Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01-06-2024 19:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-01_11b44bd0414beaa03fb73d73191cce16_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-01_11b44bd0414beaa03fb73d73191cce16_mafia.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-06-01_11b44bd0414beaa03fb73d73191cce16_mafia.exe
-
Size
712KB
-
MD5
11b44bd0414beaa03fb73d73191cce16
-
SHA1
31158983de2ca5af37ee8c546e54d898392c839b
-
SHA256
d552e30c34b72fab6bd4415b89930c1b1b04da09ca9a6ff0743fa2ec147deb13
-
SHA512
25099daf7ceca3a8ccaec69ddf9b1ca521e208473a618b5d3f6d912770a7069feb651259a32748f43380668ef41f953f31e4a24925d39561376eab58bef2cd06
-
SSDEEP
12288:FU5rCOTeiDC/cZsQsmgnakEx43nrAr6wL4NZdCvq5TJLCvY90D8/LVBlVk736Y7k:FUQOJDC/os/R58oNnCvq5TJLCvY90D8N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2356 4F0.tmp 2804 56D.tmp 2520 5CB.tmp 2648 667.tmp 2568 6D4.tmp 2544 732.tmp 2188 78F.tmp 2312 7ED.tmp 2524 83B.tmp 2456 889.tmp 2916 8D7.tmp 1004 934.tmp 2460 982.tmp 2716 9D0.tmp 2776 A1E.tmp 2296 A7C.tmp 1916 ACA.tmp 1616 B37.tmp 1476 BC4.tmp 2772 C12.tmp 2168 C6F.tmp 1432 CDC.tmp 1312 D2A.tmp 2948 D78.tmp 2808 DB7.tmp 2232 DF5.tmp 2072 E43.tmp 1896 E91.tmp 2444 ED0.tmp 664 F1E.tmp 764 F5C.tmp 1408 F9A.tmp 1508 FD9.tmp 1828 1017.tmp 1712 1065.tmp 2496 10A4.tmp 904 10D2.tmp 3056 1111.tmp 2288 114F.tmp 2680 119D.tmp 972 11DC.tmp 1208 122A.tmp 1280 1268.tmp 352 12A6.tmp 2036 12E5.tmp 848 1323.tmp 1172 1362.tmp 2008 13A0.tmp 2272 13CF.tmp 2320 140D.tmp 1904 144C.tmp 2024 148A.tmp 880 14C8.tmp 2484 1507.tmp 2328 1545.tmp 1524 1593.tmp 2700 15F1.tmp 1636 163F.tmp 2356 166E.tmp 1968 16AC.tmp 2560 16FA.tmp 2520 1758.tmp 2824 17B5.tmp 2556 1822.tmp -
Loads dropped DLL 64 IoCs
pid Process 2280 2024-06-01_11b44bd0414beaa03fb73d73191cce16_mafia.exe 2356 4F0.tmp 2804 56D.tmp 2520 5CB.tmp 2648 667.tmp 2568 6D4.tmp 2544 732.tmp 2188 78F.tmp 2312 7ED.tmp 2524 83B.tmp 2456 889.tmp 2916 8D7.tmp 1004 934.tmp 2460 982.tmp 2716 9D0.tmp 2776 A1E.tmp 2296 A7C.tmp 1916 ACA.tmp 1616 B37.tmp 1476 BC4.tmp 2772 C12.tmp 2168 C6F.tmp 1432 CDC.tmp 1312 D2A.tmp 2948 D78.tmp 2808 DB7.tmp 2232 DF5.tmp 2072 E43.tmp 1896 E91.tmp 2444 ED0.tmp 664 F1E.tmp 764 F5C.tmp 1408 F9A.tmp 1508 FD9.tmp 1828 1017.tmp 1712 1065.tmp 2496 10A4.tmp 904 10D2.tmp 3056 1111.tmp 2288 114F.tmp 2680 119D.tmp 972 11DC.tmp 1208 122A.tmp 1280 1268.tmp 352 12A6.tmp 2036 12E5.tmp 848 1323.tmp 1172 1362.tmp 2008 13A0.tmp 2272 13CF.tmp 2320 140D.tmp 1904 144C.tmp 2024 148A.tmp 880 14C8.tmp 2484 1507.tmp 2328 1545.tmp 1524 1593.tmp 2700 15F1.tmp 1636 163F.tmp 2356 166E.tmp 1968 16AC.tmp 2560 16FA.tmp 2520 1758.tmp 2824 17B5.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2280 wrote to memory of 2356 2280 2024-06-01_11b44bd0414beaa03fb73d73191cce16_mafia.exe 28 PID 2280 wrote to memory of 2356 2280 2024-06-01_11b44bd0414beaa03fb73d73191cce16_mafia.exe 28 PID 2280 wrote to memory of 2356 2280 2024-06-01_11b44bd0414beaa03fb73d73191cce16_mafia.exe 28 PID 2280 wrote to memory of 2356 2280 2024-06-01_11b44bd0414beaa03fb73d73191cce16_mafia.exe 28 PID 2356 wrote to memory of 2804 2356 4F0.tmp 29 PID 2356 wrote to memory of 2804 2356 4F0.tmp 29 PID 2356 wrote to memory of 2804 2356 4F0.tmp 29 PID 2356 wrote to memory of 2804 2356 4F0.tmp 29 PID 2804 wrote to memory of 2520 2804 56D.tmp 30 PID 2804 wrote to memory of 2520 2804 56D.tmp 30 PID 2804 wrote to memory of 2520 2804 56D.tmp 30 PID 2804 wrote to memory of 2520 2804 56D.tmp 30 PID 2520 wrote to memory of 2648 2520 5CB.tmp 31 PID 2520 wrote to memory of 2648 2520 5CB.tmp 31 PID 2520 wrote to memory of 2648 2520 5CB.tmp 31 PID 2520 wrote to memory of 2648 2520 5CB.tmp 31 PID 2648 wrote to memory of 2568 2648 667.tmp 32 PID 2648 wrote to memory of 2568 2648 667.tmp 32 PID 2648 wrote to memory of 2568 2648 667.tmp 32 PID 2648 wrote to memory of 2568 2648 667.tmp 32 PID 2568 wrote to memory of 2544 2568 6D4.tmp 33 PID 2568 wrote to memory of 2544 2568 6D4.tmp 33 PID 2568 wrote to memory of 2544 2568 6D4.tmp 33 PID 2568 wrote to memory of 2544 2568 6D4.tmp 33 PID 2544 wrote to memory of 2188 2544 732.tmp 34 PID 2544 wrote to memory of 2188 2544 732.tmp 34 PID 2544 wrote to memory of 2188 2544 732.tmp 34 PID 2544 wrote to memory of 2188 2544 732.tmp 34 PID 2188 wrote to memory of 2312 2188 78F.tmp 35 PID 2188 wrote to memory of 2312 2188 78F.tmp 35 PID 2188 wrote to memory of 2312 2188 78F.tmp 35 PID 2188 wrote to memory of 2312 2188 78F.tmp 35 PID 2312 wrote to memory of 2524 2312 7ED.tmp 36 PID 2312 wrote to memory of 2524 2312 7ED.tmp 36 PID 2312 wrote to memory of 2524 2312 7ED.tmp 36 PID 2312 wrote to memory of 2524 2312 7ED.tmp 36 PID 2524 wrote to memory of 2456 2524 83B.tmp 37 PID 2524 wrote to memory of 2456 2524 83B.tmp 37 PID 2524 wrote to memory of 2456 2524 83B.tmp 37 PID 2524 wrote to memory of 2456 2524 83B.tmp 37 PID 2456 wrote to memory of 2916 2456 889.tmp 38 PID 2456 wrote to memory of 2916 2456 889.tmp 38 PID 2456 wrote to memory of 2916 2456 889.tmp 38 PID 2456 wrote to memory of 2916 2456 889.tmp 38 PID 2916 wrote to memory of 1004 2916 8D7.tmp 39 PID 2916 wrote to memory of 1004 2916 8D7.tmp 39 PID 2916 wrote to memory of 1004 2916 8D7.tmp 39 PID 2916 wrote to memory of 1004 2916 8D7.tmp 39 PID 1004 wrote to memory of 2460 1004 934.tmp 40 PID 1004 wrote to memory of 2460 1004 934.tmp 40 PID 1004 wrote to memory of 2460 1004 934.tmp 40 PID 1004 wrote to memory of 2460 1004 934.tmp 40 PID 2460 wrote to memory of 2716 2460 982.tmp 41 PID 2460 wrote to memory of 2716 2460 982.tmp 41 PID 2460 wrote to memory of 2716 2460 982.tmp 41 PID 2460 wrote to memory of 2716 2460 982.tmp 41 PID 2716 wrote to memory of 2776 2716 9D0.tmp 42 PID 2716 wrote to memory of 2776 2716 9D0.tmp 42 PID 2716 wrote to memory of 2776 2716 9D0.tmp 42 PID 2716 wrote to memory of 2776 2716 9D0.tmp 42 PID 2776 wrote to memory of 2296 2776 A1E.tmp 43 PID 2776 wrote to memory of 2296 2776 A1E.tmp 43 PID 2776 wrote to memory of 2296 2776 A1E.tmp 43 PID 2776 wrote to memory of 2296 2776 A1E.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-01_11b44bd0414beaa03fb73d73191cce16_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-01_11b44bd0414beaa03fb73d73191cce16_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\4F0.tmp"C:\Users\Admin\AppData\Local\Temp\4F0.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\56D.tmp"C:\Users\Admin\AppData\Local\Temp\56D.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\5CB.tmp"C:\Users\Admin\AppData\Local\Temp\5CB.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\667.tmp"C:\Users\Admin\AppData\Local\Temp\667.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\6D4.tmp"C:\Users\Admin\AppData\Local\Temp\6D4.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\732.tmp"C:\Users\Admin\AppData\Local\Temp\732.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\78F.tmp"C:\Users\Admin\AppData\Local\Temp\78F.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\7ED.tmp"C:\Users\Admin\AppData\Local\Temp\7ED.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\83B.tmp"C:\Users\Admin\AppData\Local\Temp\83B.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\889.tmp"C:\Users\Admin\AppData\Local\Temp\889.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\8D7.tmp"C:\Users\Admin\AppData\Local\Temp\8D7.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\934.tmp"C:\Users\Admin\AppData\Local\Temp\934.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\982.tmp"C:\Users\Admin\AppData\Local\Temp\982.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\9D0.tmp"C:\Users\Admin\AppData\Local\Temp\9D0.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\A1E.tmp"C:\Users\Admin\AppData\Local\Temp\A1E.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\A7C.tmp"C:\Users\Admin\AppData\Local\Temp\A7C.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\ACA.tmp"C:\Users\Admin\AppData\Local\Temp\ACA.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\B37.tmp"C:\Users\Admin\AppData\Local\Temp\B37.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\BC4.tmp"C:\Users\Admin\AppData\Local\Temp\BC4.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\C12.tmp"C:\Users\Admin\AppData\Local\Temp\C12.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\C6F.tmp"C:\Users\Admin\AppData\Local\Temp\C6F.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\CDC.tmp"C:\Users\Admin\AppData\Local\Temp\CDC.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\D2A.tmp"C:\Users\Admin\AppData\Local\Temp\D2A.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\D78.tmp"C:\Users\Admin\AppData\Local\Temp\D78.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\DB7.tmp"C:\Users\Admin\AppData\Local\Temp\DB7.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\DF5.tmp"C:\Users\Admin\AppData\Local\Temp\DF5.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\E43.tmp"C:\Users\Admin\AppData\Local\Temp\E43.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\E91.tmp"C:\Users\Admin\AppData\Local\Temp\E91.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\ED0.tmp"C:\Users\Admin\AppData\Local\Temp\ED0.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\F1E.tmp"C:\Users\Admin\AppData\Local\Temp\F1E.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:664 -
C:\Users\Admin\AppData\Local\Temp\F5C.tmp"C:\Users\Admin\AppData\Local\Temp\F5C.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:764 -
C:\Users\Admin\AppData\Local\Temp\F9A.tmp"C:\Users\Admin\AppData\Local\Temp\F9A.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\FD9.tmp"C:\Users\Admin\AppData\Local\Temp\FD9.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\1017.tmp"C:\Users\Admin\AppData\Local\Temp\1017.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\1065.tmp"C:\Users\Admin\AppData\Local\Temp\1065.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\10A4.tmp"C:\Users\Admin\AppData\Local\Temp\10A4.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\10D2.tmp"C:\Users\Admin\AppData\Local\Temp\10D2.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:904 -
C:\Users\Admin\AppData\Local\Temp\1111.tmp"C:\Users\Admin\AppData\Local\Temp\1111.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\114F.tmp"C:\Users\Admin\AppData\Local\Temp\114F.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\119D.tmp"C:\Users\Admin\AppData\Local\Temp\119D.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\11DC.tmp"C:\Users\Admin\AppData\Local\Temp\11DC.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:972 -
C:\Users\Admin\AppData\Local\Temp\122A.tmp"C:\Users\Admin\AppData\Local\Temp\122A.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\1268.tmp"C:\Users\Admin\AppData\Local\Temp\1268.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\12A6.tmp"C:\Users\Admin\AppData\Local\Temp\12A6.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:352 -
C:\Users\Admin\AppData\Local\Temp\12E5.tmp"C:\Users\Admin\AppData\Local\Temp\12E5.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\1323.tmp"C:\Users\Admin\AppData\Local\Temp\1323.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:848 -
C:\Users\Admin\AppData\Local\Temp\1362.tmp"C:\Users\Admin\AppData\Local\Temp\1362.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\13A0.tmp"C:\Users\Admin\AppData\Local\Temp\13A0.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\13CF.tmp"C:\Users\Admin\AppData\Local\Temp\13CF.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\140D.tmp"C:\Users\Admin\AppData\Local\Temp\140D.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\144C.tmp"C:\Users\Admin\AppData\Local\Temp\144C.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\148A.tmp"C:\Users\Admin\AppData\Local\Temp\148A.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\14C8.tmp"C:\Users\Admin\AppData\Local\Temp\14C8.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:880 -
C:\Users\Admin\AppData\Local\Temp\1507.tmp"C:\Users\Admin\AppData\Local\Temp\1507.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\1545.tmp"C:\Users\Admin\AppData\Local\Temp\1545.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\1593.tmp"C:\Users\Admin\AppData\Local\Temp\1593.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\15F1.tmp"C:\Users\Admin\AppData\Local\Temp\15F1.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\163F.tmp"C:\Users\Admin\AppData\Local\Temp\163F.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\166E.tmp"C:\Users\Admin\AppData\Local\Temp\166E.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\16AC.tmp"C:\Users\Admin\AppData\Local\Temp\16AC.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\16FA.tmp"C:\Users\Admin\AppData\Local\Temp\16FA.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\1758.tmp"C:\Users\Admin\AppData\Local\Temp\1758.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\17B5.tmp"C:\Users\Admin\AppData\Local\Temp\17B5.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\1822.tmp"C:\Users\Admin\AppData\Local\Temp\1822.tmp"65⤵
- Executes dropped EXE
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\1870.tmp"C:\Users\Admin\AppData\Local\Temp\1870.tmp"66⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\18BE.tmp"C:\Users\Admin\AppData\Local\Temp\18BE.tmp"67⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\190C.tmp"C:\Users\Admin\AppData\Local\Temp\190C.tmp"68⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\195A.tmp"C:\Users\Admin\AppData\Local\Temp\195A.tmp"69⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\19B8.tmp"C:\Users\Admin\AppData\Local\Temp\19B8.tmp"70⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\19F6.tmp"C:\Users\Admin\AppData\Local\Temp\19F6.tmp"71⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\1A35.tmp"C:\Users\Admin\AppData\Local\Temp\1A35.tmp"72⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\1A83.tmp"C:\Users\Admin\AppData\Local\Temp\1A83.tmp"73⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"74⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\1B00.tmp"C:\Users\Admin\AppData\Local\Temp\1B00.tmp"75⤵PID:108
-
C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"76⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"77⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"78⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\1C09.tmp"C:\Users\Admin\AppData\Local\Temp\1C09.tmp"79⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\1C47.tmp"C:\Users\Admin\AppData\Local\Temp\1C47.tmp"80⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\1C86.tmp"C:\Users\Admin\AppData\Local\Temp\1C86.tmp"81⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"82⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\1D02.tmp"C:\Users\Admin\AppData\Local\Temp\1D02.tmp"83⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\1D41.tmp"C:\Users\Admin\AppData\Local\Temp\1D41.tmp"84⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"85⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\1DCD.tmp"C:\Users\Admin\AppData\Local\Temp\1DCD.tmp"86⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"87⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\1E69.tmp"C:\Users\Admin\AppData\Local\Temp\1E69.tmp"88⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"89⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\1F05.tmp"C:\Users\Admin\AppData\Local\Temp\1F05.tmp"90⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\1F44.tmp"C:\Users\Admin\AppData\Local\Temp\1F44.tmp"91⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\1F82.tmp"C:\Users\Admin\AppData\Local\Temp\1F82.tmp"92⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"93⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\200E.tmp"C:\Users\Admin\AppData\Local\Temp\200E.tmp"94⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\204D.tmp"C:\Users\Admin\AppData\Local\Temp\204D.tmp"95⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\208B.tmp"C:\Users\Admin\AppData\Local\Temp\208B.tmp"96⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\20D9.tmp"C:\Users\Admin\AppData\Local\Temp\20D9.tmp"97⤵PID:476
-
C:\Users\Admin\AppData\Local\Temp\2118.tmp"C:\Users\Admin\AppData\Local\Temp\2118.tmp"98⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\2156.tmp"C:\Users\Admin\AppData\Local\Temp\2156.tmp"99⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\2194.tmp"C:\Users\Admin\AppData\Local\Temp\2194.tmp"100⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\21E2.tmp"C:\Users\Admin\AppData\Local\Temp\21E2.tmp"101⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\2221.tmp"C:\Users\Admin\AppData\Local\Temp\2221.tmp"102⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\225F.tmp"C:\Users\Admin\AppData\Local\Temp\225F.tmp"103⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\22BD.tmp"C:\Users\Admin\AppData\Local\Temp\22BD.tmp"104⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\22FB.tmp"C:\Users\Admin\AppData\Local\Temp\22FB.tmp"105⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\233A.tmp"C:\Users\Admin\AppData\Local\Temp\233A.tmp"106⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\2388.tmp"C:\Users\Admin\AppData\Local\Temp\2388.tmp"107⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\23C6.tmp"C:\Users\Admin\AppData\Local\Temp\23C6.tmp"108⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\2404.tmp"C:\Users\Admin\AppData\Local\Temp\2404.tmp"109⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\2443.tmp"C:\Users\Admin\AppData\Local\Temp\2443.tmp"110⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\2481.tmp"C:\Users\Admin\AppData\Local\Temp\2481.tmp"111⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\24C0.tmp"C:\Users\Admin\AppData\Local\Temp\24C0.tmp"112⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\250E.tmp"C:\Users\Admin\AppData\Local\Temp\250E.tmp"113⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"114⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\259A.tmp"C:\Users\Admin\AppData\Local\Temp\259A.tmp"115⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\25D8.tmp"C:\Users\Admin\AppData\Local\Temp\25D8.tmp"116⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"117⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\2665.tmp"C:\Users\Admin\AppData\Local\Temp\2665.tmp"118⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\26A3.tmp"C:\Users\Admin\AppData\Local\Temp\26A3.tmp"119⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\26F1.tmp"C:\Users\Admin\AppData\Local\Temp\26F1.tmp"120⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\2730.tmp"C:\Users\Admin\AppData\Local\Temp\2730.tmp"121⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\277E.tmp"C:\Users\Admin\AppData\Local\Temp\277E.tmp"122⤵PID:1708
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-