Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11-06-2024 07:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-11_35b2dddab65224b7371554f8331ef972_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-11_35b2dddab65224b7371554f8331ef972_mafia.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-06-11_35b2dddab65224b7371554f8331ef972_mafia.exe
-
Size
527KB
-
MD5
35b2dddab65224b7371554f8331ef972
-
SHA1
9bf2e37f936a45a9480b60c5fddb917dd3d3c736
-
SHA256
4cad16923d0ba95806d16b11ab8072b2a9cb72ae433696c57c0040847a2afa27
-
SHA512
8cb0769da55d538d6b9b55bee64373e3eb01574ed05471a38dfa1cfbcff89f44cc63658523ea4e2c75af161240c79d5b68c7e0afc0ddc85e6f1b9a9ad7ac8dcf
-
SSDEEP
12288:fU5rCOTeid3est1gPxMkkoI6crvvWYDZu:fUQOJd3est06oIPGYDo
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2840 FBA.tmp 2908 1027.tmp 2152 10A4.tmp 2640 1101.tmp 2792 115F.tmp 2448 11CC.tmp 2176 1239.tmp 2480 1297.tmp 2172 1304.tmp 2460 1362.tmp 2608 13CF.tmp 2876 142C.tmp 1428 148A.tmp 2676 1507.tmp 2764 1574.tmp 1588 15E1.tmp 1040 164E.tmp 1964 16BC.tmp 2192 1729.tmp 1564 1786.tmp 2400 17E4.tmp 1876 1851.tmp 2260 18AF.tmp 1320 18ED.tmp 2280 193B.tmp 2248 1989.tmp 2420 19D7.tmp 2116 1A25.tmp 2816 1A73.tmp 1256 1AB2.tmp 268 1AF0.tmp 984 1B3E.tmp 584 1B7C.tmp 1260 1BCA.tmp 1868 1C09.tmp 1812 1C57.tmp 1840 1C95.tmp 836 1CE3.tmp 2128 1D31.tmp 2148 1D7F.tmp 1336 1DCD.tmp 1512 1E0C.tmp 1344 1E5A.tmp 1892 1EA8.tmp 1788 1EF6.tmp 1280 1F34.tmp 2944 1F82.tmp 1888 1FC0.tmp 2824 1FFF.tmp 2936 203D.tmp 1376 207C.tmp 3016 20CA.tmp 2308 2108.tmp 2368 2146.tmp 2008 2194.tmp 1276 21D3.tmp 2836 2211.tmp 2344 2250.tmp 2840 229E.tmp 2956 22DC.tmp 2652 231A.tmp 2660 2368.tmp 2692 23F5.tmp 2572 2443.tmp -
Loads dropped DLL 64 IoCs
pid Process 2732 2024-06-11_35b2dddab65224b7371554f8331ef972_mafia.exe 2840 FBA.tmp 2908 1027.tmp 2152 10A4.tmp 2640 1101.tmp 2792 115F.tmp 2448 11CC.tmp 2176 1239.tmp 2480 1297.tmp 2172 1304.tmp 2460 1362.tmp 2608 13CF.tmp 2876 142C.tmp 1428 148A.tmp 2676 1507.tmp 2764 1574.tmp 1588 15E1.tmp 1040 164E.tmp 1964 16BC.tmp 2192 1729.tmp 1564 1786.tmp 2400 17E4.tmp 1876 1851.tmp 2260 18AF.tmp 1320 18ED.tmp 2280 193B.tmp 2248 1989.tmp 2420 19D7.tmp 2116 1A25.tmp 2816 1A73.tmp 1256 1AB2.tmp 268 1AF0.tmp 984 1B3E.tmp 584 1B7C.tmp 1260 1BCA.tmp 1868 1C09.tmp 1812 1C57.tmp 1840 1C95.tmp 836 1CE3.tmp 2128 1D31.tmp 2148 1D7F.tmp 1336 1DCD.tmp 1512 1E0C.tmp 1344 1E5A.tmp 1892 1EA8.tmp 1788 1EF6.tmp 1280 1F34.tmp 2944 1F82.tmp 1888 1FC0.tmp 2824 1FFF.tmp 2936 203D.tmp 1376 207C.tmp 3016 20CA.tmp 2308 2108.tmp 2368 2146.tmp 2008 2194.tmp 1276 21D3.tmp 2836 2211.tmp 2344 2250.tmp 2840 229E.tmp 2956 22DC.tmp 2652 231A.tmp 2660 2368.tmp 2692 23F5.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2732 wrote to memory of 2840 2732 2024-06-11_35b2dddab65224b7371554f8331ef972_mafia.exe 28 PID 2732 wrote to memory of 2840 2732 2024-06-11_35b2dddab65224b7371554f8331ef972_mafia.exe 28 PID 2732 wrote to memory of 2840 2732 2024-06-11_35b2dddab65224b7371554f8331ef972_mafia.exe 28 PID 2732 wrote to memory of 2840 2732 2024-06-11_35b2dddab65224b7371554f8331ef972_mafia.exe 28 PID 2840 wrote to memory of 2908 2840 FBA.tmp 29 PID 2840 wrote to memory of 2908 2840 FBA.tmp 29 PID 2840 wrote to memory of 2908 2840 FBA.tmp 29 PID 2840 wrote to memory of 2908 2840 FBA.tmp 29 PID 2908 wrote to memory of 2152 2908 1027.tmp 30 PID 2908 wrote to memory of 2152 2908 1027.tmp 30 PID 2908 wrote to memory of 2152 2908 1027.tmp 30 PID 2908 wrote to memory of 2152 2908 1027.tmp 30 PID 2152 wrote to memory of 2640 2152 10A4.tmp 31 PID 2152 wrote to memory of 2640 2152 10A4.tmp 31 PID 2152 wrote to memory of 2640 2152 10A4.tmp 31 PID 2152 wrote to memory of 2640 2152 10A4.tmp 31 PID 2640 wrote to memory of 2792 2640 1101.tmp 32 PID 2640 wrote to memory of 2792 2640 1101.tmp 32 PID 2640 wrote to memory of 2792 2640 1101.tmp 32 PID 2640 wrote to memory of 2792 2640 1101.tmp 32 PID 2792 wrote to memory of 2448 2792 115F.tmp 33 PID 2792 wrote to memory of 2448 2792 115F.tmp 33 PID 2792 wrote to memory of 2448 2792 115F.tmp 33 PID 2792 wrote to memory of 2448 2792 115F.tmp 33 PID 2448 wrote to memory of 2176 2448 11CC.tmp 34 PID 2448 wrote to memory of 2176 2448 11CC.tmp 34 PID 2448 wrote to memory of 2176 2448 11CC.tmp 34 PID 2448 wrote to memory of 2176 2448 11CC.tmp 34 PID 2176 wrote to memory of 2480 2176 1239.tmp 35 PID 2176 wrote to memory of 2480 2176 1239.tmp 35 PID 2176 wrote to memory of 2480 2176 1239.tmp 35 PID 2176 wrote to memory of 2480 2176 1239.tmp 35 PID 2480 wrote to memory of 2172 2480 1297.tmp 36 PID 2480 wrote to memory of 2172 2480 1297.tmp 36 PID 2480 wrote to memory of 2172 2480 1297.tmp 36 PID 2480 wrote to memory of 2172 2480 1297.tmp 36 PID 2172 wrote to memory of 2460 2172 1304.tmp 37 PID 2172 wrote to memory of 2460 2172 1304.tmp 37 PID 2172 wrote to memory of 2460 2172 1304.tmp 37 PID 2172 wrote to memory of 2460 2172 1304.tmp 37 PID 2460 wrote to memory of 2608 2460 1362.tmp 38 PID 2460 wrote to memory of 2608 2460 1362.tmp 38 PID 2460 wrote to memory of 2608 2460 1362.tmp 38 PID 2460 wrote to memory of 2608 2460 1362.tmp 38 PID 2608 wrote to memory of 2876 2608 13CF.tmp 39 PID 2608 wrote to memory of 2876 2608 13CF.tmp 39 PID 2608 wrote to memory of 2876 2608 13CF.tmp 39 PID 2608 wrote to memory of 2876 2608 13CF.tmp 39 PID 2876 wrote to memory of 1428 2876 142C.tmp 40 PID 2876 wrote to memory of 1428 2876 142C.tmp 40 PID 2876 wrote to memory of 1428 2876 142C.tmp 40 PID 2876 wrote to memory of 1428 2876 142C.tmp 40 PID 1428 wrote to memory of 2676 1428 148A.tmp 41 PID 1428 wrote to memory of 2676 1428 148A.tmp 41 PID 1428 wrote to memory of 2676 1428 148A.tmp 41 PID 1428 wrote to memory of 2676 1428 148A.tmp 41 PID 2676 wrote to memory of 2764 2676 1507.tmp 42 PID 2676 wrote to memory of 2764 2676 1507.tmp 42 PID 2676 wrote to memory of 2764 2676 1507.tmp 42 PID 2676 wrote to memory of 2764 2676 1507.tmp 42 PID 2764 wrote to memory of 1588 2764 1574.tmp 43 PID 2764 wrote to memory of 1588 2764 1574.tmp 43 PID 2764 wrote to memory of 1588 2764 1574.tmp 43 PID 2764 wrote to memory of 1588 2764 1574.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_35b2dddab65224b7371554f8331ef972_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-11_35b2dddab65224b7371554f8331ef972_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\FBA.tmp"C:\Users\Admin\AppData\Local\Temp\FBA.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\1027.tmp"C:\Users\Admin\AppData\Local\Temp\1027.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\10A4.tmp"C:\Users\Admin\AppData\Local\Temp\10A4.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\1101.tmp"C:\Users\Admin\AppData\Local\Temp\1101.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\115F.tmp"C:\Users\Admin\AppData\Local\Temp\115F.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\11CC.tmp"C:\Users\Admin\AppData\Local\Temp\11CC.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\1239.tmp"C:\Users\Admin\AppData\Local\Temp\1239.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\1297.tmp"C:\Users\Admin\AppData\Local\Temp\1297.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\1304.tmp"C:\Users\Admin\AppData\Local\Temp\1304.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\1362.tmp"C:\Users\Admin\AppData\Local\Temp\1362.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\13CF.tmp"C:\Users\Admin\AppData\Local\Temp\13CF.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\142C.tmp"C:\Users\Admin\AppData\Local\Temp\142C.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\148A.tmp"C:\Users\Admin\AppData\Local\Temp\148A.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\1507.tmp"C:\Users\Admin\AppData\Local\Temp\1507.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\1574.tmp"C:\Users\Admin\AppData\Local\Temp\1574.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\15E1.tmp"C:\Users\Admin\AppData\Local\Temp\15E1.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\164E.tmp"C:\Users\Admin\AppData\Local\Temp\164E.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\16BC.tmp"C:\Users\Admin\AppData\Local\Temp\16BC.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\1729.tmp"C:\Users\Admin\AppData\Local\Temp\1729.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\1786.tmp"C:\Users\Admin\AppData\Local\Temp\1786.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\17E4.tmp"C:\Users\Admin\AppData\Local\Temp\17E4.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\1851.tmp"C:\Users\Admin\AppData\Local\Temp\1851.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\18AF.tmp"C:\Users\Admin\AppData\Local\Temp\18AF.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\18ED.tmp"C:\Users\Admin\AppData\Local\Temp\18ED.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\193B.tmp"C:\Users\Admin\AppData\Local\Temp\193B.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\1989.tmp"C:\Users\Admin\AppData\Local\Temp\1989.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\19D7.tmp"C:\Users\Admin\AppData\Local\Temp\19D7.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\1A25.tmp"C:\Users\Admin\AppData\Local\Temp\1A25.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\1A73.tmp"C:\Users\Admin\AppData\Local\Temp\1A73.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:268 -
C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:984 -
C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:584 -
C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\1C09.tmp"C:\Users\Admin\AppData\Local\Temp\1C09.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\1C57.tmp"C:\Users\Admin\AppData\Local\Temp\1C57.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\1C95.tmp"C:\Users\Admin\AppData\Local\Temp\1C95.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:836 -
C:\Users\Admin\AppData\Local\Temp\1D31.tmp"C:\Users\Admin\AppData\Local\Temp\1D31.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\1DCD.tmp"C:\Users\Admin\AppData\Local\Temp\1DCD.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\1F34.tmp"C:\Users\Admin\AppData\Local\Temp\1F34.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\1F82.tmp"C:\Users\Admin\AppData\Local\Temp\1F82.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\203D.tmp"C:\Users\Admin\AppData\Local\Temp\203D.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\207C.tmp"C:\Users\Admin\AppData\Local\Temp\207C.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\20CA.tmp"C:\Users\Admin\AppData\Local\Temp\20CA.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\2108.tmp"C:\Users\Admin\AppData\Local\Temp\2108.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\2146.tmp"C:\Users\Admin\AppData\Local\Temp\2146.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\2194.tmp"C:\Users\Admin\AppData\Local\Temp\2194.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\21D3.tmp"C:\Users\Admin\AppData\Local\Temp\21D3.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\2211.tmp"C:\Users\Admin\AppData\Local\Temp\2211.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\2250.tmp"C:\Users\Admin\AppData\Local\Temp\2250.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\229E.tmp"C:\Users\Admin\AppData\Local\Temp\229E.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\22DC.tmp"C:\Users\Admin\AppData\Local\Temp\22DC.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\231A.tmp"C:\Users\Admin\AppData\Local\Temp\231A.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\2368.tmp"C:\Users\Admin\AppData\Local\Temp\2368.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\23F5.tmp"C:\Users\Admin\AppData\Local\Temp\23F5.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\2443.tmp"C:\Users\Admin\AppData\Local\Temp\2443.tmp"65⤵
- Executes dropped EXE
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\2491.tmp"C:\Users\Admin\AppData\Local\Temp\2491.tmp"66⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\24CF.tmp"C:\Users\Admin\AppData\Local\Temp\24CF.tmp"67⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\250E.tmp"C:\Users\Admin\AppData\Local\Temp\250E.tmp"68⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"69⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\259A.tmp"C:\Users\Admin\AppData\Local\Temp\259A.tmp"70⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\25D8.tmp"C:\Users\Admin\AppData\Local\Temp\25D8.tmp"71⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"72⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\2655.tmp"C:\Users\Admin\AppData\Local\Temp\2655.tmp"73⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\2694.tmp"C:\Users\Admin\AppData\Local\Temp\2694.tmp"74⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\26D2.tmp"C:\Users\Admin\AppData\Local\Temp\26D2.tmp"75⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\2710.tmp"C:\Users\Admin\AppData\Local\Temp\2710.tmp"76⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\274F.tmp"C:\Users\Admin\AppData\Local\Temp\274F.tmp"77⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\278D.tmp"C:\Users\Admin\AppData\Local\Temp\278D.tmp"78⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\27CC.tmp"C:\Users\Admin\AppData\Local\Temp\27CC.tmp"79⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"80⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\2858.tmp"C:\Users\Admin\AppData\Local\Temp\2858.tmp"81⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\2896.tmp"C:\Users\Admin\AppData\Local\Temp\2896.tmp"82⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\28D5.tmp"C:\Users\Admin\AppData\Local\Temp\28D5.tmp"83⤵PID:272
-
C:\Users\Admin\AppData\Local\Temp\2923.tmp"C:\Users\Admin\AppData\Local\Temp\2923.tmp"84⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\2961.tmp"C:\Users\Admin\AppData\Local\Temp\2961.tmp"85⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\29A0.tmp"C:\Users\Admin\AppData\Local\Temp\29A0.tmp"86⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\29DE.tmp"C:\Users\Admin\AppData\Local\Temp\29DE.tmp"87⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"88⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"89⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"90⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"91⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\2B35.tmp"C:\Users\Admin\AppData\Local\Temp\2B35.tmp"92⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\2B74.tmp"C:\Users\Admin\AppData\Local\Temp\2B74.tmp"93⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"94⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"95⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"96⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"97⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"98⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"99⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\2D38.tmp"C:\Users\Admin\AppData\Local\Temp\2D38.tmp"100⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\2D76.tmp"C:\Users\Admin\AppData\Local\Temp\2D76.tmp"101⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"102⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\2E03.tmp"C:\Users\Admin\AppData\Local\Temp\2E03.tmp"103⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\2E41.tmp"C:\Users\Admin\AppData\Local\Temp\2E41.tmp"104⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\2E80.tmp"C:\Users\Admin\AppData\Local\Temp\2E80.tmp"105⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"106⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"107⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"108⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\2F89.tmp"C:\Users\Admin\AppData\Local\Temp\2F89.tmp"109⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"110⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\3025.tmp"C:\Users\Admin\AppData\Local\Temp\3025.tmp"111⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\3063.tmp"C:\Users\Admin\AppData\Local\Temp\3063.tmp"112⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\30A2.tmp"C:\Users\Admin\AppData\Local\Temp\30A2.tmp"113⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\30E0.tmp"C:\Users\Admin\AppData\Local\Temp\30E0.tmp"114⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\311E.tmp"C:\Users\Admin\AppData\Local\Temp\311E.tmp"115⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\315D.tmp"C:\Users\Admin\AppData\Local\Temp\315D.tmp"116⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\319B.tmp"C:\Users\Admin\AppData\Local\Temp\319B.tmp"117⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\31DA.tmp"C:\Users\Admin\AppData\Local\Temp\31DA.tmp"118⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\3218.tmp"C:\Users\Admin\AppData\Local\Temp\3218.tmp"119⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"120⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\3295.tmp"C:\Users\Admin\AppData\Local\Temp\3295.tmp"121⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\32E3.tmp"C:\Users\Admin\AppData\Local\Temp\32E3.tmp"122⤵PID:1600
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-