Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
20/04/2024, 08:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-20_34deb4af77eee62ef4f6aea753e73ed7_mafia.exe
Resource
win7-20231129-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-20_34deb4af77eee62ef4f6aea753e73ed7_mafia.exe
Resource
win10v2004-20240412-en
2 signatures
150 seconds
General
-
Target
2024-04-20_34deb4af77eee62ef4f6aea753e73ed7_mafia.exe
-
Size
530KB
-
MD5
34deb4af77eee62ef4f6aea753e73ed7
-
SHA1
36e8ede9fe09c67a367472e469b6db4fd13a40b5
-
SHA256
6fb0082f3e8435148b8fcc2c4ba97a17ae3a79888682285a043a4489bf3f084b
-
SHA512
b411db82bb5541fb336f79e3abc8d8e540444c4f097cf2ee06326e102ea6c37c2a868f0edc85516d320c6a6c8a0db2a5955ae4d40ed0ca85ed8dbb77703e4218
-
SSDEEP
12288:AU5rCOTeiorddBWFJIRdUpQBa+TVg2l2wdNZulFVg0M1:AUQOJoRS4RdUpQBauVTQQNclFV/M1
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2328 722.tmp 2808 780.tmp 2544 7FC.tmp 2804 86A.tmp 2588 8C7.tmp 2688 934.tmp 2468 9A2.tmp 2728 9F0.tmp 2484 A5D.tmp 2628 ABA.tmp 2456 B18.tmp 2580 B76.tmp 2900 BD3.tmp 2300 C31.tmp 1756 C8E.tmp 1084 CFC.tmp 1692 D4A.tmp 2248 DB7.tmp 1188 E24.tmp 1268 E82.tmp 1656 ED0.tmp 1540 F2D.tmp 1424 F7B.tmp 856 FC9.tmp 2752 1008.tmp 2280 1056.tmp 2088 10A4.tmp 2336 10E2.tmp 2132 1120.tmp 604 115F.tmp 472 11AD.tmp 1452 11FB.tmp 1444 1239.tmp 852 1278.tmp 1040 12B6.tmp 2224 12F4.tmp 692 1333.tmp 1044 1371.tmp 3012 13B0.tmp 2832 13EE.tmp 1560 142C.tmp 2000 146B.tmp 784 14A9.tmp 1840 14E8.tmp 2960 1526.tmp 1072 1564.tmp 1100 15A3.tmp 2040 15E1.tmp 2064 1620.tmp 3036 165E.tmp 564 16AC.tmp 1672 16EA.tmp 956 1729.tmp 2232 1767.tmp 1612 17A6.tmp 1808 17E4.tmp 2320 1822.tmp 1216 1861.tmp 2644 189F.tmp 2964 18DE.tmp 2772 191C.tmp 2616 196A.tmp 2652 19B8.tmp 2656 19F6.tmp -
Loads dropped DLL 64 IoCs
pid Process 836 2024-04-20_34deb4af77eee62ef4f6aea753e73ed7_mafia.exe 2328 722.tmp 2808 780.tmp 2544 7FC.tmp 2804 86A.tmp 2588 8C7.tmp 2688 934.tmp 2468 9A2.tmp 2728 9F0.tmp 2484 A5D.tmp 2628 ABA.tmp 2456 B18.tmp 2580 B76.tmp 2900 BD3.tmp 2300 C31.tmp 1756 C8E.tmp 1084 CFC.tmp 1692 D4A.tmp 2248 DB7.tmp 1188 E24.tmp 1268 E82.tmp 1656 ED0.tmp 1540 F2D.tmp 1424 F7B.tmp 856 FC9.tmp 2752 1008.tmp 2280 1056.tmp 2088 10A4.tmp 2336 10E2.tmp 2132 1120.tmp 604 115F.tmp 472 11AD.tmp 1452 11FB.tmp 1444 1239.tmp 852 1278.tmp 1040 12B6.tmp 2224 12F4.tmp 692 1333.tmp 1044 1371.tmp 3012 13B0.tmp 2832 13EE.tmp 1560 142C.tmp 2000 146B.tmp 784 14A9.tmp 1840 14E8.tmp 2960 1526.tmp 1072 1564.tmp 1100 15A3.tmp 2040 15E1.tmp 2064 1620.tmp 3036 165E.tmp 564 16AC.tmp 1672 16EA.tmp 956 1729.tmp 2232 1767.tmp 1612 17A6.tmp 1808 17E4.tmp 2320 1822.tmp 1216 1861.tmp 2644 189F.tmp 2964 18DE.tmp 2772 191C.tmp 2616 196A.tmp 2652 19B8.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 836 wrote to memory of 2328 836 2024-04-20_34deb4af77eee62ef4f6aea753e73ed7_mafia.exe 28 PID 836 wrote to memory of 2328 836 2024-04-20_34deb4af77eee62ef4f6aea753e73ed7_mafia.exe 28 PID 836 wrote to memory of 2328 836 2024-04-20_34deb4af77eee62ef4f6aea753e73ed7_mafia.exe 28 PID 836 wrote to memory of 2328 836 2024-04-20_34deb4af77eee62ef4f6aea753e73ed7_mafia.exe 28 PID 2328 wrote to memory of 2808 2328 722.tmp 29 PID 2328 wrote to memory of 2808 2328 722.tmp 29 PID 2328 wrote to memory of 2808 2328 722.tmp 29 PID 2328 wrote to memory of 2808 2328 722.tmp 29 PID 2808 wrote to memory of 2544 2808 780.tmp 30 PID 2808 wrote to memory of 2544 2808 780.tmp 30 PID 2808 wrote to memory of 2544 2808 780.tmp 30 PID 2808 wrote to memory of 2544 2808 780.tmp 30 PID 2544 wrote to memory of 2804 2544 7FC.tmp 31 PID 2544 wrote to memory of 2804 2544 7FC.tmp 31 PID 2544 wrote to memory of 2804 2544 7FC.tmp 31 PID 2544 wrote to memory of 2804 2544 7FC.tmp 31 PID 2804 wrote to memory of 2588 2804 86A.tmp 32 PID 2804 wrote to memory of 2588 2804 86A.tmp 32 PID 2804 wrote to memory of 2588 2804 86A.tmp 32 PID 2804 wrote to memory of 2588 2804 86A.tmp 32 PID 2588 wrote to memory of 2688 2588 8C7.tmp 33 PID 2588 wrote to memory of 2688 2588 8C7.tmp 33 PID 2588 wrote to memory of 2688 2588 8C7.tmp 33 PID 2588 wrote to memory of 2688 2588 8C7.tmp 33 PID 2688 wrote to memory of 2468 2688 934.tmp 34 PID 2688 wrote to memory of 2468 2688 934.tmp 34 PID 2688 wrote to memory of 2468 2688 934.tmp 34 PID 2688 wrote to memory of 2468 2688 934.tmp 34 PID 2468 wrote to memory of 2728 2468 9A2.tmp 35 PID 2468 wrote to memory of 2728 2468 9A2.tmp 35 PID 2468 wrote to memory of 2728 2468 9A2.tmp 35 PID 2468 wrote to memory of 2728 2468 9A2.tmp 35 PID 2728 wrote to memory of 2484 2728 9F0.tmp 36 PID 2728 wrote to memory of 2484 2728 9F0.tmp 36 PID 2728 wrote to memory of 2484 2728 9F0.tmp 36 PID 2728 wrote to memory of 2484 2728 9F0.tmp 36 PID 2484 wrote to memory of 2628 2484 A5D.tmp 37 PID 2484 wrote to memory of 2628 2484 A5D.tmp 37 PID 2484 wrote to memory of 2628 2484 A5D.tmp 37 PID 2484 wrote to memory of 2628 2484 A5D.tmp 37 PID 2628 wrote to memory of 2456 2628 ABA.tmp 38 PID 2628 wrote to memory of 2456 2628 ABA.tmp 38 PID 2628 wrote to memory of 2456 2628 ABA.tmp 38 PID 2628 wrote to memory of 2456 2628 ABA.tmp 38 PID 2456 wrote to memory of 2580 2456 B18.tmp 39 PID 2456 wrote to memory of 2580 2456 B18.tmp 39 PID 2456 wrote to memory of 2580 2456 B18.tmp 39 PID 2456 wrote to memory of 2580 2456 B18.tmp 39 PID 2580 wrote to memory of 2900 2580 B76.tmp 40 PID 2580 wrote to memory of 2900 2580 B76.tmp 40 PID 2580 wrote to memory of 2900 2580 B76.tmp 40 PID 2580 wrote to memory of 2900 2580 B76.tmp 40 PID 2900 wrote to memory of 2300 2900 BD3.tmp 41 PID 2900 wrote to memory of 2300 2900 BD3.tmp 41 PID 2900 wrote to memory of 2300 2900 BD3.tmp 41 PID 2900 wrote to memory of 2300 2900 BD3.tmp 41 PID 2300 wrote to memory of 1756 2300 C31.tmp 42 PID 2300 wrote to memory of 1756 2300 C31.tmp 42 PID 2300 wrote to memory of 1756 2300 C31.tmp 42 PID 2300 wrote to memory of 1756 2300 C31.tmp 42 PID 1756 wrote to memory of 1084 1756 C8E.tmp 43 PID 1756 wrote to memory of 1084 1756 C8E.tmp 43 PID 1756 wrote to memory of 1084 1756 C8E.tmp 43 PID 1756 wrote to memory of 1084 1756 C8E.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-20_34deb4af77eee62ef4f6aea753e73ed7_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-20_34deb4af77eee62ef4f6aea753e73ed7_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Users\Admin\AppData\Local\Temp\722.tmp"C:\Users\Admin\AppData\Local\Temp\722.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\780.tmp"C:\Users\Admin\AppData\Local\Temp\780.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\7FC.tmp"C:\Users\Admin\AppData\Local\Temp\7FC.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\86A.tmp"C:\Users\Admin\AppData\Local\Temp\86A.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\8C7.tmp"C:\Users\Admin\AppData\Local\Temp\8C7.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\934.tmp"C:\Users\Admin\AppData\Local\Temp\934.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\9A2.tmp"C:\Users\Admin\AppData\Local\Temp\9A2.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\9F0.tmp"C:\Users\Admin\AppData\Local\Temp\9F0.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\A5D.tmp"C:\Users\Admin\AppData\Local\Temp\A5D.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\ABA.tmp"C:\Users\Admin\AppData\Local\Temp\ABA.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\B18.tmp"C:\Users\Admin\AppData\Local\Temp\B18.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\B76.tmp"C:\Users\Admin\AppData\Local\Temp\B76.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\BD3.tmp"C:\Users\Admin\AppData\Local\Temp\BD3.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\C31.tmp"C:\Users\Admin\AppData\Local\Temp\C31.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\C8E.tmp"C:\Users\Admin\AppData\Local\Temp\C8E.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\CFC.tmp"C:\Users\Admin\AppData\Local\Temp\CFC.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\D4A.tmp"C:\Users\Admin\AppData\Local\Temp\D4A.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\DB7.tmp"C:\Users\Admin\AppData\Local\Temp\DB7.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\E24.tmp"C:\Users\Admin\AppData\Local\Temp\E24.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\E82.tmp"C:\Users\Admin\AppData\Local\Temp\E82.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\ED0.tmp"C:\Users\Admin\AppData\Local\Temp\ED0.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\F2D.tmp"C:\Users\Admin\AppData\Local\Temp\F2D.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\F7B.tmp"C:\Users\Admin\AppData\Local\Temp\F7B.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\FC9.tmp"C:\Users\Admin\AppData\Local\Temp\FC9.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:856 -
C:\Users\Admin\AppData\Local\Temp\1008.tmp"C:\Users\Admin\AppData\Local\Temp\1008.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\1056.tmp"C:\Users\Admin\AppData\Local\Temp\1056.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\10A4.tmp"C:\Users\Admin\AppData\Local\Temp\10A4.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\10E2.tmp"C:\Users\Admin\AppData\Local\Temp\10E2.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\1120.tmp"C:\Users\Admin\AppData\Local\Temp\1120.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\115F.tmp"C:\Users\Admin\AppData\Local\Temp\115F.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:604 -
C:\Users\Admin\AppData\Local\Temp\11AD.tmp"C:\Users\Admin\AppData\Local\Temp\11AD.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:472 -
C:\Users\Admin\AppData\Local\Temp\11FB.tmp"C:\Users\Admin\AppData\Local\Temp\11FB.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\1239.tmp"C:\Users\Admin\AppData\Local\Temp\1239.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\1278.tmp"C:\Users\Admin\AppData\Local\Temp\1278.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:852 -
C:\Users\Admin\AppData\Local\Temp\12B6.tmp"C:\Users\Admin\AppData\Local\Temp\12B6.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\12F4.tmp"C:\Users\Admin\AppData\Local\Temp\12F4.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\1333.tmp"C:\Users\Admin\AppData\Local\Temp\1333.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:692 -
C:\Users\Admin\AppData\Local\Temp\1371.tmp"C:\Users\Admin\AppData\Local\Temp\1371.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\13B0.tmp"C:\Users\Admin\AppData\Local\Temp\13B0.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\13EE.tmp"C:\Users\Admin\AppData\Local\Temp\13EE.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\142C.tmp"C:\Users\Admin\AppData\Local\Temp\142C.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\146B.tmp"C:\Users\Admin\AppData\Local\Temp\146B.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\14A9.tmp"C:\Users\Admin\AppData\Local\Temp\14A9.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:784 -
C:\Users\Admin\AppData\Local\Temp\14E8.tmp"C:\Users\Admin\AppData\Local\Temp\14E8.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\1526.tmp"C:\Users\Admin\AppData\Local\Temp\1526.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\1564.tmp"C:\Users\Admin\AppData\Local\Temp\1564.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\15A3.tmp"C:\Users\Admin\AppData\Local\Temp\15A3.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\15E1.tmp"C:\Users\Admin\AppData\Local\Temp\15E1.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\1620.tmp"C:\Users\Admin\AppData\Local\Temp\1620.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\165E.tmp"C:\Users\Admin\AppData\Local\Temp\165E.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\16AC.tmp"C:\Users\Admin\AppData\Local\Temp\16AC.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:564 -
C:\Users\Admin\AppData\Local\Temp\16EA.tmp"C:\Users\Admin\AppData\Local\Temp\16EA.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\1729.tmp"C:\Users\Admin\AppData\Local\Temp\1729.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:956 -
C:\Users\Admin\AppData\Local\Temp\1767.tmp"C:\Users\Admin\AppData\Local\Temp\1767.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\17A6.tmp"C:\Users\Admin\AppData\Local\Temp\17A6.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\17E4.tmp"C:\Users\Admin\AppData\Local\Temp\17E4.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\1822.tmp"C:\Users\Admin\AppData\Local\Temp\1822.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\1861.tmp"C:\Users\Admin\AppData\Local\Temp\1861.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\189F.tmp"C:\Users\Admin\AppData\Local\Temp\189F.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\18DE.tmp"C:\Users\Admin\AppData\Local\Temp\18DE.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\191C.tmp"C:\Users\Admin\AppData\Local\Temp\191C.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\196A.tmp"C:\Users\Admin\AppData\Local\Temp\196A.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\19B8.tmp"C:\Users\Admin\AppData\Local\Temp\19B8.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\19F6.tmp"C:\Users\Admin\AppData\Local\Temp\19F6.tmp"65⤵
- Executes dropped EXE
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\1A64.tmp"C:\Users\Admin\AppData\Local\Temp\1A64.tmp"66⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"67⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\1AE0.tmp"C:\Users\Admin\AppData\Local\Temp\1AE0.tmp"68⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"69⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"70⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"71⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\1BF9.tmp"C:\Users\Admin\AppData\Local\Temp\1BF9.tmp"72⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\1C38.tmp"C:\Users\Admin\AppData\Local\Temp\1C38.tmp"73⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\1C76.tmp"C:\Users\Admin\AppData\Local\Temp\1C76.tmp"74⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\1CB4.tmp"C:\Users\Admin\AppData\Local\Temp\1CB4.tmp"75⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"76⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\1D31.tmp"C:\Users\Admin\AppData\Local\Temp\1D31.tmp"77⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"78⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"79⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"80⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\1E4A.tmp"C:\Users\Admin\AppData\Local\Temp\1E4A.tmp"81⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\1E88.tmp"C:\Users\Admin\AppData\Local\Temp\1E88.tmp"82⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"83⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\1F05.tmp"C:\Users\Admin\AppData\Local\Temp\1F05.tmp"84⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\1F53.tmp"C:\Users\Admin\AppData\Local\Temp\1F53.tmp"85⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\1F92.tmp"C:\Users\Admin\AppData\Local\Temp\1F92.tmp"86⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"87⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\200E.tmp"C:\Users\Admin\AppData\Local\Temp\200E.tmp"88⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\205C.tmp"C:\Users\Admin\AppData\Local\Temp\205C.tmp"89⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\209B.tmp"C:\Users\Admin\AppData\Local\Temp\209B.tmp"90⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\20D9.tmp"C:\Users\Admin\AppData\Local\Temp\20D9.tmp"91⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\2118.tmp"C:\Users\Admin\AppData\Local\Temp\2118.tmp"92⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\2156.tmp"C:\Users\Admin\AppData\Local\Temp\2156.tmp"93⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\2194.tmp"C:\Users\Admin\AppData\Local\Temp\2194.tmp"94⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\21D3.tmp"C:\Users\Admin\AppData\Local\Temp\21D3.tmp"95⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\2211.tmp"C:\Users\Admin\AppData\Local\Temp\2211.tmp"96⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\2250.tmp"C:\Users\Admin\AppData\Local\Temp\2250.tmp"97⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\228E.tmp"C:\Users\Admin\AppData\Local\Temp\228E.tmp"98⤵PID:604
-
C:\Users\Admin\AppData\Local\Temp\22CC.tmp"C:\Users\Admin\AppData\Local\Temp\22CC.tmp"99⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\230B.tmp"C:\Users\Admin\AppData\Local\Temp\230B.tmp"100⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\2349.tmp"C:\Users\Admin\AppData\Local\Temp\2349.tmp"101⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\2388.tmp"C:\Users\Admin\AppData\Local\Temp\2388.tmp"102⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\23C6.tmp"C:\Users\Admin\AppData\Local\Temp\23C6.tmp"103⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\2404.tmp"C:\Users\Admin\AppData\Local\Temp\2404.tmp"104⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\2443.tmp"C:\Users\Admin\AppData\Local\Temp\2443.tmp"105⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\2481.tmp"C:\Users\Admin\AppData\Local\Temp\2481.tmp"106⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\24C0.tmp"C:\Users\Admin\AppData\Local\Temp\24C0.tmp"107⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\24FE.tmp"C:\Users\Admin\AppData\Local\Temp\24FE.tmp"108⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\253C.tmp"C:\Users\Admin\AppData\Local\Temp\253C.tmp"109⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\258A.tmp"C:\Users\Admin\AppData\Local\Temp\258A.tmp"110⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\25D8.tmp"C:\Users\Admin\AppData\Local\Temp\25D8.tmp"111⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"112⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\2655.tmp"C:\Users\Admin\AppData\Local\Temp\2655.tmp"113⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\2694.tmp"C:\Users\Admin\AppData\Local\Temp\2694.tmp"114⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\26E2.tmp"C:\Users\Admin\AppData\Local\Temp\26E2.tmp"115⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\2720.tmp"C:\Users\Admin\AppData\Local\Temp\2720.tmp"116⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\275E.tmp"C:\Users\Admin\AppData\Local\Temp\275E.tmp"117⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\27AC.tmp"C:\Users\Admin\AppData\Local\Temp\27AC.tmp"118⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\27EB.tmp"C:\Users\Admin\AppData\Local\Temp\27EB.tmp"119⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\2829.tmp"C:\Users\Admin\AppData\Local\Temp\2829.tmp"120⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\2868.tmp"C:\Users\Admin\AppData\Local\Temp\2868.tmp"121⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\28A6.tmp"C:\Users\Admin\AppData\Local\Temp\28A6.tmp"122⤵PID:1600
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-