Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20/04/2024, 12:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-20_4592a18e46b6995010fa9a209d24d0ab_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-20_4592a18e46b6995010fa9a209d24d0ab_mafia.exe
Resource
win10v2004-20240412-en
2 signatures
150 seconds
General
-
Target
2024-04-20_4592a18e46b6995010fa9a209d24d0ab_mafia.exe
-
Size
530KB
-
MD5
4592a18e46b6995010fa9a209d24d0ab
-
SHA1
ff3c28d3cabcfac90271dca435322e26b3e80956
-
SHA256
11fe16ef6d7284d14daaf8fa0dcfd905215c6631e899c33cb293585d1fd39232
-
SHA512
7a8802e30b495b26064928ec8ca2372819e022bc8966e5fd02f50139b76b432933bda8df949ae9a42a132f7cee3603f8dc003ce40756e7546719de4058f4703e
-
SSDEEP
12288:AU5rCOTeio3Hm3LA1+vvhB/WG2V8sxqZIEocoNZulFVg0M1:AUQOJo3m3kIvvh52VXqkRNclFV/M1
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 380 17F4.tmp 2484 1851.tmp 2496 18BE.tmp 2676 191C.tmp 2772 1989.tmp 2992 19F6.tmp 2616 1A54.tmp 2560 1AB2.tmp 2388 1B00.tmp 2464 1B6D.tmp 2876 1BCA.tmp 2204 1C28.tmp 2736 1C86.tmp 2840 1CE3.tmp 1604 1D50.tmp 1668 1DBE.tmp 1616 1E2B.tmp 1812 1E88.tmp 1516 1EE6.tmp 2444 1F53.tmp 1480 1FB1.tmp 1608 200E.tmp 1724 205C.tmp 2240 209B.tmp 3016 20D9.tmp 2272 2118.tmp 2752 2166.tmp 2012 21A4.tmp 2024 21E2.tmp 384 2221.tmp 1428 226F.tmp 2376 22AD.tmp 840 22FB.tmp 1840 2349.tmp 648 2397.tmp 3068 23D6.tmp 704 2414.tmp 2352 2462.tmp 3008 24B0.tmp 772 24EE.tmp 1472 253C.tmp 1708 257B.tmp 784 25B9.tmp 3020 25F8.tmp 2368 2636.tmp 1784 2674.tmp 1240 26B3.tmp 1796 26F1.tmp 1960 2730.tmp 2356 276E.tmp 1192 27AC.tmp 3004 27EB.tmp 880 2829.tmp 1456 2868.tmp 2312 28B6.tmp 2952 2932.tmp 2980 2971.tmp 3036 29AF.tmp 2484 29EE.tmp 2580 2A2C.tmp 2540 2A6A.tmp 2676 2AA9.tmp 2704 2AE7.tmp 2552 2B26.tmp -
Loads dropped DLL 64 IoCs
pid Process 2952 2024-04-20_4592a18e46b6995010fa9a209d24d0ab_mafia.exe 380 17F4.tmp 2484 1851.tmp 2496 18BE.tmp 2676 191C.tmp 2772 1989.tmp 2992 19F6.tmp 2616 1A54.tmp 2560 1AB2.tmp 2388 1B00.tmp 2464 1B6D.tmp 2876 1BCA.tmp 2204 1C28.tmp 2736 1C86.tmp 2840 1CE3.tmp 1604 1D50.tmp 1668 1DBE.tmp 1616 1E2B.tmp 1812 1E88.tmp 1516 1EE6.tmp 2444 1F53.tmp 1480 1FB1.tmp 1608 200E.tmp 1724 205C.tmp 2240 209B.tmp 3016 20D9.tmp 2272 2118.tmp 2752 2166.tmp 2012 21A4.tmp 2024 21E2.tmp 384 2221.tmp 1428 226F.tmp 2376 22AD.tmp 840 22FB.tmp 1840 2349.tmp 648 2397.tmp 3068 23D6.tmp 704 2414.tmp 2352 2462.tmp 3008 24B0.tmp 772 24EE.tmp 1472 253C.tmp 1708 257B.tmp 784 25B9.tmp 3020 25F8.tmp 2368 2636.tmp 1784 2674.tmp 1240 26B3.tmp 1796 26F1.tmp 1960 2730.tmp 2356 276E.tmp 1192 27AC.tmp 3004 27EB.tmp 880 2829.tmp 1456 2868.tmp 1644 28F4.tmp 2952 2932.tmp 2980 2971.tmp 3036 29AF.tmp 2484 29EE.tmp 2580 2A2C.tmp 2540 2A6A.tmp 2676 2AA9.tmp 2704 2AE7.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2952 wrote to memory of 380 2952 2024-04-20_4592a18e46b6995010fa9a209d24d0ab_mafia.exe 28 PID 2952 wrote to memory of 380 2952 2024-04-20_4592a18e46b6995010fa9a209d24d0ab_mafia.exe 28 PID 2952 wrote to memory of 380 2952 2024-04-20_4592a18e46b6995010fa9a209d24d0ab_mafia.exe 28 PID 2952 wrote to memory of 380 2952 2024-04-20_4592a18e46b6995010fa9a209d24d0ab_mafia.exe 28 PID 380 wrote to memory of 2484 380 17F4.tmp 29 PID 380 wrote to memory of 2484 380 17F4.tmp 29 PID 380 wrote to memory of 2484 380 17F4.tmp 29 PID 380 wrote to memory of 2484 380 17F4.tmp 29 PID 2484 wrote to memory of 2496 2484 1851.tmp 30 PID 2484 wrote to memory of 2496 2484 1851.tmp 30 PID 2484 wrote to memory of 2496 2484 1851.tmp 30 PID 2484 wrote to memory of 2496 2484 1851.tmp 30 PID 2496 wrote to memory of 2676 2496 18BE.tmp 31 PID 2496 wrote to memory of 2676 2496 18BE.tmp 31 PID 2496 wrote to memory of 2676 2496 18BE.tmp 31 PID 2496 wrote to memory of 2676 2496 18BE.tmp 31 PID 2676 wrote to memory of 2772 2676 191C.tmp 32 PID 2676 wrote to memory of 2772 2676 191C.tmp 32 PID 2676 wrote to memory of 2772 2676 191C.tmp 32 PID 2676 wrote to memory of 2772 2676 191C.tmp 32 PID 2772 wrote to memory of 2992 2772 1989.tmp 33 PID 2772 wrote to memory of 2992 2772 1989.tmp 33 PID 2772 wrote to memory of 2992 2772 1989.tmp 33 PID 2772 wrote to memory of 2992 2772 1989.tmp 33 PID 2992 wrote to memory of 2616 2992 19F6.tmp 34 PID 2992 wrote to memory of 2616 2992 19F6.tmp 34 PID 2992 wrote to memory of 2616 2992 19F6.tmp 34 PID 2992 wrote to memory of 2616 2992 19F6.tmp 34 PID 2616 wrote to memory of 2560 2616 1A54.tmp 35 PID 2616 wrote to memory of 2560 2616 1A54.tmp 35 PID 2616 wrote to memory of 2560 2616 1A54.tmp 35 PID 2616 wrote to memory of 2560 2616 1A54.tmp 35 PID 2560 wrote to memory of 2388 2560 1AB2.tmp 36 PID 2560 wrote to memory of 2388 2560 1AB2.tmp 36 PID 2560 wrote to memory of 2388 2560 1AB2.tmp 36 PID 2560 wrote to memory of 2388 2560 1AB2.tmp 36 PID 2388 wrote to memory of 2464 2388 1B00.tmp 37 PID 2388 wrote to memory of 2464 2388 1B00.tmp 37 PID 2388 wrote to memory of 2464 2388 1B00.tmp 37 PID 2388 wrote to memory of 2464 2388 1B00.tmp 37 PID 2464 wrote to memory of 2876 2464 1B6D.tmp 38 PID 2464 wrote to memory of 2876 2464 1B6D.tmp 38 PID 2464 wrote to memory of 2876 2464 1B6D.tmp 38 PID 2464 wrote to memory of 2876 2464 1B6D.tmp 38 PID 2876 wrote to memory of 2204 2876 1BCA.tmp 39 PID 2876 wrote to memory of 2204 2876 1BCA.tmp 39 PID 2876 wrote to memory of 2204 2876 1BCA.tmp 39 PID 2876 wrote to memory of 2204 2876 1BCA.tmp 39 PID 2204 wrote to memory of 2736 2204 1C28.tmp 40 PID 2204 wrote to memory of 2736 2204 1C28.tmp 40 PID 2204 wrote to memory of 2736 2204 1C28.tmp 40 PID 2204 wrote to memory of 2736 2204 1C28.tmp 40 PID 2736 wrote to memory of 2840 2736 1C86.tmp 41 PID 2736 wrote to memory of 2840 2736 1C86.tmp 41 PID 2736 wrote to memory of 2840 2736 1C86.tmp 41 PID 2736 wrote to memory of 2840 2736 1C86.tmp 41 PID 2840 wrote to memory of 1604 2840 1CE3.tmp 42 PID 2840 wrote to memory of 1604 2840 1CE3.tmp 42 PID 2840 wrote to memory of 1604 2840 1CE3.tmp 42 PID 2840 wrote to memory of 1604 2840 1CE3.tmp 42 PID 1604 wrote to memory of 1668 1604 1D50.tmp 43 PID 1604 wrote to memory of 1668 1604 1D50.tmp 43 PID 1604 wrote to memory of 1668 1604 1D50.tmp 43 PID 1604 wrote to memory of 1668 1604 1D50.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-20_4592a18e46b6995010fa9a209d24d0ab_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-20_4592a18e46b6995010fa9a209d24d0ab_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\17F4.tmp"C:\Users\Admin\AppData\Local\Temp\17F4.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Users\Admin\AppData\Local\Temp\1851.tmp"C:\Users\Admin\AppData\Local\Temp\1851.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\18BE.tmp"C:\Users\Admin\AppData\Local\Temp\18BE.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\191C.tmp"C:\Users\Admin\AppData\Local\Temp\191C.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\1989.tmp"C:\Users\Admin\AppData\Local\Temp\1989.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\19F6.tmp"C:\Users\Admin\AppData\Local\Temp\19F6.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\1A54.tmp"C:\Users\Admin\AppData\Local\Temp\1A54.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\1B00.tmp"C:\Users\Admin\AppData\Local\Temp\1B00.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\1B6D.tmp"C:\Users\Admin\AppData\Local\Temp\1B6D.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\1C28.tmp"C:\Users\Admin\AppData\Local\Temp\1C28.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\1C86.tmp"C:\Users\Admin\AppData\Local\Temp\1C86.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\1D50.tmp"C:\Users\Admin\AppData\Local\Temp\1D50.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\1E88.tmp"C:\Users\Admin\AppData\Local\Temp\1E88.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\1EE6.tmp"C:\Users\Admin\AppData\Local\Temp\1EE6.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\1F53.tmp"C:\Users\Admin\AppData\Local\Temp\1F53.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\200E.tmp"C:\Users\Admin\AppData\Local\Temp\200E.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\205C.tmp"C:\Users\Admin\AppData\Local\Temp\205C.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\209B.tmp"C:\Users\Admin\AppData\Local\Temp\209B.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\20D9.tmp"C:\Users\Admin\AppData\Local\Temp\20D9.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\2118.tmp"C:\Users\Admin\AppData\Local\Temp\2118.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\2166.tmp"C:\Users\Admin\AppData\Local\Temp\2166.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\21A4.tmp"C:\Users\Admin\AppData\Local\Temp\21A4.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\21E2.tmp"C:\Users\Admin\AppData\Local\Temp\21E2.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\2221.tmp"C:\Users\Admin\AppData\Local\Temp\2221.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:384 -
C:\Users\Admin\AppData\Local\Temp\226F.tmp"C:\Users\Admin\AppData\Local\Temp\226F.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\22AD.tmp"C:\Users\Admin\AppData\Local\Temp\22AD.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\22FB.tmp"C:\Users\Admin\AppData\Local\Temp\22FB.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:840 -
C:\Users\Admin\AppData\Local\Temp\2349.tmp"C:\Users\Admin\AppData\Local\Temp\2349.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\2397.tmp"C:\Users\Admin\AppData\Local\Temp\2397.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:648 -
C:\Users\Admin\AppData\Local\Temp\23D6.tmp"C:\Users\Admin\AppData\Local\Temp\23D6.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\2414.tmp"C:\Users\Admin\AppData\Local\Temp\2414.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:704 -
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\24B0.tmp"C:\Users\Admin\AppData\Local\Temp\24B0.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\24EE.tmp"C:\Users\Admin\AppData\Local\Temp\24EE.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:772 -
C:\Users\Admin\AppData\Local\Temp\253C.tmp"C:\Users\Admin\AppData\Local\Temp\253C.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\257B.tmp"C:\Users\Admin\AppData\Local\Temp\257B.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\25B9.tmp"C:\Users\Admin\AppData\Local\Temp\25B9.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:784 -
C:\Users\Admin\AppData\Local\Temp\25F8.tmp"C:\Users\Admin\AppData\Local\Temp\25F8.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\2636.tmp"C:\Users\Admin\AppData\Local\Temp\2636.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\2674.tmp"C:\Users\Admin\AppData\Local\Temp\2674.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\26B3.tmp"C:\Users\Admin\AppData\Local\Temp\26B3.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\26F1.tmp"C:\Users\Admin\AppData\Local\Temp\26F1.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\2730.tmp"C:\Users\Admin\AppData\Local\Temp\2730.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\276E.tmp"C:\Users\Admin\AppData\Local\Temp\276E.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\27AC.tmp"C:\Users\Admin\AppData\Local\Temp\27AC.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\27EB.tmp"C:\Users\Admin\AppData\Local\Temp\27EB.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\2829.tmp"C:\Users\Admin\AppData\Local\Temp\2829.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:880 -
C:\Users\Admin\AppData\Local\Temp\2868.tmp"C:\Users\Admin\AppData\Local\Temp\2868.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\28B6.tmp"C:\Users\Admin\AppData\Local\Temp\28B6.tmp"56⤵
- Executes dropped EXE
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\28F4.tmp"C:\Users\Admin\AppData\Local\Temp\28F4.tmp"57⤵
- Loads dropped DLL
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\2932.tmp"C:\Users\Admin\AppData\Local\Temp\2932.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\2971.tmp"C:\Users\Admin\AppData\Local\Temp\2971.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\29AF.tmp"C:\Users\Admin\AppData\Local\Temp\29AF.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\29EE.tmp"C:\Users\Admin\AppData\Local\Temp\29EE.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\2B26.tmp"C:\Users\Admin\AppData\Local\Temp\2B26.tmp"66⤵
- Executes dropped EXE
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\2B64.tmp"C:\Users\Admin\AppData\Local\Temp\2B64.tmp"67⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"68⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"69⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"70⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"71⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"72⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"73⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\2D28.tmp"C:\Users\Admin\AppData\Local\Temp\2D28.tmp"74⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\2D67.tmp"C:\Users\Admin\AppData\Local\Temp\2D67.tmp"75⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"76⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"77⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\2E22.tmp"C:\Users\Admin\AppData\Local\Temp\2E22.tmp"78⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\2E70.tmp"C:\Users\Admin\AppData\Local\Temp\2E70.tmp"79⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"80⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\2EED.tmp"C:\Users\Admin\AppData\Local\Temp\2EED.tmp"81⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"82⤵PID:472
-
C:\Users\Admin\AppData\Local\Temp\2F6A.tmp"C:\Users\Admin\AppData\Local\Temp\2F6A.tmp"83⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"84⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"85⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\3025.tmp"C:\Users\Admin\AppData\Local\Temp\3025.tmp"86⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\3063.tmp"C:\Users\Admin\AppData\Local\Temp\3063.tmp"87⤵PID:284
-
C:\Users\Admin\AppData\Local\Temp\30A2.tmp"C:\Users\Admin\AppData\Local\Temp\30A2.tmp"88⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\30E0.tmp"C:\Users\Admin\AppData\Local\Temp\30E0.tmp"89⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\311E.tmp"C:\Users\Admin\AppData\Local\Temp\311E.tmp"90⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\315D.tmp"C:\Users\Admin\AppData\Local\Temp\315D.tmp"91⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\319B.tmp"C:\Users\Admin\AppData\Local\Temp\319B.tmp"92⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\31DA.tmp"C:\Users\Admin\AppData\Local\Temp\31DA.tmp"93⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\3218.tmp"C:\Users\Admin\AppData\Local\Temp\3218.tmp"94⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"95⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\32A4.tmp"C:\Users\Admin\AppData\Local\Temp\32A4.tmp"96⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\32E3.tmp"C:\Users\Admin\AppData\Local\Temp\32E3.tmp"97⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\3321.tmp"C:\Users\Admin\AppData\Local\Temp\3321.tmp"98⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\336F.tmp"C:\Users\Admin\AppData\Local\Temp\336F.tmp"99⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\33AE.tmp"C:\Users\Admin\AppData\Local\Temp\33AE.tmp"100⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\33EC.tmp"C:\Users\Admin\AppData\Local\Temp\33EC.tmp"101⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\342A.tmp"C:\Users\Admin\AppData\Local\Temp\342A.tmp"102⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\3469.tmp"C:\Users\Admin\AppData\Local\Temp\3469.tmp"103⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\34A7.tmp"C:\Users\Admin\AppData\Local\Temp\34A7.tmp"104⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\34E6.tmp"C:\Users\Admin\AppData\Local\Temp\34E6.tmp"105⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\3524.tmp"C:\Users\Admin\AppData\Local\Temp\3524.tmp"106⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\3562.tmp"C:\Users\Admin\AppData\Local\Temp\3562.tmp"107⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\35A1.tmp"C:\Users\Admin\AppData\Local\Temp\35A1.tmp"108⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\35DF.tmp"C:\Users\Admin\AppData\Local\Temp\35DF.tmp"109⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\361E.tmp"C:\Users\Admin\AppData\Local\Temp\361E.tmp"110⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\364C.tmp"C:\Users\Admin\AppData\Local\Temp\364C.tmp"111⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\368B.tmp"C:\Users\Admin\AppData\Local\Temp\368B.tmp"112⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\36C9.tmp"C:\Users\Admin\AppData\Local\Temp\36C9.tmp"113⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\3708.tmp"C:\Users\Admin\AppData\Local\Temp\3708.tmp"114⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\3756.tmp"C:\Users\Admin\AppData\Local\Temp\3756.tmp"115⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\3794.tmp"C:\Users\Admin\AppData\Local\Temp\3794.tmp"116⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\37D2.tmp"C:\Users\Admin\AppData\Local\Temp\37D2.tmp"117⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\3820.tmp"C:\Users\Admin\AppData\Local\Temp\3820.tmp"118⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\385F.tmp"C:\Users\Admin\AppData\Local\Temp\385F.tmp"119⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\389D.tmp"C:\Users\Admin\AppData\Local\Temp\389D.tmp"120⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\38DC.tmp"C:\Users\Admin\AppData\Local\Temp\38DC.tmp"121⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\391A.tmp"C:\Users\Admin\AppData\Local\Temp\391A.tmp"122⤵PID:2104
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-