Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
28/06/2024, 16:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-28_10e8d2523d0368fe6ffc4ce60685bbc1_mafia.exe
Resource
win7-20240611-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-28_10e8d2523d0368fe6ffc4ce60685bbc1_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-06-28_10e8d2523d0368fe6ffc4ce60685bbc1_mafia.exe
-
Size
536KB
-
MD5
10e8d2523d0368fe6ffc4ce60685bbc1
-
SHA1
29740845a7c3a47feb5b584c763c84a3654fb530
-
SHA256
ae7bd3b5fd9c4f4fad1b4a3594dd9242a572df01053a978cb3c7d9539f38360c
-
SHA512
efa64feec22b2dc065be3a6a76e9a58282c7e82aeafddc991c4e069ae2e3f971931d2b85b88654053a6e77858a1028b6f98d800f0cd045c6ff0881588cab7af1
-
SSDEEP
12288:wU5rCOTeiUE26NLHWkanwASv8R5K2jQCeFbrDqgxTIZxVJ0ZT9:wUQOJUE26NEwkRbkCeTZIRJ0ZT9
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2216 233A.tmp 1956 2388.tmp 1668 2414.tmp 3016 2491.tmp 2692 24FE.tmp 2596 253C.tmp 2736 259A.tmp 2528 2617.tmp 2628 2684.tmp 2508 26F1.tmp 2544 274F.tmp 340 280A.tmp 2764 2877.tmp 2420 2904.tmp 1612 2961.tmp 2024 29AF.tmp 2792 29FD.tmp 2812 2AF7.tmp 1244 2B74.tmp 3036 2BD1.tmp 320 2C5E.tmp 484 2CCB.tmp 1232 2D38.tmp 1040 2D76.tmp 1464 2DB5.tmp 348 2E12.tmp 1080 2E51.tmp 448 2E9F.tmp 2992 2EDD.tmp 1508 2F4A.tmp 952 2F89.tmp 1772 2FD7.tmp 2876 3015.tmp 2184 3063.tmp 2364 30A2.tmp 2156 30E0.tmp 1996 311E.tmp 1708 316C.tmp 2880 31AB.tmp 1544 3208.tmp 2032 3247.tmp 2068 3285.tmp 1692 32C4.tmp 1780 3302.tmp 1976 3340.tmp 2632 337F.tmp 3016 33BD.tmp 2748 33FC.tmp 2272 344A.tmp 2844 3488.tmp 2736 34C6.tmp 2516 3505.tmp 2744 3543.tmp 2656 3582.tmp 2512 35C0.tmp 2160 35FE.tmp 1436 365C.tmp 2372 369A.tmp 2796 36D9.tmp 2416 3727.tmp 1696 3765.tmp 1032 37A4.tmp 632 37E2.tmp 2152 3820.tmp -
Loads dropped DLL 64 IoCs
pid Process 1932 2024-06-28_10e8d2523d0368fe6ffc4ce60685bbc1_mafia.exe 2216 233A.tmp 1956 2388.tmp 1668 2414.tmp 3016 2491.tmp 2692 24FE.tmp 2596 253C.tmp 2736 259A.tmp 2528 2617.tmp 2628 2684.tmp 2508 26F1.tmp 2544 274F.tmp 340 280A.tmp 2764 2877.tmp 2420 2904.tmp 1612 2961.tmp 2024 29AF.tmp 2792 29FD.tmp 2812 2AF7.tmp 1244 2B74.tmp 3036 2BD1.tmp 320 2C5E.tmp 484 2CCB.tmp 1232 2D38.tmp 1040 2D76.tmp 1464 2DB5.tmp 348 2E12.tmp 1080 2E51.tmp 448 2E9F.tmp 2992 2EDD.tmp 1508 2F4A.tmp 952 2F89.tmp 1772 2FD7.tmp 2876 3015.tmp 2184 3063.tmp 2364 30A2.tmp 2156 30E0.tmp 1996 311E.tmp 1708 316C.tmp 2880 31AB.tmp 1544 3208.tmp 2032 3247.tmp 2068 3285.tmp 1692 32C4.tmp 1780 3302.tmp 1976 3340.tmp 2632 337F.tmp 3016 33BD.tmp 2748 33FC.tmp 2272 344A.tmp 2844 3488.tmp 2736 34C6.tmp 2516 3505.tmp 2744 3543.tmp 2656 3582.tmp 2512 35C0.tmp 2160 35FE.tmp 1436 365C.tmp 2372 369A.tmp 2796 36D9.tmp 2416 3727.tmp 1696 3765.tmp 1032 37A4.tmp 632 37E2.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1932 wrote to memory of 2216 1932 2024-06-28_10e8d2523d0368fe6ffc4ce60685bbc1_mafia.exe 28 PID 1932 wrote to memory of 2216 1932 2024-06-28_10e8d2523d0368fe6ffc4ce60685bbc1_mafia.exe 28 PID 1932 wrote to memory of 2216 1932 2024-06-28_10e8d2523d0368fe6ffc4ce60685bbc1_mafia.exe 28 PID 1932 wrote to memory of 2216 1932 2024-06-28_10e8d2523d0368fe6ffc4ce60685bbc1_mafia.exe 28 PID 2216 wrote to memory of 1956 2216 233A.tmp 29 PID 2216 wrote to memory of 1956 2216 233A.tmp 29 PID 2216 wrote to memory of 1956 2216 233A.tmp 29 PID 2216 wrote to memory of 1956 2216 233A.tmp 29 PID 1956 wrote to memory of 1668 1956 2388.tmp 30 PID 1956 wrote to memory of 1668 1956 2388.tmp 30 PID 1956 wrote to memory of 1668 1956 2388.tmp 30 PID 1956 wrote to memory of 1668 1956 2388.tmp 30 PID 1668 wrote to memory of 3016 1668 2414.tmp 31 PID 1668 wrote to memory of 3016 1668 2414.tmp 31 PID 1668 wrote to memory of 3016 1668 2414.tmp 31 PID 1668 wrote to memory of 3016 1668 2414.tmp 31 PID 3016 wrote to memory of 2692 3016 2491.tmp 32 PID 3016 wrote to memory of 2692 3016 2491.tmp 32 PID 3016 wrote to memory of 2692 3016 2491.tmp 32 PID 3016 wrote to memory of 2692 3016 2491.tmp 32 PID 2692 wrote to memory of 2596 2692 24FE.tmp 33 PID 2692 wrote to memory of 2596 2692 24FE.tmp 33 PID 2692 wrote to memory of 2596 2692 24FE.tmp 33 PID 2692 wrote to memory of 2596 2692 24FE.tmp 33 PID 2596 wrote to memory of 2736 2596 253C.tmp 34 PID 2596 wrote to memory of 2736 2596 253C.tmp 34 PID 2596 wrote to memory of 2736 2596 253C.tmp 34 PID 2596 wrote to memory of 2736 2596 253C.tmp 34 PID 2736 wrote to memory of 2528 2736 259A.tmp 35 PID 2736 wrote to memory of 2528 2736 259A.tmp 35 PID 2736 wrote to memory of 2528 2736 259A.tmp 35 PID 2736 wrote to memory of 2528 2736 259A.tmp 35 PID 2528 wrote to memory of 2628 2528 2617.tmp 36 PID 2528 wrote to memory of 2628 2528 2617.tmp 36 PID 2528 wrote to memory of 2628 2528 2617.tmp 36 PID 2528 wrote to memory of 2628 2528 2617.tmp 36 PID 2628 wrote to memory of 2508 2628 2684.tmp 37 PID 2628 wrote to memory of 2508 2628 2684.tmp 37 PID 2628 wrote to memory of 2508 2628 2684.tmp 37 PID 2628 wrote to memory of 2508 2628 2684.tmp 37 PID 2508 wrote to memory of 2544 2508 26F1.tmp 38 PID 2508 wrote to memory of 2544 2508 26F1.tmp 38 PID 2508 wrote to memory of 2544 2508 26F1.tmp 38 PID 2508 wrote to memory of 2544 2508 26F1.tmp 38 PID 2544 wrote to memory of 340 2544 274F.tmp 39 PID 2544 wrote to memory of 340 2544 274F.tmp 39 PID 2544 wrote to memory of 340 2544 274F.tmp 39 PID 2544 wrote to memory of 340 2544 274F.tmp 39 PID 340 wrote to memory of 2764 340 280A.tmp 40 PID 340 wrote to memory of 2764 340 280A.tmp 40 PID 340 wrote to memory of 2764 340 280A.tmp 40 PID 340 wrote to memory of 2764 340 280A.tmp 40 PID 2764 wrote to memory of 2420 2764 2877.tmp 41 PID 2764 wrote to memory of 2420 2764 2877.tmp 41 PID 2764 wrote to memory of 2420 2764 2877.tmp 41 PID 2764 wrote to memory of 2420 2764 2877.tmp 41 PID 2420 wrote to memory of 1612 2420 2904.tmp 42 PID 2420 wrote to memory of 1612 2420 2904.tmp 42 PID 2420 wrote to memory of 1612 2420 2904.tmp 42 PID 2420 wrote to memory of 1612 2420 2904.tmp 42 PID 1612 wrote to memory of 2024 1612 2961.tmp 43 PID 1612 wrote to memory of 2024 1612 2961.tmp 43 PID 1612 wrote to memory of 2024 1612 2961.tmp 43 PID 1612 wrote to memory of 2024 1612 2961.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-28_10e8d2523d0368fe6ffc4ce60685bbc1_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-28_10e8d2523d0368fe6ffc4ce60685bbc1_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\233A.tmp"C:\Users\Admin\AppData\Local\Temp\233A.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\2388.tmp"C:\Users\Admin\AppData\Local\Temp\2388.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\2414.tmp"C:\Users\Admin\AppData\Local\Temp\2414.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\2491.tmp"C:\Users\Admin\AppData\Local\Temp\2491.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\24FE.tmp"C:\Users\Admin\AppData\Local\Temp\24FE.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\253C.tmp"C:\Users\Admin\AppData\Local\Temp\253C.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\259A.tmp"C:\Users\Admin\AppData\Local\Temp\259A.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\2684.tmp"C:\Users\Admin\AppData\Local\Temp\2684.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\26F1.tmp"C:\Users\Admin\AppData\Local\Temp\26F1.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\274F.tmp"C:\Users\Admin\AppData\Local\Temp\274F.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:340 -
C:\Users\Admin\AppData\Local\Temp\2877.tmp"C:\Users\Admin\AppData\Local\Temp\2877.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\2904.tmp"C:\Users\Admin\AppData\Local\Temp\2904.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\2961.tmp"C:\Users\Admin\AppData\Local\Temp\2961.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\29AF.tmp"C:\Users\Admin\AppData\Local\Temp\29AF.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\29FD.tmp"C:\Users\Admin\AppData\Local\Temp\29FD.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\2B74.tmp"C:\Users\Admin\AppData\Local\Temp\2B74.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:320 -
C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:484 -
C:\Users\Admin\AppData\Local\Temp\2D38.tmp"C:\Users\Admin\AppData\Local\Temp\2D38.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\2D76.tmp"C:\Users\Admin\AppData\Local\Temp\2D76.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\2E12.tmp"C:\Users\Admin\AppData\Local\Temp\2E12.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:348 -
C:\Users\Admin\AppData\Local\Temp\2E51.tmp"C:\Users\Admin\AppData\Local\Temp\2E51.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\2E9F.tmp"C:\Users\Admin\AppData\Local\Temp\2E9F.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:448 -
C:\Users\Admin\AppData\Local\Temp\2EDD.tmp"C:\Users\Admin\AppData\Local\Temp\2EDD.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\2F89.tmp"C:\Users\Admin\AppData\Local\Temp\2F89.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:952 -
C:\Users\Admin\AppData\Local\Temp\2FD7.tmp"C:\Users\Admin\AppData\Local\Temp\2FD7.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\3015.tmp"C:\Users\Admin\AppData\Local\Temp\3015.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\3063.tmp"C:\Users\Admin\AppData\Local\Temp\3063.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\30A2.tmp"C:\Users\Admin\AppData\Local\Temp\30A2.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\30E0.tmp"C:\Users\Admin\AppData\Local\Temp\30E0.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\311E.tmp"C:\Users\Admin\AppData\Local\Temp\311E.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\316C.tmp"C:\Users\Admin\AppData\Local\Temp\316C.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\31AB.tmp"C:\Users\Admin\AppData\Local\Temp\31AB.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\3208.tmp"C:\Users\Admin\AppData\Local\Temp\3208.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\3247.tmp"C:\Users\Admin\AppData\Local\Temp\3247.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\3285.tmp"C:\Users\Admin\AppData\Local\Temp\3285.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\32C4.tmp"C:\Users\Admin\AppData\Local\Temp\32C4.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\3302.tmp"C:\Users\Admin\AppData\Local\Temp\3302.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\3340.tmp"C:\Users\Admin\AppData\Local\Temp\3340.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\337F.tmp"C:\Users\Admin\AppData\Local\Temp\337F.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\33BD.tmp"C:\Users\Admin\AppData\Local\Temp\33BD.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\33FC.tmp"C:\Users\Admin\AppData\Local\Temp\33FC.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\344A.tmp"C:\Users\Admin\AppData\Local\Temp\344A.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\34C6.tmp"C:\Users\Admin\AppData\Local\Temp\34C6.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\3505.tmp"C:\Users\Admin\AppData\Local\Temp\3505.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\3543.tmp"C:\Users\Admin\AppData\Local\Temp\3543.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\3582.tmp"C:\Users\Admin\AppData\Local\Temp\3582.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\35C0.tmp"C:\Users\Admin\AppData\Local\Temp\35C0.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\35FE.tmp"C:\Users\Admin\AppData\Local\Temp\35FE.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\365C.tmp"C:\Users\Admin\AppData\Local\Temp\365C.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\369A.tmp"C:\Users\Admin\AppData\Local\Temp\369A.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\36D9.tmp"C:\Users\Admin\AppData\Local\Temp\36D9.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\3727.tmp"C:\Users\Admin\AppData\Local\Temp\3727.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\3765.tmp"C:\Users\Admin\AppData\Local\Temp\3765.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\37A4.tmp"C:\Users\Admin\AppData\Local\Temp\37A4.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\37E2.tmp"C:\Users\Admin\AppData\Local\Temp\37E2.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:632 -
C:\Users\Admin\AppData\Local\Temp\3820.tmp"C:\Users\Admin\AppData\Local\Temp\3820.tmp"65⤵
- Executes dropped EXE
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\385F.tmp"C:\Users\Admin\AppData\Local\Temp\385F.tmp"66⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\389D.tmp"C:\Users\Admin\AppData\Local\Temp\389D.tmp"67⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\38DC.tmp"C:\Users\Admin\AppData\Local\Temp\38DC.tmp"68⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\391A.tmp"C:\Users\Admin\AppData\Local\Temp\391A.tmp"69⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\3958.tmp"C:\Users\Admin\AppData\Local\Temp\3958.tmp"70⤵PID:596
-
C:\Users\Admin\AppData\Local\Temp\3997.tmp"C:\Users\Admin\AppData\Local\Temp\3997.tmp"71⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\39D5.tmp"C:\Users\Admin\AppData\Local\Temp\39D5.tmp"72⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\3A14.tmp"C:\Users\Admin\AppData\Local\Temp\3A14.tmp"73⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\3A52.tmp"C:\Users\Admin\AppData\Local\Temp\3A52.tmp"74⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\3AA0.tmp"C:\Users\Admin\AppData\Local\Temp\3AA0.tmp"75⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\3ADE.tmp"C:\Users\Admin\AppData\Local\Temp\3ADE.tmp"76⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\3B1D.tmp"C:\Users\Admin\AppData\Local\Temp\3B1D.tmp"77⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\3B5B.tmp"C:\Users\Admin\AppData\Local\Temp\3B5B.tmp"78⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\3BA9.tmp"C:\Users\Admin\AppData\Local\Temp\3BA9.tmp"79⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\3BE8.tmp"C:\Users\Admin\AppData\Local\Temp\3BE8.tmp"80⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\3C26.tmp"C:\Users\Admin\AppData\Local\Temp\3C26.tmp"81⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\3C64.tmp"C:\Users\Admin\AppData\Local\Temp\3C64.tmp"82⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\3CA3.tmp"C:\Users\Admin\AppData\Local\Temp\3CA3.tmp"83⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\3CE1.tmp"C:\Users\Admin\AppData\Local\Temp\3CE1.tmp"84⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\3D20.tmp"C:\Users\Admin\AppData\Local\Temp\3D20.tmp"85⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\3D5E.tmp"C:\Users\Admin\AppData\Local\Temp\3D5E.tmp"86⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\3DAC.tmp"C:\Users\Admin\AppData\Local\Temp\3DAC.tmp"87⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\3DEA.tmp"C:\Users\Admin\AppData\Local\Temp\3DEA.tmp"88⤵PID:108
-
C:\Users\Admin\AppData\Local\Temp\3E38.tmp"C:\Users\Admin\AppData\Local\Temp\3E38.tmp"89⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\3E77.tmp"C:\Users\Admin\AppData\Local\Temp\3E77.tmp"90⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\3EC5.tmp"C:\Users\Admin\AppData\Local\Temp\3EC5.tmp"91⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\3F03.tmp"C:\Users\Admin\AppData\Local\Temp\3F03.tmp"92⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\3F42.tmp"C:\Users\Admin\AppData\Local\Temp\3F42.tmp"93⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\3F80.tmp"C:\Users\Admin\AppData\Local\Temp\3F80.tmp"94⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\3FCE.tmp"C:\Users\Admin\AppData\Local\Temp\3FCE.tmp"95⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\400C.tmp"C:\Users\Admin\AppData\Local\Temp\400C.tmp"96⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\405A.tmp"C:\Users\Admin\AppData\Local\Temp\405A.tmp"97⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\4099.tmp"C:\Users\Admin\AppData\Local\Temp\4099.tmp"98⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\40D7.tmp"C:\Users\Admin\AppData\Local\Temp\40D7.tmp"99⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\4116.tmp"C:\Users\Admin\AppData\Local\Temp\4116.tmp"100⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\4154.tmp"C:\Users\Admin\AppData\Local\Temp\4154.tmp"101⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\4192.tmp"C:\Users\Admin\AppData\Local\Temp\4192.tmp"102⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\41D1.tmp"C:\Users\Admin\AppData\Local\Temp\41D1.tmp"103⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\420F.tmp"C:\Users\Admin\AppData\Local\Temp\420F.tmp"104⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\424E.tmp"C:\Users\Admin\AppData\Local\Temp\424E.tmp"105⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\428C.tmp"C:\Users\Admin\AppData\Local\Temp\428C.tmp"106⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\42CA.tmp"C:\Users\Admin\AppData\Local\Temp\42CA.tmp"107⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\4309.tmp"C:\Users\Admin\AppData\Local\Temp\4309.tmp"108⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\4347.tmp"C:\Users\Admin\AppData\Local\Temp\4347.tmp"109⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\4386.tmp"C:\Users\Admin\AppData\Local\Temp\4386.tmp"110⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\43C4.tmp"C:\Users\Admin\AppData\Local\Temp\43C4.tmp"111⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\4402.tmp"C:\Users\Admin\AppData\Local\Temp\4402.tmp"112⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\4441.tmp"C:\Users\Admin\AppData\Local\Temp\4441.tmp"113⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\447F.tmp"C:\Users\Admin\AppData\Local\Temp\447F.tmp"114⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\44BE.tmp"C:\Users\Admin\AppData\Local\Temp\44BE.tmp"115⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\44FC.tmp"C:\Users\Admin\AppData\Local\Temp\44FC.tmp"116⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\453A.tmp"C:\Users\Admin\AppData\Local\Temp\453A.tmp"117⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\4579.tmp"C:\Users\Admin\AppData\Local\Temp\4579.tmp"118⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\45B7.tmp"C:\Users\Admin\AppData\Local\Temp\45B7.tmp"119⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\45F6.tmp"C:\Users\Admin\AppData\Local\Temp\45F6.tmp"120⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\4634.tmp"C:\Users\Admin\AppData\Local\Temp\4634.tmp"121⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\4672.tmp"C:\Users\Admin\AppData\Local\Temp\4672.tmp"122⤵PID:2044
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-