Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
12-03-2024 13:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-03-12_2506495f977b7639941399b0fc6a9a0f_mafia.exe
Resource
win7-20240220-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-12_2506495f977b7639941399b0fc6a9a0f_mafia.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-03-12_2506495f977b7639941399b0fc6a9a0f_mafia.exe
-
Size
536KB
-
MD5
2506495f977b7639941399b0fc6a9a0f
-
SHA1
08b38692de34b8ccf0cead5e2af4b64d53d3b97d
-
SHA256
4ee284bf616d7da69bc162d2d57a145dc54158185b43212c526802197b43b4a7
-
SHA512
307bbf797600fd1c4de03b939eba9a1dc6ff4974a21aa92c65a80d0c39fbead7c3563a339d8b6d4aa05b137e7b5241f4ef1a9a9a8e044c5496bd4ff7c5762371
-
SSDEEP
12288:wU5rCOTeiUa+4p8IlaYkmJFkkkAJyAiIGh0ciPIZxVJ0ZT9:wUQOJUexzHkkkOyAiIGmciPIRJ0ZT9
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 760 1258.tmp 1796 12D5.tmp 3004 1323.tmp 2596 13CF.tmp 2520 144C.tmp 2628 149A.tmp 2132 1516.tmp 2380 1593.tmp 2140 1600.tmp 2024 164E.tmp 1416 16CB.tmp 2676 1738.tmp 2472 17A6.tmp 2728 1822.tmp 1904 189F.tmp 1912 192C.tmp 1672 1999.tmp 500 1A16.tmp 1316 1AD1.tmp 1288 1B6D.tmp 1936 1C28.tmp 2364 1C95.tmp 2792 1D12.tmp 1492 1D7F.tmp 1548 1DBE.tmp 1820 1E1B.tmp 3036 1E69.tmp 2352 1EB7.tmp 3032 1F15.tmp 1756 1F72.tmp 1356 1FEF.tmp 2724 204D.tmp 1032 20AA.tmp 3020 20E9.tmp 2884 2127.tmp 576 2185.tmp 2064 21E2.tmp 1500 2221.tmp 2812 225F.tmp 1568 229E.tmp 1112 22EC.tmp 2080 232A.tmp 2572 2388.tmp 2028 23C6.tmp 2600 2424.tmp 2772 2462.tmp 2392 24A0.tmp 2616 24FE.tmp 2408 255C.tmp 2404 25B9.tmp 2580 2646.tmp 2448 2684.tmp 2388 26C2.tmp 344 2720.tmp 2372 275E.tmp 2692 27BC.tmp 2488 27FA.tmp 2472 2839.tmp 2280 28C5.tmp 1892 2923.tmp 320 2961.tmp 2116 29A0.tmp 1664 29DE.tmp 2296 2A2C.tmp -
Loads dropped DLL 64 IoCs
pid Process 2192 2024-03-12_2506495f977b7639941399b0fc6a9a0f_mafia.exe 760 1258.tmp 1796 12D5.tmp 3004 1323.tmp 2596 13CF.tmp 2520 144C.tmp 2628 149A.tmp 2132 1516.tmp 2380 1593.tmp 2140 1600.tmp 2024 164E.tmp 1416 16CB.tmp 2676 1738.tmp 2472 17A6.tmp 2728 1822.tmp 1904 189F.tmp 1912 192C.tmp 1672 1999.tmp 500 1A16.tmp 1316 1AD1.tmp 1288 1B6D.tmp 1936 1C28.tmp 2364 1C95.tmp 2792 1D12.tmp 1492 1D7F.tmp 1548 1DBE.tmp 1820 1E1B.tmp 3036 1E69.tmp 2352 1EB7.tmp 3032 1F15.tmp 1756 1F72.tmp 1356 1FEF.tmp 2724 204D.tmp 1032 20AA.tmp 3020 20E9.tmp 2884 2127.tmp 576 2185.tmp 2064 21E2.tmp 1500 2221.tmp 2812 225F.tmp 1568 229E.tmp 1112 22EC.tmp 2080 232A.tmp 2572 2388.tmp 2028 23C6.tmp 2600 2424.tmp 2772 2462.tmp 2392 24A0.tmp 2616 24FE.tmp 2408 255C.tmp 2404 25B9.tmp 2580 2646.tmp 2448 2684.tmp 2388 26C2.tmp 344 2720.tmp 2372 275E.tmp 2692 27BC.tmp 2488 27FA.tmp 2472 2839.tmp 2280 28C5.tmp 1892 2923.tmp 320 2961.tmp 2116 29A0.tmp 1664 29DE.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2192 wrote to memory of 760 2192 2024-03-12_2506495f977b7639941399b0fc6a9a0f_mafia.exe 28 PID 2192 wrote to memory of 760 2192 2024-03-12_2506495f977b7639941399b0fc6a9a0f_mafia.exe 28 PID 2192 wrote to memory of 760 2192 2024-03-12_2506495f977b7639941399b0fc6a9a0f_mafia.exe 28 PID 2192 wrote to memory of 760 2192 2024-03-12_2506495f977b7639941399b0fc6a9a0f_mafia.exe 28 PID 760 wrote to memory of 1796 760 1258.tmp 29 PID 760 wrote to memory of 1796 760 1258.tmp 29 PID 760 wrote to memory of 1796 760 1258.tmp 29 PID 760 wrote to memory of 1796 760 1258.tmp 29 PID 1796 wrote to memory of 3004 1796 12D5.tmp 30 PID 1796 wrote to memory of 3004 1796 12D5.tmp 30 PID 1796 wrote to memory of 3004 1796 12D5.tmp 30 PID 1796 wrote to memory of 3004 1796 12D5.tmp 30 PID 3004 wrote to memory of 2596 3004 1323.tmp 31 PID 3004 wrote to memory of 2596 3004 1323.tmp 31 PID 3004 wrote to memory of 2596 3004 1323.tmp 31 PID 3004 wrote to memory of 2596 3004 1323.tmp 31 PID 2596 wrote to memory of 2520 2596 13CF.tmp 32 PID 2596 wrote to memory of 2520 2596 13CF.tmp 32 PID 2596 wrote to memory of 2520 2596 13CF.tmp 32 PID 2596 wrote to memory of 2520 2596 13CF.tmp 32 PID 2520 wrote to memory of 2628 2520 144C.tmp 33 PID 2520 wrote to memory of 2628 2520 144C.tmp 33 PID 2520 wrote to memory of 2628 2520 144C.tmp 33 PID 2520 wrote to memory of 2628 2520 144C.tmp 33 PID 2628 wrote to memory of 2132 2628 149A.tmp 34 PID 2628 wrote to memory of 2132 2628 149A.tmp 34 PID 2628 wrote to memory of 2132 2628 149A.tmp 34 PID 2628 wrote to memory of 2132 2628 149A.tmp 34 PID 2132 wrote to memory of 2380 2132 1516.tmp 35 PID 2132 wrote to memory of 2380 2132 1516.tmp 35 PID 2132 wrote to memory of 2380 2132 1516.tmp 35 PID 2132 wrote to memory of 2380 2132 1516.tmp 35 PID 2380 wrote to memory of 2140 2380 1593.tmp 36 PID 2380 wrote to memory of 2140 2380 1593.tmp 36 PID 2380 wrote to memory of 2140 2380 1593.tmp 36 PID 2380 wrote to memory of 2140 2380 1593.tmp 36 PID 2140 wrote to memory of 2024 2140 1600.tmp 37 PID 2140 wrote to memory of 2024 2140 1600.tmp 37 PID 2140 wrote to memory of 2024 2140 1600.tmp 37 PID 2140 wrote to memory of 2024 2140 1600.tmp 37 PID 2024 wrote to memory of 1416 2024 164E.tmp 38 PID 2024 wrote to memory of 1416 2024 164E.tmp 38 PID 2024 wrote to memory of 1416 2024 164E.tmp 38 PID 2024 wrote to memory of 1416 2024 164E.tmp 38 PID 1416 wrote to memory of 2676 1416 16CB.tmp 39 PID 1416 wrote to memory of 2676 1416 16CB.tmp 39 PID 1416 wrote to memory of 2676 1416 16CB.tmp 39 PID 1416 wrote to memory of 2676 1416 16CB.tmp 39 PID 2676 wrote to memory of 2472 2676 1738.tmp 40 PID 2676 wrote to memory of 2472 2676 1738.tmp 40 PID 2676 wrote to memory of 2472 2676 1738.tmp 40 PID 2676 wrote to memory of 2472 2676 1738.tmp 40 PID 2472 wrote to memory of 2728 2472 17A6.tmp 41 PID 2472 wrote to memory of 2728 2472 17A6.tmp 41 PID 2472 wrote to memory of 2728 2472 17A6.tmp 41 PID 2472 wrote to memory of 2728 2472 17A6.tmp 41 PID 2728 wrote to memory of 1904 2728 1822.tmp 42 PID 2728 wrote to memory of 1904 2728 1822.tmp 42 PID 2728 wrote to memory of 1904 2728 1822.tmp 42 PID 2728 wrote to memory of 1904 2728 1822.tmp 42 PID 1904 wrote to memory of 1912 1904 189F.tmp 43 PID 1904 wrote to memory of 1912 1904 189F.tmp 43 PID 1904 wrote to memory of 1912 1904 189F.tmp 43 PID 1904 wrote to memory of 1912 1904 189F.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-12_2506495f977b7639941399b0fc6a9a0f_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-12_2506495f977b7639941399b0fc6a9a0f_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\1258.tmp"C:\Users\Admin\AppData\Local\Temp\1258.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\12D5.tmp"C:\Users\Admin\AppData\Local\Temp\12D5.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\1323.tmp"C:\Users\Admin\AppData\Local\Temp\1323.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\13CF.tmp"C:\Users\Admin\AppData\Local\Temp\13CF.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\144C.tmp"C:\Users\Admin\AppData\Local\Temp\144C.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\149A.tmp"C:\Users\Admin\AppData\Local\Temp\149A.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\1516.tmp"C:\Users\Admin\AppData\Local\Temp\1516.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\1593.tmp"C:\Users\Admin\AppData\Local\Temp\1593.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\1600.tmp"C:\Users\Admin\AppData\Local\Temp\1600.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\164E.tmp"C:\Users\Admin\AppData\Local\Temp\164E.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\16CB.tmp"C:\Users\Admin\AppData\Local\Temp\16CB.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\1738.tmp"C:\Users\Admin\AppData\Local\Temp\1738.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\17A6.tmp"C:\Users\Admin\AppData\Local\Temp\17A6.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\1822.tmp"C:\Users\Admin\AppData\Local\Temp\1822.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\189F.tmp"C:\Users\Admin\AppData\Local\Temp\189F.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\192C.tmp"C:\Users\Admin\AppData\Local\Temp\192C.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\1999.tmp"C:\Users\Admin\AppData\Local\Temp\1999.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\1A16.tmp"C:\Users\Admin\AppData\Local\Temp\1A16.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:500 -
C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\1B6D.tmp"C:\Users\Admin\AppData\Local\Temp\1B6D.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\1C28.tmp"C:\Users\Admin\AppData\Local\Temp\1C28.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\1C95.tmp"C:\Users\Admin\AppData\Local\Temp\1C95.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\1D12.tmp"C:\Users\Admin\AppData\Local\Temp\1D12.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\1E69.tmp"C:\Users\Admin\AppData\Local\Temp\1E69.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\1F15.tmp"C:\Users\Admin\AppData\Local\Temp\1F15.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\1F72.tmp"C:\Users\Admin\AppData\Local\Temp\1F72.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\204D.tmp"C:\Users\Admin\AppData\Local\Temp\204D.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\20AA.tmp"C:\Users\Admin\AppData\Local\Temp\20AA.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\20E9.tmp"C:\Users\Admin\AppData\Local\Temp\20E9.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\2127.tmp"C:\Users\Admin\AppData\Local\Temp\2127.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\2185.tmp"C:\Users\Admin\AppData\Local\Temp\2185.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:576 -
C:\Users\Admin\AppData\Local\Temp\21E2.tmp"C:\Users\Admin\AppData\Local\Temp\21E2.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\2221.tmp"C:\Users\Admin\AppData\Local\Temp\2221.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\225F.tmp"C:\Users\Admin\AppData\Local\Temp\225F.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\229E.tmp"C:\Users\Admin\AppData\Local\Temp\229E.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\22EC.tmp"C:\Users\Admin\AppData\Local\Temp\22EC.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\232A.tmp"C:\Users\Admin\AppData\Local\Temp\232A.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\2388.tmp"C:\Users\Admin\AppData\Local\Temp\2388.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\23C6.tmp"C:\Users\Admin\AppData\Local\Temp\23C6.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\2424.tmp"C:\Users\Admin\AppData\Local\Temp\2424.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\24A0.tmp"C:\Users\Admin\AppData\Local\Temp\24A0.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\24FE.tmp"C:\Users\Admin\AppData\Local\Temp\24FE.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\25B9.tmp"C:\Users\Admin\AppData\Local\Temp\25B9.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\2646.tmp"C:\Users\Admin\AppData\Local\Temp\2646.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\2684.tmp"C:\Users\Admin\AppData\Local\Temp\2684.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\26C2.tmp"C:\Users\Admin\AppData\Local\Temp\26C2.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\2720.tmp"C:\Users\Admin\AppData\Local\Temp\2720.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:344 -
C:\Users\Admin\AppData\Local\Temp\275E.tmp"C:\Users\Admin\AppData\Local\Temp\275E.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\27BC.tmp"C:\Users\Admin\AppData\Local\Temp\27BC.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\27FA.tmp"C:\Users\Admin\AppData\Local\Temp\27FA.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\2839.tmp"C:\Users\Admin\AppData\Local\Temp\2839.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\28C5.tmp"C:\Users\Admin\AppData\Local\Temp\28C5.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\2923.tmp"C:\Users\Admin\AppData\Local\Temp\2923.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\2961.tmp"C:\Users\Admin\AppData\Local\Temp\2961.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:320 -
C:\Users\Admin\AppData\Local\Temp\29A0.tmp"C:\Users\Admin\AppData\Local\Temp\29A0.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\29DE.tmp"C:\Users\Admin\AppData\Local\Temp\29DE.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"65⤵
- Executes dropped EXE
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"66⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\2B16.tmp"C:\Users\Admin\AppData\Local\Temp\2B16.tmp"67⤵PID:500
-
C:\Users\Admin\AppData\Local\Temp\2B54.tmp"C:\Users\Admin\AppData\Local\Temp\2B54.tmp"68⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"69⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\2C1F.tmp"C:\Users\Admin\AppData\Local\Temp\2C1F.tmp"70⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"71⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\2C9C.tmp"C:\Users\Admin\AppData\Local\Temp\2C9C.tmp"72⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"73⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\2D19.tmp"C:\Users\Admin\AppData\Local\Temp\2D19.tmp"74⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\2D76.tmp"C:\Users\Admin\AppData\Local\Temp\2D76.tmp"75⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"76⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\2E22.tmp"C:\Users\Admin\AppData\Local\Temp\2E22.tmp"77⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"78⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"79⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"80⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\2F89.tmp"C:\Users\Admin\AppData\Local\Temp\2F89.tmp"81⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"82⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\3044.tmp"C:\Users\Admin\AppData\Local\Temp\3044.tmp"83⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\3073.tmp"C:\Users\Admin\AppData\Local\Temp\3073.tmp"84⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\30B1.tmp"C:\Users\Admin\AppData\Local\Temp\30B1.tmp"85⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\30E0.tmp"C:\Users\Admin\AppData\Local\Temp\30E0.tmp"86⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\312E.tmp"C:\Users\Admin\AppData\Local\Temp\312E.tmp"87⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\316C.tmp"C:\Users\Admin\AppData\Local\Temp\316C.tmp"88⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\31AB.tmp"C:\Users\Admin\AppData\Local\Temp\31AB.tmp"89⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\31E9.tmp"C:\Users\Admin\AppData\Local\Temp\31E9.tmp"90⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\3247.tmp"C:\Users\Admin\AppData\Local\Temp\3247.tmp"91⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\3285.tmp"C:\Users\Admin\AppData\Local\Temp\3285.tmp"92⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\32C4.tmp"C:\Users\Admin\AppData\Local\Temp\32C4.tmp"93⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\3302.tmp"C:\Users\Admin\AppData\Local\Temp\3302.tmp"94⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\3340.tmp"C:\Users\Admin\AppData\Local\Temp\3340.tmp"95⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\339E.tmp"C:\Users\Admin\AppData\Local\Temp\339E.tmp"96⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\33FC.tmp"C:\Users\Admin\AppData\Local\Temp\33FC.tmp"97⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\344A.tmp"C:\Users\Admin\AppData\Local\Temp\344A.tmp"98⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"99⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\3514.tmp"C:\Users\Admin\AppData\Local\Temp\3514.tmp"100⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\3572.tmp"C:\Users\Admin\AppData\Local\Temp\3572.tmp"101⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\35B0.tmp"C:\Users\Admin\AppData\Local\Temp\35B0.tmp"102⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\35EF.tmp"C:\Users\Admin\AppData\Local\Temp\35EF.tmp"103⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\361E.tmp"C:\Users\Admin\AppData\Local\Temp\361E.tmp"104⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\367B.tmp"C:\Users\Admin\AppData\Local\Temp\367B.tmp"105⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\36E8.tmp"C:\Users\Admin\AppData\Local\Temp\36E8.tmp"106⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\3746.tmp"C:\Users\Admin\AppData\Local\Temp\3746.tmp"107⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\37A4.tmp"C:\Users\Admin\AppData\Local\Temp\37A4.tmp"108⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\3801.tmp"C:\Users\Admin\AppData\Local\Temp\3801.tmp"109⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\388E.tmp"C:\Users\Admin\AppData\Local\Temp\388E.tmp"110⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\38DC.tmp"C:\Users\Admin\AppData\Local\Temp\38DC.tmp"111⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\391A.tmp"C:\Users\Admin\AppData\Local\Temp\391A.tmp"112⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\3978.tmp"C:\Users\Admin\AppData\Local\Temp\3978.tmp"113⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\39D5.tmp"C:\Users\Admin\AppData\Local\Temp\39D5.tmp"114⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\3A33.tmp"C:\Users\Admin\AppData\Local\Temp\3A33.tmp"115⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\3A71.tmp"C:\Users\Admin\AppData\Local\Temp\3A71.tmp"116⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\3AB0.tmp"C:\Users\Admin\AppData\Local\Temp\3AB0.tmp"117⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\3ADE.tmp"C:\Users\Admin\AppData\Local\Temp\3ADE.tmp"118⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\3B1D.tmp"C:\Users\Admin\AppData\Local\Temp\3B1D.tmp"119⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\3B6B.tmp"C:\Users\Admin\AppData\Local\Temp\3B6B.tmp"120⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\3BB9.tmp"C:\Users\Admin\AppData\Local\Temp\3BB9.tmp"121⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\3C16.tmp"C:\Users\Admin\AppData\Local\Temp\3C16.tmp"122⤵PID:2788
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-