Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-04-2024 17:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-27_fed9f2f0012ef4a9302189bcd5e15cb7_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-27_fed9f2f0012ef4a9302189bcd5e15cb7_mafia.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-04-27_fed9f2f0012ef4a9302189bcd5e15cb7_mafia.exe
-
Size
486KB
-
MD5
fed9f2f0012ef4a9302189bcd5e15cb7
-
SHA1
272690b47ad21851e7bea49c3f43822b14296026
-
SHA256
11291f540a9cd8f9000bb283eb831faeaadbfcd615349d7a3a5aa1ed6323897a
-
SHA512
61669908889f2afd9373ef10f608772805a21b937216603f7fd266bb11757e3c271063efadb7f02499530cfd660f56528bcbcc8d2968f37c1f4e03b467c4d2b3
-
SSDEEP
12288:UU5rCOTeiD1ANls0FVCyRES7eGIYZt0/LJjasNZ:UUQOJD1EfzyxGIAgLJjasN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1668 79C2.tmp 2560 7ABB.tmp 2736 7BC5.tmp 2524 7C8F.tmp 3060 7D3B.tmp 2520 7E35.tmp 2556 7F1F.tmp 2688 8037.tmp 2472 8121.tmp 2748 820B.tmp 592 82D6.tmp 2400 83DF.tmp 1352 84AA.tmp 1104 8565.tmp 860 8640.tmp 2816 871A.tmp 3044 87D5.tmp 2644 88BF.tmp 2324 897B.tmp 2012 8A84.tmp 1828 8B7D.tmp 1480 8CD5.tmp 2684 8DBF.tmp 696 8E4B.tmp 1040 8EC8.tmp 1044 8F64.tmp 2376 8FF0.tmp 2072 907D.tmp 2868 90F9.tmp 2032 9176.tmp 2268 9203.tmp 2272 927F.tmp 2876 92FC.tmp 2092 9389.tmp 992 93F6.tmp 2884 9473.tmp 1136 94EF.tmp 1344 955D.tmp 1316 95E9.tmp 2792 9685.tmp 2784 9711.tmp 1880 977F.tmp 1156 97EC.tmp 1320 9869.tmp 920 98E5.tmp 1692 9962.tmp 760 99DF.tmp 1684 9A6B.tmp 1304 9AD9.tmp 2892 9B55.tmp 1152 9BF1.tmp 3052 9C5F.tmp 1680 9CDB.tmp 2064 9D68.tmp 2604 9DE5.tmp 3048 9E52.tmp 1296 9ECF.tmp 2568 9F3C.tmp 2696 9FA9.tmp 2544 A016.tmp 2428 A17D.tmp 2852 A248.tmp 2720 A2C5.tmp 2448 A332.tmp -
Loads dropped DLL 64 IoCs
pid Process 3048 2024-04-27_fed9f2f0012ef4a9302189bcd5e15cb7_mafia.exe 1668 79C2.tmp 2560 7ABB.tmp 2736 7BC5.tmp 2524 7C8F.tmp 3060 7D3B.tmp 2520 7E35.tmp 2556 7F1F.tmp 2688 8037.tmp 2472 8121.tmp 2748 820B.tmp 592 82D6.tmp 2400 83DF.tmp 1352 84AA.tmp 1104 8565.tmp 860 8640.tmp 2816 871A.tmp 3044 87D5.tmp 2644 88BF.tmp 2324 897B.tmp 2012 8A84.tmp 1828 8B7D.tmp 1480 8CD5.tmp 2684 8DBF.tmp 696 8E4B.tmp 1040 8EC8.tmp 1044 8F64.tmp 2376 8FF0.tmp 2072 907D.tmp 2868 90F9.tmp 2032 9176.tmp 2268 9203.tmp 2272 927F.tmp 2876 92FC.tmp 2092 9389.tmp 992 93F6.tmp 2884 9473.tmp 1136 94EF.tmp 1344 955D.tmp 1316 95E9.tmp 2792 9685.tmp 2784 9711.tmp 1880 977F.tmp 1156 97EC.tmp 1320 9869.tmp 920 98E5.tmp 1692 9962.tmp 760 99DF.tmp 1684 9A6B.tmp 1304 9AD9.tmp 2892 9B55.tmp 1152 9BF1.tmp 3052 9C5F.tmp 1680 9CDB.tmp 2064 9D68.tmp 2604 9DE5.tmp 3048 9E52.tmp 1296 9ECF.tmp 2568 9F3C.tmp 2696 9FA9.tmp 2544 A016.tmp 2428 A17D.tmp 2852 A248.tmp 2720 A2C5.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3048 wrote to memory of 1668 3048 2024-04-27_fed9f2f0012ef4a9302189bcd5e15cb7_mafia.exe 28 PID 3048 wrote to memory of 1668 3048 2024-04-27_fed9f2f0012ef4a9302189bcd5e15cb7_mafia.exe 28 PID 3048 wrote to memory of 1668 3048 2024-04-27_fed9f2f0012ef4a9302189bcd5e15cb7_mafia.exe 28 PID 3048 wrote to memory of 1668 3048 2024-04-27_fed9f2f0012ef4a9302189bcd5e15cb7_mafia.exe 28 PID 1668 wrote to memory of 2560 1668 79C2.tmp 29 PID 1668 wrote to memory of 2560 1668 79C2.tmp 29 PID 1668 wrote to memory of 2560 1668 79C2.tmp 29 PID 1668 wrote to memory of 2560 1668 79C2.tmp 29 PID 2560 wrote to memory of 2736 2560 7ABB.tmp 30 PID 2560 wrote to memory of 2736 2560 7ABB.tmp 30 PID 2560 wrote to memory of 2736 2560 7ABB.tmp 30 PID 2560 wrote to memory of 2736 2560 7ABB.tmp 30 PID 2736 wrote to memory of 2524 2736 7BC5.tmp 31 PID 2736 wrote to memory of 2524 2736 7BC5.tmp 31 PID 2736 wrote to memory of 2524 2736 7BC5.tmp 31 PID 2736 wrote to memory of 2524 2736 7BC5.tmp 31 PID 2524 wrote to memory of 3060 2524 7C8F.tmp 32 PID 2524 wrote to memory of 3060 2524 7C8F.tmp 32 PID 2524 wrote to memory of 3060 2524 7C8F.tmp 32 PID 2524 wrote to memory of 3060 2524 7C8F.tmp 32 PID 3060 wrote to memory of 2520 3060 7D3B.tmp 33 PID 3060 wrote to memory of 2520 3060 7D3B.tmp 33 PID 3060 wrote to memory of 2520 3060 7D3B.tmp 33 PID 3060 wrote to memory of 2520 3060 7D3B.tmp 33 PID 2520 wrote to memory of 2556 2520 7E35.tmp 34 PID 2520 wrote to memory of 2556 2520 7E35.tmp 34 PID 2520 wrote to memory of 2556 2520 7E35.tmp 34 PID 2520 wrote to memory of 2556 2520 7E35.tmp 34 PID 2556 wrote to memory of 2688 2556 7F1F.tmp 35 PID 2556 wrote to memory of 2688 2556 7F1F.tmp 35 PID 2556 wrote to memory of 2688 2556 7F1F.tmp 35 PID 2556 wrote to memory of 2688 2556 7F1F.tmp 35 PID 2688 wrote to memory of 2472 2688 8037.tmp 36 PID 2688 wrote to memory of 2472 2688 8037.tmp 36 PID 2688 wrote to memory of 2472 2688 8037.tmp 36 PID 2688 wrote to memory of 2472 2688 8037.tmp 36 PID 2472 wrote to memory of 2748 2472 8121.tmp 37 PID 2472 wrote to memory of 2748 2472 8121.tmp 37 PID 2472 wrote to memory of 2748 2472 8121.tmp 37 PID 2472 wrote to memory of 2748 2472 8121.tmp 37 PID 2748 wrote to memory of 592 2748 820B.tmp 38 PID 2748 wrote to memory of 592 2748 820B.tmp 38 PID 2748 wrote to memory of 592 2748 820B.tmp 38 PID 2748 wrote to memory of 592 2748 820B.tmp 38 PID 592 wrote to memory of 2400 592 82D6.tmp 39 PID 592 wrote to memory of 2400 592 82D6.tmp 39 PID 592 wrote to memory of 2400 592 82D6.tmp 39 PID 592 wrote to memory of 2400 592 82D6.tmp 39 PID 2400 wrote to memory of 1352 2400 83DF.tmp 40 PID 2400 wrote to memory of 1352 2400 83DF.tmp 40 PID 2400 wrote to memory of 1352 2400 83DF.tmp 40 PID 2400 wrote to memory of 1352 2400 83DF.tmp 40 PID 1352 wrote to memory of 1104 1352 84AA.tmp 41 PID 1352 wrote to memory of 1104 1352 84AA.tmp 41 PID 1352 wrote to memory of 1104 1352 84AA.tmp 41 PID 1352 wrote to memory of 1104 1352 84AA.tmp 41 PID 1104 wrote to memory of 860 1104 8565.tmp 42 PID 1104 wrote to memory of 860 1104 8565.tmp 42 PID 1104 wrote to memory of 860 1104 8565.tmp 42 PID 1104 wrote to memory of 860 1104 8565.tmp 42 PID 860 wrote to memory of 2816 860 8640.tmp 43 PID 860 wrote to memory of 2816 860 8640.tmp 43 PID 860 wrote to memory of 2816 860 8640.tmp 43 PID 860 wrote to memory of 2816 860 8640.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-27_fed9f2f0012ef4a9302189bcd5e15cb7_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-27_fed9f2f0012ef4a9302189bcd5e15cb7_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\79C2.tmp"C:\Users\Admin\AppData\Local\Temp\79C2.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\7ABB.tmp"C:\Users\Admin\AppData\Local\Temp\7ABB.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\7BC5.tmp"C:\Users\Admin\AppData\Local\Temp\7BC5.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\7C8F.tmp"C:\Users\Admin\AppData\Local\Temp\7C8F.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\7D3B.tmp"C:\Users\Admin\AppData\Local\Temp\7D3B.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\7E35.tmp"C:\Users\Admin\AppData\Local\Temp\7E35.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\7F1F.tmp"C:\Users\Admin\AppData\Local\Temp\7F1F.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\8037.tmp"C:\Users\Admin\AppData\Local\Temp\8037.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\8121.tmp"C:\Users\Admin\AppData\Local\Temp\8121.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\820B.tmp"C:\Users\Admin\AppData\Local\Temp\820B.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\82D6.tmp"C:\Users\Admin\AppData\Local\Temp\82D6.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:592 -
C:\Users\Admin\AppData\Local\Temp\83DF.tmp"C:\Users\Admin\AppData\Local\Temp\83DF.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\84AA.tmp"C:\Users\Admin\AppData\Local\Temp\84AA.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\8565.tmp"C:\Users\Admin\AppData\Local\Temp\8565.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\8640.tmp"C:\Users\Admin\AppData\Local\Temp\8640.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Users\Admin\AppData\Local\Temp\871A.tmp"C:\Users\Admin\AppData\Local\Temp\871A.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\87D5.tmp"C:\Users\Admin\AppData\Local\Temp\87D5.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\88BF.tmp"C:\Users\Admin\AppData\Local\Temp\88BF.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\897B.tmp"C:\Users\Admin\AppData\Local\Temp\897B.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\8A84.tmp"C:\Users\Admin\AppData\Local\Temp\8A84.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\8CD5.tmp"C:\Users\Admin\AppData\Local\Temp\8CD5.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\8DBF.tmp"C:\Users\Admin\AppData\Local\Temp\8DBF.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\8E4B.tmp"C:\Users\Admin\AppData\Local\Temp\8E4B.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:696 -
C:\Users\Admin\AppData\Local\Temp\8EC8.tmp"C:\Users\Admin\AppData\Local\Temp\8EC8.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\8F64.tmp"C:\Users\Admin\AppData\Local\Temp\8F64.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\8FF0.tmp"C:\Users\Admin\AppData\Local\Temp\8FF0.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\907D.tmp"C:\Users\Admin\AppData\Local\Temp\907D.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\90F9.tmp"C:\Users\Admin\AppData\Local\Temp\90F9.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\9176.tmp"C:\Users\Admin\AppData\Local\Temp\9176.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\9203.tmp"C:\Users\Admin\AppData\Local\Temp\9203.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\927F.tmp"C:\Users\Admin\AppData\Local\Temp\927F.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\92FC.tmp"C:\Users\Admin\AppData\Local\Temp\92FC.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\9389.tmp"C:\Users\Admin\AppData\Local\Temp\9389.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\93F6.tmp"C:\Users\Admin\AppData\Local\Temp\93F6.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:992 -
C:\Users\Admin\AppData\Local\Temp\9473.tmp"C:\Users\Admin\AppData\Local\Temp\9473.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\94EF.tmp"C:\Users\Admin\AppData\Local\Temp\94EF.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\955D.tmp"C:\Users\Admin\AppData\Local\Temp\955D.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\95E9.tmp"C:\Users\Admin\AppData\Local\Temp\95E9.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\9685.tmp"C:\Users\Admin\AppData\Local\Temp\9685.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\9711.tmp"C:\Users\Admin\AppData\Local\Temp\9711.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\977F.tmp"C:\Users\Admin\AppData\Local\Temp\977F.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\97EC.tmp"C:\Users\Admin\AppData\Local\Temp\97EC.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\9869.tmp"C:\Users\Admin\AppData\Local\Temp\9869.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\98E5.tmp"C:\Users\Admin\AppData\Local\Temp\98E5.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:920 -
C:\Users\Admin\AppData\Local\Temp\9962.tmp"C:\Users\Admin\AppData\Local\Temp\9962.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\99DF.tmp"C:\Users\Admin\AppData\Local\Temp\99DF.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:760 -
C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\9AD9.tmp"C:\Users\Admin\AppData\Local\Temp\9AD9.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\9B55.tmp"C:\Users\Admin\AppData\Local\Temp\9B55.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\9BF1.tmp"C:\Users\Admin\AppData\Local\Temp\9BF1.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\9CDB.tmp"C:\Users\Admin\AppData\Local\Temp\9CDB.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\9D68.tmp"C:\Users\Admin\AppData\Local\Temp\9D68.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\9DE5.tmp"C:\Users\Admin\AppData\Local\Temp\9DE5.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\9E52.tmp"C:\Users\Admin\AppData\Local\Temp\9E52.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\9ECF.tmp"C:\Users\Admin\AppData\Local\Temp\9ECF.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\9F3C.tmp"C:\Users\Admin\AppData\Local\Temp\9F3C.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\9FA9.tmp"C:\Users\Admin\AppData\Local\Temp\9FA9.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\A016.tmp"C:\Users\Admin\AppData\Local\Temp\A016.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\A17D.tmp"C:\Users\Admin\AppData\Local\Temp\A17D.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\A248.tmp"C:\Users\Admin\AppData\Local\Temp\A248.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\A2C5.tmp"C:\Users\Admin\AppData\Local\Temp\A2C5.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\A332.tmp"C:\Users\Admin\AppData\Local\Temp\A332.tmp"65⤵
- Executes dropped EXE
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\A3AF.tmp"C:\Users\Admin\AppData\Local\Temp\A3AF.tmp"66⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\A41C.tmp"C:\Users\Admin\AppData\Local\Temp\A41C.tmp"67⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\A489.tmp"C:\Users\Admin\AppData\Local\Temp\A489.tmp"68⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\A506.tmp"C:\Users\Admin\AppData\Local\Temp\A506.tmp"69⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\A583.tmp"C:\Users\Admin\AppData\Local\Temp\A583.tmp"70⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\A60F.tmp"C:\Users\Admin\AppData\Local\Temp\A60F.tmp"71⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\A67C.tmp"C:\Users\Admin\AppData\Local\Temp\A67C.tmp"72⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\A709.tmp"C:\Users\Admin\AppData\Local\Temp\A709.tmp"73⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\A766.tmp"C:\Users\Admin\AppData\Local\Temp\A766.tmp"74⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\A7F3.tmp"C:\Users\Admin\AppData\Local\Temp\A7F3.tmp"75⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\A87F.tmp"C:\Users\Admin\AppData\Local\Temp\A87F.tmp"76⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\A8FC.tmp"C:\Users\Admin\AppData\Local\Temp\A8FC.tmp"77⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\A979.tmp"C:\Users\Admin\AppData\Local\Temp\A979.tmp"78⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\A9F5.tmp"C:\Users\Admin\AppData\Local\Temp\A9F5.tmp"79⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\AA72.tmp"C:\Users\Admin\AppData\Local\Temp\AA72.tmp"80⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\AAEF.tmp"C:\Users\Admin\AppData\Local\Temp\AAEF.tmp"81⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\AB3D.tmp"C:\Users\Admin\AppData\Local\Temp\AB3D.tmp"82⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\ABBA.tmp"C:\Users\Admin\AppData\Local\Temp\ABBA.tmp"83⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\AC37.tmp"C:\Users\Admin\AppData\Local\Temp\AC37.tmp"84⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\ACB3.tmp"C:\Users\Admin\AppData\Local\Temp\ACB3.tmp"85⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\AD30.tmp"C:\Users\Admin\AppData\Local\Temp\AD30.tmp"86⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\AD9D.tmp"C:\Users\Admin\AppData\Local\Temp\AD9D.tmp"87⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\AE1A.tmp"C:\Users\Admin\AppData\Local\Temp\AE1A.tmp"88⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\AE97.tmp"C:\Users\Admin\AppData\Local\Temp\AE97.tmp"89⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\AEF5.tmp"C:\Users\Admin\AppData\Local\Temp\AEF5.tmp"90⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\AF52.tmp"C:\Users\Admin\AppData\Local\Temp\AF52.tmp"91⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\AFCF.tmp"C:\Users\Admin\AppData\Local\Temp\AFCF.tmp"92⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\B05B.tmp"C:\Users\Admin\AppData\Local\Temp\B05B.tmp"93⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\B0C9.tmp"C:\Users\Admin\AppData\Local\Temp\B0C9.tmp"94⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\B136.tmp"C:\Users\Admin\AppData\Local\Temp\B136.tmp"95⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\B1C2.tmp"C:\Users\Admin\AppData\Local\Temp\B1C2.tmp"96⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\B24F.tmp"C:\Users\Admin\AppData\Local\Temp\B24F.tmp"97⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\B2BC.tmp"C:\Users\Admin\AppData\Local\Temp\B2BC.tmp"98⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\B319.tmp"C:\Users\Admin\AppData\Local\Temp\B319.tmp"99⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\B396.tmp"C:\Users\Admin\AppData\Local\Temp\B396.tmp"100⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\B3F4.tmp"C:\Users\Admin\AppData\Local\Temp\B3F4.tmp"101⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\B451.tmp"C:\Users\Admin\AppData\Local\Temp\B451.tmp"102⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\B4DE.tmp"C:\Users\Admin\AppData\Local\Temp\B4DE.tmp"103⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\B56A.tmp"C:\Users\Admin\AppData\Local\Temp\B56A.tmp"104⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\B71F.tmp"C:\Users\Admin\AppData\Local\Temp\B71F.tmp"105⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\B79C.tmp"C:\Users\Admin\AppData\Local\Temp\B79C.tmp"106⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\B809.tmp"C:\Users\Admin\AppData\Local\Temp\B809.tmp"107⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\B876.tmp"C:\Users\Admin\AppData\Local\Temp\B876.tmp"108⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\B903.tmp"C:\Users\Admin\AppData\Local\Temp\B903.tmp"109⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\B970.tmp"C:\Users\Admin\AppData\Local\Temp\B970.tmp"110⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\B9DD.tmp"C:\Users\Admin\AppData\Local\Temp\B9DD.tmp"111⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\BA4A.tmp"C:\Users\Admin\AppData\Local\Temp\BA4A.tmp"112⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\BAC7.tmp"C:\Users\Admin\AppData\Local\Temp\BAC7.tmp"113⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\BB34.tmp"C:\Users\Admin\AppData\Local\Temp\BB34.tmp"114⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\BBA1.tmp"C:\Users\Admin\AppData\Local\Temp\BBA1.tmp"115⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\BC1E.tmp"C:\Users\Admin\AppData\Local\Temp\BC1E.tmp"116⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\BC9B.tmp"C:\Users\Admin\AppData\Local\Temp\BC9B.tmp"117⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\BD27.tmp"C:\Users\Admin\AppData\Local\Temp\BD27.tmp"118⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\BDB4.tmp"C:\Users\Admin\AppData\Local\Temp\BDB4.tmp"119⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\BE40.tmp"C:\Users\Admin\AppData\Local\Temp\BE40.tmp"120⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\BE9E.tmp"C:\Users\Admin\AppData\Local\Temp\BE9E.tmp"121⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\BF1B.tmp"C:\Users\Admin\AppData\Local\Temp\BF1B.tmp"122⤵PID:2840
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-