Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
05-06-2024 13:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-05_40829a75403222f6fdce220d6f991add_mafia.exe
Resource
win7-20240508-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-05_40829a75403222f6fdce220d6f991add_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-06-05_40829a75403222f6fdce220d6f991add_mafia.exe
-
Size
529KB
-
MD5
40829a75403222f6fdce220d6f991add
-
SHA1
64cb029e164bed1ba05d598da18ebb29b8216cc2
-
SHA256
a628bdc58ae496a0fd824da43fb520993eea4f928b1d269d27c4d9a9d714724c
-
SHA512
292f7ac73499e2fc3dd64ba96169d08764ab8d46a7f1757a9cdcb81716c6b38b47f3e685b668f001470b2d82e3a4b83dabd7c7137777ac6560eadac5be0137a9
-
SSDEEP
12288:NU5rCOTeijRPgWKF/znaADlmHvuss2nDVN5n96WQTZwlH4Hp:NUQOJjRPgWKRznvlmPuv2DVz9tQTSlH2
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2744 24C0.tmp 2232 253C.tmp 2680 25E8.tmp 2868 2655.tmp 1192 26A3.tmp 2052 274F.tmp 2684 279D.tmp 2460 27EB.tmp 2524 2858.tmp 2660 28E4.tmp 1236 2942.tmp 856 29A0.tmp 2760 2A5B.tmp 2772 2AB8.tmp 1548 2B06.tmp 984 2B64.tmp 1888 2BB2.tmp 2184 2C10.tmp 2192 2C5E.tmp 2124 2CDA.tmp 768 2D38.tmp 2828 2DB5.tmp 1136 2E03.tmp 2008 2E41.tmp 2984 2EAE.tmp 2548 2F0C.tmp 2328 2F6A.tmp 2244 2FB8.tmp 2556 3006.tmp 2440 3063.tmp 2084 30B1.tmp 1388 30FF.tmp 2896 314D.tmp 2848 318C.tmp 1108 31DA.tmp 904 3228.tmp 2344 3266.tmp 1092 32B4.tmp 2404 3302.tmp 3028 3350.tmp 1448 338E.tmp 2376 33DC.tmp 112 341B.tmp 2300 3459.tmp 2000 3498.tmp 940 34D6.tmp 3024 3514.tmp 1944 3553.tmp 1840 3591.tmp 556 35D0.tmp 3012 360E.tmp 2060 364C.tmp 1416 368B.tmp 1960 36C9.tmp 1728 3717.tmp 1928 3794.tmp 3056 37D2.tmp 2728 3811.tmp 2232 384F.tmp 2680 388E.tmp 2692 38CC.tmp 2620 390A.tmp 3068 3958.tmp 2596 3997.tmp -
Loads dropped DLL 64 IoCs
pid Process 1612 2024-06-05_40829a75403222f6fdce220d6f991add_mafia.exe 2744 24C0.tmp 2232 253C.tmp 2680 25E8.tmp 2868 2655.tmp 1192 26A3.tmp 2052 274F.tmp 2684 279D.tmp 2460 27EB.tmp 2524 2858.tmp 2660 28E4.tmp 1236 2942.tmp 856 29A0.tmp 2760 2A5B.tmp 2772 2AB8.tmp 1548 2B06.tmp 984 2B64.tmp 1888 2BB2.tmp 2184 2C10.tmp 2192 2C5E.tmp 2124 2CDA.tmp 768 2D38.tmp 2828 2DB5.tmp 1136 2E03.tmp 2008 2E41.tmp 2984 2EAE.tmp 2548 2F0C.tmp 2328 2F6A.tmp 2244 2FB8.tmp 2556 3006.tmp 2440 3063.tmp 2084 30B1.tmp 1388 30FF.tmp 2896 314D.tmp 2848 318C.tmp 1108 31DA.tmp 904 3228.tmp 2344 3266.tmp 1092 32B4.tmp 2404 3302.tmp 3028 3350.tmp 1448 338E.tmp 2376 33DC.tmp 112 341B.tmp 2300 3459.tmp 2000 3498.tmp 940 34D6.tmp 3024 3514.tmp 1944 3553.tmp 1840 3591.tmp 556 35D0.tmp 3012 360E.tmp 2060 364C.tmp 1416 368B.tmp 1960 36C9.tmp 1612 3756.tmp 1928 3794.tmp 3056 37D2.tmp 2728 3811.tmp 2232 384F.tmp 2680 388E.tmp 2692 38CC.tmp 2620 390A.tmp 3068 3958.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1612 wrote to memory of 2744 1612 2024-06-05_40829a75403222f6fdce220d6f991add_mafia.exe 28 PID 1612 wrote to memory of 2744 1612 2024-06-05_40829a75403222f6fdce220d6f991add_mafia.exe 28 PID 1612 wrote to memory of 2744 1612 2024-06-05_40829a75403222f6fdce220d6f991add_mafia.exe 28 PID 1612 wrote to memory of 2744 1612 2024-06-05_40829a75403222f6fdce220d6f991add_mafia.exe 28 PID 2744 wrote to memory of 2232 2744 24C0.tmp 29 PID 2744 wrote to memory of 2232 2744 24C0.tmp 29 PID 2744 wrote to memory of 2232 2744 24C0.tmp 29 PID 2744 wrote to memory of 2232 2744 24C0.tmp 29 PID 2232 wrote to memory of 2680 2232 253C.tmp 30 PID 2232 wrote to memory of 2680 2232 253C.tmp 30 PID 2232 wrote to memory of 2680 2232 253C.tmp 30 PID 2232 wrote to memory of 2680 2232 253C.tmp 30 PID 2680 wrote to memory of 2868 2680 25E8.tmp 31 PID 2680 wrote to memory of 2868 2680 25E8.tmp 31 PID 2680 wrote to memory of 2868 2680 25E8.tmp 31 PID 2680 wrote to memory of 2868 2680 25E8.tmp 31 PID 2868 wrote to memory of 1192 2868 2655.tmp 32 PID 2868 wrote to memory of 1192 2868 2655.tmp 32 PID 2868 wrote to memory of 1192 2868 2655.tmp 32 PID 2868 wrote to memory of 1192 2868 2655.tmp 32 PID 1192 wrote to memory of 2052 1192 26A3.tmp 33 PID 1192 wrote to memory of 2052 1192 26A3.tmp 33 PID 1192 wrote to memory of 2052 1192 26A3.tmp 33 PID 1192 wrote to memory of 2052 1192 26A3.tmp 33 PID 2052 wrote to memory of 2684 2052 274F.tmp 34 PID 2052 wrote to memory of 2684 2052 274F.tmp 34 PID 2052 wrote to memory of 2684 2052 274F.tmp 34 PID 2052 wrote to memory of 2684 2052 274F.tmp 34 PID 2684 wrote to memory of 2460 2684 279D.tmp 35 PID 2684 wrote to memory of 2460 2684 279D.tmp 35 PID 2684 wrote to memory of 2460 2684 279D.tmp 35 PID 2684 wrote to memory of 2460 2684 279D.tmp 35 PID 2460 wrote to memory of 2524 2460 27EB.tmp 36 PID 2460 wrote to memory of 2524 2460 27EB.tmp 36 PID 2460 wrote to memory of 2524 2460 27EB.tmp 36 PID 2460 wrote to memory of 2524 2460 27EB.tmp 36 PID 2524 wrote to memory of 2660 2524 2858.tmp 37 PID 2524 wrote to memory of 2660 2524 2858.tmp 37 PID 2524 wrote to memory of 2660 2524 2858.tmp 37 PID 2524 wrote to memory of 2660 2524 2858.tmp 37 PID 2660 wrote to memory of 1236 2660 28E4.tmp 38 PID 2660 wrote to memory of 1236 2660 28E4.tmp 38 PID 2660 wrote to memory of 1236 2660 28E4.tmp 38 PID 2660 wrote to memory of 1236 2660 28E4.tmp 38 PID 1236 wrote to memory of 856 1236 2942.tmp 39 PID 1236 wrote to memory of 856 1236 2942.tmp 39 PID 1236 wrote to memory of 856 1236 2942.tmp 39 PID 1236 wrote to memory of 856 1236 2942.tmp 39 PID 856 wrote to memory of 2760 856 29A0.tmp 40 PID 856 wrote to memory of 2760 856 29A0.tmp 40 PID 856 wrote to memory of 2760 856 29A0.tmp 40 PID 856 wrote to memory of 2760 856 29A0.tmp 40 PID 2760 wrote to memory of 2772 2760 2A5B.tmp 41 PID 2760 wrote to memory of 2772 2760 2A5B.tmp 41 PID 2760 wrote to memory of 2772 2760 2A5B.tmp 41 PID 2760 wrote to memory of 2772 2760 2A5B.tmp 41 PID 2772 wrote to memory of 1548 2772 2AB8.tmp 42 PID 2772 wrote to memory of 1548 2772 2AB8.tmp 42 PID 2772 wrote to memory of 1548 2772 2AB8.tmp 42 PID 2772 wrote to memory of 1548 2772 2AB8.tmp 42 PID 1548 wrote to memory of 984 1548 2B06.tmp 43 PID 1548 wrote to memory of 984 1548 2B06.tmp 43 PID 1548 wrote to memory of 984 1548 2B06.tmp 43 PID 1548 wrote to memory of 984 1548 2B06.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-05_40829a75403222f6fdce220d6f991add_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-05_40829a75403222f6fdce220d6f991add_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\24C0.tmp"C:\Users\Admin\AppData\Local\Temp\24C0.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\253C.tmp"C:\Users\Admin\AppData\Local\Temp\253C.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\25E8.tmp"C:\Users\Admin\AppData\Local\Temp\25E8.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\2655.tmp"C:\Users\Admin\AppData\Local\Temp\2655.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\26A3.tmp"C:\Users\Admin\AppData\Local\Temp\26A3.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\274F.tmp"C:\Users\Admin\AppData\Local\Temp\274F.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\279D.tmp"C:\Users\Admin\AppData\Local\Temp\279D.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\27EB.tmp"C:\Users\Admin\AppData\Local\Temp\27EB.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\2858.tmp"C:\Users\Admin\AppData\Local\Temp\2858.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\28E4.tmp"C:\Users\Admin\AppData\Local\Temp\28E4.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\2942.tmp"C:\Users\Admin\AppData\Local\Temp\2942.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\29A0.tmp"C:\Users\Admin\AppData\Local\Temp\29A0.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\2B06.tmp"C:\Users\Admin\AppData\Local\Temp\2B06.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\2B64.tmp"C:\Users\Admin\AppData\Local\Temp\2B64.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:984 -
C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\2C10.tmp"C:\Users\Admin\AppData\Local\Temp\2C10.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\2D38.tmp"C:\Users\Admin\AppData\Local\Temp\2D38.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:768 -
C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\2E03.tmp"C:\Users\Admin\AppData\Local\Temp\2E03.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\2E41.tmp"C:\Users\Admin\AppData\Local\Temp\2E41.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\2F6A.tmp"C:\Users\Admin\AppData\Local\Temp\2F6A.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\3006.tmp"C:\Users\Admin\AppData\Local\Temp\3006.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\3063.tmp"C:\Users\Admin\AppData\Local\Temp\3063.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\30B1.tmp"C:\Users\Admin\AppData\Local\Temp\30B1.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\30FF.tmp"C:\Users\Admin\AppData\Local\Temp\30FF.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\314D.tmp"C:\Users\Admin\AppData\Local\Temp\314D.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\318C.tmp"C:\Users\Admin\AppData\Local\Temp\318C.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\31DA.tmp"C:\Users\Admin\AppData\Local\Temp\31DA.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\3228.tmp"C:\Users\Admin\AppData\Local\Temp\3228.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:904 -
C:\Users\Admin\AppData\Local\Temp\3266.tmp"C:\Users\Admin\AppData\Local\Temp\3266.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\32B4.tmp"C:\Users\Admin\AppData\Local\Temp\32B4.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\3302.tmp"C:\Users\Admin\AppData\Local\Temp\3302.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\3350.tmp"C:\Users\Admin\AppData\Local\Temp\3350.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\338E.tmp"C:\Users\Admin\AppData\Local\Temp\338E.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\33DC.tmp"C:\Users\Admin\AppData\Local\Temp\33DC.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\341B.tmp"C:\Users\Admin\AppData\Local\Temp\341B.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:112 -
C:\Users\Admin\AppData\Local\Temp\3459.tmp"C:\Users\Admin\AppData\Local\Temp\3459.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\3498.tmp"C:\Users\Admin\AppData\Local\Temp\3498.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\34D6.tmp"C:\Users\Admin\AppData\Local\Temp\34D6.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:940 -
C:\Users\Admin\AppData\Local\Temp\3514.tmp"C:\Users\Admin\AppData\Local\Temp\3514.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\3553.tmp"C:\Users\Admin\AppData\Local\Temp\3553.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\3591.tmp"C:\Users\Admin\AppData\Local\Temp\3591.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\35D0.tmp"C:\Users\Admin\AppData\Local\Temp\35D0.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:556 -
C:\Users\Admin\AppData\Local\Temp\360E.tmp"C:\Users\Admin\AppData\Local\Temp\360E.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\364C.tmp"C:\Users\Admin\AppData\Local\Temp\364C.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\368B.tmp"C:\Users\Admin\AppData\Local\Temp\368B.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\36C9.tmp"C:\Users\Admin\AppData\Local\Temp\36C9.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\3717.tmp"C:\Users\Admin\AppData\Local\Temp\3717.tmp"56⤵
- Executes dropped EXE
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\3756.tmp"C:\Users\Admin\AppData\Local\Temp\3756.tmp"57⤵
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\3794.tmp"C:\Users\Admin\AppData\Local\Temp\3794.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\37D2.tmp"C:\Users\Admin\AppData\Local\Temp\37D2.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\3811.tmp"C:\Users\Admin\AppData\Local\Temp\3811.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\384F.tmp"C:\Users\Admin\AppData\Local\Temp\384F.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\388E.tmp"C:\Users\Admin\AppData\Local\Temp\388E.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\38CC.tmp"C:\Users\Admin\AppData\Local\Temp\38CC.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\390A.tmp"C:\Users\Admin\AppData\Local\Temp\390A.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\3958.tmp"C:\Users\Admin\AppData\Local\Temp\3958.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\3997.tmp"C:\Users\Admin\AppData\Local\Temp\3997.tmp"66⤵
- Executes dropped EXE
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\39E5.tmp"C:\Users\Admin\AppData\Local\Temp\39E5.tmp"67⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\3A23.tmp"C:\Users\Admin\AppData\Local\Temp\3A23.tmp"68⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\3A71.tmp"C:\Users\Admin\AppData\Local\Temp\3A71.tmp"69⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\3ACF.tmp"C:\Users\Admin\AppData\Local\Temp\3ACF.tmp"70⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\3B4C.tmp"C:\Users\Admin\AppData\Local\Temp\3B4C.tmp"71⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\3B8A.tmp"C:\Users\Admin\AppData\Local\Temp\3B8A.tmp"72⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\3BC8.tmp"C:\Users\Admin\AppData\Local\Temp\3BC8.tmp"73⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\3C07.tmp"C:\Users\Admin\AppData\Local\Temp\3C07.tmp"74⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\3C45.tmp"C:\Users\Admin\AppData\Local\Temp\3C45.tmp"75⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\3C84.tmp"C:\Users\Admin\AppData\Local\Temp\3C84.tmp"76⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\3CC2.tmp"C:\Users\Admin\AppData\Local\Temp\3CC2.tmp"77⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\3D00.tmp"C:\Users\Admin\AppData\Local\Temp\3D00.tmp"78⤵PID:608
-
C:\Users\Admin\AppData\Local\Temp\3D4E.tmp"C:\Users\Admin\AppData\Local\Temp\3D4E.tmp"79⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\3D8D.tmp"C:\Users\Admin\AppData\Local\Temp\3D8D.tmp"80⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\3DDB.tmp"C:\Users\Admin\AppData\Local\Temp\3DDB.tmp"81⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\3E19.tmp"C:\Users\Admin\AppData\Local\Temp\3E19.tmp"82⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\3E58.tmp"C:\Users\Admin\AppData\Local\Temp\3E58.tmp"83⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\3E96.tmp"C:\Users\Admin\AppData\Local\Temp\3E96.tmp"84⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\3ED4.tmp"C:\Users\Admin\AppData\Local\Temp\3ED4.tmp"85⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\3F13.tmp"C:\Users\Admin\AppData\Local\Temp\3F13.tmp"86⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\3F51.tmp"C:\Users\Admin\AppData\Local\Temp\3F51.tmp"87⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\3F9F.tmp"C:\Users\Admin\AppData\Local\Temp\3F9F.tmp"88⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\3FDE.tmp"C:\Users\Admin\AppData\Local\Temp\3FDE.tmp"89⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\401C.tmp"C:\Users\Admin\AppData\Local\Temp\401C.tmp"90⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\407A.tmp"C:\Users\Admin\AppData\Local\Temp\407A.tmp"91⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\40B8.tmp"C:\Users\Admin\AppData\Local\Temp\40B8.tmp"92⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\40F6.tmp"C:\Users\Admin\AppData\Local\Temp\40F6.tmp"93⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\4135.tmp"C:\Users\Admin\AppData\Local\Temp\4135.tmp"94⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\4173.tmp"C:\Users\Admin\AppData\Local\Temp\4173.tmp"95⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\41B2.tmp"C:\Users\Admin\AppData\Local\Temp\41B2.tmp"96⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\41F0.tmp"C:\Users\Admin\AppData\Local\Temp\41F0.tmp"97⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\422E.tmp"C:\Users\Admin\AppData\Local\Temp\422E.tmp"98⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\426D.tmp"C:\Users\Admin\AppData\Local\Temp\426D.tmp"99⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\42AB.tmp"C:\Users\Admin\AppData\Local\Temp\42AB.tmp"100⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\42EA.tmp"C:\Users\Admin\AppData\Local\Temp\42EA.tmp"101⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\4328.tmp"C:\Users\Admin\AppData\Local\Temp\4328.tmp"102⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\4366.tmp"C:\Users\Admin\AppData\Local\Temp\4366.tmp"103⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\43A5.tmp"C:\Users\Admin\AppData\Local\Temp\43A5.tmp"104⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\43E3.tmp"C:\Users\Admin\AppData\Local\Temp\43E3.tmp"105⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\4422.tmp"C:\Users\Admin\AppData\Local\Temp\4422.tmp"106⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\4460.tmp"C:\Users\Admin\AppData\Local\Temp\4460.tmp"107⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\449E.tmp"C:\Users\Admin\AppData\Local\Temp\449E.tmp"108⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\44DD.tmp"C:\Users\Admin\AppData\Local\Temp\44DD.tmp"109⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\451B.tmp"C:\Users\Admin\AppData\Local\Temp\451B.tmp"110⤵PID:340
-
C:\Users\Admin\AppData\Local\Temp\455A.tmp"C:\Users\Admin\AppData\Local\Temp\455A.tmp"111⤵PID:108
-
C:\Users\Admin\AppData\Local\Temp\45A8.tmp"C:\Users\Admin\AppData\Local\Temp\45A8.tmp"112⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\45E6.tmp"C:\Users\Admin\AppData\Local\Temp\45E6.tmp"113⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\4624.tmp"C:\Users\Admin\AppData\Local\Temp\4624.tmp"114⤵PID:600
-
C:\Users\Admin\AppData\Local\Temp\4663.tmp"C:\Users\Admin\AppData\Local\Temp\4663.tmp"115⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\46A1.tmp"C:\Users\Admin\AppData\Local\Temp\46A1.tmp"116⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\46E0.tmp"C:\Users\Admin\AppData\Local\Temp\46E0.tmp"117⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\471E.tmp"C:\Users\Admin\AppData\Local\Temp\471E.tmp"118⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\476C.tmp"C:\Users\Admin\AppData\Local\Temp\476C.tmp"119⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\47AA.tmp"C:\Users\Admin\AppData\Local\Temp\47AA.tmp"120⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\47E9.tmp"C:\Users\Admin\AppData\Local\Temp\47E9.tmp"121⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\4827.tmp"C:\Users\Admin\AppData\Local\Temp\4827.tmp"122⤵PID:2208
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-