Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
25-04-2024 04:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-25_54a245d35e26e1a920ab243e739692db_mafia.exe
Resource
win7-20240220-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-25_54a245d35e26e1a920ab243e739692db_mafia.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-04-25_54a245d35e26e1a920ab243e739692db_mafia.exe
-
Size
520KB
-
MD5
54a245d35e26e1a920ab243e739692db
-
SHA1
b63afcdb76517e61a524594efe17afbdb0fb82f0
-
SHA256
be3b1890e4943e27e7230152cf84a1934313a14b96252aa786f9155b0b67ef22
-
SHA512
fbd6b1a5cc0b0750cd00e35488152cd7cec3e2ff30069e33f7755b46a7260d784e86a9b5fda027ebed388df58e13afe4f3a52618d4c6725d2757d23311531701
-
SSDEEP
12288:gj8fuxR21t5i8ffcUDqCucxW3UgEm6NZ:gj8fuK1GYEUD9u6aUgEm6N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2032 16EA.tmp 2968 1748.tmp 2604 1796.tmp 2724 17F4.tmp 2844 1851.tmp 2624 189F.tmp 2656 18FD.tmp 2664 195A.tmp 2416 1999.tmp 2784 19F6.tmp 876 1A54.tmp 2276 1AC1.tmp 1716 1B1F.tmp 2372 1B8C.tmp 2564 1BEA.tmp 2284 1C57.tmp 1588 1CB4.tmp 768 1D12.tmp 304 1D70.tmp 1820 1DCD.tmp 3016 1E1B.tmp 1544 1E88.tmp 1720 1ED6.tmp 1236 1F15.tmp 3024 1F63.tmp 2480 1FC0.tmp 2364 1FFF.tmp 1784 203D.tmp 2076 207C.tmp 688 20CA.tmp 1416 2108.tmp 588 2146.tmp 868 2185.tmp 1276 21D3.tmp 1252 2211.tmp 696 2250.tmp 2776 228E.tmp 456 22CC.tmp 1152 230B.tmp 2960 2349.tmp 1792 2388.tmp 1788 23C6.tmp 1324 2404.tmp 1676 2443.tmp 1688 2491.tmp 612 24CF.tmp 2024 250E.tmp 2268 254C.tmp 2948 259A.tmp 2044 25D8.tmp 608 2617.tmp 3012 2655.tmp 1428 2694.tmp 2464 26D2.tmp 2004 2710.tmp 1528 274F.tmp 2576 278D.tmp 2860 27CC.tmp 2900 280A.tmp 2608 2848.tmp 2540 2887.tmp 2512 28C5.tmp 2544 2904.tmp 1352 2942.tmp -
Loads dropped DLL 64 IoCs
pid Process 1780 2024-04-25_54a245d35e26e1a920ab243e739692db_mafia.exe 2032 16EA.tmp 2968 1748.tmp 2604 1796.tmp 2724 17F4.tmp 2844 1851.tmp 2624 189F.tmp 2656 18FD.tmp 2664 195A.tmp 2416 1999.tmp 2784 19F6.tmp 876 1A54.tmp 2276 1AC1.tmp 1716 1B1F.tmp 2372 1B8C.tmp 2564 1BEA.tmp 2284 1C57.tmp 1588 1CB4.tmp 768 1D12.tmp 304 1D70.tmp 1820 1DCD.tmp 3016 1E1B.tmp 1544 1E88.tmp 1720 1ED6.tmp 1236 1F15.tmp 3024 1F63.tmp 2480 1FC0.tmp 2364 1FFF.tmp 1784 203D.tmp 2076 207C.tmp 688 20CA.tmp 1416 2108.tmp 588 2146.tmp 868 2185.tmp 1276 21D3.tmp 1252 2211.tmp 696 2250.tmp 2776 228E.tmp 456 22CC.tmp 1152 230B.tmp 2960 2349.tmp 1792 2388.tmp 1788 23C6.tmp 1324 2404.tmp 1676 2443.tmp 1688 2491.tmp 612 24CF.tmp 2024 250E.tmp 2268 254C.tmp 2948 259A.tmp 2044 25D8.tmp 608 2617.tmp 3012 2655.tmp 1428 2694.tmp 2464 26D2.tmp 2004 2710.tmp 1528 274F.tmp 2576 278D.tmp 2860 27CC.tmp 2900 280A.tmp 2608 2848.tmp 2540 2887.tmp 2512 28C5.tmp 2544 2904.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1780 wrote to memory of 2032 1780 2024-04-25_54a245d35e26e1a920ab243e739692db_mafia.exe 28 PID 1780 wrote to memory of 2032 1780 2024-04-25_54a245d35e26e1a920ab243e739692db_mafia.exe 28 PID 1780 wrote to memory of 2032 1780 2024-04-25_54a245d35e26e1a920ab243e739692db_mafia.exe 28 PID 1780 wrote to memory of 2032 1780 2024-04-25_54a245d35e26e1a920ab243e739692db_mafia.exe 28 PID 2032 wrote to memory of 2968 2032 16EA.tmp 29 PID 2032 wrote to memory of 2968 2032 16EA.tmp 29 PID 2032 wrote to memory of 2968 2032 16EA.tmp 29 PID 2032 wrote to memory of 2968 2032 16EA.tmp 29 PID 2968 wrote to memory of 2604 2968 1748.tmp 30 PID 2968 wrote to memory of 2604 2968 1748.tmp 30 PID 2968 wrote to memory of 2604 2968 1748.tmp 30 PID 2968 wrote to memory of 2604 2968 1748.tmp 30 PID 2604 wrote to memory of 2724 2604 1796.tmp 31 PID 2604 wrote to memory of 2724 2604 1796.tmp 31 PID 2604 wrote to memory of 2724 2604 1796.tmp 31 PID 2604 wrote to memory of 2724 2604 1796.tmp 31 PID 2724 wrote to memory of 2844 2724 17F4.tmp 32 PID 2724 wrote to memory of 2844 2724 17F4.tmp 32 PID 2724 wrote to memory of 2844 2724 17F4.tmp 32 PID 2724 wrote to memory of 2844 2724 17F4.tmp 32 PID 2844 wrote to memory of 2624 2844 1851.tmp 33 PID 2844 wrote to memory of 2624 2844 1851.tmp 33 PID 2844 wrote to memory of 2624 2844 1851.tmp 33 PID 2844 wrote to memory of 2624 2844 1851.tmp 33 PID 2624 wrote to memory of 2656 2624 189F.tmp 34 PID 2624 wrote to memory of 2656 2624 189F.tmp 34 PID 2624 wrote to memory of 2656 2624 189F.tmp 34 PID 2624 wrote to memory of 2656 2624 189F.tmp 34 PID 2656 wrote to memory of 2664 2656 18FD.tmp 35 PID 2656 wrote to memory of 2664 2656 18FD.tmp 35 PID 2656 wrote to memory of 2664 2656 18FD.tmp 35 PID 2656 wrote to memory of 2664 2656 18FD.tmp 35 PID 2664 wrote to memory of 2416 2664 195A.tmp 36 PID 2664 wrote to memory of 2416 2664 195A.tmp 36 PID 2664 wrote to memory of 2416 2664 195A.tmp 36 PID 2664 wrote to memory of 2416 2664 195A.tmp 36 PID 2416 wrote to memory of 2784 2416 1999.tmp 37 PID 2416 wrote to memory of 2784 2416 1999.tmp 37 PID 2416 wrote to memory of 2784 2416 1999.tmp 37 PID 2416 wrote to memory of 2784 2416 1999.tmp 37 PID 2784 wrote to memory of 876 2784 19F6.tmp 38 PID 2784 wrote to memory of 876 2784 19F6.tmp 38 PID 2784 wrote to memory of 876 2784 19F6.tmp 38 PID 2784 wrote to memory of 876 2784 19F6.tmp 38 PID 876 wrote to memory of 2276 876 1A54.tmp 39 PID 876 wrote to memory of 2276 876 1A54.tmp 39 PID 876 wrote to memory of 2276 876 1A54.tmp 39 PID 876 wrote to memory of 2276 876 1A54.tmp 39 PID 2276 wrote to memory of 1716 2276 1AC1.tmp 40 PID 2276 wrote to memory of 1716 2276 1AC1.tmp 40 PID 2276 wrote to memory of 1716 2276 1AC1.tmp 40 PID 2276 wrote to memory of 1716 2276 1AC1.tmp 40 PID 1716 wrote to memory of 2372 1716 1B1F.tmp 41 PID 1716 wrote to memory of 2372 1716 1B1F.tmp 41 PID 1716 wrote to memory of 2372 1716 1B1F.tmp 41 PID 1716 wrote to memory of 2372 1716 1B1F.tmp 41 PID 2372 wrote to memory of 2564 2372 1B8C.tmp 42 PID 2372 wrote to memory of 2564 2372 1B8C.tmp 42 PID 2372 wrote to memory of 2564 2372 1B8C.tmp 42 PID 2372 wrote to memory of 2564 2372 1B8C.tmp 42 PID 2564 wrote to memory of 2284 2564 1BEA.tmp 43 PID 2564 wrote to memory of 2284 2564 1BEA.tmp 43 PID 2564 wrote to memory of 2284 2564 1BEA.tmp 43 PID 2564 wrote to memory of 2284 2564 1BEA.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_54a245d35e26e1a920ab243e739692db_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-25_54a245d35e26e1a920ab243e739692db_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\16EA.tmp"C:\Users\Admin\AppData\Local\Temp\16EA.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\1748.tmp"C:\Users\Admin\AppData\Local\Temp\1748.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\1796.tmp"C:\Users\Admin\AppData\Local\Temp\1796.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\17F4.tmp"C:\Users\Admin\AppData\Local\Temp\17F4.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\1851.tmp"C:\Users\Admin\AppData\Local\Temp\1851.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\189F.tmp"C:\Users\Admin\AppData\Local\Temp\189F.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\18FD.tmp"C:\Users\Admin\AppData\Local\Temp\18FD.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\195A.tmp"C:\Users\Admin\AppData\Local\Temp\195A.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\1999.tmp"C:\Users\Admin\AppData\Local\Temp\1999.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\19F6.tmp"C:\Users\Admin\AppData\Local\Temp\19F6.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\1A54.tmp"C:\Users\Admin\AppData\Local\Temp\1A54.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\1B8C.tmp"C:\Users\Admin\AppData\Local\Temp\1B8C.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\1BEA.tmp"C:\Users\Admin\AppData\Local\Temp\1BEA.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\1C57.tmp"C:\Users\Admin\AppData\Local\Temp\1C57.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\1CB4.tmp"C:\Users\Admin\AppData\Local\Temp\1CB4.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\1D12.tmp"C:\Users\Admin\AppData\Local\Temp\1D12.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:768 -
C:\Users\Admin\AppData\Local\Temp\1D70.tmp"C:\Users\Admin\AppData\Local\Temp\1D70.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:304 -
C:\Users\Admin\AppData\Local\Temp\1DCD.tmp"C:\Users\Admin\AppData\Local\Temp\1DCD.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\1E88.tmp"C:\Users\Admin\AppData\Local\Temp\1E88.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\1F15.tmp"C:\Users\Admin\AppData\Local\Temp\1F15.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\1F63.tmp"C:\Users\Admin\AppData\Local\Temp\1F63.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\203D.tmp"C:\Users\Admin\AppData\Local\Temp\203D.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\207C.tmp"C:\Users\Admin\AppData\Local\Temp\207C.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\20CA.tmp"C:\Users\Admin\AppData\Local\Temp\20CA.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:688 -
C:\Users\Admin\AppData\Local\Temp\2108.tmp"C:\Users\Admin\AppData\Local\Temp\2108.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\2146.tmp"C:\Users\Admin\AppData\Local\Temp\2146.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:588 -
C:\Users\Admin\AppData\Local\Temp\2185.tmp"C:\Users\Admin\AppData\Local\Temp\2185.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:868 -
C:\Users\Admin\AppData\Local\Temp\21D3.tmp"C:\Users\Admin\AppData\Local\Temp\21D3.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\2211.tmp"C:\Users\Admin\AppData\Local\Temp\2211.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\2250.tmp"C:\Users\Admin\AppData\Local\Temp\2250.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:696 -
C:\Users\Admin\AppData\Local\Temp\228E.tmp"C:\Users\Admin\AppData\Local\Temp\228E.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\22CC.tmp"C:\Users\Admin\AppData\Local\Temp\22CC.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:456 -
C:\Users\Admin\AppData\Local\Temp\230B.tmp"C:\Users\Admin\AppData\Local\Temp\230B.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\2349.tmp"C:\Users\Admin\AppData\Local\Temp\2349.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\2388.tmp"C:\Users\Admin\AppData\Local\Temp\2388.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\23C6.tmp"C:\Users\Admin\AppData\Local\Temp\23C6.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\2404.tmp"C:\Users\Admin\AppData\Local\Temp\2404.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\2443.tmp"C:\Users\Admin\AppData\Local\Temp\2443.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\2491.tmp"C:\Users\Admin\AppData\Local\Temp\2491.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\24CF.tmp"C:\Users\Admin\AppData\Local\Temp\24CF.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:612 -
C:\Users\Admin\AppData\Local\Temp\250E.tmp"C:\Users\Admin\AppData\Local\Temp\250E.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\254C.tmp"C:\Users\Admin\AppData\Local\Temp\254C.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\259A.tmp"C:\Users\Admin\AppData\Local\Temp\259A.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\25D8.tmp"C:\Users\Admin\AppData\Local\Temp\25D8.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:608 -
C:\Users\Admin\AppData\Local\Temp\2655.tmp"C:\Users\Admin\AppData\Local\Temp\2655.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\2694.tmp"C:\Users\Admin\AppData\Local\Temp\2694.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\26D2.tmp"C:\Users\Admin\AppData\Local\Temp\26D2.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\2710.tmp"C:\Users\Admin\AppData\Local\Temp\2710.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\274F.tmp"C:\Users\Admin\AppData\Local\Temp\274F.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\278D.tmp"C:\Users\Admin\AppData\Local\Temp\278D.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\27CC.tmp"C:\Users\Admin\AppData\Local\Temp\27CC.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\2848.tmp"C:\Users\Admin\AppData\Local\Temp\2848.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\2887.tmp"C:\Users\Admin\AppData\Local\Temp\2887.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\28C5.tmp"C:\Users\Admin\AppData\Local\Temp\28C5.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\2904.tmp"C:\Users\Admin\AppData\Local\Temp\2904.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\2942.tmp"C:\Users\Admin\AppData\Local\Temp\2942.tmp"65⤵
- Executes dropped EXE
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\2980.tmp"C:\Users\Admin\AppData\Local\Temp\2980.tmp"66⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\29BF.tmp"C:\Users\Admin\AppData\Local\Temp\29BF.tmp"67⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\29FD.tmp"C:\Users\Admin\AppData\Local\Temp\29FD.tmp"68⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"69⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"70⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"71⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\2B06.tmp"C:\Users\Admin\AppData\Local\Temp\2B06.tmp"72⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\2B45.tmp"C:\Users\Admin\AppData\Local\Temp\2B45.tmp"73⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\2B83.tmp"C:\Users\Admin\AppData\Local\Temp\2B83.tmp"74⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"75⤵PID:344
-
C:\Users\Admin\AppData\Local\Temp\2C00.tmp"C:\Users\Admin\AppData\Local\Temp\2C00.tmp"76⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"77⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"78⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"79⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"80⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\2D38.tmp"C:\Users\Admin\AppData\Local\Temp\2D38.tmp"81⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\2D76.tmp"C:\Users\Admin\AppData\Local\Temp\2D76.tmp"82⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"83⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\2E03.tmp"C:\Users\Admin\AppData\Local\Temp\2E03.tmp"84⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\2E41.tmp"C:\Users\Admin\AppData\Local\Temp\2E41.tmp"85⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\2E80.tmp"C:\Users\Admin\AppData\Local\Temp\2E80.tmp"86⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"87⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"88⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"89⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\2F89.tmp"C:\Users\Admin\AppData\Local\Temp\2F89.tmp"90⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\2FD7.tmp"C:\Users\Admin\AppData\Local\Temp\2FD7.tmp"91⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\3025.tmp"C:\Users\Admin\AppData\Local\Temp\3025.tmp"92⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\3063.tmp"C:\Users\Admin\AppData\Local\Temp\3063.tmp"93⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\30A2.tmp"C:\Users\Admin\AppData\Local\Temp\30A2.tmp"94⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\30E0.tmp"C:\Users\Admin\AppData\Local\Temp\30E0.tmp"95⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\311E.tmp"C:\Users\Admin\AppData\Local\Temp\311E.tmp"96⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\315D.tmp"C:\Users\Admin\AppData\Local\Temp\315D.tmp"97⤵PID:480
-
C:\Users\Admin\AppData\Local\Temp\319B.tmp"C:\Users\Admin\AppData\Local\Temp\319B.tmp"98⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\31DA.tmp"C:\Users\Admin\AppData\Local\Temp\31DA.tmp"99⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\3218.tmp"C:\Users\Admin\AppData\Local\Temp\3218.tmp"100⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"101⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\3295.tmp"C:\Users\Admin\AppData\Local\Temp\3295.tmp"102⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\32D3.tmp"C:\Users\Admin\AppData\Local\Temp\32D3.tmp"103⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\3312.tmp"C:\Users\Admin\AppData\Local\Temp\3312.tmp"104⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\3350.tmp"C:\Users\Admin\AppData\Local\Temp\3350.tmp"105⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\338E.tmp"C:\Users\Admin\AppData\Local\Temp\338E.tmp"106⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\33CD.tmp"C:\Users\Admin\AppData\Local\Temp\33CD.tmp"107⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\340B.tmp"C:\Users\Admin\AppData\Local\Temp\340B.tmp"108⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\344A.tmp"C:\Users\Admin\AppData\Local\Temp\344A.tmp"109⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"110⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\34C6.tmp"C:\Users\Admin\AppData\Local\Temp\34C6.tmp"111⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\3505.tmp"C:\Users\Admin\AppData\Local\Temp\3505.tmp"112⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\3543.tmp"C:\Users\Admin\AppData\Local\Temp\3543.tmp"113⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\3582.tmp"C:\Users\Admin\AppData\Local\Temp\3582.tmp"114⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\35C0.tmp"C:\Users\Admin\AppData\Local\Temp\35C0.tmp"115⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\35FE.tmp"C:\Users\Admin\AppData\Local\Temp\35FE.tmp"116⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\363D.tmp"C:\Users\Admin\AppData\Local\Temp\363D.tmp"117⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\367B.tmp"C:\Users\Admin\AppData\Local\Temp\367B.tmp"118⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\36BA.tmp"C:\Users\Admin\AppData\Local\Temp\36BA.tmp"119⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\36F8.tmp"C:\Users\Admin\AppData\Local\Temp\36F8.tmp"120⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\3736.tmp"C:\Users\Admin\AppData\Local\Temp\3736.tmp"121⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\3775.tmp"C:\Users\Admin\AppData\Local\Temp\3775.tmp"122⤵PID:2216
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-