Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
14/06/2024, 08:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-14_6b902c4731b5ae4abfd64bf8c13de767_mafia.exe
Resource
win7-20240508-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-14_6b902c4731b5ae4abfd64bf8c13de767_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-06-14_6b902c4731b5ae4abfd64bf8c13de767_mafia.exe
-
Size
488KB
-
MD5
6b902c4731b5ae4abfd64bf8c13de767
-
SHA1
494f43cc4518a9e44155901ce2dcb3b489b2577e
-
SHA256
31ee9d2889fe3d663b671548a5d969f76fcd6d5afe385e367baada58b35f48ef
-
SHA512
34a429951c60a9c6f1c6c9973e1cf6bbf91702eacd8e196e62389dce594438c8383b99cc2a40893d6ae880480cbd1823aaa6ab775520ba2ece5519176ee80fe2
-
SSDEEP
12288:/U5rCOTeiDz0EBtugRS8EBtz/+34Je8kI5z5uNZ:/UQOJDzd/RI/z/y4Je3eFuN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2376 2404.tmp 856 2462.tmp 2740 24FE.tmp 2736 257B.tmp 2228 25E8.tmp 2652 2655.tmp 2680 26D2.tmp 2776 274F.tmp 2632 27AC.tmp 2564 281A.tmp 3000 2887.tmp 1832 2913.tmp 2852 2980.tmp 2988 29DE.tmp 3024 2A5B.tmp 1588 2AD8.tmp 1348 2B45.tmp 548 2BB2.tmp 2188 2C2F.tmp 1676 2C9C.tmp 2608 2D19.tmp 484 2D96.tmp 800 2DF3.tmp 1564 2E32.tmp 1632 2E70.tmp 1212 2EAE.tmp 2104 2EED.tmp 2108 2F2B.tmp 2616 2F79.tmp 2500 2FB8.tmp 2116 2FF6.tmp 2708 3034.tmp 2044 3073.tmp 1112 30C1.tmp 644 310F.tmp 1140 315D.tmp 2896 319B.tmp 2284 31DA.tmp 1724 3218.tmp 1780 3256.tmp 1364 3295.tmp 2924 32D3.tmp 960 3321.tmp 944 3360.tmp 2120 339E.tmp 1648 33DC.tmp 620 341B.tmp 3064 3459.tmp 2448 3498.tmp 1624 34D6.tmp 3060 3514.tmp 2436 3553.tmp 1776 3591.tmp 2072 35D0.tmp 2392 360E.tmp 1604 364C.tmp 2488 368B.tmp 1280 36D9.tmp 2660 3727.tmp 856 3775.tmp 2740 37B3.tmp 1932 37F2.tmp 2904 3830.tmp 2812 386E.tmp -
Loads dropped DLL 64 IoCs
pid Process 2164 2024-06-14_6b902c4731b5ae4abfd64bf8c13de767_mafia.exe 2376 2404.tmp 856 2462.tmp 2740 24FE.tmp 2736 257B.tmp 2228 25E8.tmp 2652 2655.tmp 2680 26D2.tmp 2776 274F.tmp 2632 27AC.tmp 2564 281A.tmp 3000 2887.tmp 1832 2913.tmp 2852 2980.tmp 2988 29DE.tmp 3024 2A5B.tmp 1588 2AD8.tmp 1348 2B45.tmp 548 2BB2.tmp 2188 2C2F.tmp 1676 2C9C.tmp 2608 2D19.tmp 484 2D96.tmp 800 2DF3.tmp 1564 2E32.tmp 1632 2E70.tmp 1212 2EAE.tmp 2104 2EED.tmp 2108 2F2B.tmp 2616 2F79.tmp 2500 2FB8.tmp 2116 2FF6.tmp 2708 3034.tmp 2044 3073.tmp 1112 30C1.tmp 644 310F.tmp 1140 315D.tmp 2896 319B.tmp 2284 31DA.tmp 1724 3218.tmp 1780 3256.tmp 1364 3295.tmp 2924 32D3.tmp 960 3321.tmp 944 3360.tmp 2120 339E.tmp 1648 33DC.tmp 620 341B.tmp 3064 3459.tmp 2448 3498.tmp 1624 34D6.tmp 3060 3514.tmp 2436 3553.tmp 1776 3591.tmp 2072 35D0.tmp 2392 360E.tmp 1604 364C.tmp 2488 368B.tmp 1280 36D9.tmp 2660 3727.tmp 856 3775.tmp 2740 37B3.tmp 1932 37F2.tmp 2904 3830.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2164 wrote to memory of 2376 2164 2024-06-14_6b902c4731b5ae4abfd64bf8c13de767_mafia.exe 28 PID 2164 wrote to memory of 2376 2164 2024-06-14_6b902c4731b5ae4abfd64bf8c13de767_mafia.exe 28 PID 2164 wrote to memory of 2376 2164 2024-06-14_6b902c4731b5ae4abfd64bf8c13de767_mafia.exe 28 PID 2164 wrote to memory of 2376 2164 2024-06-14_6b902c4731b5ae4abfd64bf8c13de767_mafia.exe 28 PID 2376 wrote to memory of 856 2376 2404.tmp 29 PID 2376 wrote to memory of 856 2376 2404.tmp 29 PID 2376 wrote to memory of 856 2376 2404.tmp 29 PID 2376 wrote to memory of 856 2376 2404.tmp 29 PID 856 wrote to memory of 2740 856 2462.tmp 30 PID 856 wrote to memory of 2740 856 2462.tmp 30 PID 856 wrote to memory of 2740 856 2462.tmp 30 PID 856 wrote to memory of 2740 856 2462.tmp 30 PID 2740 wrote to memory of 2736 2740 24FE.tmp 31 PID 2740 wrote to memory of 2736 2740 24FE.tmp 31 PID 2740 wrote to memory of 2736 2740 24FE.tmp 31 PID 2740 wrote to memory of 2736 2740 24FE.tmp 31 PID 2736 wrote to memory of 2228 2736 257B.tmp 32 PID 2736 wrote to memory of 2228 2736 257B.tmp 32 PID 2736 wrote to memory of 2228 2736 257B.tmp 32 PID 2736 wrote to memory of 2228 2736 257B.tmp 32 PID 2228 wrote to memory of 2652 2228 25E8.tmp 33 PID 2228 wrote to memory of 2652 2228 25E8.tmp 33 PID 2228 wrote to memory of 2652 2228 25E8.tmp 33 PID 2228 wrote to memory of 2652 2228 25E8.tmp 33 PID 2652 wrote to memory of 2680 2652 2655.tmp 34 PID 2652 wrote to memory of 2680 2652 2655.tmp 34 PID 2652 wrote to memory of 2680 2652 2655.tmp 34 PID 2652 wrote to memory of 2680 2652 2655.tmp 34 PID 2680 wrote to memory of 2776 2680 26D2.tmp 35 PID 2680 wrote to memory of 2776 2680 26D2.tmp 35 PID 2680 wrote to memory of 2776 2680 26D2.tmp 35 PID 2680 wrote to memory of 2776 2680 26D2.tmp 35 PID 2776 wrote to memory of 2632 2776 274F.tmp 36 PID 2776 wrote to memory of 2632 2776 274F.tmp 36 PID 2776 wrote to memory of 2632 2776 274F.tmp 36 PID 2776 wrote to memory of 2632 2776 274F.tmp 36 PID 2632 wrote to memory of 2564 2632 27AC.tmp 37 PID 2632 wrote to memory of 2564 2632 27AC.tmp 37 PID 2632 wrote to memory of 2564 2632 27AC.tmp 37 PID 2632 wrote to memory of 2564 2632 27AC.tmp 37 PID 2564 wrote to memory of 3000 2564 281A.tmp 38 PID 2564 wrote to memory of 3000 2564 281A.tmp 38 PID 2564 wrote to memory of 3000 2564 281A.tmp 38 PID 2564 wrote to memory of 3000 2564 281A.tmp 38 PID 3000 wrote to memory of 1832 3000 2887.tmp 39 PID 3000 wrote to memory of 1832 3000 2887.tmp 39 PID 3000 wrote to memory of 1832 3000 2887.tmp 39 PID 3000 wrote to memory of 1832 3000 2887.tmp 39 PID 1832 wrote to memory of 2852 1832 2913.tmp 40 PID 1832 wrote to memory of 2852 1832 2913.tmp 40 PID 1832 wrote to memory of 2852 1832 2913.tmp 40 PID 1832 wrote to memory of 2852 1832 2913.tmp 40 PID 2852 wrote to memory of 2988 2852 2980.tmp 41 PID 2852 wrote to memory of 2988 2852 2980.tmp 41 PID 2852 wrote to memory of 2988 2852 2980.tmp 41 PID 2852 wrote to memory of 2988 2852 2980.tmp 41 PID 2988 wrote to memory of 3024 2988 29DE.tmp 42 PID 2988 wrote to memory of 3024 2988 29DE.tmp 42 PID 2988 wrote to memory of 3024 2988 29DE.tmp 42 PID 2988 wrote to memory of 3024 2988 29DE.tmp 42 PID 3024 wrote to memory of 1588 3024 2A5B.tmp 43 PID 3024 wrote to memory of 1588 3024 2A5B.tmp 43 PID 3024 wrote to memory of 1588 3024 2A5B.tmp 43 PID 3024 wrote to memory of 1588 3024 2A5B.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-14_6b902c4731b5ae4abfd64bf8c13de767_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-14_6b902c4731b5ae4abfd64bf8c13de767_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\2404.tmp"C:\Users\Admin\AppData\Local\Temp\2404.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Users\Admin\AppData\Local\Temp\24FE.tmp"C:\Users\Admin\AppData\Local\Temp\24FE.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\257B.tmp"C:\Users\Admin\AppData\Local\Temp\257B.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\25E8.tmp"C:\Users\Admin\AppData\Local\Temp\25E8.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\2655.tmp"C:\Users\Admin\AppData\Local\Temp\2655.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\26D2.tmp"C:\Users\Admin\AppData\Local\Temp\26D2.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\274F.tmp"C:\Users\Admin\AppData\Local\Temp\274F.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\27AC.tmp"C:\Users\Admin\AppData\Local\Temp\27AC.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\281A.tmp"C:\Users\Admin\AppData\Local\Temp\281A.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\2887.tmp"C:\Users\Admin\AppData\Local\Temp\2887.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\2913.tmp"C:\Users\Admin\AppData\Local\Temp\2913.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\2980.tmp"C:\Users\Admin\AppData\Local\Temp\2980.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\29DE.tmp"C:\Users\Admin\AppData\Local\Temp\29DE.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\2B45.tmp"C:\Users\Admin\AppData\Local\Temp\2B45.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:548 -
C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\2C9C.tmp"C:\Users\Admin\AppData\Local\Temp\2C9C.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\2D19.tmp"C:\Users\Admin\AppData\Local\Temp\2D19.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\2D96.tmp"C:\Users\Admin\AppData\Local\Temp\2D96.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:484 -
C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:800 -
C:\Users\Admin\AppData\Local\Temp\2E32.tmp"C:\Users\Admin\AppData\Local\Temp\2E32.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\2E70.tmp"C:\Users\Admin\AppData\Local\Temp\2E70.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\2EED.tmp"C:\Users\Admin\AppData\Local\Temp\2EED.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\2F79.tmp"C:\Users\Admin\AppData\Local\Temp\2F79.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\3034.tmp"C:\Users\Admin\AppData\Local\Temp\3034.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\3073.tmp"C:\Users\Admin\AppData\Local\Temp\3073.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\30C1.tmp"C:\Users\Admin\AppData\Local\Temp\30C1.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\310F.tmp"C:\Users\Admin\AppData\Local\Temp\310F.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:644 -
C:\Users\Admin\AppData\Local\Temp\315D.tmp"C:\Users\Admin\AppData\Local\Temp\315D.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\319B.tmp"C:\Users\Admin\AppData\Local\Temp\319B.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\31DA.tmp"C:\Users\Admin\AppData\Local\Temp\31DA.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\3218.tmp"C:\Users\Admin\AppData\Local\Temp\3218.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\3295.tmp"C:\Users\Admin\AppData\Local\Temp\3295.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\32D3.tmp"C:\Users\Admin\AppData\Local\Temp\32D3.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\3321.tmp"C:\Users\Admin\AppData\Local\Temp\3321.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:960 -
C:\Users\Admin\AppData\Local\Temp\3360.tmp"C:\Users\Admin\AppData\Local\Temp\3360.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:944 -
C:\Users\Admin\AppData\Local\Temp\339E.tmp"C:\Users\Admin\AppData\Local\Temp\339E.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\33DC.tmp"C:\Users\Admin\AppData\Local\Temp\33DC.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\341B.tmp"C:\Users\Admin\AppData\Local\Temp\341B.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:620 -
C:\Users\Admin\AppData\Local\Temp\3459.tmp"C:\Users\Admin\AppData\Local\Temp\3459.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\3498.tmp"C:\Users\Admin\AppData\Local\Temp\3498.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\34D6.tmp"C:\Users\Admin\AppData\Local\Temp\34D6.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\3514.tmp"C:\Users\Admin\AppData\Local\Temp\3514.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\3553.tmp"C:\Users\Admin\AppData\Local\Temp\3553.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\3591.tmp"C:\Users\Admin\AppData\Local\Temp\3591.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\35D0.tmp"C:\Users\Admin\AppData\Local\Temp\35D0.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\360E.tmp"C:\Users\Admin\AppData\Local\Temp\360E.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\364C.tmp"C:\Users\Admin\AppData\Local\Temp\364C.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\368B.tmp"C:\Users\Admin\AppData\Local\Temp\368B.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\36D9.tmp"C:\Users\Admin\AppData\Local\Temp\36D9.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\3727.tmp"C:\Users\Admin\AppData\Local\Temp\3727.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\3775.tmp"C:\Users\Admin\AppData\Local\Temp\3775.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:856 -
C:\Users\Admin\AppData\Local\Temp\37B3.tmp"C:\Users\Admin\AppData\Local\Temp\37B3.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\37F2.tmp"C:\Users\Admin\AppData\Local\Temp\37F2.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\3830.tmp"C:\Users\Admin\AppData\Local\Temp\3830.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\386E.tmp"C:\Users\Admin\AppData\Local\Temp\386E.tmp"65⤵
- Executes dropped EXE
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\38AD.tmp"C:\Users\Admin\AppData\Local\Temp\38AD.tmp"66⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\38EB.tmp"C:\Users\Admin\AppData\Local\Temp\38EB.tmp"67⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\392A.tmp"C:\Users\Admin\AppData\Local\Temp\392A.tmp"68⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\3968.tmp"C:\Users\Admin\AppData\Local\Temp\3968.tmp"69⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\39A6.tmp"C:\Users\Admin\AppData\Local\Temp\39A6.tmp"70⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\39E5.tmp"C:\Users\Admin\AppData\Local\Temp\39E5.tmp"71⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\3A23.tmp"C:\Users\Admin\AppData\Local\Temp\3A23.tmp"72⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\3A62.tmp"C:\Users\Admin\AppData\Local\Temp\3A62.tmp"73⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\3AA0.tmp"C:\Users\Admin\AppData\Local\Temp\3AA0.tmp"74⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\3ADE.tmp"C:\Users\Admin\AppData\Local\Temp\3ADE.tmp"75⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\3B1D.tmp"C:\Users\Admin\AppData\Local\Temp\3B1D.tmp"76⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\3B5B.tmp"C:\Users\Admin\AppData\Local\Temp\3B5B.tmp"77⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\3B9A.tmp"C:\Users\Admin\AppData\Local\Temp\3B9A.tmp"78⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\3BE8.tmp"C:\Users\Admin\AppData\Local\Temp\3BE8.tmp"79⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\3C26.tmp"C:\Users\Admin\AppData\Local\Temp\3C26.tmp"80⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\3C64.tmp"C:\Users\Admin\AppData\Local\Temp\3C64.tmp"81⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\3CA3.tmp"C:\Users\Admin\AppData\Local\Temp\3CA3.tmp"82⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\3CE1.tmp"C:\Users\Admin\AppData\Local\Temp\3CE1.tmp"83⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\3D20.tmp"C:\Users\Admin\AppData\Local\Temp\3D20.tmp"84⤵PID:344
-
C:\Users\Admin\AppData\Local\Temp\3D5E.tmp"C:\Users\Admin\AppData\Local\Temp\3D5E.tmp"85⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"86⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\3DDB.tmp"C:\Users\Admin\AppData\Local\Temp\3DDB.tmp"87⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\3E19.tmp"C:\Users\Admin\AppData\Local\Temp\3E19.tmp"88⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\3E58.tmp"C:\Users\Admin\AppData\Local\Temp\3E58.tmp"89⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\3E96.tmp"C:\Users\Admin\AppData\Local\Temp\3E96.tmp"90⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"91⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\3F22.tmp"C:\Users\Admin\AppData\Local\Temp\3F22.tmp"92⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\3F61.tmp"C:\Users\Admin\AppData\Local\Temp\3F61.tmp"93⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\3F9F.tmp"C:\Users\Admin\AppData\Local\Temp\3F9F.tmp"94⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\3FDE.tmp"C:\Users\Admin\AppData\Local\Temp\3FDE.tmp"95⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\401C.tmp"C:\Users\Admin\AppData\Local\Temp\401C.tmp"96⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\405A.tmp"C:\Users\Admin\AppData\Local\Temp\405A.tmp"97⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\4099.tmp"C:\Users\Admin\AppData\Local\Temp\4099.tmp"98⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\40D7.tmp"C:\Users\Admin\AppData\Local\Temp\40D7.tmp"99⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\4116.tmp"C:\Users\Admin\AppData\Local\Temp\4116.tmp"100⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\4164.tmp"C:\Users\Admin\AppData\Local\Temp\4164.tmp"101⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\41A2.tmp"C:\Users\Admin\AppData\Local\Temp\41A2.tmp"102⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\41E0.tmp"C:\Users\Admin\AppData\Local\Temp\41E0.tmp"103⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\421F.tmp"C:\Users\Admin\AppData\Local\Temp\421F.tmp"104⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\425D.tmp"C:\Users\Admin\AppData\Local\Temp\425D.tmp"105⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\429C.tmp"C:\Users\Admin\AppData\Local\Temp\429C.tmp"106⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\42DA.tmp"C:\Users\Admin\AppData\Local\Temp\42DA.tmp"107⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\4318.tmp"C:\Users\Admin\AppData\Local\Temp\4318.tmp"108⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\4357.tmp"C:\Users\Admin\AppData\Local\Temp\4357.tmp"109⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\4395.tmp"C:\Users\Admin\AppData\Local\Temp\4395.tmp"110⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\43D4.tmp"C:\Users\Admin\AppData\Local\Temp\43D4.tmp"111⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\4412.tmp"C:\Users\Admin\AppData\Local\Temp\4412.tmp"112⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\4450.tmp"C:\Users\Admin\AppData\Local\Temp\4450.tmp"113⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\449E.tmp"C:\Users\Admin\AppData\Local\Temp\449E.tmp"114⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\44DD.tmp"C:\Users\Admin\AppData\Local\Temp\44DD.tmp"115⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\451B.tmp"C:\Users\Admin\AppData\Local\Temp\451B.tmp"116⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\4569.tmp"C:\Users\Admin\AppData\Local\Temp\4569.tmp"117⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\45A8.tmp"C:\Users\Admin\AppData\Local\Temp\45A8.tmp"118⤵PID:356
-
C:\Users\Admin\AppData\Local\Temp\45E6.tmp"C:\Users\Admin\AppData\Local\Temp\45E6.tmp"119⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\4624.tmp"C:\Users\Admin\AppData\Local\Temp\4624.tmp"120⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\4663.tmp"C:\Users\Admin\AppData\Local\Temp\4663.tmp"121⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\46A1.tmp"C:\Users\Admin\AppData\Local\Temp\46A1.tmp"122⤵PID:1744
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-