Analysis
-
max time kernel
147s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
11/02/2024, 11:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-11_5593b5c35e7f595f9a3340b5fe8f88ca_mafia.exe
Resource
win7-20231129-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-11_5593b5c35e7f595f9a3340b5fe8f88ca_mafia.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
2024-02-11_5593b5c35e7f595f9a3340b5fe8f88ca_mafia.exe
-
Size
486KB
-
MD5
5593b5c35e7f595f9a3340b5fe8f88ca
-
SHA1
fdb8d90e6cc9554165007eb845a0b256d0869ddf
-
SHA256
167babe4a38ad9bd8b6f80d4229f15f063002992795de1e3511f84ba0e43b0ca
-
SHA512
db1a69cfdd16a6eeff9fd7adf7c36e93a375b7211178a61d94c0910f39f9713376a11954c8a4a1658a39fdead65e4a501efef9f34f5b17e54bdd5110153da9de
-
SSDEEP
12288:UU5rCOTeiDMPFRDZ8OMGb2kyTAQ1/SRvRNZ:UUQOJDW3t8jpKRvRN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2868 7DD.tmp 2996 83B.tmp 3040 8A8.tmp 2188 906.tmp 2780 963.tmp 2704 9D0.tmp 2620 A2E.tmp 2680 A7C.tmp 2500 ADA.tmp 948 B28.tmp 2732 B85.tmp 2524 BD3.tmp 2924 C21.tmp 2292 C7F.tmp 2796 CCD.tmp 1220 D2A.tmp 1536 D69.tmp 2760 DB7.tmp 1636 E24.tmp 2908 E91.tmp 2720 EEF.tmp 1452 F4C.tmp 1440 F9A.tmp 2564 FD9.tmp 2024 1017.tmp 1896 1056.tmp 2236 10A4.tmp 1712 10D2.tmp 1740 1101.tmp 536 1140.tmp 268 117E.tmp 872 11EB.tmp 2812 122A.tmp 2312 1268.tmp 1920 12A6.tmp 916 12E5.tmp 1176 1323.tmp 1036 1362.tmp 2128 13A0.tmp 2660 13DE.tmp 1596 141D.tmp 1208 145B.tmp 1828 149A.tmp 2396 14D8.tmp 700 1516.tmp 964 1555.tmp 612 1593.tmp 2232 15D2.tmp 1576 1610.tmp 1136 164E.tmp 380 168D.tmp 1752 16CB.tmp 1908 170A.tmp 2120 1748.tmp 1624 1786.tmp 2880 17C5.tmp 1600 1803.tmp 1684 1842.tmp 3036 1880.tmp 2116 18BE.tmp 3032 18FD.tmp 2596 194B.tmp 2616 1989.tmp 2716 19C8.tmp -
Loads dropped DLL 64 IoCs
pid Process 2652 2024-02-11_5593b5c35e7f595f9a3340b5fe8f88ca_mafia.exe 2868 7DD.tmp 2996 83B.tmp 3040 8A8.tmp 2188 906.tmp 2780 963.tmp 2704 9D0.tmp 2620 A2E.tmp 2680 A7C.tmp 2500 ADA.tmp 948 B28.tmp 2732 B85.tmp 2524 BD3.tmp 2924 C21.tmp 2292 C7F.tmp 2796 CCD.tmp 1220 D2A.tmp 1536 D69.tmp 2760 DB7.tmp 1636 E24.tmp 2908 E91.tmp 2720 EEF.tmp 1452 F4C.tmp 1440 F9A.tmp 2564 FD9.tmp 2024 1017.tmp 1896 1056.tmp 2236 10A4.tmp 1712 10D2.tmp 1740 1101.tmp 536 1140.tmp 268 117E.tmp 872 11EB.tmp 2812 122A.tmp 2312 1268.tmp 1920 12A6.tmp 916 12E5.tmp 1176 1323.tmp 1036 1362.tmp 2128 13A0.tmp 2660 13DE.tmp 1596 141D.tmp 1208 145B.tmp 1828 149A.tmp 2396 14D8.tmp 700 1516.tmp 964 1555.tmp 612 1593.tmp 2232 15D2.tmp 1576 1610.tmp 1136 164E.tmp 380 168D.tmp 1752 16CB.tmp 1908 170A.tmp 2120 1748.tmp 1624 1786.tmp 2880 17C5.tmp 1600 1803.tmp 1684 1842.tmp 3036 1880.tmp 2116 18BE.tmp 3032 18FD.tmp 2596 194B.tmp 2616 1989.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2652 wrote to memory of 2868 2652 2024-02-11_5593b5c35e7f595f9a3340b5fe8f88ca_mafia.exe 28 PID 2652 wrote to memory of 2868 2652 2024-02-11_5593b5c35e7f595f9a3340b5fe8f88ca_mafia.exe 28 PID 2652 wrote to memory of 2868 2652 2024-02-11_5593b5c35e7f595f9a3340b5fe8f88ca_mafia.exe 28 PID 2652 wrote to memory of 2868 2652 2024-02-11_5593b5c35e7f595f9a3340b5fe8f88ca_mafia.exe 28 PID 2868 wrote to memory of 2996 2868 7DD.tmp 29 PID 2868 wrote to memory of 2996 2868 7DD.tmp 29 PID 2868 wrote to memory of 2996 2868 7DD.tmp 29 PID 2868 wrote to memory of 2996 2868 7DD.tmp 29 PID 2996 wrote to memory of 3040 2996 83B.tmp 30 PID 2996 wrote to memory of 3040 2996 83B.tmp 30 PID 2996 wrote to memory of 3040 2996 83B.tmp 30 PID 2996 wrote to memory of 3040 2996 83B.tmp 30 PID 3040 wrote to memory of 2188 3040 8A8.tmp 31 PID 3040 wrote to memory of 2188 3040 8A8.tmp 31 PID 3040 wrote to memory of 2188 3040 8A8.tmp 31 PID 3040 wrote to memory of 2188 3040 8A8.tmp 31 PID 2188 wrote to memory of 2780 2188 906.tmp 32 PID 2188 wrote to memory of 2780 2188 906.tmp 32 PID 2188 wrote to memory of 2780 2188 906.tmp 32 PID 2188 wrote to memory of 2780 2188 906.tmp 32 PID 2780 wrote to memory of 2704 2780 963.tmp 33 PID 2780 wrote to memory of 2704 2780 963.tmp 33 PID 2780 wrote to memory of 2704 2780 963.tmp 33 PID 2780 wrote to memory of 2704 2780 963.tmp 33 PID 2704 wrote to memory of 2620 2704 9D0.tmp 34 PID 2704 wrote to memory of 2620 2704 9D0.tmp 34 PID 2704 wrote to memory of 2620 2704 9D0.tmp 34 PID 2704 wrote to memory of 2620 2704 9D0.tmp 34 PID 2620 wrote to memory of 2680 2620 A2E.tmp 35 PID 2620 wrote to memory of 2680 2620 A2E.tmp 35 PID 2620 wrote to memory of 2680 2620 A2E.tmp 35 PID 2620 wrote to memory of 2680 2620 A2E.tmp 35 PID 2680 wrote to memory of 2500 2680 A7C.tmp 36 PID 2680 wrote to memory of 2500 2680 A7C.tmp 36 PID 2680 wrote to memory of 2500 2680 A7C.tmp 36 PID 2680 wrote to memory of 2500 2680 A7C.tmp 36 PID 2500 wrote to memory of 948 2500 ADA.tmp 37 PID 2500 wrote to memory of 948 2500 ADA.tmp 37 PID 2500 wrote to memory of 948 2500 ADA.tmp 37 PID 2500 wrote to memory of 948 2500 ADA.tmp 37 PID 948 wrote to memory of 2732 948 B28.tmp 38 PID 948 wrote to memory of 2732 948 B28.tmp 38 PID 948 wrote to memory of 2732 948 B28.tmp 38 PID 948 wrote to memory of 2732 948 B28.tmp 38 PID 2732 wrote to memory of 2524 2732 B85.tmp 39 PID 2732 wrote to memory of 2524 2732 B85.tmp 39 PID 2732 wrote to memory of 2524 2732 B85.tmp 39 PID 2732 wrote to memory of 2524 2732 B85.tmp 39 PID 2524 wrote to memory of 2924 2524 BD3.tmp 40 PID 2524 wrote to memory of 2924 2524 BD3.tmp 40 PID 2524 wrote to memory of 2924 2524 BD3.tmp 40 PID 2524 wrote to memory of 2924 2524 BD3.tmp 40 PID 2924 wrote to memory of 2292 2924 C21.tmp 41 PID 2924 wrote to memory of 2292 2924 C21.tmp 41 PID 2924 wrote to memory of 2292 2924 C21.tmp 41 PID 2924 wrote to memory of 2292 2924 C21.tmp 41 PID 2292 wrote to memory of 2796 2292 C7F.tmp 42 PID 2292 wrote to memory of 2796 2292 C7F.tmp 42 PID 2292 wrote to memory of 2796 2292 C7F.tmp 42 PID 2292 wrote to memory of 2796 2292 C7F.tmp 42 PID 2796 wrote to memory of 1220 2796 CCD.tmp 43 PID 2796 wrote to memory of 1220 2796 CCD.tmp 43 PID 2796 wrote to memory of 1220 2796 CCD.tmp 43 PID 2796 wrote to memory of 1220 2796 CCD.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-11_5593b5c35e7f595f9a3340b5fe8f88ca_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-11_5593b5c35e7f595f9a3340b5fe8f88ca_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\7DD.tmp"C:\Users\Admin\AppData\Local\Temp\7DD.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\83B.tmp"C:\Users\Admin\AppData\Local\Temp\83B.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\8A8.tmp"C:\Users\Admin\AppData\Local\Temp\8A8.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\906.tmp"C:\Users\Admin\AppData\Local\Temp\906.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\963.tmp"C:\Users\Admin\AppData\Local\Temp\963.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\9D0.tmp"C:\Users\Admin\AppData\Local\Temp\9D0.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\A2E.tmp"C:\Users\Admin\AppData\Local\Temp\A2E.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\A7C.tmp"C:\Users\Admin\AppData\Local\Temp\A7C.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\ADA.tmp"C:\Users\Admin\AppData\Local\Temp\ADA.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\B28.tmp"C:\Users\Admin\AppData\Local\Temp\B28.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Users\Admin\AppData\Local\Temp\B85.tmp"C:\Users\Admin\AppData\Local\Temp\B85.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\BD3.tmp"C:\Users\Admin\AppData\Local\Temp\BD3.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\C21.tmp"C:\Users\Admin\AppData\Local\Temp\C21.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\C7F.tmp"C:\Users\Admin\AppData\Local\Temp\C7F.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\CCD.tmp"C:\Users\Admin\AppData\Local\Temp\CCD.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\D2A.tmp"C:\Users\Admin\AppData\Local\Temp\D2A.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\D69.tmp"C:\Users\Admin\AppData\Local\Temp\D69.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\DB7.tmp"C:\Users\Admin\AppData\Local\Temp\DB7.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\E24.tmp"C:\Users\Admin\AppData\Local\Temp\E24.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\E91.tmp"C:\Users\Admin\AppData\Local\Temp\E91.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\EEF.tmp"C:\Users\Admin\AppData\Local\Temp\EEF.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\F4C.tmp"C:\Users\Admin\AppData\Local\Temp\F4C.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\F9A.tmp"C:\Users\Admin\AppData\Local\Temp\F9A.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\FD9.tmp"C:\Users\Admin\AppData\Local\Temp\FD9.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\1017.tmp"C:\Users\Admin\AppData\Local\Temp\1017.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\1056.tmp"C:\Users\Admin\AppData\Local\Temp\1056.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\10A4.tmp"C:\Users\Admin\AppData\Local\Temp\10A4.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\10D2.tmp"C:\Users\Admin\AppData\Local\Temp\10D2.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\1101.tmp"C:\Users\Admin\AppData\Local\Temp\1101.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\1140.tmp"C:\Users\Admin\AppData\Local\Temp\1140.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:536 -
C:\Users\Admin\AppData\Local\Temp\117E.tmp"C:\Users\Admin\AppData\Local\Temp\117E.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:268 -
C:\Users\Admin\AppData\Local\Temp\11EB.tmp"C:\Users\Admin\AppData\Local\Temp\11EB.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:872 -
C:\Users\Admin\AppData\Local\Temp\122A.tmp"C:\Users\Admin\AppData\Local\Temp\122A.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\1268.tmp"C:\Users\Admin\AppData\Local\Temp\1268.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\12A6.tmp"C:\Users\Admin\AppData\Local\Temp\12A6.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\12E5.tmp"C:\Users\Admin\AppData\Local\Temp\12E5.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:916 -
C:\Users\Admin\AppData\Local\Temp\1323.tmp"C:\Users\Admin\AppData\Local\Temp\1323.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\1362.tmp"C:\Users\Admin\AppData\Local\Temp\1362.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\13A0.tmp"C:\Users\Admin\AppData\Local\Temp\13A0.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\13DE.tmp"C:\Users\Admin\AppData\Local\Temp\13DE.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\141D.tmp"C:\Users\Admin\AppData\Local\Temp\141D.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\145B.tmp"C:\Users\Admin\AppData\Local\Temp\145B.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\149A.tmp"C:\Users\Admin\AppData\Local\Temp\149A.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\14D8.tmp"C:\Users\Admin\AppData\Local\Temp\14D8.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\1516.tmp"C:\Users\Admin\AppData\Local\Temp\1516.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:700 -
C:\Users\Admin\AppData\Local\Temp\1555.tmp"C:\Users\Admin\AppData\Local\Temp\1555.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:964 -
C:\Users\Admin\AppData\Local\Temp\1593.tmp"C:\Users\Admin\AppData\Local\Temp\1593.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:612 -
C:\Users\Admin\AppData\Local\Temp\15D2.tmp"C:\Users\Admin\AppData\Local\Temp\15D2.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\1610.tmp"C:\Users\Admin\AppData\Local\Temp\1610.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\164E.tmp"C:\Users\Admin\AppData\Local\Temp\164E.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\168D.tmp"C:\Users\Admin\AppData\Local\Temp\168D.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:380 -
C:\Users\Admin\AppData\Local\Temp\16CB.tmp"C:\Users\Admin\AppData\Local\Temp\16CB.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\170A.tmp"C:\Users\Admin\AppData\Local\Temp\170A.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\1748.tmp"C:\Users\Admin\AppData\Local\Temp\1748.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\1786.tmp"C:\Users\Admin\AppData\Local\Temp\1786.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\17C5.tmp"C:\Users\Admin\AppData\Local\Temp\17C5.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\1803.tmp"C:\Users\Admin\AppData\Local\Temp\1803.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\1842.tmp"C:\Users\Admin\AppData\Local\Temp\1842.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\1880.tmp"C:\Users\Admin\AppData\Local\Temp\1880.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\18BE.tmp"C:\Users\Admin\AppData\Local\Temp\18BE.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\18FD.tmp"C:\Users\Admin\AppData\Local\Temp\18FD.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\194B.tmp"C:\Users\Admin\AppData\Local\Temp\194B.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\1989.tmp"C:\Users\Admin\AppData\Local\Temp\1989.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\19C8.tmp"C:\Users\Admin\AppData\Local\Temp\19C8.tmp"65⤵
- Executes dropped EXE
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\1A06.tmp"C:\Users\Admin\AppData\Local\Temp\1A06.tmp"66⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\1A44.tmp"C:\Users\Admin\AppData\Local\Temp\1A44.tmp"67⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\1A83.tmp"C:\Users\Admin\AppData\Local\Temp\1A83.tmp"68⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"69⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\1B00.tmp"C:\Users\Admin\AppData\Local\Temp\1B00.tmp"70⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"71⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"72⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"73⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\1C09.tmp"C:\Users\Admin\AppData\Local\Temp\1C09.tmp"74⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\1C47.tmp"C:\Users\Admin\AppData\Local\Temp\1C47.tmp"75⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\1C86.tmp"C:\Users\Admin\AppData\Local\Temp\1C86.tmp"76⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"77⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\1D02.tmp"C:\Users\Admin\AppData\Local\Temp\1D02.tmp"78⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\1D41.tmp"C:\Users\Admin\AppData\Local\Temp\1D41.tmp"79⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"80⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"81⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"82⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"83⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\1E88.tmp"C:\Users\Admin\AppData\Local\Temp\1E88.tmp"84⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"85⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\1F05.tmp"C:\Users\Admin\AppData\Local\Temp\1F05.tmp"86⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\1F44.tmp"C:\Users\Admin\AppData\Local\Temp\1F44.tmp"87⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\1F82.tmp"C:\Users\Admin\AppData\Local\Temp\1F82.tmp"88⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"89⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"90⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\203D.tmp"C:\Users\Admin\AppData\Local\Temp\203D.tmp"91⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\207C.tmp"C:\Users\Admin\AppData\Local\Temp\207C.tmp"92⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\20BA.tmp"C:\Users\Admin\AppData\Local\Temp\20BA.tmp"93⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\20F8.tmp"C:\Users\Admin\AppData\Local\Temp\20F8.tmp"94⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\2146.tmp"C:\Users\Admin\AppData\Local\Temp\2146.tmp"95⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\2185.tmp"C:\Users\Admin\AppData\Local\Temp\2185.tmp"96⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\21C3.tmp"C:\Users\Admin\AppData\Local\Temp\21C3.tmp"97⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\2202.tmp"C:\Users\Admin\AppData\Local\Temp\2202.tmp"98⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\2240.tmp"C:\Users\Admin\AppData\Local\Temp\2240.tmp"99⤵PID:268
-
C:\Users\Admin\AppData\Local\Temp\227E.tmp"C:\Users\Admin\AppData\Local\Temp\227E.tmp"100⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\22BD.tmp"C:\Users\Admin\AppData\Local\Temp\22BD.tmp"101⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\22FB.tmp"C:\Users\Admin\AppData\Local\Temp\22FB.tmp"102⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\233A.tmp"C:\Users\Admin\AppData\Local\Temp\233A.tmp"103⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\2378.tmp"C:\Users\Admin\AppData\Local\Temp\2378.tmp"104⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\23B6.tmp"C:\Users\Admin\AppData\Local\Temp\23B6.tmp"105⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\23F5.tmp"C:\Users\Admin\AppData\Local\Temp\23F5.tmp"106⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\2433.tmp"C:\Users\Admin\AppData\Local\Temp\2433.tmp"107⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\2472.tmp"C:\Users\Admin\AppData\Local\Temp\2472.tmp"108⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\24B0.tmp"C:\Users\Admin\AppData\Local\Temp\24B0.tmp"109⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\24EE.tmp"C:\Users\Admin\AppData\Local\Temp\24EE.tmp"110⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\252D.tmp"C:\Users\Admin\AppData\Local\Temp\252D.tmp"111⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\256B.tmp"C:\Users\Admin\AppData\Local\Temp\256B.tmp"112⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\25AA.tmp"C:\Users\Admin\AppData\Local\Temp\25AA.tmp"113⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\25E8.tmp"C:\Users\Admin\AppData\Local\Temp\25E8.tmp"114⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\2626.tmp"C:\Users\Admin\AppData\Local\Temp\2626.tmp"115⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\2665.tmp"C:\Users\Admin\AppData\Local\Temp\2665.tmp"116⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\26A3.tmp"C:\Users\Admin\AppData\Local\Temp\26A3.tmp"117⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\26E2.tmp"C:\Users\Admin\AppData\Local\Temp\26E2.tmp"118⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\2720.tmp"C:\Users\Admin\AppData\Local\Temp\2720.tmp"119⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\275E.tmp"C:\Users\Admin\AppData\Local\Temp\275E.tmp"120⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\279D.tmp"C:\Users\Admin\AppData\Local\Temp\279D.tmp"121⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\27DB.tmp"C:\Users\Admin\AppData\Local\Temp\27DB.tmp"122⤵PID:2120
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-