Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04-05-2024 17:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-04_cf1bc93275c71232641a890328232175_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-04_cf1bc93275c71232641a890328232175_mafia.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-04_cf1bc93275c71232641a890328232175_mafia.exe
-
Size
530KB
-
MD5
cf1bc93275c71232641a890328232175
-
SHA1
e94779a2b8c0d4ff51fafdb2c9604577ed40bcd3
-
SHA256
74948f0491fe863b1cf00631614193c67e33f45bca594e071888229f57cb094e
-
SHA512
dabd14cae9a29a2c98162841838a93dd9e053acf78737efbf38d7be499e99c544cce1510fc0abb2ddf06d4d88e51ed151fc1db547e6e3c2dd1405c7b19100cdf
-
SSDEEP
12288:AU5rCOTeioWCLWLlck46GLJqPEZochdIVNZulFVg0M1:AUQOJoWCAlcJbdTZoIdsNclFV/M1
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1696 1F63.tmp 2156 1FA1.tmp 3064 1FEF.tmp 2556 203D.tmp 2668 2108.tmp 2596 2194.tmp 2696 2230.tmp 1820 22BD.tmp 2612 232A.tmp 2440 23B6.tmp 2568 2424.tmp 2152 24A0.tmp 2256 252D.tmp 2824 25AA.tmp 2976 2646.tmp 2388 26B3.tmp 1488 26F1.tmp 760 277E.tmp 2744 27EB.tmp 884 2887.tmp 1220 2923.tmp 288 29BF.tmp 868 2A3C.tmp 624 2A7A.tmp 1760 2AC8.tmp 2264 2B16.tmp 2316 2B64.tmp 2428 2BB2.tmp 472 2C00.tmp 2856 2C4E.tmp 2108 2C9C.tmp 488 2CDA.tmp 680 2D28.tmp 1460 2D76.tmp 2176 2DC4.tmp 824 2E12.tmp 1496 2E60.tmp 1156 2E9F.tmp 1124 2EED.tmp 2284 2F2B.tmp 1748 2F79.tmp 2008 2FC7.tmp 1828 3015.tmp 780 3054.tmp 1240 3092.tmp 1280 30E0.tmp 896 312E.tmp 2880 316C.tmp 1856 31BA.tmp 1072 3208.tmp 1300 3256.tmp 2000 32D3.tmp 876 3312.tmp 1680 3350.tmp 2248 339E.tmp 1540 33DC.tmp 1992 342A.tmp 3068 3469.tmp 2172 34A7.tmp 2576 34E6.tmp 1628 3534.tmp 2156 3582.tmp 2656 35C0.tmp 2604 35FE.tmp -
Loads dropped DLL 64 IoCs
pid Process 2356 2024-05-04_cf1bc93275c71232641a890328232175_mafia.exe 1696 1F63.tmp 2156 1FA1.tmp 3064 1FEF.tmp 2556 203D.tmp 2668 2108.tmp 2596 2194.tmp 2696 2230.tmp 1820 22BD.tmp 2612 232A.tmp 2440 23B6.tmp 2568 2424.tmp 2152 24A0.tmp 2256 252D.tmp 2824 25AA.tmp 2976 2646.tmp 2388 26B3.tmp 1488 26F1.tmp 760 277E.tmp 2744 27EB.tmp 884 2887.tmp 1220 2923.tmp 288 29BF.tmp 868 2A3C.tmp 624 2A7A.tmp 1760 2AC8.tmp 2264 2B16.tmp 2316 2B64.tmp 2428 2BB2.tmp 472 2C00.tmp 2856 2C4E.tmp 2108 2C9C.tmp 488 2CDA.tmp 680 2D28.tmp 1460 2D76.tmp 2176 2DC4.tmp 824 2E12.tmp 1496 2E60.tmp 1156 2E9F.tmp 1124 2EED.tmp 2284 2F2B.tmp 1748 2F79.tmp 2008 2FC7.tmp 1828 3015.tmp 780 3054.tmp 1240 3092.tmp 1280 30E0.tmp 896 312E.tmp 2880 316C.tmp 1856 31BA.tmp 1072 3208.tmp 1300 3256.tmp 2000 32D3.tmp 876 3312.tmp 1680 3350.tmp 2248 339E.tmp 1540 33DC.tmp 1992 342A.tmp 3068 3469.tmp 2172 34A7.tmp 2576 34E6.tmp 1628 3534.tmp 2156 3582.tmp 2656 35C0.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2356 wrote to memory of 1696 2356 2024-05-04_cf1bc93275c71232641a890328232175_mafia.exe 28 PID 2356 wrote to memory of 1696 2356 2024-05-04_cf1bc93275c71232641a890328232175_mafia.exe 28 PID 2356 wrote to memory of 1696 2356 2024-05-04_cf1bc93275c71232641a890328232175_mafia.exe 28 PID 2356 wrote to memory of 1696 2356 2024-05-04_cf1bc93275c71232641a890328232175_mafia.exe 28 PID 1696 wrote to memory of 2156 1696 1F63.tmp 29 PID 1696 wrote to memory of 2156 1696 1F63.tmp 29 PID 1696 wrote to memory of 2156 1696 1F63.tmp 29 PID 1696 wrote to memory of 2156 1696 1F63.tmp 29 PID 2156 wrote to memory of 3064 2156 1FA1.tmp 30 PID 2156 wrote to memory of 3064 2156 1FA1.tmp 30 PID 2156 wrote to memory of 3064 2156 1FA1.tmp 30 PID 2156 wrote to memory of 3064 2156 1FA1.tmp 30 PID 3064 wrote to memory of 2556 3064 1FEF.tmp 31 PID 3064 wrote to memory of 2556 3064 1FEF.tmp 31 PID 3064 wrote to memory of 2556 3064 1FEF.tmp 31 PID 3064 wrote to memory of 2556 3064 1FEF.tmp 31 PID 2556 wrote to memory of 2668 2556 203D.tmp 32 PID 2556 wrote to memory of 2668 2556 203D.tmp 32 PID 2556 wrote to memory of 2668 2556 203D.tmp 32 PID 2556 wrote to memory of 2668 2556 203D.tmp 32 PID 2668 wrote to memory of 2596 2668 2108.tmp 33 PID 2668 wrote to memory of 2596 2668 2108.tmp 33 PID 2668 wrote to memory of 2596 2668 2108.tmp 33 PID 2668 wrote to memory of 2596 2668 2108.tmp 33 PID 2596 wrote to memory of 2696 2596 2194.tmp 34 PID 2596 wrote to memory of 2696 2596 2194.tmp 34 PID 2596 wrote to memory of 2696 2596 2194.tmp 34 PID 2596 wrote to memory of 2696 2596 2194.tmp 34 PID 2696 wrote to memory of 1820 2696 2230.tmp 35 PID 2696 wrote to memory of 1820 2696 2230.tmp 35 PID 2696 wrote to memory of 1820 2696 2230.tmp 35 PID 2696 wrote to memory of 1820 2696 2230.tmp 35 PID 1820 wrote to memory of 2612 1820 22BD.tmp 36 PID 1820 wrote to memory of 2612 1820 22BD.tmp 36 PID 1820 wrote to memory of 2612 1820 22BD.tmp 36 PID 1820 wrote to memory of 2612 1820 22BD.tmp 36 PID 2612 wrote to memory of 2440 2612 232A.tmp 37 PID 2612 wrote to memory of 2440 2612 232A.tmp 37 PID 2612 wrote to memory of 2440 2612 232A.tmp 37 PID 2612 wrote to memory of 2440 2612 232A.tmp 37 PID 2440 wrote to memory of 2568 2440 23B6.tmp 38 PID 2440 wrote to memory of 2568 2440 23B6.tmp 38 PID 2440 wrote to memory of 2568 2440 23B6.tmp 38 PID 2440 wrote to memory of 2568 2440 23B6.tmp 38 PID 2568 wrote to memory of 2152 2568 2424.tmp 39 PID 2568 wrote to memory of 2152 2568 2424.tmp 39 PID 2568 wrote to memory of 2152 2568 2424.tmp 39 PID 2568 wrote to memory of 2152 2568 2424.tmp 39 PID 2152 wrote to memory of 2256 2152 24A0.tmp 40 PID 2152 wrote to memory of 2256 2152 24A0.tmp 40 PID 2152 wrote to memory of 2256 2152 24A0.tmp 40 PID 2152 wrote to memory of 2256 2152 24A0.tmp 40 PID 2256 wrote to memory of 2824 2256 252D.tmp 41 PID 2256 wrote to memory of 2824 2256 252D.tmp 41 PID 2256 wrote to memory of 2824 2256 252D.tmp 41 PID 2256 wrote to memory of 2824 2256 252D.tmp 41 PID 2824 wrote to memory of 2976 2824 25AA.tmp 42 PID 2824 wrote to memory of 2976 2824 25AA.tmp 42 PID 2824 wrote to memory of 2976 2824 25AA.tmp 42 PID 2824 wrote to memory of 2976 2824 25AA.tmp 42 PID 2976 wrote to memory of 2388 2976 2646.tmp 43 PID 2976 wrote to memory of 2388 2976 2646.tmp 43 PID 2976 wrote to memory of 2388 2976 2646.tmp 43 PID 2976 wrote to memory of 2388 2976 2646.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-04_cf1bc93275c71232641a890328232175_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-04_cf1bc93275c71232641a890328232175_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\1F63.tmp"C:\Users\Admin\AppData\Local\Temp\1F63.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\1FA1.tmp"C:\Users\Admin\AppData\Local\Temp\1FA1.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\203D.tmp"C:\Users\Admin\AppData\Local\Temp\203D.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\2108.tmp"C:\Users\Admin\AppData\Local\Temp\2108.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\2194.tmp"C:\Users\Admin\AppData\Local\Temp\2194.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\2230.tmp"C:\Users\Admin\AppData\Local\Temp\2230.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\22BD.tmp"C:\Users\Admin\AppData\Local\Temp\22BD.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\232A.tmp"C:\Users\Admin\AppData\Local\Temp\232A.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\23B6.tmp"C:\Users\Admin\AppData\Local\Temp\23B6.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\2424.tmp"C:\Users\Admin\AppData\Local\Temp\2424.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\24A0.tmp"C:\Users\Admin\AppData\Local\Temp\24A0.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\252D.tmp"C:\Users\Admin\AppData\Local\Temp\252D.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\25AA.tmp"C:\Users\Admin\AppData\Local\Temp\25AA.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\2646.tmp"C:\Users\Admin\AppData\Local\Temp\2646.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\26B3.tmp"C:\Users\Admin\AppData\Local\Temp\26B3.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\26F1.tmp"C:\Users\Admin\AppData\Local\Temp\26F1.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\277E.tmp"C:\Users\Admin\AppData\Local\Temp\277E.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:760 -
C:\Users\Admin\AppData\Local\Temp\27EB.tmp"C:\Users\Admin\AppData\Local\Temp\27EB.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\2887.tmp"C:\Users\Admin\AppData\Local\Temp\2887.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:884 -
C:\Users\Admin\AppData\Local\Temp\2923.tmp"C:\Users\Admin\AppData\Local\Temp\2923.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\29BF.tmp"C:\Users\Admin\AppData\Local\Temp\29BF.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:288 -
C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:868 -
C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:624 -
C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\2B16.tmp"C:\Users\Admin\AppData\Local\Temp\2B16.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\2B64.tmp"C:\Users\Admin\AppData\Local\Temp\2B64.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\2C00.tmp"C:\Users\Admin\AppData\Local\Temp\2C00.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:472 -
C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\2C9C.tmp"C:\Users\Admin\AppData\Local\Temp\2C9C.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:488 -
C:\Users\Admin\AppData\Local\Temp\2D28.tmp"C:\Users\Admin\AppData\Local\Temp\2D28.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:680 -
C:\Users\Admin\AppData\Local\Temp\2D76.tmp"C:\Users\Admin\AppData\Local\Temp\2D76.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\2E12.tmp"C:\Users\Admin\AppData\Local\Temp\2E12.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:824 -
C:\Users\Admin\AppData\Local\Temp\2E60.tmp"C:\Users\Admin\AppData\Local\Temp\2E60.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\2E9F.tmp"C:\Users\Admin\AppData\Local\Temp\2E9F.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\2EED.tmp"C:\Users\Admin\AppData\Local\Temp\2EED.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\2F79.tmp"C:\Users\Admin\AppData\Local\Temp\2F79.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\3015.tmp"C:\Users\Admin\AppData\Local\Temp\3015.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\3054.tmp"C:\Users\Admin\AppData\Local\Temp\3054.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:780 -
C:\Users\Admin\AppData\Local\Temp\3092.tmp"C:\Users\Admin\AppData\Local\Temp\3092.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\30E0.tmp"C:\Users\Admin\AppData\Local\Temp\30E0.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\312E.tmp"C:\Users\Admin\AppData\Local\Temp\312E.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:896 -
C:\Users\Admin\AppData\Local\Temp\316C.tmp"C:\Users\Admin\AppData\Local\Temp\316C.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\31BA.tmp"C:\Users\Admin\AppData\Local\Temp\31BA.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\3208.tmp"C:\Users\Admin\AppData\Local\Temp\3208.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\32D3.tmp"C:\Users\Admin\AppData\Local\Temp\32D3.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\3312.tmp"C:\Users\Admin\AppData\Local\Temp\3312.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:876 -
C:\Users\Admin\AppData\Local\Temp\3350.tmp"C:\Users\Admin\AppData\Local\Temp\3350.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\339E.tmp"C:\Users\Admin\AppData\Local\Temp\339E.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\33DC.tmp"C:\Users\Admin\AppData\Local\Temp\33DC.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\342A.tmp"C:\Users\Admin\AppData\Local\Temp\342A.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\3469.tmp"C:\Users\Admin\AppData\Local\Temp\3469.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\34A7.tmp"C:\Users\Admin\AppData\Local\Temp\34A7.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\34E6.tmp"C:\Users\Admin\AppData\Local\Temp\34E6.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\3534.tmp"C:\Users\Admin\AppData\Local\Temp\3534.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\3582.tmp"C:\Users\Admin\AppData\Local\Temp\3582.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\35C0.tmp"C:\Users\Admin\AppData\Local\Temp\35C0.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\35FE.tmp"C:\Users\Admin\AppData\Local\Temp\35FE.tmp"65⤵
- Executes dropped EXE
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\364C.tmp"C:\Users\Admin\AppData\Local\Temp\364C.tmp"66⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\369A.tmp"C:\Users\Admin\AppData\Local\Temp\369A.tmp"67⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\36D9.tmp"C:\Users\Admin\AppData\Local\Temp\36D9.tmp"68⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\3727.tmp"C:\Users\Admin\AppData\Local\Temp\3727.tmp"69⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\3765.tmp"C:\Users\Admin\AppData\Local\Temp\3765.tmp"70⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\37B3.tmp"C:\Users\Admin\AppData\Local\Temp\37B3.tmp"71⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\3801.tmp"C:\Users\Admin\AppData\Local\Temp\3801.tmp"72⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\3840.tmp"C:\Users\Admin\AppData\Local\Temp\3840.tmp"73⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\388E.tmp"C:\Users\Admin\AppData\Local\Temp\388E.tmp"74⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\38DC.tmp"C:\Users\Admin\AppData\Local\Temp\38DC.tmp"75⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\392A.tmp"C:\Users\Admin\AppData\Local\Temp\392A.tmp"76⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\3968.tmp"C:\Users\Admin\AppData\Local\Temp\3968.tmp"77⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\39A6.tmp"C:\Users\Admin\AppData\Local\Temp\39A6.tmp"78⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\39E5.tmp"C:\Users\Admin\AppData\Local\Temp\39E5.tmp"79⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\3A33.tmp"C:\Users\Admin\AppData\Local\Temp\3A33.tmp"80⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\3A81.tmp"C:\Users\Admin\AppData\Local\Temp\3A81.tmp"81⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\3ACF.tmp"C:\Users\Admin\AppData\Local\Temp\3ACF.tmp"82⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\3B0D.tmp"C:\Users\Admin\AppData\Local\Temp\3B0D.tmp"83⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\3B5B.tmp"C:\Users\Admin\AppData\Local\Temp\3B5B.tmp"84⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\3B9A.tmp"C:\Users\Admin\AppData\Local\Temp\3B9A.tmp"85⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\3BD8.tmp"C:\Users\Admin\AppData\Local\Temp\3BD8.tmp"86⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\3C16.tmp"C:\Users\Admin\AppData\Local\Temp\3C16.tmp"87⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\3C55.tmp"C:\Users\Admin\AppData\Local\Temp\3C55.tmp"88⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\3CA3.tmp"C:\Users\Admin\AppData\Local\Temp\3CA3.tmp"89⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\3CF1.tmp"C:\Users\Admin\AppData\Local\Temp\3CF1.tmp"90⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\3D3F.tmp"C:\Users\Admin\AppData\Local\Temp\3D3F.tmp"91⤵PID:288
-
C:\Users\Admin\AppData\Local\Temp\3D8D.tmp"C:\Users\Admin\AppData\Local\Temp\3D8D.tmp"92⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\3DDB.tmp"C:\Users\Admin\AppData\Local\Temp\3DDB.tmp"93⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\3E19.tmp"C:\Users\Admin\AppData\Local\Temp\3E19.tmp"94⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\3E58.tmp"C:\Users\Admin\AppData\Local\Temp\3E58.tmp"95⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\3E96.tmp"C:\Users\Admin\AppData\Local\Temp\3E96.tmp"96⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\3ED4.tmp"C:\Users\Admin\AppData\Local\Temp\3ED4.tmp"97⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\3F13.tmp"C:\Users\Admin\AppData\Local\Temp\3F13.tmp"98⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\3F51.tmp"C:\Users\Admin\AppData\Local\Temp\3F51.tmp"99⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\3F9F.tmp"C:\Users\Admin\AppData\Local\Temp\3F9F.tmp"100⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\3FDE.tmp"C:\Users\Admin\AppData\Local\Temp\3FDE.tmp"101⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\401C.tmp"C:\Users\Admin\AppData\Local\Temp\401C.tmp"102⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\406A.tmp"C:\Users\Admin\AppData\Local\Temp\406A.tmp"103⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\40A8.tmp"C:\Users\Admin\AppData\Local\Temp\40A8.tmp"104⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\40E7.tmp"C:\Users\Admin\AppData\Local\Temp\40E7.tmp"105⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\4125.tmp"C:\Users\Admin\AppData\Local\Temp\4125.tmp"106⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\4164.tmp"C:\Users\Admin\AppData\Local\Temp\4164.tmp"107⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\41A2.tmp"C:\Users\Admin\AppData\Local\Temp\41A2.tmp"108⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\41E0.tmp"C:\Users\Admin\AppData\Local\Temp\41E0.tmp"109⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\421F.tmp"C:\Users\Admin\AppData\Local\Temp\421F.tmp"110⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\425D.tmp"C:\Users\Admin\AppData\Local\Temp\425D.tmp"111⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\42AB.tmp"C:\Users\Admin\AppData\Local\Temp\42AB.tmp"112⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\42EA.tmp"C:\Users\Admin\AppData\Local\Temp\42EA.tmp"113⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\4338.tmp"C:\Users\Admin\AppData\Local\Temp\4338.tmp"114⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\4376.tmp"C:\Users\Admin\AppData\Local\Temp\4376.tmp"115⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\43C4.tmp"C:\Users\Admin\AppData\Local\Temp\43C4.tmp"116⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\4402.tmp"C:\Users\Admin\AppData\Local\Temp\4402.tmp"117⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\4441.tmp"C:\Users\Admin\AppData\Local\Temp\4441.tmp"118⤵PID:312
-
C:\Users\Admin\AppData\Local\Temp\447F.tmp"C:\Users\Admin\AppData\Local\Temp\447F.tmp"119⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\44CD.tmp"C:\Users\Admin\AppData\Local\Temp\44CD.tmp"120⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\450C.tmp"C:\Users\Admin\AppData\Local\Temp\450C.tmp"121⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\455A.tmp"C:\Users\Admin\AppData\Local\Temp\455A.tmp"122⤵PID:2000
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-