Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
16-06-2024 06:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-16_41e89c14e261dc1d145ac77d8b44b2aa_mafia.exe
Resource
win7-20240508-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-16_41e89c14e261dc1d145ac77d8b44b2aa_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-06-16_41e89c14e261dc1d145ac77d8b44b2aa_mafia.exe
-
Size
541KB
-
MD5
41e89c14e261dc1d145ac77d8b44b2aa
-
SHA1
638e581acedcd78a21a1916e988fd54c8fdee34d
-
SHA256
b981aa9d9ff48dfc3d9babc28aee2f46b2742fe77484961c7ad93761d62c5353
-
SHA512
ae16aa485f55399d01525040467da2146cd5f7252525e66c0938741d3c3313f5dfe10dba222d69e3c347ba86984565e497f5468765d4ca1eebc1757ed7821e74
-
SSDEEP
12288:UU5rCOTeifSIzzOgK3cpB+4lagGZ2ONczrZa73ctO:UUQOJf6gKW+4wzZ2ONczrU73ctO
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3048 1DAE.tmp 2812 1E1B.tmp 1088 1E98.tmp 2732 1F15.tmp 2676 1F92.tmp 2148 1FFF.tmp 2756 207C.tmp 2344 20CA.tmp 1668 2137.tmp 2564 21B4.tmp 3032 2221.tmp 3064 228E.tmp 2828 230B.tmp 2848 2388.tmp 2908 23F5.tmp 1572 2462.tmp 1956 24CF.tmp 1736 254C.tmp 1628 25C9.tmp 1624 2646.tmp 1444 26B3.tmp 1508 2710.tmp 1228 276E.tmp 2056 27AC.tmp 2076 27EB.tmp 1200 2829.tmp 1852 2877.tmp 2964 28B6.tmp 2008 28F4.tmp 380 2932.tmp 540 2971.tmp 988 29BF.tmp 1484 29FD.tmp 2296 2A3C.tmp 576 2A8A.tmp 1492 2AC8.tmp 2356 2B06.tmp 2372 2B45.tmp 1044 2B93.tmp 1696 2BD1.tmp 1660 2C10.tmp 1984 2C4E.tmp 1604 2C8C.tmp 1084 2CCB.tmp 1060 2D09.tmp 748 2D48.tmp 2388 2D86.tmp 2128 2DC4.tmp 1740 2E03.tmp 1800 2E41.tmp 2160 2E80.tmp 2444 2EBE.tmp 876 2EFC.tmp 1752 2F3B.tmp 1708 2F79.tmp 1716 3015.tmp 3056 3054.tmp 3052 30B1.tmp 2712 30FF.tmp 1644 313E.tmp 2748 31AB.tmp 2672 31E9.tmp 2680 3228.tmp 2772 3266.tmp -
Loads dropped DLL 64 IoCs
pid Process 2992 2024-06-16_41e89c14e261dc1d145ac77d8b44b2aa_mafia.exe 3048 1DAE.tmp 2812 1E1B.tmp 1088 1E98.tmp 2732 1F15.tmp 2676 1F92.tmp 2148 1FFF.tmp 2756 207C.tmp 2344 20CA.tmp 1668 2137.tmp 2564 21B4.tmp 3032 2221.tmp 3064 228E.tmp 2828 230B.tmp 2848 2388.tmp 2908 23F5.tmp 1572 2462.tmp 1956 24CF.tmp 1736 254C.tmp 1628 25C9.tmp 1624 2646.tmp 1444 26B3.tmp 1508 2710.tmp 1228 276E.tmp 2056 27AC.tmp 2076 27EB.tmp 1200 2829.tmp 1852 2877.tmp 2964 28B6.tmp 2008 28F4.tmp 380 2932.tmp 540 2971.tmp 988 29BF.tmp 1484 29FD.tmp 2296 2A3C.tmp 576 2A8A.tmp 1492 2AC8.tmp 2356 2B06.tmp 2372 2B45.tmp 1044 2B93.tmp 1696 2BD1.tmp 1660 2C10.tmp 1984 2C4E.tmp 1604 2C8C.tmp 1084 2CCB.tmp 1060 2D09.tmp 748 2D48.tmp 2388 2D86.tmp 2128 2DC4.tmp 1740 2E03.tmp 1800 2E41.tmp 2160 2E80.tmp 2444 2EBE.tmp 876 2EFC.tmp 1752 2F3B.tmp 2204 2FB8.tmp 1716 3015.tmp 3056 3054.tmp 3052 30B1.tmp 2712 30FF.tmp 1644 313E.tmp 2748 31AB.tmp 2672 31E9.tmp 2680 3228.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2992 wrote to memory of 3048 2992 2024-06-16_41e89c14e261dc1d145ac77d8b44b2aa_mafia.exe 28 PID 2992 wrote to memory of 3048 2992 2024-06-16_41e89c14e261dc1d145ac77d8b44b2aa_mafia.exe 28 PID 2992 wrote to memory of 3048 2992 2024-06-16_41e89c14e261dc1d145ac77d8b44b2aa_mafia.exe 28 PID 2992 wrote to memory of 3048 2992 2024-06-16_41e89c14e261dc1d145ac77d8b44b2aa_mafia.exe 28 PID 3048 wrote to memory of 2812 3048 1DAE.tmp 29 PID 3048 wrote to memory of 2812 3048 1DAE.tmp 29 PID 3048 wrote to memory of 2812 3048 1DAE.tmp 29 PID 3048 wrote to memory of 2812 3048 1DAE.tmp 29 PID 2812 wrote to memory of 1088 2812 1E1B.tmp 30 PID 2812 wrote to memory of 1088 2812 1E1B.tmp 30 PID 2812 wrote to memory of 1088 2812 1E1B.tmp 30 PID 2812 wrote to memory of 1088 2812 1E1B.tmp 30 PID 1088 wrote to memory of 2732 1088 1E98.tmp 31 PID 1088 wrote to memory of 2732 1088 1E98.tmp 31 PID 1088 wrote to memory of 2732 1088 1E98.tmp 31 PID 1088 wrote to memory of 2732 1088 1E98.tmp 31 PID 2732 wrote to memory of 2676 2732 1F15.tmp 32 PID 2732 wrote to memory of 2676 2732 1F15.tmp 32 PID 2732 wrote to memory of 2676 2732 1F15.tmp 32 PID 2732 wrote to memory of 2676 2732 1F15.tmp 32 PID 2676 wrote to memory of 2148 2676 1F92.tmp 33 PID 2676 wrote to memory of 2148 2676 1F92.tmp 33 PID 2676 wrote to memory of 2148 2676 1F92.tmp 33 PID 2676 wrote to memory of 2148 2676 1F92.tmp 33 PID 2148 wrote to memory of 2756 2148 1FFF.tmp 34 PID 2148 wrote to memory of 2756 2148 1FFF.tmp 34 PID 2148 wrote to memory of 2756 2148 1FFF.tmp 34 PID 2148 wrote to memory of 2756 2148 1FFF.tmp 34 PID 2756 wrote to memory of 2344 2756 207C.tmp 35 PID 2756 wrote to memory of 2344 2756 207C.tmp 35 PID 2756 wrote to memory of 2344 2756 207C.tmp 35 PID 2756 wrote to memory of 2344 2756 207C.tmp 35 PID 2344 wrote to memory of 1668 2344 20CA.tmp 36 PID 2344 wrote to memory of 1668 2344 20CA.tmp 36 PID 2344 wrote to memory of 1668 2344 20CA.tmp 36 PID 2344 wrote to memory of 1668 2344 20CA.tmp 36 PID 1668 wrote to memory of 2564 1668 2137.tmp 37 PID 1668 wrote to memory of 2564 1668 2137.tmp 37 PID 1668 wrote to memory of 2564 1668 2137.tmp 37 PID 1668 wrote to memory of 2564 1668 2137.tmp 37 PID 2564 wrote to memory of 3032 2564 21B4.tmp 38 PID 2564 wrote to memory of 3032 2564 21B4.tmp 38 PID 2564 wrote to memory of 3032 2564 21B4.tmp 38 PID 2564 wrote to memory of 3032 2564 21B4.tmp 38 PID 3032 wrote to memory of 3064 3032 2221.tmp 39 PID 3032 wrote to memory of 3064 3032 2221.tmp 39 PID 3032 wrote to memory of 3064 3032 2221.tmp 39 PID 3032 wrote to memory of 3064 3032 2221.tmp 39 PID 3064 wrote to memory of 2828 3064 228E.tmp 40 PID 3064 wrote to memory of 2828 3064 228E.tmp 40 PID 3064 wrote to memory of 2828 3064 228E.tmp 40 PID 3064 wrote to memory of 2828 3064 228E.tmp 40 PID 2828 wrote to memory of 2848 2828 230B.tmp 41 PID 2828 wrote to memory of 2848 2828 230B.tmp 41 PID 2828 wrote to memory of 2848 2828 230B.tmp 41 PID 2828 wrote to memory of 2848 2828 230B.tmp 41 PID 2848 wrote to memory of 2908 2848 2388.tmp 42 PID 2848 wrote to memory of 2908 2848 2388.tmp 42 PID 2848 wrote to memory of 2908 2848 2388.tmp 42 PID 2848 wrote to memory of 2908 2848 2388.tmp 42 PID 2908 wrote to memory of 1572 2908 23F5.tmp 43 PID 2908 wrote to memory of 1572 2908 23F5.tmp 43 PID 2908 wrote to memory of 1572 2908 23F5.tmp 43 PID 2908 wrote to memory of 1572 2908 23F5.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-16_41e89c14e261dc1d145ac77d8b44b2aa_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-16_41e89c14e261dc1d145ac77d8b44b2aa_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\1E98.tmp"C:\Users\Admin\AppData\Local\Temp\1E98.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\1F15.tmp"C:\Users\Admin\AppData\Local\Temp\1F15.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\1F92.tmp"C:\Users\Admin\AppData\Local\Temp\1F92.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\207C.tmp"C:\Users\Admin\AppData\Local\Temp\207C.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\20CA.tmp"C:\Users\Admin\AppData\Local\Temp\20CA.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\2137.tmp"C:\Users\Admin\AppData\Local\Temp\2137.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\21B4.tmp"C:\Users\Admin\AppData\Local\Temp\21B4.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\2221.tmp"C:\Users\Admin\AppData\Local\Temp\2221.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\228E.tmp"C:\Users\Admin\AppData\Local\Temp\228E.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\230B.tmp"C:\Users\Admin\AppData\Local\Temp\230B.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\2388.tmp"C:\Users\Admin\AppData\Local\Temp\2388.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\23F5.tmp"C:\Users\Admin\AppData\Local\Temp\23F5.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\24CF.tmp"C:\Users\Admin\AppData\Local\Temp\24CF.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\254C.tmp"C:\Users\Admin\AppData\Local\Temp\254C.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\25C9.tmp"C:\Users\Admin\AppData\Local\Temp\25C9.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\2646.tmp"C:\Users\Admin\AppData\Local\Temp\2646.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\26B3.tmp"C:\Users\Admin\AppData\Local\Temp\26B3.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\2710.tmp"C:\Users\Admin\AppData\Local\Temp\2710.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\276E.tmp"C:\Users\Admin\AppData\Local\Temp\276E.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\27AC.tmp"C:\Users\Admin\AppData\Local\Temp\27AC.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\27EB.tmp"C:\Users\Admin\AppData\Local\Temp\27EB.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\2829.tmp"C:\Users\Admin\AppData\Local\Temp\2829.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\2877.tmp"C:\Users\Admin\AppData\Local\Temp\2877.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\28B6.tmp"C:\Users\Admin\AppData\Local\Temp\28B6.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\28F4.tmp"C:\Users\Admin\AppData\Local\Temp\28F4.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\2932.tmp"C:\Users\Admin\AppData\Local\Temp\2932.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:380 -
C:\Users\Admin\AppData\Local\Temp\2971.tmp"C:\Users\Admin\AppData\Local\Temp\2971.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:540 -
C:\Users\Admin\AppData\Local\Temp\29BF.tmp"C:\Users\Admin\AppData\Local\Temp\29BF.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:988 -
C:\Users\Admin\AppData\Local\Temp\29FD.tmp"C:\Users\Admin\AppData\Local\Temp\29FD.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:576 -
C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\2B06.tmp"C:\Users\Admin\AppData\Local\Temp\2B06.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\2B45.tmp"C:\Users\Admin\AppData\Local\Temp\2B45.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\2B93.tmp"C:\Users\Admin\AppData\Local\Temp\2B93.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\2C10.tmp"C:\Users\Admin\AppData\Local\Temp\2C10.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\2D09.tmp"C:\Users\Admin\AppData\Local\Temp\2D09.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\2D48.tmp"C:\Users\Admin\AppData\Local\Temp\2D48.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:748 -
C:\Users\Admin\AppData\Local\Temp\2D86.tmp"C:\Users\Admin\AppData\Local\Temp\2D86.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\2E03.tmp"C:\Users\Admin\AppData\Local\Temp\2E03.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\2E41.tmp"C:\Users\Admin\AppData\Local\Temp\2E41.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\2E80.tmp"C:\Users\Admin\AppData\Local\Temp\2E80.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:876 -
C:\Users\Admin\AppData\Local\Temp\2F3B.tmp"C:\Users\Admin\AppData\Local\Temp\2F3B.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\2F79.tmp"C:\Users\Admin\AppData\Local\Temp\2F79.tmp"56⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"57⤵
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\3015.tmp"C:\Users\Admin\AppData\Local\Temp\3015.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\3054.tmp"C:\Users\Admin\AppData\Local\Temp\3054.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\30B1.tmp"C:\Users\Admin\AppData\Local\Temp\30B1.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\30FF.tmp"C:\Users\Admin\AppData\Local\Temp\30FF.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\313E.tmp"C:\Users\Admin\AppData\Local\Temp\313E.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\31AB.tmp"C:\Users\Admin\AppData\Local\Temp\31AB.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\31E9.tmp"C:\Users\Admin\AppData\Local\Temp\31E9.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\3228.tmp"C:\Users\Admin\AppData\Local\Temp\3228.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\3266.tmp"C:\Users\Admin\AppData\Local\Temp\3266.tmp"66⤵
- Executes dropped EXE
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\32A4.tmp"C:\Users\Admin\AppData\Local\Temp\32A4.tmp"67⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\32E3.tmp"C:\Users\Admin\AppData\Local\Temp\32E3.tmp"68⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\3321.tmp"C:\Users\Admin\AppData\Local\Temp\3321.tmp"69⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\3360.tmp"C:\Users\Admin\AppData\Local\Temp\3360.tmp"70⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\339E.tmp"C:\Users\Admin\AppData\Local\Temp\339E.tmp"71⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\33DC.tmp"C:\Users\Admin\AppData\Local\Temp\33DC.tmp"72⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\341B.tmp"C:\Users\Admin\AppData\Local\Temp\341B.tmp"73⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\3459.tmp"C:\Users\Admin\AppData\Local\Temp\3459.tmp"74⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\3498.tmp"C:\Users\Admin\AppData\Local\Temp\3498.tmp"75⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\34D6.tmp"C:\Users\Admin\AppData\Local\Temp\34D6.tmp"76⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\3514.tmp"C:\Users\Admin\AppData\Local\Temp\3514.tmp"77⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\3553.tmp"C:\Users\Admin\AppData\Local\Temp\3553.tmp"78⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\3591.tmp"C:\Users\Admin\AppData\Local\Temp\3591.tmp"79⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\35D0.tmp"C:\Users\Admin\AppData\Local\Temp\35D0.tmp"80⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\360E.tmp"C:\Users\Admin\AppData\Local\Temp\360E.tmp"81⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\364C.tmp"C:\Users\Admin\AppData\Local\Temp\364C.tmp"82⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\368B.tmp"C:\Users\Admin\AppData\Local\Temp\368B.tmp"83⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\36C9.tmp"C:\Users\Admin\AppData\Local\Temp\36C9.tmp"84⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\3708.tmp"C:\Users\Admin\AppData\Local\Temp\3708.tmp"85⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\3746.tmp"C:\Users\Admin\AppData\Local\Temp\3746.tmp"86⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\3784.tmp"C:\Users\Admin\AppData\Local\Temp\3784.tmp"87⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\37C3.tmp"C:\Users\Admin\AppData\Local\Temp\37C3.tmp"88⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\3801.tmp"C:\Users\Admin\AppData\Local\Temp\3801.tmp"89⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\3840.tmp"C:\Users\Admin\AppData\Local\Temp\3840.tmp"90⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\387E.tmp"C:\Users\Admin\AppData\Local\Temp\387E.tmp"91⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\38BC.tmp"C:\Users\Admin\AppData\Local\Temp\38BC.tmp"92⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\38FB.tmp"C:\Users\Admin\AppData\Local\Temp\38FB.tmp"93⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\3939.tmp"C:\Users\Admin\AppData\Local\Temp\3939.tmp"94⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\3968.tmp"C:\Users\Admin\AppData\Local\Temp\3968.tmp"95⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\39A6.tmp"C:\Users\Admin\AppData\Local\Temp\39A6.tmp"96⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\39E5.tmp"C:\Users\Admin\AppData\Local\Temp\39E5.tmp"97⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\3A23.tmp"C:\Users\Admin\AppData\Local\Temp\3A23.tmp"98⤵PID:484
-
C:\Users\Admin\AppData\Local\Temp\3A62.tmp"C:\Users\Admin\AppData\Local\Temp\3A62.tmp"99⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\3AA0.tmp"C:\Users\Admin\AppData\Local\Temp\3AA0.tmp"100⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\3ADE.tmp"C:\Users\Admin\AppData\Local\Temp\3ADE.tmp"101⤵PID:604
-
C:\Users\Admin\AppData\Local\Temp\3B1D.tmp"C:\Users\Admin\AppData\Local\Temp\3B1D.tmp"102⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\3B5B.tmp"C:\Users\Admin\AppData\Local\Temp\3B5B.tmp"103⤵PID:340
-
C:\Users\Admin\AppData\Local\Temp\3B9A.tmp"C:\Users\Admin\AppData\Local\Temp\3B9A.tmp"104⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\3BD8.tmp"C:\Users\Admin\AppData\Local\Temp\3BD8.tmp"105⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\3C16.tmp"C:\Users\Admin\AppData\Local\Temp\3C16.tmp"106⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\3C55.tmp"C:\Users\Admin\AppData\Local\Temp\3C55.tmp"107⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\3C93.tmp"C:\Users\Admin\AppData\Local\Temp\3C93.tmp"108⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\3CD2.tmp"C:\Users\Admin\AppData\Local\Temp\3CD2.tmp"109⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\3D10.tmp"C:\Users\Admin\AppData\Local\Temp\3D10.tmp"110⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\3D5E.tmp"C:\Users\Admin\AppData\Local\Temp\3D5E.tmp"111⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"112⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\3DEA.tmp"C:\Users\Admin\AppData\Local\Temp\3DEA.tmp"113⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\3E29.tmp"C:\Users\Admin\AppData\Local\Temp\3E29.tmp"114⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\3E67.tmp"C:\Users\Admin\AppData\Local\Temp\3E67.tmp"115⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\3EA6.tmp"C:\Users\Admin\AppData\Local\Temp\3EA6.tmp"116⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"117⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\3F22.tmp"C:\Users\Admin\AppData\Local\Temp\3F22.tmp"118⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\3F61.tmp"C:\Users\Admin\AppData\Local\Temp\3F61.tmp"119⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\3F9F.tmp"C:\Users\Admin\AppData\Local\Temp\3F9F.tmp"120⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\3FDE.tmp"C:\Users\Admin\AppData\Local\Temp\3FDE.tmp"121⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\401C.tmp"C:\Users\Admin\AppData\Local\Temp\401C.tmp"122⤵PID:2116
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-