Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
08-03-2024 04:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-03-08_e64fa3be163095d4b6f16d5cde000beb_mafia.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-08_e64fa3be163095d4b6f16d5cde000beb_mafia.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-03-08_e64fa3be163095d4b6f16d5cde000beb_mafia.exe
-
Size
487KB
-
MD5
e64fa3be163095d4b6f16d5cde000beb
-
SHA1
6868cb3950df9a4cc7ef9d17497addfdf2e6055e
-
SHA256
18d89ca7858d149bc8ff4aae193d8c6171ad6e0c48190df54b02dd0b2a87ba92
-
SHA512
a2a7bd8a509330d5643320837ec3e1aa43359298ff3f5e836fe41db1dc3198647777892cd96d49ddf664b9995638f4cc8918bac2c7695d76195b938ec90eeea5
-
SSDEEP
12288:HU5rCOTeiJoCShzloEL3bb8zfjPGbZlNZ:HUQOJJoqEnb8zab7N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2176 780.tmp 2892 7DD.tmp 3060 84A.tmp 2888 898.tmp 2572 8F6.tmp 2720 954.tmp 2576 9B1.tmp 2764 A1E.tmp 2832 A7C.tmp 2728 ADA.tmp 2464 B56.tmp 2036 BB4.tmp 2996 C21.tmp 1748 C8E.tmp 3008 CEC.tmp 2700 D3A.tmp 2820 D98.tmp 1468 DD6.tmp 2432 E14.tmp 2684 E62.tmp 2980 EB0.tmp 1716 F0E.tmp 1756 F5C.tmp 3028 F9A.tmp 2076 FD9.tmp 2316 1017.tmp 1800 1056.tmp 2312 1094.tmp 1892 10D2.tmp 700 1111.tmp 1344 114F.tmp 1972 118E.tmp 1076 11DC.tmp 560 121A.tmp 1304 1258.tmp 716 1297.tmp 1036 12D5.tmp 1476 1314.tmp 2068 1352.tmp 1472 1390.tmp 1528 13CF.tmp 1168 140D.tmp 1820 143C.tmp 2104 147A.tmp 1816 14B9.tmp 980 14F7.tmp 1460 1536.tmp 1440 1574.tmp 1504 15B2.tmp 1692 15F1.tmp 2152 162F.tmp 2156 166E.tmp 1928 16AC.tmp 2216 16EA.tmp 1592 1729.tmp 1568 1758.tmp 2220 1796.tmp 2960 17C5.tmp 1880 1803.tmp 3068 1842.tmp 672 1880.tmp 2624 18BE.tmp 2600 18FD.tmp 2572 193B.tmp -
Loads dropped DLL 64 IoCs
pid Process 1872 2024-03-08_e64fa3be163095d4b6f16d5cde000beb_mafia.exe 2176 780.tmp 2892 7DD.tmp 3060 84A.tmp 2888 898.tmp 2572 8F6.tmp 2720 954.tmp 2576 9B1.tmp 2764 A1E.tmp 2832 A7C.tmp 2728 ADA.tmp 2464 B56.tmp 2036 BB4.tmp 2996 C21.tmp 1748 C8E.tmp 3008 CEC.tmp 2700 D3A.tmp 2820 D98.tmp 1468 DD6.tmp 2432 E14.tmp 2684 E62.tmp 2980 EB0.tmp 1716 F0E.tmp 1756 F5C.tmp 3028 F9A.tmp 2076 FD9.tmp 2316 1017.tmp 1800 1056.tmp 2312 1094.tmp 1892 10D2.tmp 700 1111.tmp 1344 114F.tmp 1972 118E.tmp 1076 11DC.tmp 560 121A.tmp 1304 1258.tmp 716 1297.tmp 1036 12D5.tmp 1476 1314.tmp 2068 1352.tmp 1472 1390.tmp 1528 13CF.tmp 1168 140D.tmp 1820 143C.tmp 2104 147A.tmp 1816 14B9.tmp 980 14F7.tmp 1460 1536.tmp 1440 1574.tmp 1504 15B2.tmp 1692 15F1.tmp 2152 162F.tmp 2156 166E.tmp 1928 16AC.tmp 2216 16EA.tmp 1592 1729.tmp 1568 1758.tmp 2220 1796.tmp 2960 17C5.tmp 1880 1803.tmp 3068 1842.tmp 672 1880.tmp 2624 18BE.tmp 2600 18FD.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1872 wrote to memory of 2176 1872 2024-03-08_e64fa3be163095d4b6f16d5cde000beb_mafia.exe 28 PID 1872 wrote to memory of 2176 1872 2024-03-08_e64fa3be163095d4b6f16d5cde000beb_mafia.exe 28 PID 1872 wrote to memory of 2176 1872 2024-03-08_e64fa3be163095d4b6f16d5cde000beb_mafia.exe 28 PID 1872 wrote to memory of 2176 1872 2024-03-08_e64fa3be163095d4b6f16d5cde000beb_mafia.exe 28 PID 2176 wrote to memory of 2892 2176 780.tmp 29 PID 2176 wrote to memory of 2892 2176 780.tmp 29 PID 2176 wrote to memory of 2892 2176 780.tmp 29 PID 2176 wrote to memory of 2892 2176 780.tmp 29 PID 2892 wrote to memory of 3060 2892 7DD.tmp 30 PID 2892 wrote to memory of 3060 2892 7DD.tmp 30 PID 2892 wrote to memory of 3060 2892 7DD.tmp 30 PID 2892 wrote to memory of 3060 2892 7DD.tmp 30 PID 3060 wrote to memory of 2888 3060 84A.tmp 31 PID 3060 wrote to memory of 2888 3060 84A.tmp 31 PID 3060 wrote to memory of 2888 3060 84A.tmp 31 PID 3060 wrote to memory of 2888 3060 84A.tmp 31 PID 2888 wrote to memory of 2572 2888 898.tmp 32 PID 2888 wrote to memory of 2572 2888 898.tmp 32 PID 2888 wrote to memory of 2572 2888 898.tmp 32 PID 2888 wrote to memory of 2572 2888 898.tmp 32 PID 2572 wrote to memory of 2720 2572 8F6.tmp 33 PID 2572 wrote to memory of 2720 2572 8F6.tmp 33 PID 2572 wrote to memory of 2720 2572 8F6.tmp 33 PID 2572 wrote to memory of 2720 2572 8F6.tmp 33 PID 2720 wrote to memory of 2576 2720 954.tmp 34 PID 2720 wrote to memory of 2576 2720 954.tmp 34 PID 2720 wrote to memory of 2576 2720 954.tmp 34 PID 2720 wrote to memory of 2576 2720 954.tmp 34 PID 2576 wrote to memory of 2764 2576 9B1.tmp 35 PID 2576 wrote to memory of 2764 2576 9B1.tmp 35 PID 2576 wrote to memory of 2764 2576 9B1.tmp 35 PID 2576 wrote to memory of 2764 2576 9B1.tmp 35 PID 2764 wrote to memory of 2832 2764 A1E.tmp 36 PID 2764 wrote to memory of 2832 2764 A1E.tmp 36 PID 2764 wrote to memory of 2832 2764 A1E.tmp 36 PID 2764 wrote to memory of 2832 2764 A1E.tmp 36 PID 2832 wrote to memory of 2728 2832 A7C.tmp 37 PID 2832 wrote to memory of 2728 2832 A7C.tmp 37 PID 2832 wrote to memory of 2728 2832 A7C.tmp 37 PID 2832 wrote to memory of 2728 2832 A7C.tmp 37 PID 2728 wrote to memory of 2464 2728 ADA.tmp 38 PID 2728 wrote to memory of 2464 2728 ADA.tmp 38 PID 2728 wrote to memory of 2464 2728 ADA.tmp 38 PID 2728 wrote to memory of 2464 2728 ADA.tmp 38 PID 2464 wrote to memory of 2036 2464 B56.tmp 39 PID 2464 wrote to memory of 2036 2464 B56.tmp 39 PID 2464 wrote to memory of 2036 2464 B56.tmp 39 PID 2464 wrote to memory of 2036 2464 B56.tmp 39 PID 2036 wrote to memory of 2996 2036 BB4.tmp 40 PID 2036 wrote to memory of 2996 2036 BB4.tmp 40 PID 2036 wrote to memory of 2996 2036 BB4.tmp 40 PID 2036 wrote to memory of 2996 2036 BB4.tmp 40 PID 2996 wrote to memory of 1748 2996 C21.tmp 41 PID 2996 wrote to memory of 1748 2996 C21.tmp 41 PID 2996 wrote to memory of 1748 2996 C21.tmp 41 PID 2996 wrote to memory of 1748 2996 C21.tmp 41 PID 1748 wrote to memory of 3008 1748 C8E.tmp 42 PID 1748 wrote to memory of 3008 1748 C8E.tmp 42 PID 1748 wrote to memory of 3008 1748 C8E.tmp 42 PID 1748 wrote to memory of 3008 1748 C8E.tmp 42 PID 3008 wrote to memory of 2700 3008 CEC.tmp 43 PID 3008 wrote to memory of 2700 3008 CEC.tmp 43 PID 3008 wrote to memory of 2700 3008 CEC.tmp 43 PID 3008 wrote to memory of 2700 3008 CEC.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-08_e64fa3be163095d4b6f16d5cde000beb_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-08_e64fa3be163095d4b6f16d5cde000beb_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\780.tmp"C:\Users\Admin\AppData\Local\Temp\780.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\7DD.tmp"C:\Users\Admin\AppData\Local\Temp\7DD.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\84A.tmp"C:\Users\Admin\AppData\Local\Temp\84A.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\898.tmp"C:\Users\Admin\AppData\Local\Temp\898.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\8F6.tmp"C:\Users\Admin\AppData\Local\Temp\8F6.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\954.tmp"C:\Users\Admin\AppData\Local\Temp\954.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\9B1.tmp"C:\Users\Admin\AppData\Local\Temp\9B1.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\A1E.tmp"C:\Users\Admin\AppData\Local\Temp\A1E.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\A7C.tmp"C:\Users\Admin\AppData\Local\Temp\A7C.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\ADA.tmp"C:\Users\Admin\AppData\Local\Temp\ADA.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\B56.tmp"C:\Users\Admin\AppData\Local\Temp\B56.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\BB4.tmp"C:\Users\Admin\AppData\Local\Temp\BB4.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\C21.tmp"C:\Users\Admin\AppData\Local\Temp\C21.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\C8E.tmp"C:\Users\Admin\AppData\Local\Temp\C8E.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\CEC.tmp"C:\Users\Admin\AppData\Local\Temp\CEC.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\D3A.tmp"C:\Users\Admin\AppData\Local\Temp\D3A.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\D98.tmp"C:\Users\Admin\AppData\Local\Temp\D98.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\DD6.tmp"C:\Users\Admin\AppData\Local\Temp\DD6.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\E14.tmp"C:\Users\Admin\AppData\Local\Temp\E14.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\E62.tmp"C:\Users\Admin\AppData\Local\Temp\E62.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\EB0.tmp"C:\Users\Admin\AppData\Local\Temp\EB0.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\F0E.tmp"C:\Users\Admin\AppData\Local\Temp\F0E.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\F5C.tmp"C:\Users\Admin\AppData\Local\Temp\F5C.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\F9A.tmp"C:\Users\Admin\AppData\Local\Temp\F9A.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\FD9.tmp"C:\Users\Admin\AppData\Local\Temp\FD9.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\1017.tmp"C:\Users\Admin\AppData\Local\Temp\1017.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\1056.tmp"C:\Users\Admin\AppData\Local\Temp\1056.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\1094.tmp"C:\Users\Admin\AppData\Local\Temp\1094.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\10D2.tmp"C:\Users\Admin\AppData\Local\Temp\10D2.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\1111.tmp"C:\Users\Admin\AppData\Local\Temp\1111.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:700 -
C:\Users\Admin\AppData\Local\Temp\114F.tmp"C:\Users\Admin\AppData\Local\Temp\114F.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\118E.tmp"C:\Users\Admin\AppData\Local\Temp\118E.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\11DC.tmp"C:\Users\Admin\AppData\Local\Temp\11DC.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\121A.tmp"C:\Users\Admin\AppData\Local\Temp\121A.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:560 -
C:\Users\Admin\AppData\Local\Temp\1258.tmp"C:\Users\Admin\AppData\Local\Temp\1258.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\1297.tmp"C:\Users\Admin\AppData\Local\Temp\1297.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:716 -
C:\Users\Admin\AppData\Local\Temp\12D5.tmp"C:\Users\Admin\AppData\Local\Temp\12D5.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\1314.tmp"C:\Users\Admin\AppData\Local\Temp\1314.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\1352.tmp"C:\Users\Admin\AppData\Local\Temp\1352.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\1390.tmp"C:\Users\Admin\AppData\Local\Temp\1390.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\13CF.tmp"C:\Users\Admin\AppData\Local\Temp\13CF.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\140D.tmp"C:\Users\Admin\AppData\Local\Temp\140D.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\143C.tmp"C:\Users\Admin\AppData\Local\Temp\143C.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\147A.tmp"C:\Users\Admin\AppData\Local\Temp\147A.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\14B9.tmp"C:\Users\Admin\AppData\Local\Temp\14B9.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\14F7.tmp"C:\Users\Admin\AppData\Local\Temp\14F7.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:980 -
C:\Users\Admin\AppData\Local\Temp\1536.tmp"C:\Users\Admin\AppData\Local\Temp\1536.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\1574.tmp"C:\Users\Admin\AppData\Local\Temp\1574.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\15B2.tmp"C:\Users\Admin\AppData\Local\Temp\15B2.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\15F1.tmp"C:\Users\Admin\AppData\Local\Temp\15F1.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\162F.tmp"C:\Users\Admin\AppData\Local\Temp\162F.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\166E.tmp"C:\Users\Admin\AppData\Local\Temp\166E.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\16AC.tmp"C:\Users\Admin\AppData\Local\Temp\16AC.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\16EA.tmp"C:\Users\Admin\AppData\Local\Temp\16EA.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\1729.tmp"C:\Users\Admin\AppData\Local\Temp\1729.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\1758.tmp"C:\Users\Admin\AppData\Local\Temp\1758.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\1796.tmp"C:\Users\Admin\AppData\Local\Temp\1796.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\17C5.tmp"C:\Users\Admin\AppData\Local\Temp\17C5.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\1803.tmp"C:\Users\Admin\AppData\Local\Temp\1803.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\1842.tmp"C:\Users\Admin\AppData\Local\Temp\1842.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\1880.tmp"C:\Users\Admin\AppData\Local\Temp\1880.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:672 -
C:\Users\Admin\AppData\Local\Temp\18BE.tmp"C:\Users\Admin\AppData\Local\Temp\18BE.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\18FD.tmp"C:\Users\Admin\AppData\Local\Temp\18FD.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\193B.tmp"C:\Users\Admin\AppData\Local\Temp\193B.tmp"65⤵
- Executes dropped EXE
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\197A.tmp"C:\Users\Admin\AppData\Local\Temp\197A.tmp"66⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\19C8.tmp"C:\Users\Admin\AppData\Local\Temp\19C8.tmp"67⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\1A06.tmp"C:\Users\Admin\AppData\Local\Temp\1A06.tmp"68⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\1A44.tmp"C:\Users\Admin\AppData\Local\Temp\1A44.tmp"69⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\1A83.tmp"C:\Users\Admin\AppData\Local\Temp\1A83.tmp"70⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"71⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\1B00.tmp"C:\Users\Admin\AppData\Local\Temp\1B00.tmp"72⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"73⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"74⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"75⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\1BF9.tmp"C:\Users\Admin\AppData\Local\Temp\1BF9.tmp"76⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\1C38.tmp"C:\Users\Admin\AppData\Local\Temp\1C38.tmp"77⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\1C76.tmp"C:\Users\Admin\AppData\Local\Temp\1C76.tmp"78⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\1CB4.tmp"C:\Users\Admin\AppData\Local\Temp\1CB4.tmp"79⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"80⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\1D31.tmp"C:\Users\Admin\AppData\Local\Temp\1D31.tmp"81⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\1D70.tmp"C:\Users\Admin\AppData\Local\Temp\1D70.tmp"82⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"83⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"84⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"85⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"86⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\1E98.tmp"C:\Users\Admin\AppData\Local\Temp\1E98.tmp"87⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"88⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\1F15.tmp"C:\Users\Admin\AppData\Local\Temp\1F15.tmp"89⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\1F82.tmp"C:\Users\Admin\AppData\Local\Temp\1F82.tmp"90⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"91⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"92⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\205C.tmp"C:\Users\Admin\AppData\Local\Temp\205C.tmp"93⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\20BA.tmp"C:\Users\Admin\AppData\Local\Temp\20BA.tmp"94⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\2108.tmp"C:\Users\Admin\AppData\Local\Temp\2108.tmp"95⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\2175.tmp"C:\Users\Admin\AppData\Local\Temp\2175.tmp"96⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\21D3.tmp"C:\Users\Admin\AppData\Local\Temp\21D3.tmp"97⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\2221.tmp"C:\Users\Admin\AppData\Local\Temp\2221.tmp"98⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\227E.tmp"C:\Users\Admin\AppData\Local\Temp\227E.tmp"99⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\22BD.tmp"C:\Users\Admin\AppData\Local\Temp\22BD.tmp"100⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\22FB.tmp"C:\Users\Admin\AppData\Local\Temp\22FB.tmp"101⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\233A.tmp"C:\Users\Admin\AppData\Local\Temp\233A.tmp"102⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\2378.tmp"C:\Users\Admin\AppData\Local\Temp\2378.tmp"103⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\23B6.tmp"C:\Users\Admin\AppData\Local\Temp\23B6.tmp"104⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\23F5.tmp"C:\Users\Admin\AppData\Local\Temp\23F5.tmp"105⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\2433.tmp"C:\Users\Admin\AppData\Local\Temp\2433.tmp"106⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\2472.tmp"C:\Users\Admin\AppData\Local\Temp\2472.tmp"107⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\24B0.tmp"C:\Users\Admin\AppData\Local\Temp\24B0.tmp"108⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\24EE.tmp"C:\Users\Admin\AppData\Local\Temp\24EE.tmp"109⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\252D.tmp"C:\Users\Admin\AppData\Local\Temp\252D.tmp"110⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\256B.tmp"C:\Users\Admin\AppData\Local\Temp\256B.tmp"111⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\25AA.tmp"C:\Users\Admin\AppData\Local\Temp\25AA.tmp"112⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\25E8.tmp"C:\Users\Admin\AppData\Local\Temp\25E8.tmp"113⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\2626.tmp"C:\Users\Admin\AppData\Local\Temp\2626.tmp"114⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\2665.tmp"C:\Users\Admin\AppData\Local\Temp\2665.tmp"115⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\26A3.tmp"C:\Users\Admin\AppData\Local\Temp\26A3.tmp"116⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\26E2.tmp"C:\Users\Admin\AppData\Local\Temp\26E2.tmp"117⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\2730.tmp"C:\Users\Admin\AppData\Local\Temp\2730.tmp"118⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\276E.tmp"C:\Users\Admin\AppData\Local\Temp\276E.tmp"119⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\27AC.tmp"C:\Users\Admin\AppData\Local\Temp\27AC.tmp"120⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\27EB.tmp"C:\Users\Admin\AppData\Local\Temp\27EB.tmp"121⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\2829.tmp"C:\Users\Admin\AppData\Local\Temp\2829.tmp"122⤵PID:1684
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-