Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
27-05-2024 01:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-27_64266d0139de5507a49f0bddbc8fb833_mafia.exe
Resource
win7-20240419-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-27_64266d0139de5507a49f0bddbc8fb833_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-27_64266d0139de5507a49f0bddbc8fb833_mafia.exe
-
Size
520KB
-
MD5
64266d0139de5507a49f0bddbc8fb833
-
SHA1
aa8cd190d693ec81657713cbbb1288598bd1fd87
-
SHA256
e853d1615c27065e641930b440857cd79e4229179a98a72e798bb79fc0de1c98
-
SHA512
4f1e78bdb1f898b1d9c5bbaefc56d5e8a156e5877dfb53c8c013ac5067cb8f240f591996e89145411a4fd7e90bd30c158e28dc9dd213275300be21bc68831aca
-
SSDEEP
12288:gj8fuxR21t5i8fuxrpuahBkODGDTu1e94gNZ:gj8fuK1GYuxdVhtZ1Q5N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1616 1748.tmp 2396 1786.tmp 2272 1832.tmp 2664 18AF.tmp 2744 192C.tmp 2656 19B8.tmp 2824 1A35.tmp 2868 1AC1.tmp 2572 1B3E.tmp 2520 1B8C.tmp 2644 1C28.tmp 2364 1C95.tmp 1856 1D22.tmp 2700 1D7F.tmp 2956 1DBE.tmp 2268 1E2B.tmp 1032 1EB7.tmp 1956 1F34.tmp 2500 1FC0.tmp 1124 202E.tmp 2752 20AA.tmp 1288 2127.tmp 304 2175.tmp 552 21C3.tmp 2096 2211.tmp 2084 225F.tmp 2312 22AD.tmp 2504 22EC.tmp 2068 232A.tmp 2368 2368.tmp 1924 23B6.tmp 484 2404.tmp 748 2452.tmp 680 2491.tmp 1100 24CF.tmp 560 251D.tmp 1816 256B.tmp 1784 25B9.tmp 1692 25F8.tmp 2360 2636.tmp 1708 2674.tmp 1564 26C2.tmp 2028 2710.tmp 1608 274F.tmp 2004 278D.tmp 2924 27CC.tmp 880 281A.tmp 2232 2858.tmp 1696 28A6.tmp 1164 28E4.tmp 2216 2932.tmp 868 2971.tmp 1700 29AF.tmp 840 29FD.tmp 1764 2A4B.tmp 3048 2A8A.tmp 1560 2AD8.tmp 3044 2B16.tmp 1572 2B54.tmp 2704 2B93.tmp 2632 2BD1.tmp 2724 2C1F.tmp 2792 2C6D.tmp 2680 2CAC.tmp -
Loads dropped DLL 64 IoCs
pid Process 2888 2024-05-27_64266d0139de5507a49f0bddbc8fb833_mafia.exe 1616 1748.tmp 2396 1786.tmp 2272 1832.tmp 2664 18AF.tmp 2744 192C.tmp 2656 19B8.tmp 2824 1A35.tmp 2868 1AC1.tmp 2572 1B3E.tmp 2520 1B8C.tmp 2644 1C28.tmp 2364 1C95.tmp 1856 1D22.tmp 2700 1D7F.tmp 2956 1DBE.tmp 2268 1E2B.tmp 1032 1EB7.tmp 1956 1F34.tmp 2500 1FC0.tmp 1124 202E.tmp 2752 20AA.tmp 1288 2127.tmp 304 2175.tmp 552 21C3.tmp 2096 2211.tmp 2084 225F.tmp 2312 22AD.tmp 2504 22EC.tmp 2068 232A.tmp 2368 2368.tmp 1924 23B6.tmp 484 2404.tmp 748 2452.tmp 680 2491.tmp 1100 24CF.tmp 560 251D.tmp 1816 256B.tmp 1784 25B9.tmp 1692 25F8.tmp 2360 2636.tmp 1708 2674.tmp 1564 26C2.tmp 2028 2710.tmp 1608 274F.tmp 2004 278D.tmp 2924 27CC.tmp 880 281A.tmp 2232 2858.tmp 1696 28A6.tmp 1164 28E4.tmp 2216 2932.tmp 868 2971.tmp 1700 29AF.tmp 840 29FD.tmp 1764 2A4B.tmp 3048 2A8A.tmp 1560 2AD8.tmp 3044 2B16.tmp 1572 2B54.tmp 2704 2B93.tmp 2632 2BD1.tmp 2724 2C1F.tmp 2792 2C6D.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2888 wrote to memory of 1616 2888 2024-05-27_64266d0139de5507a49f0bddbc8fb833_mafia.exe 28 PID 2888 wrote to memory of 1616 2888 2024-05-27_64266d0139de5507a49f0bddbc8fb833_mafia.exe 28 PID 2888 wrote to memory of 1616 2888 2024-05-27_64266d0139de5507a49f0bddbc8fb833_mafia.exe 28 PID 2888 wrote to memory of 1616 2888 2024-05-27_64266d0139de5507a49f0bddbc8fb833_mafia.exe 28 PID 1616 wrote to memory of 2396 1616 1748.tmp 29 PID 1616 wrote to memory of 2396 1616 1748.tmp 29 PID 1616 wrote to memory of 2396 1616 1748.tmp 29 PID 1616 wrote to memory of 2396 1616 1748.tmp 29 PID 2396 wrote to memory of 2272 2396 1786.tmp 30 PID 2396 wrote to memory of 2272 2396 1786.tmp 30 PID 2396 wrote to memory of 2272 2396 1786.tmp 30 PID 2396 wrote to memory of 2272 2396 1786.tmp 30 PID 2272 wrote to memory of 2664 2272 1832.tmp 31 PID 2272 wrote to memory of 2664 2272 1832.tmp 31 PID 2272 wrote to memory of 2664 2272 1832.tmp 31 PID 2272 wrote to memory of 2664 2272 1832.tmp 31 PID 2664 wrote to memory of 2744 2664 18AF.tmp 32 PID 2664 wrote to memory of 2744 2664 18AF.tmp 32 PID 2664 wrote to memory of 2744 2664 18AF.tmp 32 PID 2664 wrote to memory of 2744 2664 18AF.tmp 32 PID 2744 wrote to memory of 2656 2744 192C.tmp 33 PID 2744 wrote to memory of 2656 2744 192C.tmp 33 PID 2744 wrote to memory of 2656 2744 192C.tmp 33 PID 2744 wrote to memory of 2656 2744 192C.tmp 33 PID 2656 wrote to memory of 2824 2656 19B8.tmp 34 PID 2656 wrote to memory of 2824 2656 19B8.tmp 34 PID 2656 wrote to memory of 2824 2656 19B8.tmp 34 PID 2656 wrote to memory of 2824 2656 19B8.tmp 34 PID 2824 wrote to memory of 2868 2824 1A35.tmp 35 PID 2824 wrote to memory of 2868 2824 1A35.tmp 35 PID 2824 wrote to memory of 2868 2824 1A35.tmp 35 PID 2824 wrote to memory of 2868 2824 1A35.tmp 35 PID 2868 wrote to memory of 2572 2868 1AC1.tmp 36 PID 2868 wrote to memory of 2572 2868 1AC1.tmp 36 PID 2868 wrote to memory of 2572 2868 1AC1.tmp 36 PID 2868 wrote to memory of 2572 2868 1AC1.tmp 36 PID 2572 wrote to memory of 2520 2572 1B3E.tmp 37 PID 2572 wrote to memory of 2520 2572 1B3E.tmp 37 PID 2572 wrote to memory of 2520 2572 1B3E.tmp 37 PID 2572 wrote to memory of 2520 2572 1B3E.tmp 37 PID 2520 wrote to memory of 2644 2520 1B8C.tmp 38 PID 2520 wrote to memory of 2644 2520 1B8C.tmp 38 PID 2520 wrote to memory of 2644 2520 1B8C.tmp 38 PID 2520 wrote to memory of 2644 2520 1B8C.tmp 38 PID 2644 wrote to memory of 2364 2644 1C28.tmp 39 PID 2644 wrote to memory of 2364 2644 1C28.tmp 39 PID 2644 wrote to memory of 2364 2644 1C28.tmp 39 PID 2644 wrote to memory of 2364 2644 1C28.tmp 39 PID 2364 wrote to memory of 1856 2364 1C95.tmp 40 PID 2364 wrote to memory of 1856 2364 1C95.tmp 40 PID 2364 wrote to memory of 1856 2364 1C95.tmp 40 PID 2364 wrote to memory of 1856 2364 1C95.tmp 40 PID 1856 wrote to memory of 2700 1856 1D22.tmp 41 PID 1856 wrote to memory of 2700 1856 1D22.tmp 41 PID 1856 wrote to memory of 2700 1856 1D22.tmp 41 PID 1856 wrote to memory of 2700 1856 1D22.tmp 41 PID 2700 wrote to memory of 2956 2700 1D7F.tmp 42 PID 2700 wrote to memory of 2956 2700 1D7F.tmp 42 PID 2700 wrote to memory of 2956 2700 1D7F.tmp 42 PID 2700 wrote to memory of 2956 2700 1D7F.tmp 42 PID 2956 wrote to memory of 2268 2956 1DBE.tmp 43 PID 2956 wrote to memory of 2268 2956 1DBE.tmp 43 PID 2956 wrote to memory of 2268 2956 1DBE.tmp 43 PID 2956 wrote to memory of 2268 2956 1DBE.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-27_64266d0139de5507a49f0bddbc8fb833_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-27_64266d0139de5507a49f0bddbc8fb833_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\1748.tmp"C:\Users\Admin\AppData\Local\Temp\1748.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\1786.tmp"C:\Users\Admin\AppData\Local\Temp\1786.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\1832.tmp"C:\Users\Admin\AppData\Local\Temp\1832.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\18AF.tmp"C:\Users\Admin\AppData\Local\Temp\18AF.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\192C.tmp"C:\Users\Admin\AppData\Local\Temp\192C.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\19B8.tmp"C:\Users\Admin\AppData\Local\Temp\19B8.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\1A35.tmp"C:\Users\Admin\AppData\Local\Temp\1A35.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\1B8C.tmp"C:\Users\Admin\AppData\Local\Temp\1B8C.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\1C28.tmp"C:\Users\Admin\AppData\Local\Temp\1C28.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\1C95.tmp"C:\Users\Admin\AppData\Local\Temp\1C95.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\1D22.tmp"C:\Users\Admin\AppData\Local\Temp\1D22.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\1F34.tmp"C:\Users\Admin\AppData\Local\Temp\1F34.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\202E.tmp"C:\Users\Admin\AppData\Local\Temp\202E.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\20AA.tmp"C:\Users\Admin\AppData\Local\Temp\20AA.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\2127.tmp"C:\Users\Admin\AppData\Local\Temp\2127.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\2175.tmp"C:\Users\Admin\AppData\Local\Temp\2175.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:304 -
C:\Users\Admin\AppData\Local\Temp\21C3.tmp"C:\Users\Admin\AppData\Local\Temp\21C3.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:552 -
C:\Users\Admin\AppData\Local\Temp\2211.tmp"C:\Users\Admin\AppData\Local\Temp\2211.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\225F.tmp"C:\Users\Admin\AppData\Local\Temp\225F.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\22AD.tmp"C:\Users\Admin\AppData\Local\Temp\22AD.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\22EC.tmp"C:\Users\Admin\AppData\Local\Temp\22EC.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\232A.tmp"C:\Users\Admin\AppData\Local\Temp\232A.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\2368.tmp"C:\Users\Admin\AppData\Local\Temp\2368.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\23B6.tmp"C:\Users\Admin\AppData\Local\Temp\23B6.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\2404.tmp"C:\Users\Admin\AppData\Local\Temp\2404.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:484 -
C:\Users\Admin\AppData\Local\Temp\2452.tmp"C:\Users\Admin\AppData\Local\Temp\2452.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:748 -
C:\Users\Admin\AppData\Local\Temp\2491.tmp"C:\Users\Admin\AppData\Local\Temp\2491.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:680 -
C:\Users\Admin\AppData\Local\Temp\24CF.tmp"C:\Users\Admin\AppData\Local\Temp\24CF.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\251D.tmp"C:\Users\Admin\AppData\Local\Temp\251D.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:560 -
C:\Users\Admin\AppData\Local\Temp\256B.tmp"C:\Users\Admin\AppData\Local\Temp\256B.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\25B9.tmp"C:\Users\Admin\AppData\Local\Temp\25B9.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\25F8.tmp"C:\Users\Admin\AppData\Local\Temp\25F8.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\2636.tmp"C:\Users\Admin\AppData\Local\Temp\2636.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\2674.tmp"C:\Users\Admin\AppData\Local\Temp\2674.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\26C2.tmp"C:\Users\Admin\AppData\Local\Temp\26C2.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\2710.tmp"C:\Users\Admin\AppData\Local\Temp\2710.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\274F.tmp"C:\Users\Admin\AppData\Local\Temp\274F.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\278D.tmp"C:\Users\Admin\AppData\Local\Temp\278D.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\27CC.tmp"C:\Users\Admin\AppData\Local\Temp\27CC.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\281A.tmp"C:\Users\Admin\AppData\Local\Temp\281A.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:880 -
C:\Users\Admin\AppData\Local\Temp\2858.tmp"C:\Users\Admin\AppData\Local\Temp\2858.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\28A6.tmp"C:\Users\Admin\AppData\Local\Temp\28A6.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\28E4.tmp"C:\Users\Admin\AppData\Local\Temp\28E4.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\2932.tmp"C:\Users\Admin\AppData\Local\Temp\2932.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\2971.tmp"C:\Users\Admin\AppData\Local\Temp\2971.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:868 -
C:\Users\Admin\AppData\Local\Temp\29AF.tmp"C:\Users\Admin\AppData\Local\Temp\29AF.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\29FD.tmp"C:\Users\Admin\AppData\Local\Temp\29FD.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:840 -
C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\2B16.tmp"C:\Users\Admin\AppData\Local\Temp\2B16.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\2B54.tmp"C:\Users\Admin\AppData\Local\Temp\2B54.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\2B93.tmp"C:\Users\Admin\AppData\Local\Temp\2B93.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\2C1F.tmp"C:\Users\Admin\AppData\Local\Temp\2C1F.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"65⤵
- Executes dropped EXE
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"66⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\2D38.tmp"C:\Users\Admin\AppData\Local\Temp\2D38.tmp"67⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\2D76.tmp"C:\Users\Admin\AppData\Local\Temp\2D76.tmp"68⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"69⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"70⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\2E32.tmp"C:\Users\Admin\AppData\Local\Temp\2E32.tmp"71⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\2E70.tmp"C:\Users\Admin\AppData\Local\Temp\2E70.tmp"72⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"73⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\2EED.tmp"C:\Users\Admin\AppData\Local\Temp\2EED.tmp"74⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\2F3B.tmp"C:\Users\Admin\AppData\Local\Temp\2F3B.tmp"75⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\2F79.tmp"C:\Users\Admin\AppData\Local\Temp\2F79.tmp"76⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"77⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"78⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\3034.tmp"C:\Users\Admin\AppData\Local\Temp\3034.tmp"79⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\3073.tmp"C:\Users\Admin\AppData\Local\Temp\3073.tmp"80⤵PID:288
-
C:\Users\Admin\AppData\Local\Temp\30C1.tmp"C:\Users\Admin\AppData\Local\Temp\30C1.tmp"81⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\30FF.tmp"C:\Users\Admin\AppData\Local\Temp\30FF.tmp"82⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\313E.tmp"C:\Users\Admin\AppData\Local\Temp\313E.tmp"83⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\317C.tmp"C:\Users\Admin\AppData\Local\Temp\317C.tmp"84⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\31BA.tmp"C:\Users\Admin\AppData\Local\Temp\31BA.tmp"85⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\31F9.tmp"C:\Users\Admin\AppData\Local\Temp\31F9.tmp"86⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\3247.tmp"C:\Users\Admin\AppData\Local\Temp\3247.tmp"87⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\3285.tmp"C:\Users\Admin\AppData\Local\Temp\3285.tmp"88⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\32C4.tmp"C:\Users\Admin\AppData\Local\Temp\32C4.tmp"89⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\3302.tmp"C:\Users\Admin\AppData\Local\Temp\3302.tmp"90⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\3340.tmp"C:\Users\Admin\AppData\Local\Temp\3340.tmp"91⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\338E.tmp"C:\Users\Admin\AppData\Local\Temp\338E.tmp"92⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\33CD.tmp"C:\Users\Admin\AppData\Local\Temp\33CD.tmp"93⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\341B.tmp"C:\Users\Admin\AppData\Local\Temp\341B.tmp"94⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\3459.tmp"C:\Users\Admin\AppData\Local\Temp\3459.tmp"95⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\3498.tmp"C:\Users\Admin\AppData\Local\Temp\3498.tmp"96⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\34D6.tmp"C:\Users\Admin\AppData\Local\Temp\34D6.tmp"97⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\3514.tmp"C:\Users\Admin\AppData\Local\Temp\3514.tmp"98⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\3553.tmp"C:\Users\Admin\AppData\Local\Temp\3553.tmp"99⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\3591.tmp"C:\Users\Admin\AppData\Local\Temp\3591.tmp"100⤵PID:340
-
C:\Users\Admin\AppData\Local\Temp\35D0.tmp"C:\Users\Admin\AppData\Local\Temp\35D0.tmp"101⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\360E.tmp"C:\Users\Admin\AppData\Local\Temp\360E.tmp"102⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\365C.tmp"C:\Users\Admin\AppData\Local\Temp\365C.tmp"103⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\369A.tmp"C:\Users\Admin\AppData\Local\Temp\369A.tmp"104⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\36E8.tmp"C:\Users\Admin\AppData\Local\Temp\36E8.tmp"105⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\3727.tmp"C:\Users\Admin\AppData\Local\Temp\3727.tmp"106⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\3765.tmp"C:\Users\Admin\AppData\Local\Temp\3765.tmp"107⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\37A4.tmp"C:\Users\Admin\AppData\Local\Temp\37A4.tmp"108⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\37E2.tmp"C:\Users\Admin\AppData\Local\Temp\37E2.tmp"109⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\3820.tmp"C:\Users\Admin\AppData\Local\Temp\3820.tmp"110⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\385F.tmp"C:\Users\Admin\AppData\Local\Temp\385F.tmp"111⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\38AD.tmp"C:\Users\Admin\AppData\Local\Temp\38AD.tmp"112⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\38FB.tmp"C:\Users\Admin\AppData\Local\Temp\38FB.tmp"113⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\3949.tmp"C:\Users\Admin\AppData\Local\Temp\3949.tmp"114⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\3987.tmp"C:\Users\Admin\AppData\Local\Temp\3987.tmp"115⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\39C6.tmp"C:\Users\Admin\AppData\Local\Temp\39C6.tmp"116⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\3A14.tmp"C:\Users\Admin\AppData\Local\Temp\3A14.tmp"117⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\3A62.tmp"C:\Users\Admin\AppData\Local\Temp\3A62.tmp"118⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\3AA0.tmp"C:\Users\Admin\AppData\Local\Temp\3AA0.tmp"119⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\3ADE.tmp"C:\Users\Admin\AppData\Local\Temp\3ADE.tmp"120⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\3B1D.tmp"C:\Users\Admin\AppData\Local\Temp\3B1D.tmp"121⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\3B5B.tmp"C:\Users\Admin\AppData\Local\Temp\3B5B.tmp"122⤵PID:3064
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-