Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
09-05-2024 12:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-09_ad3ebb4caa508935eacdf046b24672e1_mafia.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-09_ad3ebb4caa508935eacdf046b24672e1_mafia.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-09_ad3ebb4caa508935eacdf046b24672e1_mafia.exe
-
Size
486KB
-
MD5
ad3ebb4caa508935eacdf046b24672e1
-
SHA1
ee813ea8c45f25b7df2e91753c36492557718603
-
SHA256
2ff5d20e5d1482498c584e11fd1f4b635bbff562b0a7850b4c713d42588868d8
-
SHA512
453d6e20ec0756042566f8d21ee8632dc11976a2754c905cc0a465074fc1d3fbdea7b95405ea742d449dc33a79a2e10947398e483f0b9f10820e57d40ff7875a
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7SbsqMwoq83CSZa2ca2sAVcdA1he7e+71oanT:/U5rCOTeiDS4qqvk3a2sR7XBvylQNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2372 19F6.tmp 2164 1A54.tmp 1720 1AA2.tmp 1884 1B00.tmp 2720 1B4E.tmp 2576 1B9C.tmp 2648 1BF9.tmp 2804 1C38.tmp 2612 1C86.tmp 2460 1CC4.tmp 2596 1D22.tmp 2436 1D60.tmp 2552 1DBE.tmp 3016 1DFC.tmp 1484 1E3A.tmp 2856 1E88.tmp 1204 1EC7.tmp 2500 1F15.tmp 1940 1F63.tmp 1612 1FB1.tmp 2784 1FEF.tmp 1468 202E.tmp 2360 207C.tmp 1780 20BA.tmp 2004 2108.tmp 2528 2146.tmp 2252 2185.tmp 2108 21C3.tmp 2260 2202.tmp 796 2240.tmp 668 227E.tmp 728 22BD.tmp 112 22FB.tmp 1456 233A.tmp 808 2378.tmp 2400 23B6.tmp 2944 23F5.tmp 1044 2433.tmp 2776 2472.tmp 2100 24B0.tmp 1440 24EE.tmp 1552 252D.tmp 1128 255C.tmp 1080 259A.tmp 2136 25D8.tmp 1096 2617.tmp 1036 2646.tmp 1312 2684.tmp 2796 26C2.tmp 3056 2701.tmp 2848 273F.tmp 2936 277E.tmp 888 27BC.tmp 2288 27FA.tmp 1604 2839.tmp 760 2877.tmp 2152 28A6.tmp 2372 28D5.tmp 2164 2913.tmp 2512 2952.tmp 2220 2990.tmp 2524 29BF.tmp 2744 29FD.tmp 1924 2A3C.tmp -
Loads dropped DLL 64 IoCs
pid Process 1736 2024-05-09_ad3ebb4caa508935eacdf046b24672e1_mafia.exe 2372 19F6.tmp 2164 1A54.tmp 1720 1AA2.tmp 1884 1B00.tmp 2720 1B4E.tmp 2576 1B9C.tmp 2648 1BF9.tmp 2804 1C38.tmp 2612 1C86.tmp 2460 1CC4.tmp 2596 1D22.tmp 2436 1D60.tmp 2552 1DBE.tmp 3016 1DFC.tmp 1484 1E3A.tmp 2856 1E88.tmp 1204 1EC7.tmp 2500 1F15.tmp 1940 1F63.tmp 1612 1FB1.tmp 2784 1FEF.tmp 1468 202E.tmp 2360 207C.tmp 1780 20BA.tmp 2004 2108.tmp 2528 2146.tmp 2252 2185.tmp 2108 21C3.tmp 2260 2202.tmp 796 2240.tmp 668 227E.tmp 728 22BD.tmp 112 22FB.tmp 1456 233A.tmp 808 2378.tmp 2400 23B6.tmp 2944 23F5.tmp 1044 2433.tmp 2776 2472.tmp 2100 24B0.tmp 1440 24EE.tmp 1552 252D.tmp 1128 255C.tmp 1080 259A.tmp 2136 25D8.tmp 1096 2617.tmp 1036 2646.tmp 1312 2684.tmp 2796 26C2.tmp 3056 2701.tmp 2848 273F.tmp 2936 277E.tmp 888 27BC.tmp 2288 27FA.tmp 1604 2839.tmp 760 2877.tmp 2152 28A6.tmp 2372 28D5.tmp 2164 2913.tmp 2512 2952.tmp 2220 2990.tmp 2524 29BF.tmp 2744 29FD.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1736 wrote to memory of 2372 1736 2024-05-09_ad3ebb4caa508935eacdf046b24672e1_mafia.exe 28 PID 1736 wrote to memory of 2372 1736 2024-05-09_ad3ebb4caa508935eacdf046b24672e1_mafia.exe 28 PID 1736 wrote to memory of 2372 1736 2024-05-09_ad3ebb4caa508935eacdf046b24672e1_mafia.exe 28 PID 1736 wrote to memory of 2372 1736 2024-05-09_ad3ebb4caa508935eacdf046b24672e1_mafia.exe 28 PID 2372 wrote to memory of 2164 2372 19F6.tmp 86 PID 2372 wrote to memory of 2164 2372 19F6.tmp 86 PID 2372 wrote to memory of 2164 2372 19F6.tmp 86 PID 2372 wrote to memory of 2164 2372 19F6.tmp 86 PID 2164 wrote to memory of 1720 2164 1A54.tmp 30 PID 2164 wrote to memory of 1720 2164 1A54.tmp 30 PID 2164 wrote to memory of 1720 2164 1A54.tmp 30 PID 2164 wrote to memory of 1720 2164 1A54.tmp 30 PID 1720 wrote to memory of 1884 1720 1AA2.tmp 31 PID 1720 wrote to memory of 1884 1720 1AA2.tmp 31 PID 1720 wrote to memory of 1884 1720 1AA2.tmp 31 PID 1720 wrote to memory of 1884 1720 1AA2.tmp 31 PID 1884 wrote to memory of 2720 1884 1B00.tmp 32 PID 1884 wrote to memory of 2720 1884 1B00.tmp 32 PID 1884 wrote to memory of 2720 1884 1B00.tmp 32 PID 1884 wrote to memory of 2720 1884 1B00.tmp 32 PID 2720 wrote to memory of 2576 2720 1B4E.tmp 33 PID 2720 wrote to memory of 2576 2720 1B4E.tmp 33 PID 2720 wrote to memory of 2576 2720 1B4E.tmp 33 PID 2720 wrote to memory of 2576 2720 1B4E.tmp 33 PID 2576 wrote to memory of 2648 2576 1B9C.tmp 34 PID 2576 wrote to memory of 2648 2576 1B9C.tmp 34 PID 2576 wrote to memory of 2648 2576 1B9C.tmp 34 PID 2576 wrote to memory of 2648 2576 1B9C.tmp 34 PID 2648 wrote to memory of 2804 2648 1BF9.tmp 35 PID 2648 wrote to memory of 2804 2648 1BF9.tmp 35 PID 2648 wrote to memory of 2804 2648 1BF9.tmp 35 PID 2648 wrote to memory of 2804 2648 1BF9.tmp 35 PID 2804 wrote to memory of 2612 2804 1C38.tmp 36 PID 2804 wrote to memory of 2612 2804 1C38.tmp 36 PID 2804 wrote to memory of 2612 2804 1C38.tmp 36 PID 2804 wrote to memory of 2612 2804 1C38.tmp 36 PID 2612 wrote to memory of 2460 2612 1C86.tmp 37 PID 2612 wrote to memory of 2460 2612 1C86.tmp 37 PID 2612 wrote to memory of 2460 2612 1C86.tmp 37 PID 2612 wrote to memory of 2460 2612 1C86.tmp 37 PID 2460 wrote to memory of 2596 2460 1CC4.tmp 38 PID 2460 wrote to memory of 2596 2460 1CC4.tmp 38 PID 2460 wrote to memory of 2596 2460 1CC4.tmp 38 PID 2460 wrote to memory of 2596 2460 1CC4.tmp 38 PID 2596 wrote to memory of 2436 2596 1D22.tmp 39 PID 2596 wrote to memory of 2436 2596 1D22.tmp 39 PID 2596 wrote to memory of 2436 2596 1D22.tmp 39 PID 2596 wrote to memory of 2436 2596 1D22.tmp 39 PID 2436 wrote to memory of 2552 2436 1D60.tmp 40 PID 2436 wrote to memory of 2552 2436 1D60.tmp 40 PID 2436 wrote to memory of 2552 2436 1D60.tmp 40 PID 2436 wrote to memory of 2552 2436 1D60.tmp 40 PID 2552 wrote to memory of 3016 2552 1DBE.tmp 41 PID 2552 wrote to memory of 3016 2552 1DBE.tmp 41 PID 2552 wrote to memory of 3016 2552 1DBE.tmp 41 PID 2552 wrote to memory of 3016 2552 1DBE.tmp 41 PID 3016 wrote to memory of 1484 3016 1DFC.tmp 104 PID 3016 wrote to memory of 1484 3016 1DFC.tmp 104 PID 3016 wrote to memory of 1484 3016 1DFC.tmp 104 PID 3016 wrote to memory of 1484 3016 1DFC.tmp 104 PID 1484 wrote to memory of 2856 1484 1E3A.tmp 43 PID 1484 wrote to memory of 2856 1484 1E3A.tmp 43 PID 1484 wrote to memory of 2856 1484 1E3A.tmp 43 PID 1484 wrote to memory of 2856 1484 1E3A.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-09_ad3ebb4caa508935eacdf046b24672e1_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-09_ad3ebb4caa508935eacdf046b24672e1_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\19F6.tmp"C:\Users\Admin\AppData\Local\Temp\19F6.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\1A54.tmp"C:\Users\Admin\AppData\Local\Temp\1A54.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\1B00.tmp"C:\Users\Admin\AppData\Local\Temp\1B00.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\1BF9.tmp"C:\Users\Admin\AppData\Local\Temp\1BF9.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\1C38.tmp"C:\Users\Admin\AppData\Local\Temp\1C38.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\1C86.tmp"C:\Users\Admin\AppData\Local\Temp\1C86.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\1D22.tmp"C:\Users\Admin\AppData\Local\Temp\1D22.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\1D60.tmp"C:\Users\Admin\AppData\Local\Temp\1D60.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\1E88.tmp"C:\Users\Admin\AppData\Local\Temp\1E88.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\1F15.tmp"C:\Users\Admin\AppData\Local\Temp\1F15.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\1F63.tmp"C:\Users\Admin\AppData\Local\Temp\1F63.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\202E.tmp"C:\Users\Admin\AppData\Local\Temp\202E.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\207C.tmp"C:\Users\Admin\AppData\Local\Temp\207C.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\20BA.tmp"C:\Users\Admin\AppData\Local\Temp\20BA.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\2108.tmp"C:\Users\Admin\AppData\Local\Temp\2108.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\2146.tmp"C:\Users\Admin\AppData\Local\Temp\2146.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\2185.tmp"C:\Users\Admin\AppData\Local\Temp\2185.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\21C3.tmp"C:\Users\Admin\AppData\Local\Temp\21C3.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\2202.tmp"C:\Users\Admin\AppData\Local\Temp\2202.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\2240.tmp"C:\Users\Admin\AppData\Local\Temp\2240.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:796 -
C:\Users\Admin\AppData\Local\Temp\227E.tmp"C:\Users\Admin\AppData\Local\Temp\227E.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:668 -
C:\Users\Admin\AppData\Local\Temp\22BD.tmp"C:\Users\Admin\AppData\Local\Temp\22BD.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:728 -
C:\Users\Admin\AppData\Local\Temp\22FB.tmp"C:\Users\Admin\AppData\Local\Temp\22FB.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:112 -
C:\Users\Admin\AppData\Local\Temp\233A.tmp"C:\Users\Admin\AppData\Local\Temp\233A.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\2378.tmp"C:\Users\Admin\AppData\Local\Temp\2378.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:808 -
C:\Users\Admin\AppData\Local\Temp\23B6.tmp"C:\Users\Admin\AppData\Local\Temp\23B6.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\23F5.tmp"C:\Users\Admin\AppData\Local\Temp\23F5.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\2433.tmp"C:\Users\Admin\AppData\Local\Temp\2433.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\2472.tmp"C:\Users\Admin\AppData\Local\Temp\2472.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\24B0.tmp"C:\Users\Admin\AppData\Local\Temp\24B0.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\24EE.tmp"C:\Users\Admin\AppData\Local\Temp\24EE.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\252D.tmp"C:\Users\Admin\AppData\Local\Temp\252D.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\259A.tmp"C:\Users\Admin\AppData\Local\Temp\259A.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\25D8.tmp"C:\Users\Admin\AppData\Local\Temp\25D8.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\2646.tmp"C:\Users\Admin\AppData\Local\Temp\2646.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\2684.tmp"C:\Users\Admin\AppData\Local\Temp\2684.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\26C2.tmp"C:\Users\Admin\AppData\Local\Temp\26C2.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\2701.tmp"C:\Users\Admin\AppData\Local\Temp\2701.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\273F.tmp"C:\Users\Admin\AppData\Local\Temp\273F.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\277E.tmp"C:\Users\Admin\AppData\Local\Temp\277E.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\27BC.tmp"C:\Users\Admin\AppData\Local\Temp\27BC.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:888 -
C:\Users\Admin\AppData\Local\Temp\27FA.tmp"C:\Users\Admin\AppData\Local\Temp\27FA.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\2839.tmp"C:\Users\Admin\AppData\Local\Temp\2839.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\2877.tmp"C:\Users\Admin\AppData\Local\Temp\2877.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:760 -
C:\Users\Admin\AppData\Local\Temp\28A6.tmp"C:\Users\Admin\AppData\Local\Temp\28A6.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\28D5.tmp"C:\Users\Admin\AppData\Local\Temp\28D5.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\2913.tmp"C:\Users\Admin\AppData\Local\Temp\2913.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\2952.tmp"C:\Users\Admin\AppData\Local\Temp\2952.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\2990.tmp"C:\Users\Admin\AppData\Local\Temp\2990.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\29BF.tmp"C:\Users\Admin\AppData\Local\Temp\29BF.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\29FD.tmp"C:\Users\Admin\AppData\Local\Temp\29FD.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"65⤵
- Executes dropped EXE
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"66⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"67⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"68⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\2B26.tmp"C:\Users\Admin\AppData\Local\Temp\2B26.tmp"69⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\2B64.tmp"C:\Users\Admin\AppData\Local\Temp\2B64.tmp"70⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"71⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\2BE1.tmp"C:\Users\Admin\AppData\Local\Temp\2BE1.tmp"72⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\2C1F.tmp"C:\Users\Admin\AppData\Local\Temp\2C1F.tmp"73⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"74⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"75⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"76⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\2D19.tmp"C:\Users\Admin\AppData\Local\Temp\2D19.tmp"77⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\2D57.tmp"C:\Users\Admin\AppData\Local\Temp\2D57.tmp"78⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\2D86.tmp"C:\Users\Admin\AppData\Local\Temp\2D86.tmp"79⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"80⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"81⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\2E41.tmp"C:\Users\Admin\AppData\Local\Temp\2E41.tmp"82⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"83⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"84⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"85⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\2F79.tmp"C:\Users\Admin\AppData\Local\Temp\2F79.tmp"86⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"87⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\3025.tmp"C:\Users\Admin\AppData\Local\Temp\3025.tmp"88⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\3073.tmp"C:\Users\Admin\AppData\Local\Temp\3073.tmp"89⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\30B1.tmp"C:\Users\Admin\AppData\Local\Temp\30B1.tmp"90⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\310F.tmp"C:\Users\Admin\AppData\Local\Temp\310F.tmp"91⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\319B.tmp"C:\Users\Admin\AppData\Local\Temp\319B.tmp"92⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\3208.tmp"C:\Users\Admin\AppData\Local\Temp\3208.tmp"93⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\3266.tmp"C:\Users\Admin\AppData\Local\Temp\3266.tmp"94⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\32A4.tmp"C:\Users\Admin\AppData\Local\Temp\32A4.tmp"95⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\32E3.tmp"C:\Users\Admin\AppData\Local\Temp\32E3.tmp"96⤵PID:500
-
C:\Users\Admin\AppData\Local\Temp\3331.tmp"C:\Users\Admin\AppData\Local\Temp\3331.tmp"97⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\336F.tmp"C:\Users\Admin\AppData\Local\Temp\336F.tmp"98⤵PID:608
-
C:\Users\Admin\AppData\Local\Temp\33AE.tmp"C:\Users\Admin\AppData\Local\Temp\33AE.tmp"99⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\33EC.tmp"C:\Users\Admin\AppData\Local\Temp\33EC.tmp"100⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\342A.tmp"C:\Users\Admin\AppData\Local\Temp\342A.tmp"101⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\3469.tmp"C:\Users\Admin\AppData\Local\Temp\3469.tmp"102⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\34A7.tmp"C:\Users\Admin\AppData\Local\Temp\34A7.tmp"103⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\34E6.tmp"C:\Users\Admin\AppData\Local\Temp\34E6.tmp"104⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\3524.tmp"C:\Users\Admin\AppData\Local\Temp\3524.tmp"105⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\3562.tmp"C:\Users\Admin\AppData\Local\Temp\3562.tmp"106⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\35A1.tmp"C:\Users\Admin\AppData\Local\Temp\35A1.tmp"107⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\35DF.tmp"C:\Users\Admin\AppData\Local\Temp\35DF.tmp"108⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\361E.tmp"C:\Users\Admin\AppData\Local\Temp\361E.tmp"109⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\365C.tmp"C:\Users\Admin\AppData\Local\Temp\365C.tmp"110⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\369A.tmp"C:\Users\Admin\AppData\Local\Temp\369A.tmp"111⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\36D9.tmp"C:\Users\Admin\AppData\Local\Temp\36D9.tmp"112⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\3717.tmp"C:\Users\Admin\AppData\Local\Temp\3717.tmp"113⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\3756.tmp"C:\Users\Admin\AppData\Local\Temp\3756.tmp"114⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\3794.tmp"C:\Users\Admin\AppData\Local\Temp\3794.tmp"115⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\37D2.tmp"C:\Users\Admin\AppData\Local\Temp\37D2.tmp"116⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\3811.tmp"C:\Users\Admin\AppData\Local\Temp\3811.tmp"117⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\384F.tmp"C:\Users\Admin\AppData\Local\Temp\384F.tmp"118⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\387E.tmp"C:\Users\Admin\AppData\Local\Temp\387E.tmp"119⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\38AD.tmp"C:\Users\Admin\AppData\Local\Temp\38AD.tmp"120⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\38EB.tmp"C:\Users\Admin\AppData\Local\Temp\38EB.tmp"121⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\391A.tmp"C:\Users\Admin\AppData\Local\Temp\391A.tmp"122⤵PID:2288
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-