768 1A25.tmp 33 PID 2768 wrote to memory of 2500 2768 1A25.tmp 33 PID 2768 wrote to memory of 2500 2768 1A25.tmp 33 PID 2768 wrote to memory of 2500 2768 1A25.tmp 33 PID 2500 wrote to memory of 2736 2500 1A83.tmp 34 PID 2500 wrote to memory of 2736 2500 1A83.tmp 34 PID 2500 wrote to memory of 2736 2500 1A83.tmp 34 PID 2500 wrote to memory of 2736 2500 1A83.tmp 34 PID 2736 wrote to memory of 2548 2736 1AE0.tmp 35 PID 2736 wrote to memory of 2548 2736 1AE0.tmp 35 PID 2736 wrote to memory of 2548 2736 1AE0.tmp 35 PID 2736 wrote to memory of 2548 2736 1AE0.tmp 35 PID 2548 wrote to memory of 2384 2548 1B4E.tmp 36 PID 2548 wrote to memory of 2384 2548 1B4E.tmp 36 PID 2548 wrote to memory of 2384 2548 1B4E.tmp 36 PID 2548 wrote to memory of 2384 2548 1B4E.tmp 36 PID 2384 wrote to memory of 2456 2384 1B9C.tmp 37 PID 2384 wrote to memory of 2456 2384 1B9C.tmp 37 PID 2384 wrote to memory of 2456 2384 1B9C.tmp 37 PID 2384 wrote to memory of 2456 2384 1B9C.tmp 37 PID 2456 wrote to memory of 2844 2456 1BF9.tmp 38 PID 2456 wrote to memory of 2844 2456 1BF9.tmp 38 PID 2456 wrote to memory of 2844 2456 1BF9.tmp 38 PID 2456 wrote to memory of 2844 2456 1BF9.tmp 38 PID 2844 wrote to memory of 1248 2844 1C57.tmp 39 PID 2844 wrote to memory of 1248 2844 1C57.tmp 39 PID 2844 wrote to memory of 1248 2844 1C57.tmp 39 PID 2844 wrote to memory of 1248 2844 1C57.tmp 39 PID 1248 wrote to memory of 1376 1248 1CB4.tmp 40 PID 1248 wrote to memory of 1376 1248 1CB4.tmp 40 PID 1248 wrote to memory of 1376 1248 1CB4.tmp 40 PID 1248 wrote to memory of 1376 1248 1CB4.tmp 40 PID 1376 wrote to memory of 2560 1376 1D22.tmp 41 PID 1376 wrote to memory of 2560 1376 1D22.tmp 41 PID 1376 wrote to memory of 2560 1376 1D22.tmp 41 PID 1376 wrote to memory of 2560 1376 1D22.tmp 41 PID 2560 wrote to memory of 2712 2560 1D8F.tmp 42 PID 2560 wrote to memory of 2712 2560 1D8F.tmp 42 PID 2560 wrote to memory of 2712 2560 1D8F.tmp 42 PID 2560 wrote to memory of 2712 2560 1D8F.tmp 42 PID 2712 wrote to memory of 2732 2712 1DEC.tmp 43 PID 2712 wrote to memory of 2732 2712 1DEC.tmp 43 PID 2712 wrote to memory of 2732 2712 1DEC.tmp 43 PID 2712 wrote to memory of 2732 2712 1DEC.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-14_64ee48fbefe93907ff6d54c080c4d12e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-14_64ee48fbefe93907ff6d54c080c4d12e_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\1870.tmp"C:\Users\Admin\AppData\Local\Temp\1870.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\18DE.tmp"C:\Users\Admin\AppData\Local\Temp\18DE.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\196A.tmp"C:\Users\Admin\AppData\Local\Temp\196A.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\19C8.tmp"C:\Users\Admin\AppData\Local\Temp\19C8.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\1A25.tmp"C:\Users\Admin\AppData\Local\Temp\1A25.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\1A83.tmp"C:\Users\Admin\AppData\Local\Temp\1A83.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\1AE0.tmp"C:\Users\Admin\AppData\Local\Temp\1AE0.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\1BF9.tmp"C:\Users\Admin\AppData\Local\Temp\1BF9.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\1C57.tmp"C:\Users\Admin\AppData\Local\Temp\1C57.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\1CB4.tmp"C:\Users\Admin\AppData\Local\Temp\1CB4.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\1D22.tmp"C:\Users\Admin\AppData\Local\Temp\1D22.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\1D8F.tmp"C:\Users\Admin\AppData\Local\Temp\1D8F.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\1E79.tmp"C:\Users\Admin\AppData\Local\Temp\1E79.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\1F15.tmp"C:\Users\Admin\AppData\Local\Temp\1F15.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\1F53.tmp"C:\Users\Admin\AppData\Local\Temp\1F53.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\1F92.tmp"C:\Users\Admin\AppData\Local\Temp\1F92.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\203D.tmp"C:\Users\Admin\AppData\Local\Temp\203D.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\207C.tmp"C:\Users\Admin\AppData\Local\Temp\207C.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\20BA.tmp"C:\Users\Admin\AppData\Local\Temp\20BA.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\20F8.tmp"C:\Users\Admin\AppData\Local\Temp\20F8.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\2146.tmp"C:\Users\Admin\AppData\Local\Temp\2146.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\21B4.tmp"C:\Users\Admin\AppData\Local\Temp\21B4.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\2202.tmp"C:\Users\Admin\AppData\Local\Temp\2202.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\2250.tmp"C:\Users\Admin\AppData\Local\Temp\2250.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:596 -
C:\Users\Admin\AppData\Local\Temp\229E.tmp"C:\Users\Admin\AppData\Local\Temp\229E.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:720 -
C:\Users\Admin\AppData\Local\Temp\22DC.tmp"C:\Users\Admin\AppData\Local\Temp\22DC.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:380 -
C:\Users\Admin\AppData\Local\Temp\231A.tmp"C:\Users\Admin\AppData\Local\Temp\231A.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:576 -
C:\Users\Admin\AppData\Local\Temp\2359.tmp"C:\Users\Admin\AppData\Local\Temp\2359.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\23A7.tmp"C:\Users\Admin\AppData\Local\Temp\23A7.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\23F5.tmp"C:\Users\Admin\AppData\Local\Temp\23F5.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\2433.tmp"C:\Users\Admin\AppData\Local\Temp\2433.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\2472.tmp"C:\Users\Admin\AppData\Local\Temp\2472.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\24B0.tmp"C:\Users\Admin\AppData\Local\Temp\24B0.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:448 -
C:\Users\Admin\AppData\Local\Temp\24FE.tmp"C:\Users\Admin\AppData\Local\Temp\24FE.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\254C.tmp"C:\Users\Admin\AppData\Local\Temp\254C.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\259A.tmp"C:\Users\Admin\AppData\Local\Temp\259A.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\25E8.tmp"C:\Users\Admin\AppData\Local\Temp\25E8.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\2636.tmp"C:\Users\Admin\AppData\Local\Temp\2636.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\2684.tmp"C:\Users\Admin\AppData\Local\Temp\2684.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:344 -
C:\Users\Admin\AppData\Local\Temp\26C2.tmp"C:\Users\Admin\AppData\Local\Temp\26C2.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\2701.tmp"C:\Users\Admin\AppData\Local\Temp\2701.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\273F.tmp"C:\Users\Admin\AppData\Local\Temp\273F.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\277E.tmp"C:\Users\Admin\AppData\Local\Temp\277E.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\27BC.tmp"C:\Users\Admin\AppData\Local\Temp\27BC.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\2848.tmp"C:\Users\Admin\AppData\Local\Temp\2848.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\2887.tmp"C:\Users\Admin\AppData\Local\Temp\2887.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\28C5.tmp"C:\Users\Admin\AppData\Local\Temp\28C5.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:896 -
C:\Users\Admin\AppData\Local\Temp\2913.tmp"C:\Users\Admin\AppData\Local\Temp\2913.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\2961.tmp"C:\Users\Admin\AppData\Local\Temp\2961.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\29AF.tmp"C:\Users\Admin\AppData\Local\Temp\29AF.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\29EE.tmp"C:\Users\Admin\AppData\Local\Temp\29EE.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\2B06.tmp"C:\Users\Admin\AppData\Local\Temp\2B06.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\2B54.tmp"C:\Users\Admin\AppData\Local\Temp\2B54.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\2B93.tmp"C:\Users\Admin\AppData\Local\Temp\2B93.tmp"65⤵
- Executes dropped EXE
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"66⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\2C1F.tmp"C:\Users\Admin\AppData\Local\Temp\2C1F.tmp"67⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"68⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"69⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"70⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\2D38.tmp"C:\Users\Admin\AppData\Local\Temp\2D38.tmp"71⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\2D76.tmp"C:\Users\Admin\AppData\Local\Temp\2D76.tmp"72⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"73⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"74⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\2E41.tmp"C:\Users\Admin\AppData\Local\Temp\2E41.tmp"75⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\2E80.tmp"C:\Users\Admin\AppData\Local\Temp\2E80.tmp"76⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"77⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"78⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"79⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\2F98.tmp"C:\Users\Admin\AppData\Local\Temp\2F98.tmp"80⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\2FD7.tmp"C:\Users\Admin\AppData\Local\Temp\2FD7.tmp"81⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\3015.tmp"C:\Users\Admin\AppData\Local\Temp\3015.tmp"82⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\3054.tmp"C:\Users\Admin\AppData\Local\Temp\3054.tmp"83⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\3092.tmp"C:\Users\Admin\AppData\Local\Temp\3092.tmp"84⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\30D0.tmp"C:\Users\Admin\AppData\Local\Temp\30D0.tmp"85⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\310F.tmp"C:\Users\Admin\AppData\Local\Temp\310F.tmp"86⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\314D.tmp"C:\Users\Admin\AppData\Local\Temp\314D.tmp"87⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\319B.tmp"C:\Users\Admin\AppData\Local\Temp\319B.tmp"88⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\31DA.tmp"C:\Users\Admin\AppData\Local\Temp\31DA.tmp"89⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\3218.tmp"C:\Users\Admin\AppData\Local\Temp\3218.tmp"90⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"91⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\32A4.tmp"C:\Users\Admin\AppData\Local\Temp\32A4.tmp"92⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\32E3.tmp"C:\Users\Admin\AppData\Local\Temp\32E3.tmp"93⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\3321.tmp"C:\Users\Admin\AppData\Local\Temp\3321.tmp"94⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\3360.tmp"C:\Users\Admin\AppData\Local\Temp\3360.tmp"95⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\339E.tmp"C:\Users\Admin\AppData\Local\Temp\339E.tmp"96⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\33DC.tmp"C:\Users\Admin\AppData\Local\Temp\33DC.tmp"97⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\341B.tmp"C:\Users\Admin\AppData\Local\Temp\341B.tmp"98⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\3459.tmp"C:\Users\Admin\AppData\Local\Temp\3459.tmp"99⤵PID:484
-
C:\Users\Admin\AppData\Local\Temp\34A7.tmp"C:\Users\Admin\AppData\Local\Temp\34A7.tmp"100⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\34E6.tmp"C:\Users\Admin\AppData\Local\Temp\34E6.tmp"101⤵PID:588
-
C:\Users\Admin\AppData\Local\Temp\3534.tmp"C:\Users\Admin\AppData\Local\Temp\3534.tmp"102⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\3582.tmp"C:\Users\Admin\AppData\Local\Temp\3582.tmp"103⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\35D0.tmp"C:\Users\Admin\AppData\Local\Temp\35D0.tmp"104⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\360E.tmp"C:\Users\Admin\AppData\Local\Temp\360E.tmp"105⤵PID:272
-
C:\Users\Admin\AppData\Local\Temp\364C.tmp"C:\Users\Admin\AppData\Local\Temp\364C.tmp"106⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\369A.tmp"C:\Users\Admin\AppData\Local\Temp\369A.tmp"107⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\36D9.tmp"C:\Users\Admin\AppData\Local\Temp\36D9.tmp"108⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\3727.tmp"C:\Users\Admin\AppData\Local\Temp\3727.tmp"109⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\3775.tmp"C:\Users\Admin\AppData\Local\Temp\3775.tmp"110⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\37B3.tmp"C:\Users\Admin\AppData\Local\Temp\37B3.tmp"111⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\37F2.tmp"C:\Users\Admin\AppData\Local\Temp\37F2.tmp"112⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\3830.tmp"C:\Users\Admin\AppData\Local\Temp\3830.tmp"113⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\387E.tmp"C:\Users\Admin\AppData\Local\Temp\387E.tmp"114⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\38BC.tmp"C:\Users\Admin\AppData\Local\Temp\38BC.tmp"115⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\38FB.tmp"C:\Users\Admin\AppData\Local\Temp\38FB.tmp"116⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\3949.tmp"C:\Users\Admin\AppData\Local\Temp\3949.tmp"117⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\3987.tmp"C:\Users\Admin\AppData\Local\Temp\3987.tmp"118⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\39D5.tmp"C:\Users\Admin\AppData\Local\Temp\39D5.tmp"119⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\3A23.tmp"C:\Users\Admin\AppData\Local\Temp\3A23.tmp"120⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\3A71.tmp"C:\Users\Admin\AppData\Local\Temp\3A71.tmp"121⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\3AB0.tmp"C:\Users\Admin\AppData\Local\Temp\3AB0.tmp"122⤵PID:1448
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-