Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
27/04/2024, 18:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-27_601931f6f76e72a74baab85fcfd20583_mafia.exe
Resource
win7-20240220-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-27_601931f6f76e72a74baab85fcfd20583_mafia.exe
Resource
win10v2004-20240419-en
2 signatures
150 seconds
General
-
Target
2024-04-27_601931f6f76e72a74baab85fcfd20583_mafia.exe
-
Size
486KB
-
MD5
601931f6f76e72a74baab85fcfd20583
-
SHA1
7defe4d0c0400bffb7f67996e177d8e5364e2a6f
-
SHA256
b6b394591b5b323770e83dba8e4a640f6e79fb7555b8ae023e86e2cc8522f3eb
-
SHA512
d0d30eb400298ef4bfb791b631727430775ceb5698eeae4188519a2b4f7058934b07a083815db6478cc58366ccccaa88a8e6754463d399633a62bc9fa2a33ac4
-
SSDEEP
12288:UU5rCOTeiDy0J9M7BxCCHTMuip9jiZq+NuNZ:UUQOJDyuQfCHuegAzN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2096 26F1.tmp 2900 2730.tmp 2060 277E.tmp 2576 27DB.tmp 2672 2829.tmp 2560 2877.tmp 2656 28B6.tmp 2708 28F4.tmp 2572 2942.tmp 2436 29A0.tmp 2508 29DE.tmp 2944 2A2C.tmp 2236 2A7A.tmp 1668 2AC8.tmp 1252 2B26.tmp 816 2B64.tmp 1980 2BB2.tmp 1052 2C2F.tmp 1096 2C6D.tmp 2004 2CCB.tmp 2028 2D19.tmp 692 2D76.tmp 1000 2DC4.tmp 1500 2E12.tmp 1708 2E51.tmp 900 2E8F.tmp 1572 2ECE.tmp 2968 2F0C.tmp 2756 2F4A.tmp 1520 2F89.tmp 2308 2FC7.tmp 2808 3006.tmp 2088 3044.tmp 584 3082.tmp 1692 30C1.tmp 560 30F0.tmp 644 312E.tmp 1088 316C.tmp 712 31AB.tmp 3044 31E9.tmp 1372 3237.tmp 1580 3276.tmp 1984 32B4.tmp 1876 32F2.tmp 2784 3331.tmp 1804 336F.tmp 1652 33AE.tmp 1384 33EC.tmp 2812 342A.tmp 360 3469.tmp 3000 34A7.tmp 2172 34E6.tmp 904 3524.tmp 1508 3562.tmp 1564 35A1.tmp 1448 35DF.tmp 2836 361E.tmp 2096 365C.tmp 2988 369A.tmp 2616 36D9.tmp 2528 3717.tmp 2704 3756.tmp 2632 3784.tmp 2672 37C3.tmp -
Loads dropped DLL 64 IoCs
pid Process 2732 2024-04-27_601931f6f76e72a74baab85fcfd20583_mafia.exe 2096 26F1.tmp 2900 2730.tmp 2060 277E.tmp 2576 27DB.tmp 2672 2829.tmp 2560 2877.tmp 2656 28B6.tmp 2708 28F4.tmp 2572 2942.tmp 2436 29A0.tmp 2508 29DE.tmp 2944 2A2C.tmp 2236 2A7A.tmp 1668 2AC8.tmp 1252 2B26.tmp 816 2B64.tmp 1980 2BB2.tmp 1052 2C2F.tmp 1096 2C6D.tmp 2004 2CCB.tmp 2028 2D19.tmp 692 2D76.tmp 1000 2DC4.tmp 1500 2E12.tmp 1708 2E51.tmp 900 2E8F.tmp 1572 2ECE.tmp 2968 2F0C.tmp 2756 2F4A.tmp 1520 2F89.tmp 2308 2FC7.tmp 2808 3006.tmp 2088 3044.tmp 584 3082.tmp 1692 30C1.tmp 560 30F0.tmp 644 312E.tmp 1088 316C.tmp 712 31AB.tmp 3044 31E9.tmp 1372 3237.tmp 1580 3276.tmp 1984 32B4.tmp 1876 32F2.tmp 2784 3331.tmp 1804 336F.tmp 1652 33AE.tmp 1384 33EC.tmp 2812 342A.tmp 360 3469.tmp 3000 34A7.tmp 2172 34E6.tmp 904 3524.tmp 1508 3562.tmp 1564 35A1.tmp 1448 35DF.tmp 2836 361E.tmp 2096 365C.tmp 2988 369A.tmp 2616 36D9.tmp 2528 3717.tmp 2704 3756.tmp 2632 3784.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2732 wrote to memory of 2096 2732 2024-04-27_601931f6f76e72a74baab85fcfd20583_mafia.exe 28 PID 2732 wrote to memory of 2096 2732 2024-04-27_601931f6f76e72a74baab85fcfd20583_mafia.exe 28 PID 2732 wrote to memory of 2096 2732 2024-04-27_601931f6f76e72a74baab85fcfd20583_mafia.exe 28 PID 2732 wrote to memory of 2096 2732 2024-04-27_601931f6f76e72a74baab85fcfd20583_mafia.exe 28 PID 2096 wrote to memory of 2900 2096 26F1.tmp 29 PID 2096 wrote to memory of 2900 2096 26F1.tmp 29 PID 2096 wrote to memory of 2900 2096 26F1.tmp 29 PID 2096 wrote to memory of 2900 2096 26F1.tmp 29 PID 2900 wrote to memory of 2060 2900 2730.tmp 30 PID 2900 wrote to memory of 2060 2900 2730.tmp 30 PID 2900 wrote to memory of 2060 2900 2730.tmp 30 PID 2900 wrote to memory of 2060 2900 2730.tmp 30 PID 2060 wrote to memory of 2576 2060 277E.tmp 31 PID 2060 wrote to memory of 2576 2060 277E.tmp 31 PID 2060 wrote to memory of 2576 2060 277E.tmp 31 PID 2060 wrote to memory of 2576 2060 277E.tmp 31 PID 2576 wrote to memory of 2672 2576 27DB.tmp 91 PID 2576 wrote to memory of 2672 2576 27DB.tmp 91 PID 2576 wrote to memory of 2672 2576 27DB.tmp 91 PID 2576 wrote to memory of 2672 2576 27DB.tmp 91 PID 2672 wrote to memory of 2560 2672 2829.tmp 33 PID 2672 wrote to memory of 2560 2672 2829.tmp 33 PID 2672 wrote to memory of 2560 2672 2829.tmp 33 PID 2672 wrote to memory of 2560 2672 2829.tmp 33 PID 2560 wrote to memory of 2656 2560 2877.tmp 34 PID 2560 wrote to memory of 2656 2560 2877.tmp 34 PID 2560 wrote to memory of 2656 2560 2877.tmp 34 PID 2560 wrote to memory of 2656 2560 2877.tmp 34 PID 2656 wrote to memory of 2708 2656 28B6.tmp 95 PID 2656 wrote to memory of 2708 2656 28B6.tmp 95 PID 2656 wrote to memory of 2708 2656 28B6.tmp 95 PID 2656 wrote to memory of 2708 2656 28B6.tmp 95 PID 2708 wrote to memory of 2572 2708 28F4.tmp 36 PID 2708 wrote to memory of 2572 2708 28F4.tmp 36 PID 2708 wrote to memory of 2572 2708 28F4.tmp 36 PID 2708 wrote to memory of 2572 2708 28F4.tmp 36 PID 2572 wrote to memory of 2436 2572 2942.tmp 37 PID 2572 wrote to memory of 2436 2572 2942.tmp 37 PID 2572 wrote to memory of 2436 2572 2942.tmp 37 PID 2572 wrote to memory of 2436 2572 2942.tmp 37 PID 2436 wrote to memory of 2508 2436 29A0.tmp 38 PID 2436 wrote to memory of 2508 2436 29A0.tmp 38 PID 2436 wrote to memory of 2508 2436 29A0.tmp 38 PID 2436 wrote to memory of 2508 2436 29A0.tmp 38 PID 2508 wrote to memory of 2944 2508 29DE.tmp 39 PID 2508 wrote to memory of 2944 2508 29DE.tmp 39 PID 2508 wrote to memory of 2944 2508 29DE.tmp 39 PID 2508 wrote to memory of 2944 2508 29DE.tmp 39 PID 2944 wrote to memory of 2236 2944 2A2C.tmp 40 PID 2944 wrote to memory of 2236 2944 2A2C.tmp 40 PID 2944 wrote to memory of 2236 2944 2A2C.tmp 40 PID 2944 wrote to memory of 2236 2944 2A2C.tmp 40 PID 2236 wrote to memory of 1668 2236 2A7A.tmp 41 PID 2236 wrote to memory of 1668 2236 2A7A.tmp 41 PID 2236 wrote to memory of 1668 2236 2A7A.tmp 41 PID 2236 wrote to memory of 1668 2236 2A7A.tmp 41 PID 1668 wrote to memory of 1252 1668 2AC8.tmp 42 PID 1668 wrote to memory of 1252 1668 2AC8.tmp 42 PID 1668 wrote to memory of 1252 1668 2AC8.tmp 42 PID 1668 wrote to memory of 1252 1668 2AC8.tmp 42 PID 1252 wrote to memory of 816 1252 2B26.tmp 43 PID 1252 wrote to memory of 816 1252 2B26.tmp 43 PID 1252 wrote to memory of 816 1252 2B26.tmp 43 PID 1252 wrote to memory of 816 1252 2B26.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-27_601931f6f76e72a74baab85fcfd20583_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-27_601931f6f76e72a74baab85fcfd20583_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\26F1.tmp"C:\Users\Admin\AppData\Local\Temp\26F1.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\2730.tmp"C:\Users\Admin\AppData\Local\Temp\2730.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\277E.tmp"C:\Users\Admin\AppData\Local\Temp\277E.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\27DB.tmp"C:\Users\Admin\AppData\Local\Temp\27DB.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\2829.tmp"C:\Users\Admin\AppData\Local\Temp\2829.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\2877.tmp"C:\Users\Admin\AppData\Local\Temp\2877.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\28B6.tmp"C:\Users\Admin\AppData\Local\Temp\28B6.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\28F4.tmp"C:\Users\Admin\AppData\Local\Temp\28F4.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\2942.tmp"C:\Users\Admin\AppData\Local\Temp\2942.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\29A0.tmp"C:\Users\Admin\AppData\Local\Temp\29A0.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\29DE.tmp"C:\Users\Admin\AppData\Local\Temp\29DE.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\2B26.tmp"C:\Users\Admin\AppData\Local\Temp\2B26.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\2B64.tmp"C:\Users\Admin\AppData\Local\Temp\2B64.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:816 -
C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\2D19.tmp"C:\Users\Admin\AppData\Local\Temp\2D19.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\2D76.tmp"C:\Users\Admin\AppData\Local\Temp\2D76.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:692 -
C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\2E12.tmp"C:\Users\Admin\AppData\Local\Temp\2E12.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\2E51.tmp"C:\Users\Admin\AppData\Local\Temp\2E51.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:900 -
C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\2F89.tmp"C:\Users\Admin\AppData\Local\Temp\2F89.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\3006.tmp"C:\Users\Admin\AppData\Local\Temp\3006.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\3044.tmp"C:\Users\Admin\AppData\Local\Temp\3044.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\3082.tmp"C:\Users\Admin\AppData\Local\Temp\3082.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:584 -
C:\Users\Admin\AppData\Local\Temp\30C1.tmp"C:\Users\Admin\AppData\Local\Temp\30C1.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\30F0.tmp"C:\Users\Admin\AppData\Local\Temp\30F0.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:560 -
C:\Users\Admin\AppData\Local\Temp\312E.tmp"C:\Users\Admin\AppData\Local\Temp\312E.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:644 -
C:\Users\Admin\AppData\Local\Temp\316C.tmp"C:\Users\Admin\AppData\Local\Temp\316C.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\31AB.tmp"C:\Users\Admin\AppData\Local\Temp\31AB.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:712 -
C:\Users\Admin\AppData\Local\Temp\31E9.tmp"C:\Users\Admin\AppData\Local\Temp\31E9.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\3237.tmp"C:\Users\Admin\AppData\Local\Temp\3237.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\3276.tmp"C:\Users\Admin\AppData\Local\Temp\3276.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\32B4.tmp"C:\Users\Admin\AppData\Local\Temp\32B4.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\32F2.tmp"C:\Users\Admin\AppData\Local\Temp\32F2.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\3331.tmp"C:\Users\Admin\AppData\Local\Temp\3331.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\336F.tmp"C:\Users\Admin\AppData\Local\Temp\336F.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\33AE.tmp"C:\Users\Admin\AppData\Local\Temp\33AE.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\33EC.tmp"C:\Users\Admin\AppData\Local\Temp\33EC.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\342A.tmp"C:\Users\Admin\AppData\Local\Temp\342A.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\3469.tmp"C:\Users\Admin\AppData\Local\Temp\3469.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:360 -
C:\Users\Admin\AppData\Local\Temp\34A7.tmp"C:\Users\Admin\AppData\Local\Temp\34A7.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\34E6.tmp"C:\Users\Admin\AppData\Local\Temp\34E6.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\3524.tmp"C:\Users\Admin\AppData\Local\Temp\3524.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:904 -
C:\Users\Admin\AppData\Local\Temp\3562.tmp"C:\Users\Admin\AppData\Local\Temp\3562.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\35A1.tmp"C:\Users\Admin\AppData\Local\Temp\35A1.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\35DF.tmp"C:\Users\Admin\AppData\Local\Temp\35DF.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\361E.tmp"C:\Users\Admin\AppData\Local\Temp\361E.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\365C.tmp"C:\Users\Admin\AppData\Local\Temp\365C.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\369A.tmp"C:\Users\Admin\AppData\Local\Temp\369A.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\36D9.tmp"C:\Users\Admin\AppData\Local\Temp\36D9.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\3717.tmp"C:\Users\Admin\AppData\Local\Temp\3717.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\3756.tmp"C:\Users\Admin\AppData\Local\Temp\3756.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\3784.tmp"C:\Users\Admin\AppData\Local\Temp\3784.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\37C3.tmp"C:\Users\Admin\AppData\Local\Temp\37C3.tmp"65⤵
- Executes dropped EXE
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\3801.tmp"C:\Users\Admin\AppData\Local\Temp\3801.tmp"66⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\3840.tmp"C:\Users\Admin\AppData\Local\Temp\3840.tmp"67⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\387E.tmp"C:\Users\Admin\AppData\Local\Temp\387E.tmp"68⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\38BC.tmp"C:\Users\Admin\AppData\Local\Temp\38BC.tmp"69⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\38FB.tmp"C:\Users\Admin\AppData\Local\Temp\38FB.tmp"70⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\3939.tmp"C:\Users\Admin\AppData\Local\Temp\3939.tmp"71⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\3978.tmp"C:\Users\Admin\AppData\Local\Temp\3978.tmp"72⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\39A6.tmp"C:\Users\Admin\AppData\Local\Temp\39A6.tmp"73⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\39E5.tmp"C:\Users\Admin\AppData\Local\Temp\39E5.tmp"74⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\3A23.tmp"C:\Users\Admin\AppData\Local\Temp\3A23.tmp"75⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\3A71.tmp"C:\Users\Admin\AppData\Local\Temp\3A71.tmp"76⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\3AB0.tmp"C:\Users\Admin\AppData\Local\Temp\3AB0.tmp"77⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\3ADE.tmp"C:\Users\Admin\AppData\Local\Temp\3ADE.tmp"78⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\3B1D.tmp"C:\Users\Admin\AppData\Local\Temp\3B1D.tmp"79⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\3B5B.tmp"C:\Users\Admin\AppData\Local\Temp\3B5B.tmp"80⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\3B8A.tmp"C:\Users\Admin\AppData\Local\Temp\3B8A.tmp"81⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\3BC8.tmp"C:\Users\Admin\AppData\Local\Temp\3BC8.tmp"82⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\3C07.tmp"C:\Users\Admin\AppData\Local\Temp\3C07.tmp"83⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\3C45.tmp"C:\Users\Admin\AppData\Local\Temp\3C45.tmp"84⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\3C84.tmp"C:\Users\Admin\AppData\Local\Temp\3C84.tmp"85⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\3CC2.tmp"C:\Users\Admin\AppData\Local\Temp\3CC2.tmp"86⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\3D00.tmp"C:\Users\Admin\AppData\Local\Temp\3D00.tmp"87⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\3D3F.tmp"C:\Users\Admin\AppData\Local\Temp\3D3F.tmp"88⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\3D7D.tmp"C:\Users\Admin\AppData\Local\Temp\3D7D.tmp"89⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\3DAC.tmp"C:\Users\Admin\AppData\Local\Temp\3DAC.tmp"90⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\3DEA.tmp"C:\Users\Admin\AppData\Local\Temp\3DEA.tmp"91⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\3E29.tmp"C:\Users\Admin\AppData\Local\Temp\3E29.tmp"92⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\3E77.tmp"C:\Users\Admin\AppData\Local\Temp\3E77.tmp"93⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\3EB5.tmp"C:\Users\Admin\AppData\Local\Temp\3EB5.tmp"94⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\3EF4.tmp"C:\Users\Admin\AppData\Local\Temp\3EF4.tmp"95⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\3F32.tmp"C:\Users\Admin\AppData\Local\Temp\3F32.tmp"96⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\3F70.tmp"C:\Users\Admin\AppData\Local\Temp\3F70.tmp"97⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\3FAF.tmp"C:\Users\Admin\AppData\Local\Temp\3FAF.tmp"98⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\3FED.tmp"C:\Users\Admin\AppData\Local\Temp\3FED.tmp"99⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\402C.tmp"C:\Users\Admin\AppData\Local\Temp\402C.tmp"100⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\406A.tmp"C:\Users\Admin\AppData\Local\Temp\406A.tmp"101⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\40A8.tmp"C:\Users\Admin\AppData\Local\Temp\40A8.tmp"102⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\40E7.tmp"C:\Users\Admin\AppData\Local\Temp\40E7.tmp"103⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\4125.tmp"C:\Users\Admin\AppData\Local\Temp\4125.tmp"104⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\4164.tmp"C:\Users\Admin\AppData\Local\Temp\4164.tmp"105⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\41A2.tmp"C:\Users\Admin\AppData\Local\Temp\41A2.tmp"106⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\41E0.tmp"C:\Users\Admin\AppData\Local\Temp\41E0.tmp"107⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\421F.tmp"C:\Users\Admin\AppData\Local\Temp\421F.tmp"108⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\425D.tmp"C:\Users\Admin\AppData\Local\Temp\425D.tmp"109⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\429C.tmp"C:\Users\Admin\AppData\Local\Temp\429C.tmp"110⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\42DA.tmp"C:\Users\Admin\AppData\Local\Temp\42DA.tmp"111⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\4318.tmp"C:\Users\Admin\AppData\Local\Temp\4318.tmp"112⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\4357.tmp"C:\Users\Admin\AppData\Local\Temp\4357.tmp"113⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\4395.tmp"C:\Users\Admin\AppData\Local\Temp\4395.tmp"114⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\43D4.tmp"C:\Users\Admin\AppData\Local\Temp\43D4.tmp"115⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\4412.tmp"C:\Users\Admin\AppData\Local\Temp\4412.tmp"116⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\4450.tmp"C:\Users\Admin\AppData\Local\Temp\4450.tmp"117⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\447F.tmp"C:\Users\Admin\AppData\Local\Temp\447F.tmp"118⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\44BE.tmp"C:\Users\Admin\AppData\Local\Temp\44BE.tmp"119⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\44FC.tmp"C:\Users\Admin\AppData\Local\Temp\44FC.tmp"120⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\453A.tmp"C:\Users\Admin\AppData\Local\Temp\453A.tmp"121⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\4579.tmp"C:\Users\Admin\AppData\Local\Temp\4579.tmp"122⤵PID:2152
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-