Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
27-01-2024 22:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-01-27_0af26bad97a8779e9436e4f1738b5cf9_mafia.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-01-27_0af26bad97a8779e9436e4f1738b5cf9_mafia.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-01-27_0af26bad97a8779e9436e4f1738b5cf9_mafia.exe
-
Size
487KB
-
MD5
0af26bad97a8779e9436e4f1738b5cf9
-
SHA1
8e347734bb5b7193cace1ed6194d4f550b2d0b6a
-
SHA256
8a1ef93ecc49ff8138a157c6b661132b55a6c047fd67bd5d2fc41cfdb3d6e85f
-
SHA512
22a5208e864ba2aaff8091e3c1c82e6170128ff3e0de005283546b936ed6704818eb736c898ae78eebfed5d1f7c9d4d3319072cf270ffaba851e8a72cd03e6d9
-
SSDEEP
12288:yU5rCOTeiNu9e/W50crC7qZ2PZ5CbpXjH6UlMbZ:yUQOJNuc+DH2x5CbI6Mb
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3000 712.tmp 3052 770.tmp 2176 7DD.tmp 2004 82B.tmp 2660 879.tmp 2664 8D7.tmp 2772 934.tmp 2500 992.tmp 788 9F0.tmp 2520 A5D.tmp 2516 ABA.tmp 2964 B18.tmp 2976 B76.tmp 2820 BD3.tmp 2696 C31.tmp 860 C8E.tmp 1320 CEC.tmp 2180 D4A.tmp 2712 D98.tmp 2640 DE6.tmp 1436 E34.tmp 1376 E82.tmp 2040 ED0.tmp 2080 F1E.tmp 2052 F5C.tmp 1836 F9A.tmp 2312 FE8.tmp 2032 1027.tmp 324 1065.tmp 336 10A4.tmp 240 10F2.tmp 652 1130.tmp 1996 116E.tmp 1552 11AD.tmp 1944 11EB.tmp 1040 122A.tmp 1240 1268.tmp 2008 12A6.tmp 2296 12F4.tmp 1568 1333.tmp 1216 1371.tmp 956 13B0.tmp 308 13EE.tmp 1788 142C.tmp 1120 147A.tmp 3024 14C8.tmp 1892 1507.tmp 1724 1545.tmp 280 1584.tmp 2644 15C2.tmp 2152 1600.tmp 892 164E.tmp 2236 168D.tmp 2380 16DB.tmp 2928 1758.tmp 2872 1796.tmp 2076 17D4.tmp 2556 1813.tmp 2824 1851.tmp 2620 1890.tmp 2680 18CE.tmp 2668 190C.tmp 2776 194B.tmp 3048 1989.tmp -
Loads dropped DLL 64 IoCs
pid Process 2928 2024-01-27_0af26bad97a8779e9436e4f1738b5cf9_mafia.exe 3000 712.tmp 3052 770.tmp 2176 7DD.tmp 2004 82B.tmp 2660 879.tmp 2664 8D7.tmp 2772 934.tmp 2500 992.tmp 788 9F0.tmp 2520 A5D.tmp 2516 ABA.tmp 2964 B18.tmp 2976 B76.tmp 2820 BD3.tmp 2696 C31.tmp 860 C8E.tmp 1320 CEC.tmp 2180 D4A.tmp 2712 D98.tmp 2640 DE6.tmp 1436 E34.tmp 1376 E82.tmp 2040 ED0.tmp 2080 F1E.tmp 2052 F5C.tmp 1836 F9A.tmp 2312 FE8.tmp 2032 1027.tmp 324 1065.tmp 336 10A4.tmp 240 10F2.tmp 652 1130.tmp 1996 116E.tmp 1552 11AD.tmp 1944 11EB.tmp 1040 122A.tmp 1240 1268.tmp 2008 12A6.tmp 2296 12F4.tmp 1568 1333.tmp 1216 1371.tmp 956 13B0.tmp 308 13EE.tmp 1788 142C.tmp 1120 147A.tmp 3024 14C8.tmp 1892 1507.tmp 1724 1545.tmp 280 1584.tmp 2644 15C2.tmp 2152 1600.tmp 892 164E.tmp 2236 168D.tmp 1616 1719.tmp 2928 1758.tmp 2872 1796.tmp 2076 17D4.tmp 2556 1813.tmp 2824 1851.tmp 2620 1890.tmp 2680 18CE.tmp 2668 190C.tmp 2776 194B.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2928 wrote to memory of 3000 2928 2024-01-27_0af26bad97a8779e9436e4f1738b5cf9_mafia.exe 28 PID 2928 wrote to memory of 3000 2928 2024-01-27_0af26bad97a8779e9436e4f1738b5cf9_mafia.exe 28 PID 2928 wrote to memory of 3000 2928 2024-01-27_0af26bad97a8779e9436e4f1738b5cf9_mafia.exe 28 PID 2928 wrote to memory of 3000 2928 2024-01-27_0af26bad97a8779e9436e4f1738b5cf9_mafia.exe 28 PID 3000 wrote to memory of 3052 3000 712.tmp 29 PID 3000 wrote to memory of 3052 3000 712.tmp 29 PID 3000 wrote to memory of 3052 3000 712.tmp 29 PID 3000 wrote to memory of 3052 3000 712.tmp 29 PID 3052 wrote to memory of 2176 3052 770.tmp 30 PID 3052 wrote to memory of 2176 3052 770.tmp 30 PID 3052 wrote to memory of 2176 3052 770.tmp 30 PID 3052 wrote to memory of 2176 3052 770.tmp 30 PID 2176 wrote to memory of 2004 2176 7DD.tmp 31 PID 2176 wrote to memory of 2004 2176 7DD.tmp 31 PID 2176 wrote to memory of 2004 2176 7DD.tmp 31 PID 2176 wrote to memory of 2004 2176 7DD.tmp 31 PID 2004 wrote to memory of 2660 2004 82B.tmp 32 PID 2004 wrote to memory of 2660 2004 82B.tmp 32 PID 2004 wrote to memory of 2660 2004 82B.tmp 32 PID 2004 wrote to memory of 2660 2004 82B.tmp 32 PID 2660 wrote to memory of 2664 2660 879.tmp 33 PID 2660 wrote to memory of 2664 2660 879.tmp 33 PID 2660 wrote to memory of 2664 2660 879.tmp 33 PID 2660 wrote to memory of 2664 2660 879.tmp 33 PID 2664 wrote to memory of 2772 2664 8D7.tmp 34 PID 2664 wrote to memory of 2772 2664 8D7.tmp 34 PID 2664 wrote to memory of 2772 2664 8D7.tmp 34 PID 2664 wrote to memory of 2772 2664 8D7.tmp 34 PID 2772 wrote to memory of 2500 2772 934.tmp 35 PID 2772 wrote to memory of 2500 2772 934.tmp 35 PID 2772 wrote to memory of 2500 2772 934.tmp 35 PID 2772 wrote to memory of 2500 2772 934.tmp 35 PID 2500 wrote to memory of 788 2500 992.tmp 36 PID 2500 wrote to memory of 788 2500 992.tmp 36 PID 2500 wrote to memory of 788 2500 992.tmp 36 PID 2500 wrote to memory of 788 2500 992.tmp 36 PID 788 wrote to memory of 2520 788 9F0.tmp 37 PID 788 wrote to memory of 2520 788 9F0.tmp 37 PID 788 wrote to memory of 2520 788 9F0.tmp 37 PID 788 wrote to memory of 2520 788 9F0.tmp 37 PID 2520 wrote to memory of 2516 2520 A5D.tmp 38 PID 2520 wrote to memory of 2516 2520 A5D.tmp 38 PID 2520 wrote to memory of 2516 2520 A5D.tmp 38 PID 2520 wrote to memory of 2516 2520 A5D.tmp 38 PID 2516 wrote to memory of 2964 2516 ABA.tmp 39 PID 2516 wrote to memory of 2964 2516 ABA.tmp 39 PID 2516 wrote to memory of 2964 2516 ABA.tmp 39 PID 2516 wrote to memory of 2964 2516 ABA.tmp 39 PID 2964 wrote to memory of 2976 2964 B18.tmp 40 PID 2964 wrote to memory of 2976 2964 B18.tmp 40 PID 2964 wrote to memory of 2976 2964 B18.tmp 40 PID 2964 wrote to memory of 2976 2964 B18.tmp 40 PID 2976 wrote to memory of 2820 2976 B76.tmp 41 PID 2976 wrote to memory of 2820 2976 B76.tmp 41 PID 2976 wrote to memory of 2820 2976 B76.tmp 41 PID 2976 wrote to memory of 2820 2976 B76.tmp 41 PID 2820 wrote to memory of 2696 2820 BD3.tmp 42 PID 2820 wrote to memory of 2696 2820 BD3.tmp 42 PID 2820 wrote to memory of 2696 2820 BD3.tmp 42 PID 2820 wrote to memory of 2696 2820 BD3.tmp 42 PID 2696 wrote to memory of 860 2696 C31.tmp 43 PID 2696 wrote to memory of 860 2696 C31.tmp 43 PID 2696 wrote to memory of 860 2696 C31.tmp 43 PID 2696 wrote to memory of 860 2696 C31.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-27_0af26bad97a8779e9436e4f1738b5cf9_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-27_0af26bad97a8779e9436e4f1738b5cf9_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\712.tmp"C:\Users\Admin\AppData\Local\Temp\712.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\770.tmp"C:\Users\Admin\AppData\Local\Temp\770.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\7DD.tmp"C:\Users\Admin\AppData\Local\Temp\7DD.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\82B.tmp"C:\Users\Admin\AppData\Local\Temp\82B.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\879.tmp"C:\Users\Admin\AppData\Local\Temp\879.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\8D7.tmp"C:\Users\Admin\AppData\Local\Temp\8D7.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\934.tmp"C:\Users\Admin\AppData\Local\Temp\934.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\992.tmp"C:\Users\Admin\AppData\Local\Temp\992.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\9F0.tmp"C:\Users\Admin\AppData\Local\Temp\9F0.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Users\Admin\AppData\Local\Temp\A5D.tmp"C:\Users\Admin\AppData\Local\Temp\A5D.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\ABA.tmp"C:\Users\Admin\AppData\Local\Temp\ABA.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\B18.tmp"C:\Users\Admin\AppData\Local\Temp\B18.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\B76.tmp"C:\Users\Admin\AppData\Local\Temp\B76.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\BD3.tmp"C:\Users\Admin\AppData\Local\Temp\BD3.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\C31.tmp"C:\Users\Admin\AppData\Local\Temp\C31.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\C8E.tmp"C:\Users\Admin\AppData\Local\Temp\C8E.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:860 -
C:\Users\Admin\AppData\Local\Temp\CEC.tmp"C:\Users\Admin\AppData\Local\Temp\CEC.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\D4A.tmp"C:\Users\Admin\AppData\Local\Temp\D4A.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\D98.tmp"C:\Users\Admin\AppData\Local\Temp\D98.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\DE6.tmp"C:\Users\Admin\AppData\Local\Temp\DE6.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\E34.tmp"C:\Users\Admin\AppData\Local\Temp\E34.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\E82.tmp"C:\Users\Admin\AppData\Local\Temp\E82.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\ED0.tmp"C:\Users\Admin\AppData\Local\Temp\ED0.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\F1E.tmp"C:\Users\Admin\AppData\Local\Temp\F1E.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\F5C.tmp"C:\Users\Admin\AppData\Local\Temp\F5C.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\F9A.tmp"C:\Users\Admin\AppData\Local\Temp\F9A.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\FE8.tmp"C:\Users\Admin\AppData\Local\Temp\FE8.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\1027.tmp"C:\Users\Admin\AppData\Local\Temp\1027.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\1065.tmp"C:\Users\Admin\AppData\Local\Temp\1065.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:324 -
C:\Users\Admin\AppData\Local\Temp\10A4.tmp"C:\Users\Admin\AppData\Local\Temp\10A4.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:336 -
C:\Users\Admin\AppData\Local\Temp\10F2.tmp"C:\Users\Admin\AppData\Local\Temp\10F2.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:240 -
C:\Users\Admin\AppData\Local\Temp\1130.tmp"C:\Users\Admin\AppData\Local\Temp\1130.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:652 -
C:\Users\Admin\AppData\Local\Temp\116E.tmp"C:\Users\Admin\AppData\Local\Temp\116E.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\11AD.tmp"C:\Users\Admin\AppData\Local\Temp\11AD.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\11EB.tmp"C:\Users\Admin\AppData\Local\Temp\11EB.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\122A.tmp"C:\Users\Admin\AppData\Local\Temp\122A.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\1268.tmp"C:\Users\Admin\AppData\Local\Temp\1268.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\12A6.tmp"C:\Users\Admin\AppData\Local\Temp\12A6.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\12F4.tmp"C:\Users\Admin\AppData\Local\Temp\12F4.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\1333.tmp"C:\Users\Admin\AppData\Local\Temp\1333.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\1371.tmp"C:\Users\Admin\AppData\Local\Temp\1371.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\13B0.tmp"C:\Users\Admin\AppData\Local\Temp\13B0.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:956 -
C:\Users\Admin\AppData\Local\Temp\13EE.tmp"C:\Users\Admin\AppData\Local\Temp\13EE.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:308 -
C:\Users\Admin\AppData\Local\Temp\142C.tmp"C:\Users\Admin\AppData\Local\Temp\142C.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\147A.tmp"C:\Users\Admin\AppData\Local\Temp\147A.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\14C8.tmp"C:\Users\Admin\AppData\Local\Temp\14C8.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\1507.tmp"C:\Users\Admin\AppData\Local\Temp\1507.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\1545.tmp"C:\Users\Admin\AppData\Local\Temp\1545.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\1584.tmp"C:\Users\Admin\AppData\Local\Temp\1584.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:280 -
C:\Users\Admin\AppData\Local\Temp\15C2.tmp"C:\Users\Admin\AppData\Local\Temp\15C2.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\1600.tmp"C:\Users\Admin\AppData\Local\Temp\1600.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\164E.tmp"C:\Users\Admin\AppData\Local\Temp\164E.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:892 -
C:\Users\Admin\AppData\Local\Temp\168D.tmp"C:\Users\Admin\AppData\Local\Temp\168D.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\16DB.tmp"C:\Users\Admin\AppData\Local\Temp\16DB.tmp"55⤵
- Executes dropped EXE
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\1719.tmp"C:\Users\Admin\AppData\Local\Temp\1719.tmp"56⤵
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\1758.tmp"C:\Users\Admin\AppData\Local\Temp\1758.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\1796.tmp"C:\Users\Admin\AppData\Local\Temp\1796.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\17D4.tmp"C:\Users\Admin\AppData\Local\Temp\17D4.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\1813.tmp"C:\Users\Admin\AppData\Local\Temp\1813.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\1851.tmp"C:\Users\Admin\AppData\Local\Temp\1851.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\1890.tmp"C:\Users\Admin\AppData\Local\Temp\1890.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\18CE.tmp"C:\Users\Admin\AppData\Local\Temp\18CE.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\190C.tmp"C:\Users\Admin\AppData\Local\Temp\190C.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\194B.tmp"C:\Users\Admin\AppData\Local\Temp\194B.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\1989.tmp"C:\Users\Admin\AppData\Local\Temp\1989.tmp"66⤵
- Executes dropped EXE
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\19C8.tmp"C:\Users\Admin\AppData\Local\Temp\19C8.tmp"67⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\1A06.tmp"C:\Users\Admin\AppData\Local\Temp\1A06.tmp"68⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\1A44.tmp"C:\Users\Admin\AppData\Local\Temp\1A44.tmp"69⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\1A83.tmp"C:\Users\Admin\AppData\Local\Temp\1A83.tmp"70⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"71⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\1B00.tmp"C:\Users\Admin\AppData\Local\Temp\1B00.tmp"72⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"73⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"74⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"75⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\1BF9.tmp"C:\Users\Admin\AppData\Local\Temp\1BF9.tmp"76⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\1C38.tmp"C:\Users\Admin\AppData\Local\Temp\1C38.tmp"77⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\1C76.tmp"C:\Users\Admin\AppData\Local\Temp\1C76.tmp"78⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\1CB4.tmp"C:\Users\Admin\AppData\Local\Temp\1CB4.tmp"79⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"80⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\1D31.tmp"C:\Users\Admin\AppData\Local\Temp\1D31.tmp"81⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\1D70.tmp"C:\Users\Admin\AppData\Local\Temp\1D70.tmp"82⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"83⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"84⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"85⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\1E69.tmp"C:\Users\Admin\AppData\Local\Temp\1E69.tmp"86⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"87⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"88⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\1F34.tmp"C:\Users\Admin\AppData\Local\Temp\1F34.tmp"89⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\1F72.tmp"C:\Users\Admin\AppData\Local\Temp\1F72.tmp"90⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"91⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"92⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\202E.tmp"C:\Users\Admin\AppData\Local\Temp\202E.tmp"93⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\206C.tmp"C:\Users\Admin\AppData\Local\Temp\206C.tmp"94⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\20AA.tmp"C:\Users\Admin\AppData\Local\Temp\20AA.tmp"95⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\20E9.tmp"C:\Users\Admin\AppData\Local\Temp\20E9.tmp"96⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\2127.tmp"C:\Users\Admin\AppData\Local\Temp\2127.tmp"97⤵PID:300
-
C:\Users\Admin\AppData\Local\Temp\2166.tmp"C:\Users\Admin\AppData\Local\Temp\2166.tmp"98⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\21A4.tmp"C:\Users\Admin\AppData\Local\Temp\21A4.tmp"99⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\21E2.tmp"C:\Users\Admin\AppData\Local\Temp\21E2.tmp"100⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\2221.tmp"C:\Users\Admin\AppData\Local\Temp\2221.tmp"101⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\225F.tmp"C:\Users\Admin\AppData\Local\Temp\225F.tmp"102⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\229E.tmp"C:\Users\Admin\AppData\Local\Temp\229E.tmp"103⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\22DC.tmp"C:\Users\Admin\AppData\Local\Temp\22DC.tmp"104⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\231A.tmp"C:\Users\Admin\AppData\Local\Temp\231A.tmp"105⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\2359.tmp"C:\Users\Admin\AppData\Local\Temp\2359.tmp"106⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\2397.tmp"C:\Users\Admin\AppData\Local\Temp\2397.tmp"107⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\23D6.tmp"C:\Users\Admin\AppData\Local\Temp\23D6.tmp"108⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\2414.tmp"C:\Users\Admin\AppData\Local\Temp\2414.tmp"109⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\2452.tmp"C:\Users\Admin\AppData\Local\Temp\2452.tmp"110⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\2491.tmp"C:\Users\Admin\AppData\Local\Temp\2491.tmp"111⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\24CF.tmp"C:\Users\Admin\AppData\Local\Temp\24CF.tmp"112⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\250E.tmp"C:\Users\Admin\AppData\Local\Temp\250E.tmp"113⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\254C.tmp"C:\Users\Admin\AppData\Local\Temp\254C.tmp"114⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\258A.tmp"C:\Users\Admin\AppData\Local\Temp\258A.tmp"115⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\25C9.tmp"C:\Users\Admin\AppData\Local\Temp\25C9.tmp"116⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\2607.tmp"C:\Users\Admin\AppData\Local\Temp\2607.tmp"117⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\2646.tmp"C:\Users\Admin\AppData\Local\Temp\2646.tmp"118⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\2694.tmp"C:\Users\Admin\AppData\Local\Temp\2694.tmp"119⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\26D2.tmp"C:\Users\Admin\AppData\Local\Temp\26D2.tmp"120⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\2710.tmp"C:\Users\Admin\AppData\Local\Temp\2710.tmp"121⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\274F.tmp"C:\Users\Admin\AppData\Local\Temp\274F.tmp"122⤵PID:2948
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-