Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
02-06-2024 03:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-02_86ee2f0704d08e26f12f68b54a4219c1_mafia.exe
Resource
win7-20240508-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-02_86ee2f0704d08e26f12f68b54a4219c1_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-06-02_86ee2f0704d08e26f12f68b54a4219c1_mafia.exe
-
Size
487KB
-
MD5
86ee2f0704d08e26f12f68b54a4219c1
-
SHA1
10847116aeb4d749738e6fa7dff425a6b798b4b9
-
SHA256
b9a167736ba362dd480ba786e1759d0f18a062b75d51bd3893ce66fe63bea6f8
-
SHA512
0ed7aae3c7b7108828dd68da79c71f7195d18e44c8d1e00037a9590b7193d7d91aed809427709369af19f4914a3ebd8ed5684a2bfd3dfc55f9758d0a290e08c9
-
SSDEEP
6144:qorf3lPvovsgZnqG2C7mOTeiL9DUk7eRDmuv9ba2psJkNgd91o8c4Mwmcw/w7nar:HU5rCOTeiJCtsENNq923wh7na0liNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1872 3321.tmp 2188 337F.tmp 2580 340B.tmp 2628 3469.tmp 2756 34E6.tmp 2752 3543.tmp 2852 35C0.tmp 2816 362D.tmp 2656 36BA.tmp 2500 3736.tmp 2416 37B3.tmp 2104 3820.tmp 1852 388E.tmp 2808 390A.tmp 2812 3978.tmp 2144 39E5.tmp 1080 3A42.tmp 2456 3AB0.tmp 1880 3B2C.tmp 1304 3BA9.tmp 480 3C16.tmp 1320 3C74.tmp 1280 3CD2.tmp 1656 3D20.tmp 2212 3D5E.tmp 844 3D9C.tmp 2044 3DEA.tmp 1976 3E29.tmp 2004 3E67.tmp 2264 3EA6.tmp 2008 3EE4.tmp 2340 3F32.tmp 2284 3F70.tmp 2440 3FAF.tmp 1604 3FED.tmp 2444 402C.tmp 1332 407A.tmp 2336 40B8.tmp 840 40F6.tmp 1676 4144.tmp 1636 4183.tmp 1968 41D1.tmp 1276 420F.tmp 2172 424E.tmp 1744 428C.tmp 340 42CA.tmp 2120 4309.tmp 3004 4347.tmp 1184 4386.tmp 296 43D4.tmp 1876 4412.tmp 2572 4450.tmp 1868 448F.tmp 2988 44DD.tmp 2056 451B.tmp 1532 4598.tmp 2216 45D6.tmp 3016 4634.tmp 2460 4672.tmp 2684 46C0.tmp 2700 470E.tmp 2644 474D.tmp 2732 478B.tmp 1152 47CA.tmp -
Loads dropped DLL 64 IoCs
pid Process 2844 2024-06-02_86ee2f0704d08e26f12f68b54a4219c1_mafia.exe 1872 3321.tmp 2188 337F.tmp 2580 340B.tmp 2628 3469.tmp 2756 34E6.tmp 2752 3543.tmp 2852 35C0.tmp 2816 362D.tmp 2656 36BA.tmp 2500 3736.tmp 2416 37B3.tmp 2104 3820.tmp 1852 388E.tmp 2808 390A.tmp 2812 3978.tmp 2144 39E5.tmp 1080 3A42.tmp 2456 3AB0.tmp 1880 3B2C.tmp 1304 3BA9.tmp 480 3C16.tmp 1320 3C74.tmp 1280 3CD2.tmp 1656 3D20.tmp 2212 3D5E.tmp 844 3D9C.tmp 2044 3DEA.tmp 1976 3E29.tmp 2004 3E67.tmp 2264 3EA6.tmp 2008 3EE4.tmp 2340 3F32.tmp 2284 3F70.tmp 2440 3FAF.tmp 1604 3FED.tmp 2444 402C.tmp 1332 407A.tmp 2336 40B8.tmp 840 40F6.tmp 1676 4144.tmp 1636 4183.tmp 1968 41D1.tmp 1276 420F.tmp 2172 424E.tmp 1744 428C.tmp 340 42CA.tmp 2120 4309.tmp 3004 4347.tmp 1184 4386.tmp 296 43D4.tmp 1876 4412.tmp 2572 4450.tmp 1868 448F.tmp 2988 44DD.tmp 1556 455A.tmp 1532 4598.tmp 2216 45D6.tmp 3016 4634.tmp 2460 4672.tmp 2684 46C0.tmp 2700 470E.tmp 2644 474D.tmp 2732 478B.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2844 wrote to memory of 1872 2844 2024-06-02_86ee2f0704d08e26f12f68b54a4219c1_mafia.exe 28 PID 2844 wrote to memory of 1872 2844 2024-06-02_86ee2f0704d08e26f12f68b54a4219c1_mafia.exe 28 PID 2844 wrote to memory of 1872 2844 2024-06-02_86ee2f0704d08e26f12f68b54a4219c1_mafia.exe 28 PID 2844 wrote to memory of 1872 2844 2024-06-02_86ee2f0704d08e26f12f68b54a4219c1_mafia.exe 28 PID 1872 wrote to memory of 2188 1872 3321.tmp 29 PID 1872 wrote to memory of 2188 1872 3321.tmp 29 PID 1872 wrote to memory of 2188 1872 3321.tmp 29 PID 1872 wrote to memory of 2188 1872 3321.tmp 29 PID 2188 wrote to memory of 2580 2188 337F.tmp 30 PID 2188 wrote to memory of 2580 2188 337F.tmp 30 PID 2188 wrote to memory of 2580 2188 337F.tmp 30 PID 2188 wrote to memory of 2580 2188 337F.tmp 30 PID 2580 wrote to memory of 2628 2580 340B.tmp 31 PID 2580 wrote to memory of 2628 2580 340B.tmp 31 PID 2580 wrote to memory of 2628 2580 340B.tmp 31 PID 2580 wrote to memory of 2628 2580 340B.tmp 31 PID 2628 wrote to memory of 2756 2628 3469.tmp 32 PID 2628 wrote to memory of 2756 2628 3469.tmp 32 PID 2628 wrote to memory of 2756 2628 3469.tmp 32 PID 2628 wrote to memory of 2756 2628 3469.tmp 32 PID 2756 wrote to memory of 2752 2756 34E6.tmp 33 PID 2756 wrote to memory of 2752 2756 34E6.tmp 33 PID 2756 wrote to memory of 2752 2756 34E6.tmp 33 PID 2756 wrote to memory of 2752 2756 34E6.tmp 33 PID 2752 wrote to memory of 2852 2752 3543.tmp 34 PID 2752 wrote to memory of 2852 2752 3543.tmp 34 PID 2752 wrote to memory of 2852 2752 3543.tmp 34 PID 2752 wrote to memory of 2852 2752 3543.tmp 34 PID 2852 wrote to memory of 2816 2852 35C0.tmp 35 PID 2852 wrote to memory of 2816 2852 35C0.tmp 35 PID 2852 wrote to memory of 2816 2852 35C0.tmp 35 PID 2852 wrote to memory of 2816 2852 35C0.tmp 35 PID 2816 wrote to memory of 2656 2816 362D.tmp 36 PID 2816 wrote to memory of 2656 2816 362D.tmp 36 PID 2816 wrote to memory of 2656 2816 362D.tmp 36 PID 2816 wrote to memory of 2656 2816 362D.tmp 36 PID 2656 wrote to memory of 2500 2656 36BA.tmp 37 PID 2656 wrote to memory of 2500 2656 36BA.tmp 37 PID 2656 wrote to memory of 2500 2656 36BA.tmp 37 PID 2656 wrote to memory of 2500 2656 36BA.tmp 37 PID 2500 wrote to memory of 2416 2500 3736.tmp 38 PID 2500 wrote to memory of 2416 2500 3736.tmp 38 PID 2500 wrote to memory of 2416 2500 3736.tmp 38 PID 2500 wrote to memory of 2416 2500 3736.tmp 38 PID 2416 wrote to memory of 2104 2416 37B3.tmp 39 PID 2416 wrote to memory of 2104 2416 37B3.tmp 39 PID 2416 wrote to memory of 2104 2416 37B3.tmp 39 PID 2416 wrote to memory of 2104 2416 37B3.tmp 39 PID 2104 wrote to memory of 1852 2104 3820.tmp 40 PID 2104 wrote to memory of 1852 2104 3820.tmp 40 PID 2104 wrote to memory of 1852 2104 3820.tmp 40 PID 2104 wrote to memory of 1852 2104 3820.tmp 40 PID 1852 wrote to memory of 2808 1852 388E.tmp 41 PID 1852 wrote to memory of 2808 1852 388E.tmp 41 PID 1852 wrote to memory of 2808 1852 388E.tmp 41 PID 1852 wrote to memory of 2808 1852 388E.tmp 41 PID 2808 wrote to memory of 2812 2808 390A.tmp 42 PID 2808 wrote to memory of 2812 2808 390A.tmp 42 PID 2808 wrote to memory of 2812 2808 390A.tmp 42 PID 2808 wrote to memory of 2812 2808 390A.tmp 42 PID 2812 wrote to memory of 2144 2812 3978.tmp 43 PID 2812 wrote to memory of 2144 2812 3978.tmp 43 PID 2812 wrote to memory of 2144 2812 3978.tmp 43 PID 2812 wrote to memory of 2144 2812 3978.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-02_86ee2f0704d08e26f12f68b54a4219c1_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-02_86ee2f0704d08e26f12f68b54a4219c1_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\3321.tmp"C:\Users\Admin\AppData\Local\Temp\3321.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\337F.tmp"C:\Users\Admin\AppData\Local\Temp\337F.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\340B.tmp"C:\Users\Admin\AppData\Local\Temp\340B.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\3469.tmp"C:\Users\Admin\AppData\Local\Temp\3469.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\34E6.tmp"C:\Users\Admin\AppData\Local\Temp\34E6.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\3543.tmp"C:\Users\Admin\AppData\Local\Temp\3543.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\35C0.tmp"C:\Users\Admin\AppData\Local\Temp\35C0.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\362D.tmp"C:\Users\Admin\AppData\Local\Temp\362D.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\36BA.tmp"C:\Users\Admin\AppData\Local\Temp\36BA.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\3736.tmp"C:\Users\Admin\AppData\Local\Temp\3736.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\37B3.tmp"C:\Users\Admin\AppData\Local\Temp\37B3.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\3820.tmp"C:\Users\Admin\AppData\Local\Temp\3820.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\388E.tmp"C:\Users\Admin\AppData\Local\Temp\388E.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\390A.tmp"C:\Users\Admin\AppData\Local\Temp\390A.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\3978.tmp"C:\Users\Admin\AppData\Local\Temp\3978.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\39E5.tmp"C:\Users\Admin\AppData\Local\Temp\39E5.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\3A42.tmp"C:\Users\Admin\AppData\Local\Temp\3A42.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\3AB0.tmp"C:\Users\Admin\AppData\Local\Temp\3AB0.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\3B2C.tmp"C:\Users\Admin\AppData\Local\Temp\3B2C.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\3BA9.tmp"C:\Users\Admin\AppData\Local\Temp\3BA9.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\3C16.tmp"C:\Users\Admin\AppData\Local\Temp\3C16.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:480 -
C:\Users\Admin\AppData\Local\Temp\3C74.tmp"C:\Users\Admin\AppData\Local\Temp\3C74.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\3CD2.tmp"C:\Users\Admin\AppData\Local\Temp\3CD2.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\3D20.tmp"C:\Users\Admin\AppData\Local\Temp\3D20.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\3D5E.tmp"C:\Users\Admin\AppData\Local\Temp\3D5E.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:844 -
C:\Users\Admin\AppData\Local\Temp\3DEA.tmp"C:\Users\Admin\AppData\Local\Temp\3DEA.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\3E29.tmp"C:\Users\Admin\AppData\Local\Temp\3E29.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\3E67.tmp"C:\Users\Admin\AppData\Local\Temp\3E67.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\3EA6.tmp"C:\Users\Admin\AppData\Local\Temp\3EA6.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\3F32.tmp"C:\Users\Admin\AppData\Local\Temp\3F32.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\3F70.tmp"C:\Users\Admin\AppData\Local\Temp\3F70.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\3FAF.tmp"C:\Users\Admin\AppData\Local\Temp\3FAF.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\3FED.tmp"C:\Users\Admin\AppData\Local\Temp\3FED.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\402C.tmp"C:\Users\Admin\AppData\Local\Temp\402C.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\407A.tmp"C:\Users\Admin\AppData\Local\Temp\407A.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\40B8.tmp"C:\Users\Admin\AppData\Local\Temp\40B8.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\40F6.tmp"C:\Users\Admin\AppData\Local\Temp\40F6.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:840 -
C:\Users\Admin\AppData\Local\Temp\4144.tmp"C:\Users\Admin\AppData\Local\Temp\4144.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\4183.tmp"C:\Users\Admin\AppData\Local\Temp\4183.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\41D1.tmp"C:\Users\Admin\AppData\Local\Temp\41D1.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\420F.tmp"C:\Users\Admin\AppData\Local\Temp\420F.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\424E.tmp"C:\Users\Admin\AppData\Local\Temp\424E.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\428C.tmp"C:\Users\Admin\AppData\Local\Temp\428C.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\42CA.tmp"C:\Users\Admin\AppData\Local\Temp\42CA.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:340 -
C:\Users\Admin\AppData\Local\Temp\4309.tmp"C:\Users\Admin\AppData\Local\Temp\4309.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\4347.tmp"C:\Users\Admin\AppData\Local\Temp\4347.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\4386.tmp"C:\Users\Admin\AppData\Local\Temp\4386.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\43D4.tmp"C:\Users\Admin\AppData\Local\Temp\43D4.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:296 -
C:\Users\Admin\AppData\Local\Temp\4412.tmp"C:\Users\Admin\AppData\Local\Temp\4412.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\4450.tmp"C:\Users\Admin\AppData\Local\Temp\4450.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\448F.tmp"C:\Users\Admin\AppData\Local\Temp\448F.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\44DD.tmp"C:\Users\Admin\AppData\Local\Temp\44DD.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\451B.tmp"C:\Users\Admin\AppData\Local\Temp\451B.tmp"56⤵
- Executes dropped EXE
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\455A.tmp"C:\Users\Admin\AppData\Local\Temp\455A.tmp"57⤵
- Loads dropped DLL
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\4598.tmp"C:\Users\Admin\AppData\Local\Temp\4598.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\45D6.tmp"C:\Users\Admin\AppData\Local\Temp\45D6.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\4634.tmp"C:\Users\Admin\AppData\Local\Temp\4634.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\4672.tmp"C:\Users\Admin\AppData\Local\Temp\4672.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\46C0.tmp"C:\Users\Admin\AppData\Local\Temp\46C0.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\470E.tmp"C:\Users\Admin\AppData\Local\Temp\470E.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\474D.tmp"C:\Users\Admin\AppData\Local\Temp\474D.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\478B.tmp"C:\Users\Admin\AppData\Local\Temp\478B.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\47CA.tmp"C:\Users\Admin\AppData\Local\Temp\47CA.tmp"66⤵
- Executes dropped EXE
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\4808.tmp"C:\Users\Admin\AppData\Local\Temp\4808.tmp"67⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\4846.tmp"C:\Users\Admin\AppData\Local\Temp\4846.tmp"68⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\4894.tmp"C:\Users\Admin\AppData\Local\Temp\4894.tmp"69⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\48D3.tmp"C:\Users\Admin\AppData\Local\Temp\48D3.tmp"70⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\4911.tmp"C:\Users\Admin\AppData\Local\Temp\4911.tmp"71⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\4950.tmp"C:\Users\Admin\AppData\Local\Temp\4950.tmp"72⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\499E.tmp"C:\Users\Admin\AppData\Local\Temp\499E.tmp"73⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\49DC.tmp"C:\Users\Admin\AppData\Local\Temp\49DC.tmp"74⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\4A1A.tmp"C:\Users\Admin\AppData\Local\Temp\4A1A.tmp"75⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\4A59.tmp"C:\Users\Admin\AppData\Local\Temp\4A59.tmp"76⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\4A97.tmp"C:\Users\Admin\AppData\Local\Temp\4A97.tmp"77⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\4AD6.tmp"C:\Users\Admin\AppData\Local\Temp\4AD6.tmp"78⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\4B14.tmp"C:\Users\Admin\AppData\Local\Temp\4B14.tmp"79⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\4B52.tmp"C:\Users\Admin\AppData\Local\Temp\4B52.tmp"80⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\4B91.tmp"C:\Users\Admin\AppData\Local\Temp\4B91.tmp"81⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\4BDF.tmp"C:\Users\Admin\AppData\Local\Temp\4BDF.tmp"82⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\4C1D.tmp"C:\Users\Admin\AppData\Local\Temp\4C1D.tmp"83⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\4C5C.tmp"C:\Users\Admin\AppData\Local\Temp\4C5C.tmp"84⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\4C9A.tmp"C:\Users\Admin\AppData\Local\Temp\4C9A.tmp"85⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"86⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\4D17.tmp"C:\Users\Admin\AppData\Local\Temp\4D17.tmp"87⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"88⤵PID:492
-
C:\Users\Admin\AppData\Local\Temp\4D94.tmp"C:\Users\Admin\AppData\Local\Temp\4D94.tmp"89⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"90⤵PID:268
-
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"91⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"92⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"93⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"94⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"95⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"96⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\4F96.tmp"C:\Users\Admin\AppData\Local\Temp\4F96.tmp"97⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"98⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\5013.tmp"C:\Users\Admin\AppData\Local\Temp\5013.tmp"99⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"100⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\5090.tmp"C:\Users\Admin\AppData\Local\Temp\5090.tmp"101⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\50CE.tmp"C:\Users\Admin\AppData\Local\Temp\50CE.tmp"102⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\510D.tmp"C:\Users\Admin\AppData\Local\Temp\510D.tmp"103⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\514B.tmp"C:\Users\Admin\AppData\Local\Temp\514B.tmp"104⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\518A.tmp"C:\Users\Admin\AppData\Local\Temp\518A.tmp"105⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\51C8.tmp"C:\Users\Admin\AppData\Local\Temp\51C8.tmp"106⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\5206.tmp"C:\Users\Admin\AppData\Local\Temp\5206.tmp"107⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\5245.tmp"C:\Users\Admin\AppData\Local\Temp\5245.tmp"108⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\5283.tmp"C:\Users\Admin\AppData\Local\Temp\5283.tmp"109⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\52C2.tmp"C:\Users\Admin\AppData\Local\Temp\52C2.tmp"110⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\5300.tmp"C:\Users\Admin\AppData\Local\Temp\5300.tmp"111⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\533E.tmp"C:\Users\Admin\AppData\Local\Temp\533E.tmp"112⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\537D.tmp"C:\Users\Admin\AppData\Local\Temp\537D.tmp"113⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\53BB.tmp"C:\Users\Admin\AppData\Local\Temp\53BB.tmp"114⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\53FA.tmp"C:\Users\Admin\AppData\Local\Temp\53FA.tmp"115⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\5438.tmp"C:\Users\Admin\AppData\Local\Temp\5438.tmp"116⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\5476.tmp"C:\Users\Admin\AppData\Local\Temp\5476.tmp"117⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\54B5.tmp"C:\Users\Admin\AppData\Local\Temp\54B5.tmp"118⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\54F3.tmp"C:\Users\Admin\AppData\Local\Temp\54F3.tmp"119⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\5532.tmp"C:\Users\Admin\AppData\Local\Temp\5532.tmp"120⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\5570.tmp"C:\Users\Admin\AppData\Local\Temp\5570.tmp"121⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\55AE.tmp"C:\Users\Admin\AppData\Local\Temp\55AE.tmp"122⤵PID:1924
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-