Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 15:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-20_382f8cff1ba3acd466185ae0252cc0d4_mafia.exe
Resource
win7-20240215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-20_382f8cff1ba3acd466185ae0252cc0d4_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-05-20_382f8cff1ba3acd466185ae0252cc0d4_mafia.exe
-
Size
520KB
-
MD5
382f8cff1ba3acd466185ae0252cc0d4
-
SHA1
c1117650e2fe22b0742e9b2725b0af3d16a8abe3
-
SHA256
1555c122e84fd97eb27df50c2c9158aa1c5f99caf8a29c2a2ff54c7d820d2b80
-
SHA512
16d5eb49c0f5b778534c4b45d33d4c6a9afddeca1a3bc9a23e0ff0da5dfc7ffdd5c14da4694cb21a9e4e68e235c5d3ae412fee7b7e69aace730f17d28d3a4afc
-
SSDEEP
6144:pXT6Oq8HBh4huuAOBdRFyh1T55i8fkbacarBsLbe5HpB2ExT1TKTcvFM6Sm24UgG:gj8fuxR21t5i8fYaeb2RKTcGIsdnXNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1444 D0B.tmp 2716 D69.tmp 2984 DD6.tmp 2668 E24.tmp 2232 E91.tmp 2696 EEF.tmp 2744 F5C.tmp 2656 FBA.tmp 2448 1027.tmp 2436 1084.tmp 2868 10F2.tmp 1480 114F.tmp 2644 11AD.tmp 2728 120A.tmp 2852 1268.tmp 1260 12C6.tmp 1576 1323.tmp 2280 1381.tmp 356 13EE.tmp 1184 144C.tmp 836 14C8.tmp 2036 1526.tmp 2008 1574.tmp 1940 15C2.tmp 2908 1600.tmp 2220 164E.tmp 1696 169C.tmp 1824 16DB.tmp 1900 1729.tmp 324 1767.tmp 780 17A6.tmp 1400 17F4.tmp 2372 1842.tmp 888 1880.tmp 1772 18BE.tmp 1452 18FD.tmp 2080 194B.tmp 700 1989.tmp 2356 19C8.tmp 2988 1A16.tmp 2784 1A54.tmp 1504 1A92.tmp 792 1AD1.tmp 1780 1B1F.tmp 1012 1B6D.tmp 1016 1BAB.tmp 3040 1BEA.tmp 1988 1C28.tmp 2824 1C66.tmp 1668 1CA5.tmp 3060 1CE3.tmp 1684 1D31.tmp 2256 1D70.tmp 880 1DAE.tmp 1704 1DEC.tmp 1500 1E2B.tmp 1840 1E69.tmp 2324 1EB7.tmp 1444 1EF6.tmp 1724 1F34.tmp 2540 1F72.tmp 2600 1FB1.tmp 2544 1FEF.tmp 2772 202E.tmp -
Loads dropped DLL 64 IoCs
pid Process 1728 2024-05-20_382f8cff1ba3acd466185ae0252cc0d4_mafia.exe 1444 D0B.tmp 2716 D69.tmp 2984 DD6.tmp 2668 E24.tmp 2232 E91.tmp 2696 EEF.tmp 2744 F5C.tmp 2656 FBA.tmp 2448 1027.tmp 2436 1084.tmp 2868 10F2.tmp 1480 114F.tmp 2644 11AD.tmp 2728 120A.tmp 2852 1268.tmp 1260 12C6.tmp 1576 1323.tmp 2280 1381.tmp 356 13EE.tmp 1184 144C.tmp 836 14C8.tmp 2036 1526.tmp 2008 1574.tmp 1940 15C2.tmp 2908 1600.tmp 2220 164E.tmp 1696 169C.tmp 1824 16DB.tmp 1900 1729.tmp 324 1767.tmp 780 17A6.tmp 1400 17F4.tmp 2372 1842.tmp 888 1880.tmp 1772 18BE.tmp 1452 18FD.tmp 2080 194B.tmp 700 1989.tmp 2356 19C8.tmp 2988 1A16.tmp 2784 1A54.tmp 1504 1A92.tmp 792 1AD1.tmp 1780 1B1F.tmp 1012 1B6D.tmp 1016 1BAB.tmp 3040 1BEA.tmp 1988 1C28.tmp 2824 1C66.tmp 1668 1CA5.tmp 3060 1CE3.tmp 1684 1D31.tmp 2256 1D70.tmp 880 1DAE.tmp 1704 1DEC.tmp 1500 1E2B.tmp 1840 1E69.tmp 2324 1EB7.tmp 1444 1EF6.tmp 1724 1F34.tmp 2540 1F72.tmp 2600 1FB1.tmp 2544 1FEF.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1728 wrote to memory of 1444 1728 2024-05-20_382f8cff1ba3acd466185ae0252cc0d4_mafia.exe 28 PID 1728 wrote to memory of 1444 1728 2024-05-20_382f8cff1ba3acd466185ae0252cc0d4_mafia.exe 28 PID 1728 wrote to memory of 1444 1728 2024-05-20_382f8cff1ba3acd466185ae0252cc0d4_mafia.exe 28 PID 1728 wrote to memory of 1444 1728 2024-05-20_382f8cff1ba3acd466185ae0252cc0d4_mafia.exe 28 PID 1444 wrote to memory of 2716 1444 D0B.tmp 29 PID 1444 wrote to memory of 2716 1444 D0B.tmp 29 PID 1444 wrote to memory of 2716 1444 D0B.tmp 29 PID 1444 wrote to memory of 2716 1444 D0B.tmp 29 PID 2716 wrote to memory of 2984 2716 D69.tmp 30 PID 2716 wrote to memory of 2984 2716 D69.tmp 30 PID 2716 wrote to memory of 2984 2716 D69.tmp 30 PID 2716 wrote to memory of 2984 2716 D69.tmp 30 PID 2984 wrote to memory of 2668 2984 DD6.tmp 31 PID 2984 wrote to memory of 2668 2984 DD6.tmp 31 PID 2984 wrote to memory of 2668 2984 DD6.tmp 31 PID 2984 wrote to memory of 2668 2984 DD6.tmp 31 PID 2668 wrote to memory of 2232 2668 E24.tmp 32 PID 2668 wrote to memory of 2232 2668 E24.tmp 32 PID 2668 wrote to memory of 2232 2668 E24.tmp 32 PID 2668 wrote to memory of 2232 2668 E24.tmp 32 PID 2232 wrote to memory of 2696 2232 E91.tmp 33 PID 2232 wrote to memory of 2696 2232 E91.tmp 33 PID 2232 wrote to memory of 2696 2232 E91.tmp 33 PID 2232 wrote to memory of 2696 2232 E91.tmp 33 PID 2696 wrote to memory of 2744 2696 EEF.tmp 34 PID 2696 wrote to memory of 2744 2696 EEF.tmp 34 PID 2696 wrote to memory of 2744 2696 EEF.tmp 34 PID 2696 wrote to memory of 2744 2696 EEF.tmp 34 PID 2744 wrote to memory of 2656 2744 F5C.tmp 35 PID 2744 wrote to memory of 2656 2744 F5C.tmp 35 PID 2744 wrote to memory of 2656 2744 F5C.tmp 35 PID 2744 wrote to memory of 2656 2744 F5C.tmp 35 PID 2656 wrote to memory of 2448 2656 FBA.tmp 36 PID 2656 wrote to memory of 2448 2656 FBA.tmp 36 PID 2656 wrote to memory of 2448 2656 FBA.tmp 36 PID 2656 wrote to memory of 2448 2656 FBA.tmp 36 PID 2448 wrote to memory of 2436 2448 1027.tmp 37 PID 2448 wrote to memory of 2436 2448 1027.tmp 37 PID 2448 wrote to memory of 2436 2448 1027.tmp 37 PID 2448 wrote to memory of 2436 2448 1027.tmp 37 PID 2436 wrote to memory of 2868 2436 1084.tmp 38 PID 2436 wrote to memory of 2868 2436 1084.tmp 38 PID 2436 wrote to memory of 2868 2436 1084.tmp 38 PID 2436 wrote to memory of 2868 2436 1084.tmp 38 PID 2868 wrote to memory of 1480 2868 10F2.tmp 39 PID 2868 wrote to memory of 1480 2868 10F2.tmp 39 PID 2868 wrote to memory of 1480 2868 10F2.tmp 39 PID 2868 wrote to memory of 1480 2868 10F2.tmp 39 PID 1480 wrote to memory of 2644 1480 114F.tmp 40 PID 1480 wrote to memory of 2644 1480 114F.tmp 40 PID 1480 wrote to memory of 2644 1480 114F.tmp 40 PID 1480 wrote to memory of 2644 1480 114F.tmp 40 PID 2644 wrote to memory of 2728 2644 11AD.tmp 41 PID 2644 wrote to memory of 2728 2644 11AD.tmp 41 PID 2644 wrote to memory of 2728 2644 11AD.tmp 41 PID 2644 wrote to memory of 2728 2644 11AD.tmp 41 PID 2728 wrote to memory of 2852 2728 120A.tmp 42 PID 2728 wrote to memory of 2852 2728 120A.tmp 42 PID 2728 wrote to memory of 2852 2728 120A.tmp 42 PID 2728 wrote to memory of 2852 2728 120A.tmp 42 PID 2852 wrote to memory of 1260 2852 1268.tmp 43 PID 2852 wrote to memory of 1260 2852 1268.tmp 43 PID 2852 wrote to memory of 1260 2852 1268.tmp 43 PID 2852 wrote to memory of 1260 2852 1268.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-20_382f8cff1ba3acd466185ae0252cc0d4_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-20_382f8cff1ba3acd466185ae0252cc0d4_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\D0B.tmp"C:\Users\Admin\AppData\Local\Temp\D0B.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\D69.tmp"C:\Users\Admin\AppData\Local\Temp\D69.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\DD6.tmp"C:\Users\Admin\AppData\Local\Temp\DD6.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\E24.tmp"C:\Users\Admin\AppData\Local\Temp\E24.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\E91.tmp"C:\Users\Admin\AppData\Local\Temp\E91.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\EEF.tmp"C:\Users\Admin\AppData\Local\Temp\EEF.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\F5C.tmp"C:\Users\Admin\AppData\Local\Temp\F5C.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\FBA.tmp"C:\Users\Admin\AppData\Local\Temp\FBA.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\1027.tmp"C:\Users\Admin\AppData\Local\Temp\1027.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\1084.tmp"C:\Users\Admin\AppData\Local\Temp\1084.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\10F2.tmp"C:\Users\Admin\AppData\Local\Temp\10F2.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\114F.tmp"C:\Users\Admin\AppData\Local\Temp\114F.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\11AD.tmp"C:\Users\Admin\AppData\Local\Temp\11AD.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\120A.tmp"C:\Users\Admin\AppData\Local\Temp\120A.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\1268.tmp"C:\Users\Admin\AppData\Local\Temp\1268.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\12C6.tmp"C:\Users\Admin\AppData\Local\Temp\12C6.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\1323.tmp"C:\Users\Admin\AppData\Local\Temp\1323.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\1381.tmp"C:\Users\Admin\AppData\Local\Temp\1381.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\13EE.tmp"C:\Users\Admin\AppData\Local\Temp\13EE.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:356 -
C:\Users\Admin\AppData\Local\Temp\144C.tmp"C:\Users\Admin\AppData\Local\Temp\144C.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\14C8.tmp"C:\Users\Admin\AppData\Local\Temp\14C8.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:836 -
C:\Users\Admin\AppData\Local\Temp\1526.tmp"C:\Users\Admin\AppData\Local\Temp\1526.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\1574.tmp"C:\Users\Admin\AppData\Local\Temp\1574.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\15C2.tmp"C:\Users\Admin\AppData\Local\Temp\15C2.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\1600.tmp"C:\Users\Admin\AppData\Local\Temp\1600.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\164E.tmp"C:\Users\Admin\AppData\Local\Temp\164E.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\169C.tmp"C:\Users\Admin\AppData\Local\Temp\169C.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\16DB.tmp"C:\Users\Admin\AppData\Local\Temp\16DB.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\1729.tmp"C:\Users\Admin\AppData\Local\Temp\1729.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\1767.tmp"C:\Users\Admin\AppData\Local\Temp\1767.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:324 -
C:\Users\Admin\AppData\Local\Temp\17A6.tmp"C:\Users\Admin\AppData\Local\Temp\17A6.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:780 -
C:\Users\Admin\AppData\Local\Temp\17F4.tmp"C:\Users\Admin\AppData\Local\Temp\17F4.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\1842.tmp"C:\Users\Admin\AppData\Local\Temp\1842.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\1880.tmp"C:\Users\Admin\AppData\Local\Temp\1880.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:888 -
C:\Users\Admin\AppData\Local\Temp\18BE.tmp"C:\Users\Admin\AppData\Local\Temp\18BE.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\18FD.tmp"C:\Users\Admin\AppData\Local\Temp\18FD.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\194B.tmp"C:\Users\Admin\AppData\Local\Temp\194B.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\1989.tmp"C:\Users\Admin\AppData\Local\Temp\1989.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:700 -
C:\Users\Admin\AppData\Local\Temp\19C8.tmp"C:\Users\Admin\AppData\Local\Temp\19C8.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\1A16.tmp"C:\Users\Admin\AppData\Local\Temp\1A16.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\1A54.tmp"C:\Users\Admin\AppData\Local\Temp\1A54.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\1A92.tmp"C:\Users\Admin\AppData\Local\Temp\1A92.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:792 -
C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\1B6D.tmp"C:\Users\Admin\AppData\Local\Temp\1B6D.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\1BEA.tmp"C:\Users\Admin\AppData\Local\Temp\1BEA.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\1C28.tmp"C:\Users\Admin\AppData\Local\Temp\1C28.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\1C66.tmp"C:\Users\Admin\AppData\Local\Temp\1C66.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\1D31.tmp"C:\Users\Admin\AppData\Local\Temp\1D31.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\1D70.tmp"C:\Users\Admin\AppData\Local\Temp\1D70.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:880 -
C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\1E69.tmp"C:\Users\Admin\AppData\Local\Temp\1E69.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\1F34.tmp"C:\Users\Admin\AppData\Local\Temp\1F34.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\1F72.tmp"C:\Users\Admin\AppData\Local\Temp\1F72.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\202E.tmp"C:\Users\Admin\AppData\Local\Temp\202E.tmp"65⤵
- Executes dropped EXE
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\206C.tmp"C:\Users\Admin\AppData\Local\Temp\206C.tmp"66⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\20BA.tmp"C:\Users\Admin\AppData\Local\Temp\20BA.tmp"67⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\2108.tmp"C:\Users\Admin\AppData\Local\Temp\2108.tmp"68⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\2146.tmp"C:\Users\Admin\AppData\Local\Temp\2146.tmp"69⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\2185.tmp"C:\Users\Admin\AppData\Local\Temp\2185.tmp"70⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\21C3.tmp"C:\Users\Admin\AppData\Local\Temp\21C3.tmp"71⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\2202.tmp"C:\Users\Admin\AppData\Local\Temp\2202.tmp"72⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\2240.tmp"C:\Users\Admin\AppData\Local\Temp\2240.tmp"73⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\228E.tmp"C:\Users\Admin\AppData\Local\Temp\228E.tmp"74⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\22CC.tmp"C:\Users\Admin\AppData\Local\Temp\22CC.tmp"75⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\230B.tmp"C:\Users\Admin\AppData\Local\Temp\230B.tmp"76⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\2349.tmp"C:\Users\Admin\AppData\Local\Temp\2349.tmp"77⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\2388.tmp"C:\Users\Admin\AppData\Local\Temp\2388.tmp"78⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\23C6.tmp"C:\Users\Admin\AppData\Local\Temp\23C6.tmp"79⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\2404.tmp"C:\Users\Admin\AppData\Local\Temp\2404.tmp"80⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\2443.tmp"C:\Users\Admin\AppData\Local\Temp\2443.tmp"81⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\2481.tmp"C:\Users\Admin\AppData\Local\Temp\2481.tmp"82⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\24C0.tmp"C:\Users\Admin\AppData\Local\Temp\24C0.tmp"83⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\24FE.tmp"C:\Users\Admin\AppData\Local\Temp\24FE.tmp"84⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\253C.tmp"C:\Users\Admin\AppData\Local\Temp\253C.tmp"85⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\257B.tmp"C:\Users\Admin\AppData\Local\Temp\257B.tmp"86⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\25B9.tmp"C:\Users\Admin\AppData\Local\Temp\25B9.tmp"87⤵PID:356
-
C:\Users\Admin\AppData\Local\Temp\2607.tmp"C:\Users\Admin\AppData\Local\Temp\2607.tmp"88⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\2646.tmp"C:\Users\Admin\AppData\Local\Temp\2646.tmp"89⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\2684.tmp"C:\Users\Admin\AppData\Local\Temp\2684.tmp"90⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\26D2.tmp"C:\Users\Admin\AppData\Local\Temp\26D2.tmp"91⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\2710.tmp"C:\Users\Admin\AppData\Local\Temp\2710.tmp"92⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\274F.tmp"C:\Users\Admin\AppData\Local\Temp\274F.tmp"93⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\278D.tmp"C:\Users\Admin\AppData\Local\Temp\278D.tmp"94⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\27DB.tmp"C:\Users\Admin\AppData\Local\Temp\27DB.tmp"95⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\281A.tmp"C:\Users\Admin\AppData\Local\Temp\281A.tmp"96⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\2858.tmp"C:\Users\Admin\AppData\Local\Temp\2858.tmp"97⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\28A6.tmp"C:\Users\Admin\AppData\Local\Temp\28A6.tmp"98⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\28E4.tmp"C:\Users\Admin\AppData\Local\Temp\28E4.tmp"99⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\2923.tmp"C:\Users\Admin\AppData\Local\Temp\2923.tmp"100⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\2961.tmp"C:\Users\Admin\AppData\Local\Temp\2961.tmp"101⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\29A0.tmp"C:\Users\Admin\AppData\Local\Temp\29A0.tmp"102⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\29DE.tmp"C:\Users\Admin\AppData\Local\Temp\29DE.tmp"103⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"104⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"105⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\2A99.tmp"C:\Users\Admin\AppData\Local\Temp\2A99.tmp"106⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"107⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\2B26.tmp"C:\Users\Admin\AppData\Local\Temp\2B26.tmp"108⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\2B64.tmp"C:\Users\Admin\AppData\Local\Temp\2B64.tmp"109⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"110⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\2BE1.tmp"C:\Users\Admin\AppData\Local\Temp\2BE1.tmp"111⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\2C1F.tmp"C:\Users\Admin\AppData\Local\Temp\2C1F.tmp"112⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"113⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\2C9C.tmp"C:\Users\Admin\AppData\Local\Temp\2C9C.tmp"114⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"115⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\2D19.tmp"C:\Users\Admin\AppData\Local\Temp\2D19.tmp"116⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\2D57.tmp"C:\Users\Admin\AppData\Local\Temp\2D57.tmp"117⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\2D96.tmp"C:\Users\Admin\AppData\Local\Temp\2D96.tmp"118⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"119⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\2E12.tmp"C:\Users\Admin\AppData\Local\Temp\2E12.tmp"120⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\2E51.tmp"C:\Users\Admin\AppData\Local\Temp\2E51.tmp"121⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"122⤵PID:2068
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-