Analysis
-
max time kernel
151s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 20:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-20_7de4b370a0e700ca7763236a8a744b67_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-20_7de4b370a0e700ca7763236a8a744b67_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-05-20_7de4b370a0e700ca7763236a8a744b67_mafia.exe
-
Size
536KB
-
MD5
7de4b370a0e700ca7763236a8a744b67
-
SHA1
1423ac4d3f6b7ebc1a75669eb7eb5c12112d6bf8
-
SHA256
aaf9271905979e70395008604413132a5a934e7295244f30741c0556f4ec59f4
-
SHA512
e0db1904e0cc04d6be8907848ba8ad5a9b74f73200ebbfd38747ef1900957b505457e4ac4b1195e0a5e325ba692ac6cde89cb206d2ae250189a82e2e905201f0
-
SSDEEP
12288:wU5rCOTeiULUgRhbOCPJm9bprhpPeVgIZxVJ0ZT9:wUQOJULfR5nPkprzGVgIRJ0ZT9
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2068 91B5.tmp 2504 930C.tmp 2764 94C1.tmp 2892 9608.tmp 2700 977F.tmp 2860 98C6.tmp 2368 9A7B.tmp 2820 9C11.tmp 776 9CDB.tmp 1660 9D77.tmp 764 9E42.tmp 2276 9EFD.tmp 1400 9F99.tmp 544 A016.tmp 2180 A0C2.tmp 2140 A2B5.tmp 1872 A3AF.tmp 1756 A45A.tmp 1264 A4E7.tmp 2476 A583.tmp 2704 A63E.tmp 2216 A6F9.tmp 476 A795.tmp 800 A850.tmp 1928 A8EC.tmp 1896 A988.tmp 2084 AA34.tmp 1788 AAD0.tmp 1444 AB7B.tmp 1536 AC27.tmp 1404 ACD3.tmp 1248 AD6F.tmp 320 AE1A.tmp 872 AEB6.tmp 540 AF43.tmp 2020 AFDF.tmp 2112 B07B.tmp 2268 B107.tmp 1888 B1B3.tmp 2240 B24F.tmp 1524 B3D5.tmp 2940 B4BF.tmp 2468 B56A.tmp 2596 B606.tmp 2684 B700.tmp 2536 B7F9.tmp 2552 BBEF.tmp 2464 BF0B.tmp 2600 BFA7.tmp 2420 C081.tmp 2824 C0EF.tmp 3008 C19A.tmp 1808 C217.tmp 1420 C294.tmp 2172 C311.tmp 1508 C39D.tmp 2432 C41A.tmp 1224 C497.tmp 2184 C504.tmp 1492 C5BF.tmp 2176 C66B.tmp 1948 C6D8.tmp 2000 C755.tmp 2732 C7C2.tmp -
Loads dropped DLL 64 IoCs
pid Process 2988 2024-05-20_7de4b370a0e700ca7763236a8a744b67_mafia.exe 2068 91B5.tmp 2504 930C.tmp 2764 94C1.tmp 2892 9608.tmp 2700 977F.tmp 2860 98C6.tmp 2368 9A7B.tmp 2820 9C11.tmp 776 9CDB.tmp 1660 9D77.tmp 764 9E42.tmp 2276 9EFD.tmp 1400 9F99.tmp 544 A016.tmp 2180 A0C2.tmp 2140 A2B5.tmp 1872 A3AF.tmp 1756 A45A.tmp 1264 A4E7.tmp 2476 A583.tmp 2704 A63E.tmp 2216 A6F9.tmp 476 A795.tmp 800 A850.tmp 1928 A8EC.tmp 1896 A988.tmp 2084 AA34.tmp 1788 AAD0.tmp 1444 AB7B.tmp 1536 AC27.tmp 1404 ACD3.tmp 1248 AD6F.tmp 320 AE1A.tmp 872 AEB6.tmp 540 AF43.tmp 2020 AFDF.tmp 2112 B07B.tmp 2268 B107.tmp 1888 B1B3.tmp 2240 B24F.tmp 1524 B3D5.tmp 2940 B4BF.tmp 2468 B56A.tmp 2596 B606.tmp 2684 B700.tmp 2536 B7F9.tmp 2552 BBEF.tmp 2464 BF0B.tmp 2600 BFA7.tmp 2420 C081.tmp 2824 C0EF.tmp 3008 C19A.tmp 1808 C217.tmp 1420 C294.tmp 2172 C311.tmp 1508 C39D.tmp 2432 C41A.tmp 1224 C497.tmp 2184 C504.tmp 1492 C5BF.tmp 2176 C66B.tmp 1948 C6D8.tmp 2000 C755.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2988 wrote to memory of 2068 2988 2024-05-20_7de4b370a0e700ca7763236a8a744b67_mafia.exe 28 PID 2988 wrote to memory of 2068 2988 2024-05-20_7de4b370a0e700ca7763236a8a744b67_mafia.exe 28 PID 2988 wrote to memory of 2068 2988 2024-05-20_7de4b370a0e700ca7763236a8a744b67_mafia.exe 28 PID 2988 wrote to memory of 2068 2988 2024-05-20_7de4b370a0e700ca7763236a8a744b67_mafia.exe 28 PID 2068 wrote to memory of 2504 2068 91B5.tmp 29 PID 2068 wrote to memory of 2504 2068 91B5.tmp 29 PID 2068 wrote to memory of 2504 2068 91B5.tmp 29 PID 2068 wrote to memory of 2504 2068 91B5.tmp 29 PID 2504 wrote to memory of 2764 2504 930C.tmp 30 PID 2504 wrote to memory of 2764 2504 930C.tmp 30 PID 2504 wrote to memory of 2764 2504 930C.tmp 30 PID 2504 wrote to memory of 2764 2504 930C.tmp 30 PID 2764 wrote to memory of 2892 2764 94C1.tmp 31 PID 2764 wrote to memory of 2892 2764 94C1.tmp 31 PID 2764 wrote to memory of 2892 2764 94C1.tmp 31 PID 2764 wrote to memory of 2892 2764 94C1.tmp 31 PID 2892 wrote to memory of 2700 2892 9608.tmp 32 PID 2892 wrote to memory of 2700 2892 9608.tmp 32 PID 2892 wrote to memory of 2700 2892 9608.tmp 32 PID 2892 wrote to memory of 2700 2892 9608.tmp 32 PID 2700 wrote to memory of 2860 2700 977F.tmp 33 PID 2700 wrote to memory of 2860 2700 977F.tmp 33 PID 2700 wrote to memory of 2860 2700 977F.tmp 33 PID 2700 wrote to memory of 2860 2700 977F.tmp 33 PID 2860 wrote to memory of 2368 2860 98C6.tmp 34 PID 2860 wrote to memory of 2368 2860 98C6.tmp 34 PID 2860 wrote to memory of 2368 2860 98C6.tmp 34 PID 2860 wrote to memory of 2368 2860 98C6.tmp 34 PID 2368 wrote to memory of 2820 2368 9A7B.tmp 35 PID 2368 wrote to memory of 2820 2368 9A7B.tmp 35 PID 2368 wrote to memory of 2820 2368 9A7B.tmp 35 PID 2368 wrote to memory of 2820 2368 9A7B.tmp 35 PID 2820 wrote to memory of 776 2820 9C11.tmp 36 PID 2820 wrote to memory of 776 2820 9C11.tmp 36 PID 2820 wrote to memory of 776 2820 9C11.tmp 36 PID 2820 wrote to memory of 776 2820 9C11.tmp 36 PID 776 wrote to memory of 1660 776 9CDB.tmp 37 PID 776 wrote to memory of 1660 776 9CDB.tmp 37 PID 776 wrote to memory of 1660 776 9CDB.tmp 37 PID 776 wrote to memory of 1660 776 9CDB.tmp 37 PID 1660 wrote to memory of 764 1660 9D77.tmp 38 PID 1660 wrote to memory of 764 1660 9D77.tmp 38 PID 1660 wrote to memory of 764 1660 9D77.tmp 38 PID 1660 wrote to memory of 764 1660 9D77.tmp 38 PID 764 wrote to memory of 2276 764 9E42.tmp 39 PID 764 wrote to memory of 2276 764 9E42.tmp 39 PID 764 wrote to memory of 2276 764 9E42.tmp 39 PID 764 wrote to memory of 2276 764 9E42.tmp 39 PID 2276 wrote to memory of 1400 2276 9EFD.tmp 40 PID 2276 wrote to memory of 1400 2276 9EFD.tmp 40 PID 2276 wrote to memory of 1400 2276 9EFD.tmp 40 PID 2276 wrote to memory of 1400 2276 9EFD.tmp 40 PID 1400 wrote to memory of 544 1400 9F99.tmp 41 PID 1400 wrote to memory of 544 1400 9F99.tmp 41 PID 1400 wrote to memory of 544 1400 9F99.tmp 41 PID 1400 wrote to memory of 544 1400 9F99.tmp 41 PID 544 wrote to memory of 2180 544 A016.tmp 42 PID 544 wrote to memory of 2180 544 A016.tmp 42 PID 544 wrote to memory of 2180 544 A016.tmp 42 PID 544 wrote to memory of 2180 544 A016.tmp 42 PID 2180 wrote to memory of 2140 2180 A0C2.tmp 43 PID 2180 wrote to memory of 2140 2180 A0C2.tmp 43 PID 2180 wrote to memory of 2140 2180 A0C2.tmp 43 PID 2180 wrote to memory of 2140 2180 A0C2.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-20_7de4b370a0e700ca7763236a8a744b67_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-20_7de4b370a0e700ca7763236a8a744b67_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\91B5.tmp"C:\Users\Admin\AppData\Local\Temp\91B5.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\930C.tmp"C:\Users\Admin\AppData\Local\Temp\930C.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\94C1.tmp"C:\Users\Admin\AppData\Local\Temp\94C1.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\9608.tmp"C:\Users\Admin\AppData\Local\Temp\9608.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\977F.tmp"C:\Users\Admin\AppData\Local\Temp\977F.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\98C6.tmp"C:\Users\Admin\AppData\Local\Temp\98C6.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\9C11.tmp"C:\Users\Admin\AppData\Local\Temp\9C11.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\9CDB.tmp"C:\Users\Admin\AppData\Local\Temp\9CDB.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Users\Admin\AppData\Local\Temp\9D77.tmp"C:\Users\Admin\AppData\Local\Temp\9D77.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\9E42.tmp"C:\Users\Admin\AppData\Local\Temp\9E42.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Users\Admin\AppData\Local\Temp\9EFD.tmp"C:\Users\Admin\AppData\Local\Temp\9EFD.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\9F99.tmp"C:\Users\Admin\AppData\Local\Temp\9F99.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\A016.tmp"C:\Users\Admin\AppData\Local\Temp\A016.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Users\Admin\AppData\Local\Temp\A0C2.tmp"C:\Users\Admin\AppData\Local\Temp\A0C2.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\A2B5.tmp"C:\Users\Admin\AppData\Local\Temp\A2B5.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\A3AF.tmp"C:\Users\Admin\AppData\Local\Temp\A3AF.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\A45A.tmp"C:\Users\Admin\AppData\Local\Temp\A45A.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\A4E7.tmp"C:\Users\Admin\AppData\Local\Temp\A4E7.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\A583.tmp"C:\Users\Admin\AppData\Local\Temp\A583.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\A63E.tmp"C:\Users\Admin\AppData\Local\Temp\A63E.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\A6F9.tmp"C:\Users\Admin\AppData\Local\Temp\A6F9.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\A795.tmp"C:\Users\Admin\AppData\Local\Temp\A795.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:476 -
C:\Users\Admin\AppData\Local\Temp\A850.tmp"C:\Users\Admin\AppData\Local\Temp\A850.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:800 -
C:\Users\Admin\AppData\Local\Temp\A8EC.tmp"C:\Users\Admin\AppData\Local\Temp\A8EC.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\A988.tmp"C:\Users\Admin\AppData\Local\Temp\A988.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\AA34.tmp"C:\Users\Admin\AppData\Local\Temp\AA34.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\AAD0.tmp"C:\Users\Admin\AppData\Local\Temp\AAD0.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\AB7B.tmp"C:\Users\Admin\AppData\Local\Temp\AB7B.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\AC27.tmp"C:\Users\Admin\AppData\Local\Temp\AC27.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\ACD3.tmp"C:\Users\Admin\AppData\Local\Temp\ACD3.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\AD6F.tmp"C:\Users\Admin\AppData\Local\Temp\AD6F.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\AE1A.tmp"C:\Users\Admin\AppData\Local\Temp\AE1A.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:320 -
C:\Users\Admin\AppData\Local\Temp\AEB6.tmp"C:\Users\Admin\AppData\Local\Temp\AEB6.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:872 -
C:\Users\Admin\AppData\Local\Temp\AF43.tmp"C:\Users\Admin\AppData\Local\Temp\AF43.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:540 -
C:\Users\Admin\AppData\Local\Temp\AFDF.tmp"C:\Users\Admin\AppData\Local\Temp\AFDF.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\B07B.tmp"C:\Users\Admin\AppData\Local\Temp\B07B.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\B107.tmp"C:\Users\Admin\AppData\Local\Temp\B107.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\B1B3.tmp"C:\Users\Admin\AppData\Local\Temp\B1B3.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\B24F.tmp"C:\Users\Admin\AppData\Local\Temp\B24F.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\B3D5.tmp"C:\Users\Admin\AppData\Local\Temp\B3D5.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\B4BF.tmp"C:\Users\Admin\AppData\Local\Temp\B4BF.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\B56A.tmp"C:\Users\Admin\AppData\Local\Temp\B56A.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\B606.tmp"C:\Users\Admin\AppData\Local\Temp\B606.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\B700.tmp"C:\Users\Admin\AppData\Local\Temp\B700.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\B7F9.tmp"C:\Users\Admin\AppData\Local\Temp\B7F9.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\BBEF.tmp"C:\Users\Admin\AppData\Local\Temp\BBEF.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\BF0B.tmp"C:\Users\Admin\AppData\Local\Temp\BF0B.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\BFA7.tmp"C:\Users\Admin\AppData\Local\Temp\BFA7.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\C081.tmp"C:\Users\Admin\AppData\Local\Temp\C081.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\C0EF.tmp"C:\Users\Admin\AppData\Local\Temp\C0EF.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\C19A.tmp"C:\Users\Admin\AppData\Local\Temp\C19A.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\C217.tmp"C:\Users\Admin\AppData\Local\Temp\C217.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\C294.tmp"C:\Users\Admin\AppData\Local\Temp\C294.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\C311.tmp"C:\Users\Admin\AppData\Local\Temp\C311.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\C39D.tmp"C:\Users\Admin\AppData\Local\Temp\C39D.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\C41A.tmp"C:\Users\Admin\AppData\Local\Temp\C41A.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\C497.tmp"C:\Users\Admin\AppData\Local\Temp\C497.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\C504.tmp"C:\Users\Admin\AppData\Local\Temp\C504.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\C5BF.tmp"C:\Users\Admin\AppData\Local\Temp\C5BF.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\C66B.tmp"C:\Users\Admin\AppData\Local\Temp\C66B.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\C6D8.tmp"C:\Users\Admin\AppData\Local\Temp\C6D8.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\C755.tmp"C:\Users\Admin\AppData\Local\Temp\C755.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\C7C2.tmp"C:\Users\Admin\AppData\Local\Temp\C7C2.tmp"65⤵
- Executes dropped EXE
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\C85E.tmp"C:\Users\Admin\AppData\Local\Temp\C85E.tmp"66⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\C8BB.tmp"C:\Users\Admin\AppData\Local\Temp\C8BB.tmp"67⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\C919.tmp"C:\Users\Admin\AppData\Local\Temp\C919.tmp"68⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\C977.tmp"C:\Users\Admin\AppData\Local\Temp\C977.tmp"69⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\C9F3.tmp"C:\Users\Admin\AppData\Local\Temp\C9F3.tmp"70⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\CA61.tmp"C:\Users\Admin\AppData\Local\Temp\CA61.tmp"71⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\CAED.tmp"C:\Users\Admin\AppData\Local\Temp\CAED.tmp"72⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\CB79.tmp"C:\Users\Admin\AppData\Local\Temp\CB79.tmp"73⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\CC06.tmp"C:\Users\Admin\AppData\Local\Temp\CC06.tmp"74⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\CC73.tmp"C:\Users\Admin\AppData\Local\Temp\CC73.tmp"75⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\CD0F.tmp"C:\Users\Admin\AppData\Local\Temp\CD0F.tmp"76⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\CD8C.tmp"C:\Users\Admin\AppData\Local\Temp\CD8C.tmp"77⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\CE09.tmp"C:\Users\Admin\AppData\Local\Temp\CE09.tmp"78⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\CE66.tmp"C:\Users\Admin\AppData\Local\Temp\CE66.tmp"79⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\CED3.tmp"C:\Users\Admin\AppData\Local\Temp\CED3.tmp"80⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\CF50.tmp"C:\Users\Admin\AppData\Local\Temp\CF50.tmp"81⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\CFFC.tmp"C:\Users\Admin\AppData\Local\Temp\CFFC.tmp"82⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\D059.tmp"C:\Users\Admin\AppData\Local\Temp\D059.tmp"83⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\D0D6.tmp"C:\Users\Admin\AppData\Local\Temp\D0D6.tmp"84⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\D143.tmp"C:\Users\Admin\AppData\Local\Temp\D143.tmp"85⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\D1B1.tmp"C:\Users\Admin\AppData\Local\Temp\D1B1.tmp"86⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\D21E.tmp"C:\Users\Admin\AppData\Local\Temp\D21E.tmp"87⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\D27B.tmp"C:\Users\Admin\AppData\Local\Temp\D27B.tmp"88⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\D3D3.tmp"C:\Users\Admin\AppData\Local\Temp\D3D3.tmp"89⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\D44F.tmp"C:\Users\Admin\AppData\Local\Temp\D44F.tmp"90⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\D4BD.tmp"C:\Users\Admin\AppData\Local\Temp\D4BD.tmp"91⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\D52A.tmp"C:\Users\Admin\AppData\Local\Temp\D52A.tmp"92⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\D5A7.tmp"C:\Users\Admin\AppData\Local\Temp\D5A7.tmp"93⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\D614.tmp"C:\Users\Admin\AppData\Local\Temp\D614.tmp"94⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\D681.tmp"C:\Users\Admin\AppData\Local\Temp\D681.tmp"95⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\D6EE.tmp"C:\Users\Admin\AppData\Local\Temp\D6EE.tmp"96⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\D77B.tmp"C:\Users\Admin\AppData\Local\Temp\D77B.tmp"97⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\D7E8.tmp"C:\Users\Admin\AppData\Local\Temp\D7E8.tmp"98⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\D855.tmp"C:\Users\Admin\AppData\Local\Temp\D855.tmp"99⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\D8D2.tmp"C:\Users\Admin\AppData\Local\Temp\D8D2.tmp"100⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\D93F.tmp"C:\Users\Admin\AppData\Local\Temp\D93F.tmp"101⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\D9BC.tmp"C:\Users\Admin\AppData\Local\Temp\D9BC.tmp"102⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\DA48.tmp"C:\Users\Admin\AppData\Local\Temp\DA48.tmp"103⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\DAB5.tmp"C:\Users\Admin\AppData\Local\Temp\DAB5.tmp"104⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\DB51.tmp"C:\Users\Admin\AppData\Local\Temp\DB51.tmp"105⤵PID:108
-
C:\Users\Admin\AppData\Local\Temp\DBDE.tmp"C:\Users\Admin\AppData\Local\Temp\DBDE.tmp"106⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\DC4B.tmp"C:\Users\Admin\AppData\Local\Temp\DC4B.tmp"107⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\DCA9.tmp"C:\Users\Admin\AppData\Local\Temp\DCA9.tmp"108⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\DD16.tmp"C:\Users\Admin\AppData\Local\Temp\DD16.tmp"109⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\DD93.tmp"C:\Users\Admin\AppData\Local\Temp\DD93.tmp"110⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\DDF0.tmp"C:\Users\Admin\AppData\Local\Temp\DDF0.tmp"111⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\DE6D.tmp"C:\Users\Admin\AppData\Local\Temp\DE6D.tmp"112⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\DEEA.tmp"C:\Users\Admin\AppData\Local\Temp\DEEA.tmp"113⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\DF76.tmp"C:\Users\Admin\AppData\Local\Temp\DF76.tmp"114⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\DFF3.tmp"C:\Users\Admin\AppData\Local\Temp\DFF3.tmp"115⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\E060.tmp"C:\Users\Admin\AppData\Local\Temp\E060.tmp"116⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\E0BE.tmp"C:\Users\Admin\AppData\Local\Temp\E0BE.tmp"117⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\E13B.tmp"C:\Users\Admin\AppData\Local\Temp\E13B.tmp"118⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\E1B8.tmp"C:\Users\Admin\AppData\Local\Temp\E1B8.tmp"119⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\E225.tmp"C:\Users\Admin\AppData\Local\Temp\E225.tmp"120⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\E2A2.tmp"C:\Users\Admin\AppData\Local\Temp\E2A2.tmp"121⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\E2FF.tmp"C:\Users\Admin\AppData\Local\Temp\E2FF.tmp"122⤵PID:2732
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-