Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29-03-2024 07:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-03-29_c5ac88fe69ea4e952c1ee58474a70f7e_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-29_c5ac88fe69ea4e952c1ee58474a70f7e_mafia.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-03-29_c5ac88fe69ea4e952c1ee58474a70f7e_mafia.exe
-
Size
486KB
-
MD5
c5ac88fe69ea4e952c1ee58474a70f7e
-
SHA1
f2105b2a5f549eeff15dce00ddf7b0191973afb8
-
SHA256
7a496772d14dea7da94f98ea3f0475e14e13928b518e8149d0611317340600bf
-
SHA512
c5283fd79527003ff8a0de71bddbb988b15c92c4ac7f458e039b0e30d262377935a6c9ce0e21a737b3e2c865ee5729e249f0dc3e4d9fe36adcf3e69dd9a11b88
-
SSDEEP
12288:UU5rCOTeiDa8slT2C7cZWaK20rN67uY5qEhNZ:UUQOJDfs94ZWKiNLaZN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3048 1239.tmp 1752 1297.tmp 2616 1304.tmp 2120 1362.tmp 2636 13BF.tmp 2584 140D.tmp 2044 146B.tmp 2648 14C8.tmp 3064 1536.tmp 2728 15A3.tmp 2460 15E1.tmp 3068 162F.tmp 2996 169C.tmp 2856 16EA.tmp 2972 1748.tmp 3020 17A6.tmp 2776 1813.tmp 1560 1880.tmp 1584 18DE.tmp 2528 194B.tmp 2868 19A8.tmp 2820 19F6.tmp 1400 1A44.tmp 1200 1A83.tmp 1716 1AD1.tmp 1972 1B0F.tmp 1692 1B4E.tmp 2740 1B8C.tmp 2900 1BCA.tmp 2408 1C09.tmp 1996 1C47.tmp 676 1C86.tmp 592 1CC4.tmp 1476 1D02.tmp 1064 1D50.tmp 852 1D8F.tmp 1780 1DCD.tmp 612 1E0C.tmp 412 1E4A.tmp 1632 1E88.tmp 1364 1ED6.tmp 1552 1F15.tmp 1032 1F53.tmp 932 1F92.tmp 1648 1FE0.tmp 1816 201E.tmp 856 205C.tmp 2252 209B.tmp 2212 20D9.tmp 2204 2118.tmp 1372 2156.tmp 2344 2194.tmp 1504 21D3.tmp 2228 2211.tmp 1592 2250.tmp 1844 228E.tmp 2880 22CC.tmp 3052 230B.tmp 2760 2349.tmp 2248 2388.tmp 2168 23C6.tmp 2568 2404.tmp 2708 2452.tmp 2644 2491.tmp -
Loads dropped DLL 64 IoCs
pid Process 2880 2024-03-29_c5ac88fe69ea4e952c1ee58474a70f7e_mafia.exe 3048 1239.tmp 1752 1297.tmp 2616 1304.tmp 2120 1362.tmp 2636 13BF.tmp 2584 140D.tmp 2044 146B.tmp 2648 14C8.tmp 3064 1536.tmp 2728 15A3.tmp 2460 15E1.tmp 3068 162F.tmp 2996 169C.tmp 2856 16EA.tmp 2972 1748.tmp 3020 17A6.tmp 2776 1813.tmp 1560 1880.tmp 1584 18DE.tmp 2528 194B.tmp 2868 19A8.tmp 2820 19F6.tmp 1400 1A44.tmp 1200 1A83.tmp 1716 1AD1.tmp 1972 1B0F.tmp 1692 1B4E.tmp 2740 1B8C.tmp 2900 1BCA.tmp 2408 1C09.tmp 1996 1C47.tmp 676 1C86.tmp 592 1CC4.tmp 1476 1D02.tmp 1064 1D50.tmp 852 1D8F.tmp 1780 1DCD.tmp 612 1E0C.tmp 412 1E4A.tmp 1632 1E88.tmp 1364 1ED6.tmp 1552 1F15.tmp 1032 1F53.tmp 932 1F92.tmp 1648 1FE0.tmp 1816 201E.tmp 856 205C.tmp 2252 209B.tmp 2212 20D9.tmp 2204 2118.tmp 1372 2156.tmp 2344 2194.tmp 1504 21D3.tmp 2228 2211.tmp 1592 2250.tmp 1844 228E.tmp 2880 22CC.tmp 3052 230B.tmp 2760 2349.tmp 2248 2388.tmp 2168 23C6.tmp 2568 2404.tmp 2708 2452.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2880 wrote to memory of 3048 2880 2024-03-29_c5ac88fe69ea4e952c1ee58474a70f7e_mafia.exe 28 PID 2880 wrote to memory of 3048 2880 2024-03-29_c5ac88fe69ea4e952c1ee58474a70f7e_mafia.exe 28 PID 2880 wrote to memory of 3048 2880 2024-03-29_c5ac88fe69ea4e952c1ee58474a70f7e_mafia.exe 28 PID 2880 wrote to memory of 3048 2880 2024-03-29_c5ac88fe69ea4e952c1ee58474a70f7e_mafia.exe 28 PID 3048 wrote to memory of 1752 3048 1239.tmp 29 PID 3048 wrote to memory of 1752 3048 1239.tmp 29 PID 3048 wrote to memory of 1752 3048 1239.tmp 29 PID 3048 wrote to memory of 1752 3048 1239.tmp 29 PID 1752 wrote to memory of 2616 1752 1297.tmp 30 PID 1752 wrote to memory of 2616 1752 1297.tmp 30 PID 1752 wrote to memory of 2616 1752 1297.tmp 30 PID 1752 wrote to memory of 2616 1752 1297.tmp 30 PID 2616 wrote to memory of 2120 2616 1304.tmp 31 PID 2616 wrote to memory of 2120 2616 1304.tmp 31 PID 2616 wrote to memory of 2120 2616 1304.tmp 31 PID 2616 wrote to memory of 2120 2616 1304.tmp 31 PID 2120 wrote to memory of 2636 2120 1362.tmp 32 PID 2120 wrote to memory of 2636 2120 1362.tmp 32 PID 2120 wrote to memory of 2636 2120 1362.tmp 32 PID 2120 wrote to memory of 2636 2120 1362.tmp 32 PID 2636 wrote to memory of 2584 2636 13BF.tmp 33 PID 2636 wrote to memory of 2584 2636 13BF.tmp 33 PID 2636 wrote to memory of 2584 2636 13BF.tmp 33 PID 2636 wrote to memory of 2584 2636 13BF.tmp 33 PID 2584 wrote to memory of 2044 2584 140D.tmp 34 PID 2584 wrote to memory of 2044 2584 140D.tmp 34 PID 2584 wrote to memory of 2044 2584 140D.tmp 34 PID 2584 wrote to memory of 2044 2584 140D.tmp 34 PID 2044 wrote to memory of 2648 2044 146B.tmp 35 PID 2044 wrote to memory of 2648 2044 146B.tmp 35 PID 2044 wrote to memory of 2648 2044 146B.tmp 35 PID 2044 wrote to memory of 2648 2044 146B.tmp 35 PID 2648 wrote to memory of 3064 2648 14C8.tmp 36 PID 2648 wrote to memory of 3064 2648 14C8.tmp 36 PID 2648 wrote to memory of 3064 2648 14C8.tmp 36 PID 2648 wrote to memory of 3064 2648 14C8.tmp 36 PID 3064 wrote to memory of 2728 3064 1536.tmp 37 PID 3064 wrote to memory of 2728 3064 1536.tmp 37 PID 3064 wrote to memory of 2728 3064 1536.tmp 37 PID 3064 wrote to memory of 2728 3064 1536.tmp 37 PID 2728 wrote to memory of 2460 2728 15A3.tmp 38 PID 2728 wrote to memory of 2460 2728 15A3.tmp 38 PID 2728 wrote to memory of 2460 2728 15A3.tmp 38 PID 2728 wrote to memory of 2460 2728 15A3.tmp 38 PID 2460 wrote to memory of 3068 2460 15E1.tmp 39 PID 2460 wrote to memory of 3068 2460 15E1.tmp 39 PID 2460 wrote to memory of 3068 2460 15E1.tmp 39 PID 2460 wrote to memory of 3068 2460 15E1.tmp 39 PID 3068 wrote to memory of 2996 3068 162F.tmp 40 PID 3068 wrote to memory of 2996 3068 162F.tmp 40 PID 3068 wrote to memory of 2996 3068 162F.tmp 40 PID 3068 wrote to memory of 2996 3068 162F.tmp 40 PID 2996 wrote to memory of 2856 2996 169C.tmp 41 PID 2996 wrote to memory of 2856 2996 169C.tmp 41 PID 2996 wrote to memory of 2856 2996 169C.tmp 41 PID 2996 wrote to memory of 2856 2996 169C.tmp 41 PID 2856 wrote to memory of 2972 2856 16EA.tmp 42 PID 2856 wrote to memory of 2972 2856 16EA.tmp 42 PID 2856 wrote to memory of 2972 2856 16EA.tmp 42 PID 2856 wrote to memory of 2972 2856 16EA.tmp 42 PID 2972 wrote to memory of 3020 2972 1748.tmp 43 PID 2972 wrote to memory of 3020 2972 1748.tmp 43 PID 2972 wrote to memory of 3020 2972 1748.tmp 43 PID 2972 wrote to memory of 3020 2972 1748.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-29_c5ac88fe69ea4e952c1ee58474a70f7e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-29_c5ac88fe69ea4e952c1ee58474a70f7e_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\1239.tmp"C:\Users\Admin\AppData\Local\Temp\1239.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\1297.tmp"C:\Users\Admin\AppData\Local\Temp\1297.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\1304.tmp"C:\Users\Admin\AppData\Local\Temp\1304.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\1362.tmp"C:\Users\Admin\AppData\Local\Temp\1362.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\13BF.tmp"C:\Users\Admin\AppData\Local\Temp\13BF.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\140D.tmp"C:\Users\Admin\AppData\Local\Temp\140D.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\146B.tmp"C:\Users\Admin\AppData\Local\Temp\146B.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\14C8.tmp"C:\Users\Admin\AppData\Local\Temp\14C8.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\1536.tmp"C:\Users\Admin\AppData\Local\Temp\1536.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\15A3.tmp"C:\Users\Admin\AppData\Local\Temp\15A3.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\15E1.tmp"C:\Users\Admin\AppData\Local\Temp\15E1.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\162F.tmp"C:\Users\Admin\AppData\Local\Temp\162F.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\169C.tmp"C:\Users\Admin\AppData\Local\Temp\169C.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\16EA.tmp"C:\Users\Admin\AppData\Local\Temp\16EA.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\1748.tmp"C:\Users\Admin\AppData\Local\Temp\1748.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\17A6.tmp"C:\Users\Admin\AppData\Local\Temp\17A6.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\1813.tmp"C:\Users\Admin\AppData\Local\Temp\1813.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\1880.tmp"C:\Users\Admin\AppData\Local\Temp\1880.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\18DE.tmp"C:\Users\Admin\AppData\Local\Temp\18DE.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\194B.tmp"C:\Users\Admin\AppData\Local\Temp\194B.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\19A8.tmp"C:\Users\Admin\AppData\Local\Temp\19A8.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\19F6.tmp"C:\Users\Admin\AppData\Local\Temp\19F6.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\1A44.tmp"C:\Users\Admin\AppData\Local\Temp\1A44.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\1A83.tmp"C:\Users\Admin\AppData\Local\Temp\1A83.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\1B0F.tmp"C:\Users\Admin\AppData\Local\Temp\1B0F.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\1B8C.tmp"C:\Users\Admin\AppData\Local\Temp\1B8C.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\1C09.tmp"C:\Users\Admin\AppData\Local\Temp\1C09.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\1C47.tmp"C:\Users\Admin\AppData\Local\Temp\1C47.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\1C86.tmp"C:\Users\Admin\AppData\Local\Temp\1C86.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:676 -
C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:592 -
C:\Users\Admin\AppData\Local\Temp\1D02.tmp"C:\Users\Admin\AppData\Local\Temp\1D02.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\1D50.tmp"C:\Users\Admin\AppData\Local\Temp\1D50.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\1D8F.tmp"C:\Users\Admin\AppData\Local\Temp\1D8F.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:852 -
C:\Users\Admin\AppData\Local\Temp\1DCD.tmp"C:\Users\Admin\AppData\Local\Temp\1DCD.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:612 -
C:\Users\Admin\AppData\Local\Temp\1E4A.tmp"C:\Users\Admin\AppData\Local\Temp\1E4A.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:412 -
C:\Users\Admin\AppData\Local\Temp\1E88.tmp"C:\Users\Admin\AppData\Local\Temp\1E88.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\1F15.tmp"C:\Users\Admin\AppData\Local\Temp\1F15.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\1F53.tmp"C:\Users\Admin\AppData\Local\Temp\1F53.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\1F92.tmp"C:\Users\Admin\AppData\Local\Temp\1F92.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:932 -
C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\201E.tmp"C:\Users\Admin\AppData\Local\Temp\201E.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\205C.tmp"C:\Users\Admin\AppData\Local\Temp\205C.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:856 -
C:\Users\Admin\AppData\Local\Temp\209B.tmp"C:\Users\Admin\AppData\Local\Temp\209B.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\20D9.tmp"C:\Users\Admin\AppData\Local\Temp\20D9.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\2118.tmp"C:\Users\Admin\AppData\Local\Temp\2118.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\2156.tmp"C:\Users\Admin\AppData\Local\Temp\2156.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\2194.tmp"C:\Users\Admin\AppData\Local\Temp\2194.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\21D3.tmp"C:\Users\Admin\AppData\Local\Temp\21D3.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\2211.tmp"C:\Users\Admin\AppData\Local\Temp\2211.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\2250.tmp"C:\Users\Admin\AppData\Local\Temp\2250.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\228E.tmp"C:\Users\Admin\AppData\Local\Temp\228E.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\22CC.tmp"C:\Users\Admin\AppData\Local\Temp\22CC.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\230B.tmp"C:\Users\Admin\AppData\Local\Temp\230B.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\2349.tmp"C:\Users\Admin\AppData\Local\Temp\2349.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\2388.tmp"C:\Users\Admin\AppData\Local\Temp\2388.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\23C6.tmp"C:\Users\Admin\AppData\Local\Temp\23C6.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\2404.tmp"C:\Users\Admin\AppData\Local\Temp\2404.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\2452.tmp"C:\Users\Admin\AppData\Local\Temp\2452.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\2491.tmp"C:\Users\Admin\AppData\Local\Temp\2491.tmp"65⤵
- Executes dropped EXE
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\24CF.tmp"C:\Users\Admin\AppData\Local\Temp\24CF.tmp"66⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\250E.tmp"C:\Users\Admin\AppData\Local\Temp\250E.tmp"67⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"68⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\259A.tmp"C:\Users\Admin\AppData\Local\Temp\259A.tmp"69⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\25F8.tmp"C:\Users\Admin\AppData\Local\Temp\25F8.tmp"70⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\2636.tmp"C:\Users\Admin\AppData\Local\Temp\2636.tmp"71⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\2674.tmp"C:\Users\Admin\AppData\Local\Temp\2674.tmp"72⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\26B3.tmp"C:\Users\Admin\AppData\Local\Temp\26B3.tmp"73⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\26F1.tmp"C:\Users\Admin\AppData\Local\Temp\26F1.tmp"74⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\2730.tmp"C:\Users\Admin\AppData\Local\Temp\2730.tmp"75⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\276E.tmp"C:\Users\Admin\AppData\Local\Temp\276E.tmp"76⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\27BC.tmp"C:\Users\Admin\AppData\Local\Temp\27BC.tmp"77⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\27FA.tmp"C:\Users\Admin\AppData\Local\Temp\27FA.tmp"78⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\2839.tmp"C:\Users\Admin\AppData\Local\Temp\2839.tmp"79⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\2877.tmp"C:\Users\Admin\AppData\Local\Temp\2877.tmp"80⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\28B6.tmp"C:\Users\Admin\AppData\Local\Temp\28B6.tmp"81⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\2904.tmp"C:\Users\Admin\AppData\Local\Temp\2904.tmp"82⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\2952.tmp"C:\Users\Admin\AppData\Local\Temp\2952.tmp"83⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\2990.tmp"C:\Users\Admin\AppData\Local\Temp\2990.tmp"84⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\29CE.tmp"C:\Users\Admin\AppData\Local\Temp\29CE.tmp"85⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"86⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"87⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"88⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"89⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\2B16.tmp"C:\Users\Admin\AppData\Local\Temp\2B16.tmp"90⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\2B54.tmp"C:\Users\Admin\AppData\Local\Temp\2B54.tmp"91⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\2B93.tmp"C:\Users\Admin\AppData\Local\Temp\2B93.tmp"92⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"93⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\2C10.tmp"C:\Users\Admin\AppData\Local\Temp\2C10.tmp"94⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"95⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\2C9C.tmp"C:\Users\Admin\AppData\Local\Temp\2C9C.tmp"96⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"97⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\2D19.tmp"C:\Users\Admin\AppData\Local\Temp\2D19.tmp"98⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\2D57.tmp"C:\Users\Admin\AppData\Local\Temp\2D57.tmp"99⤵PID:504
-
C:\Users\Admin\AppData\Local\Temp\2D96.tmp"C:\Users\Admin\AppData\Local\Temp\2D96.tmp"100⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"101⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\2E12.tmp"C:\Users\Admin\AppData\Local\Temp\2E12.tmp"102⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\2E51.tmp"C:\Users\Admin\AppData\Local\Temp\2E51.tmp"103⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"104⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"105⤵PID:332
-
C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"106⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"107⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\2F89.tmp"C:\Users\Admin\AppData\Local\Temp\2F89.tmp"108⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"109⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\3015.tmp"C:\Users\Admin\AppData\Local\Temp\3015.tmp"110⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\3054.tmp"C:\Users\Admin\AppData\Local\Temp\3054.tmp"111⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\3092.tmp"C:\Users\Admin\AppData\Local\Temp\3092.tmp"112⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\30D0.tmp"C:\Users\Admin\AppData\Local\Temp\30D0.tmp"113⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\310F.tmp"C:\Users\Admin\AppData\Local\Temp\310F.tmp"114⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\314D.tmp"C:\Users\Admin\AppData\Local\Temp\314D.tmp"115⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\318C.tmp"C:\Users\Admin\AppData\Local\Temp\318C.tmp"116⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\31CA.tmp"C:\Users\Admin\AppData\Local\Temp\31CA.tmp"117⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\3218.tmp"C:\Users\Admin\AppData\Local\Temp\3218.tmp"118⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"119⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\3295.tmp"C:\Users\Admin\AppData\Local\Temp\3295.tmp"120⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\32D3.tmp"C:\Users\Admin\AppData\Local\Temp\32D3.tmp"121⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\3312.tmp"C:\Users\Admin\AppData\Local\Temp\3312.tmp"122⤵PID:2220
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-