Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
09/06/2024, 07:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-09_aac5fae32095185d09250cc7fc579b2d_mafia.exe
Resource
win7-20240508-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-09_aac5fae32095185d09250cc7fc579b2d_mafia.exe
Resource
win10v2004-20240426-en
2 signatures
150 seconds
General
-
Target
2024-06-09_aac5fae32095185d09250cc7fc579b2d_mafia.exe
-
Size
520KB
-
MD5
aac5fae32095185d09250cc7fc579b2d
-
SHA1
bd63ae81f1fe7d71dd3d82d057f31ecd1c728a07
-
SHA256
a28db12a6191667f5d9dc76bfd1419b22955138275387061cad3755fee757e9b
-
SHA512
885fe12a9b5e50a03d85c3eac26a5c8dde3d25099b141ba78f802692d99c1c8e7b0dc455783d00102a5a59bc1dabfb1496309054c432cf263f91b4d942d1d73b
-
SSDEEP
12288:gj8fuxR21t5i8fKSEBEu05mb0m4obTbVBndKoi3ZNZ:gj8fuK1GYKHQ5mbIo/bYokN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2144 992.tmp 2528 A0F.tmp 2564 A8C.tmp 2664 AF9.tmp 2560 B66.tmp 2152 BB4.tmp 2464 C21.tmp 2484 C8E.tmp 2432 CEC.tmp 2556 D59.tmp 2916 DA7.tmp 1468 E24.tmp 1132 E72.tmp 2424 EC0.tmp 992 EFE.tmp 2104 F5C.tmp 1504 FAA.tmp 796 FF8.tmp 1556 1046.tmp 1336 10A4.tmp 2244 10E2.tmp 2036 1130.tmp 2020 11AD.tmp 2056 11FB.tmp 2892 1239.tmp 2200 1278.tmp 1928 12B6.tmp 2768 12F4.tmp 2176 1333.tmp 264 1381.tmp 724 13CF.tmp 1412 142C.tmp 1392 148A.tmp 1808 14E8.tmp 1716 1526.tmp 1688 1564.tmp 1944 15A3.tmp 448 15E1.tmp 844 1620.tmp 2264 165E.tmp 2076 169C.tmp 1476 16DB.tmp 1872 1719.tmp 928 1767.tmp 2136 17A6.tmp 1600 17E4.tmp 2320 1822.tmp 2924 1861.tmp 1656 189F.tmp 2132 18DE.tmp 1532 191C.tmp 1784 195A.tmp 888 1999.tmp 876 19D7.tmp 2384 1A16.tmp 1528 1A54.tmp 1516 1A92.tmp 2980 1AD1.tmp 1952 1B0F.tmp 2640 1B4E.tmp 2632 1B8C.tmp 2564 1BCA.tmp 2716 1C09.tmp 2816 1C47.tmp -
Loads dropped DLL 64 IoCs
pid Process 2284 2024-06-09_aac5fae32095185d09250cc7fc579b2d_mafia.exe 2144 992.tmp 2528 A0F.tmp 2564 A8C.tmp 2664 AF9.tmp 2560 B66.tmp 2152 BB4.tmp 2464 C21.tmp 2484 C8E.tmp 2432 CEC.tmp 2556 D59.tmp 2916 DA7.tmp 1468 E24.tmp 1132 E72.tmp 2424 EC0.tmp 992 EFE.tmp 2104 F5C.tmp 1504 FAA.tmp 796 FF8.tmp 1556 1046.tmp 1336 10A4.tmp 2244 10E2.tmp 2036 1130.tmp 2020 11AD.tmp 2056 11FB.tmp 2892 1239.tmp 2200 1278.tmp 1928 12B6.tmp 2768 12F4.tmp 2176 1333.tmp 264 1381.tmp 724 13CF.tmp 1412 142C.tmp 1392 148A.tmp 1808 14E8.tmp 1716 1526.tmp 1688 1564.tmp 1944 15A3.tmp 448 15E1.tmp 844 1620.tmp 2264 165E.tmp 2076 169C.tmp 1476 16DB.tmp 1872 1719.tmp 928 1767.tmp 2136 17A6.tmp 1600 17E4.tmp 2320 1822.tmp 2924 1861.tmp 1656 189F.tmp 2132 18DE.tmp 1532 191C.tmp 1784 195A.tmp 888 1999.tmp 876 19D7.tmp 2384 1A16.tmp 1528 1A54.tmp 1516 1A92.tmp 2980 1AD1.tmp 1952 1B0F.tmp 2640 1B4E.tmp 2632 1B8C.tmp 2564 1BCA.tmp 2716 1C09.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2284 wrote to memory of 2144 2284 2024-06-09_aac5fae32095185d09250cc7fc579b2d_mafia.exe 28 PID 2284 wrote to memory of 2144 2284 2024-06-09_aac5fae32095185d09250cc7fc579b2d_mafia.exe 28 PID 2284 wrote to memory of 2144 2284 2024-06-09_aac5fae32095185d09250cc7fc579b2d_mafia.exe 28 PID 2284 wrote to memory of 2144 2284 2024-06-09_aac5fae32095185d09250cc7fc579b2d_mafia.exe 28 PID 2144 wrote to memory of 2528 2144 992.tmp 29 PID 2144 wrote to memory of 2528 2144 992.tmp 29 PID 2144 wrote to memory of 2528 2144 992.tmp 29 PID 2144 wrote to memory of 2528 2144 992.tmp 29 PID 2528 wrote to memory of 2564 2528 A0F.tmp 30 PID 2528 wrote to memory of 2564 2528 A0F.tmp 30 PID 2528 wrote to memory of 2564 2528 A0F.tmp 30 PID 2528 wrote to memory of 2564 2528 A0F.tmp 30 PID 2564 wrote to memory of 2664 2564 A8C.tmp 31 PID 2564 wrote to memory of 2664 2564 A8C.tmp 31 PID 2564 wrote to memory of 2664 2564 A8C.tmp 31 PID 2564 wrote to memory of 2664 2564 A8C.tmp 31 PID 2664 wrote to memory of 2560 2664 AF9.tmp 32 PID 2664 wrote to memory of 2560 2664 AF9.tmp 32 PID 2664 wrote to memory of 2560 2664 AF9.tmp 32 PID 2664 wrote to memory of 2560 2664 AF9.tmp 32 PID 2560 wrote to memory of 2152 2560 B66.tmp 33 PID 2560 wrote to memory of 2152 2560 B66.tmp 33 PID 2560 wrote to memory of 2152 2560 B66.tmp 33 PID 2560 wrote to memory of 2152 2560 B66.tmp 33 PID 2152 wrote to memory of 2464 2152 BB4.tmp 34 PID 2152 wrote to memory of 2464 2152 BB4.tmp 34 PID 2152 wrote to memory of 2464 2152 BB4.tmp 34 PID 2152 wrote to memory of 2464 2152 BB4.tmp 34 PID 2464 wrote to memory of 2484 2464 C21.tmp 35 PID 2464 wrote to memory of 2484 2464 C21.tmp 35 PID 2464 wrote to memory of 2484 2464 C21.tmp 35 PID 2464 wrote to memory of 2484 2464 C21.tmp 35 PID 2484 wrote to memory of 2432 2484 C8E.tmp 36 PID 2484 wrote to memory of 2432 2484 C8E.tmp 36 PID 2484 wrote to memory of 2432 2484 C8E.tmp 36 PID 2484 wrote to memory of 2432 2484 C8E.tmp 36 PID 2432 wrote to memory of 2556 2432 CEC.tmp 37 PID 2432 wrote to memory of 2556 2432 CEC.tmp 37 PID 2432 wrote to memory of 2556 2432 CEC.tmp 37 PID 2432 wrote to memory of 2556 2432 CEC.tmp 37 PID 2556 wrote to memory of 2916 2556 D59.tmp 38 PID 2556 wrote to memory of 2916 2556 D59.tmp 38 PID 2556 wrote to memory of 2916 2556 D59.tmp 38 PID 2556 wrote to memory of 2916 2556 D59.tmp 38 PID 2916 wrote to memory of 1468 2916 DA7.tmp 39 PID 2916 wrote to memory of 1468 2916 DA7.tmp 39 PID 2916 wrote to memory of 1468 2916 DA7.tmp 39 PID 2916 wrote to memory of 1468 2916 DA7.tmp 39 PID 1468 wrote to memory of 1132 1468 E24.tmp 40 PID 1468 wrote to memory of 1132 1468 E24.tmp 40 PID 1468 wrote to memory of 1132 1468 E24.tmp 40 PID 1468 wrote to memory of 1132 1468 E24.tmp 40 PID 1132 wrote to memory of 2424 1132 E72.tmp 41 PID 1132 wrote to memory of 2424 1132 E72.tmp 41 PID 1132 wrote to memory of 2424 1132 E72.tmp 41 PID 1132 wrote to memory of 2424 1132 E72.tmp 41 PID 2424 wrote to memory of 992 2424 EC0.tmp 42 PID 2424 wrote to memory of 992 2424 EC0.tmp 42 PID 2424 wrote to memory of 992 2424 EC0.tmp 42 PID 2424 wrote to memory of 992 2424 EC0.tmp 42 PID 992 wrote to memory of 2104 992 EFE.tmp 43 PID 992 wrote to memory of 2104 992 EFE.tmp 43 PID 992 wrote to memory of 2104 992 EFE.tmp 43 PID 992 wrote to memory of 2104 992 EFE.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-09_aac5fae32095185d09250cc7fc579b2d_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-09_aac5fae32095185d09250cc7fc579b2d_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\992.tmp"C:\Users\Admin\AppData\Local\Temp\992.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\A0F.tmp"C:\Users\Admin\AppData\Local\Temp\A0F.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\A8C.tmp"C:\Users\Admin\AppData\Local\Temp\A8C.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\AF9.tmp"C:\Users\Admin\AppData\Local\Temp\AF9.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\B66.tmp"C:\Users\Admin\AppData\Local\Temp\B66.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\BB4.tmp"C:\Users\Admin\AppData\Local\Temp\BB4.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\C21.tmp"C:\Users\Admin\AppData\Local\Temp\C21.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\C8E.tmp"C:\Users\Admin\AppData\Local\Temp\C8E.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\CEC.tmp"C:\Users\Admin\AppData\Local\Temp\CEC.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\D59.tmp"C:\Users\Admin\AppData\Local\Temp\D59.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\DA7.tmp"C:\Users\Admin\AppData\Local\Temp\DA7.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\E24.tmp"C:\Users\Admin\AppData\Local\Temp\E24.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\E72.tmp"C:\Users\Admin\AppData\Local\Temp\E72.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\EC0.tmp"C:\Users\Admin\AppData\Local\Temp\EC0.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\EFE.tmp"C:\Users\Admin\AppData\Local\Temp\EFE.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\AppData\Local\Temp\F5C.tmp"C:\Users\Admin\AppData\Local\Temp\F5C.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\FAA.tmp"C:\Users\Admin\AppData\Local\Temp\FAA.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\FF8.tmp"C:\Users\Admin\AppData\Local\Temp\FF8.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:796 -
C:\Users\Admin\AppData\Local\Temp\1046.tmp"C:\Users\Admin\AppData\Local\Temp\1046.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\10A4.tmp"C:\Users\Admin\AppData\Local\Temp\10A4.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\10E2.tmp"C:\Users\Admin\AppData\Local\Temp\10E2.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\1130.tmp"C:\Users\Admin\AppData\Local\Temp\1130.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\11AD.tmp"C:\Users\Admin\AppData\Local\Temp\11AD.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\11FB.tmp"C:\Users\Admin\AppData\Local\Temp\11FB.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\1239.tmp"C:\Users\Admin\AppData\Local\Temp\1239.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\1278.tmp"C:\Users\Admin\AppData\Local\Temp\1278.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\12B6.tmp"C:\Users\Admin\AppData\Local\Temp\12B6.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\12F4.tmp"C:\Users\Admin\AppData\Local\Temp\12F4.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\1333.tmp"C:\Users\Admin\AppData\Local\Temp\1333.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\1381.tmp"C:\Users\Admin\AppData\Local\Temp\1381.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:264 -
C:\Users\Admin\AppData\Local\Temp\13CF.tmp"C:\Users\Admin\AppData\Local\Temp\13CF.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:724 -
C:\Users\Admin\AppData\Local\Temp\142C.tmp"C:\Users\Admin\AppData\Local\Temp\142C.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\148A.tmp"C:\Users\Admin\AppData\Local\Temp\148A.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\14E8.tmp"C:\Users\Admin\AppData\Local\Temp\14E8.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\1526.tmp"C:\Users\Admin\AppData\Local\Temp\1526.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\1564.tmp"C:\Users\Admin\AppData\Local\Temp\1564.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\15A3.tmp"C:\Users\Admin\AppData\Local\Temp\15A3.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\15E1.tmp"C:\Users\Admin\AppData\Local\Temp\15E1.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:448 -
C:\Users\Admin\AppData\Local\Temp\1620.tmp"C:\Users\Admin\AppData\Local\Temp\1620.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:844 -
C:\Users\Admin\AppData\Local\Temp\165E.tmp"C:\Users\Admin\AppData\Local\Temp\165E.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\169C.tmp"C:\Users\Admin\AppData\Local\Temp\169C.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\16DB.tmp"C:\Users\Admin\AppData\Local\Temp\16DB.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\1719.tmp"C:\Users\Admin\AppData\Local\Temp\1719.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\1767.tmp"C:\Users\Admin\AppData\Local\Temp\1767.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:928 -
C:\Users\Admin\AppData\Local\Temp\17A6.tmp"C:\Users\Admin\AppData\Local\Temp\17A6.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\17E4.tmp"C:\Users\Admin\AppData\Local\Temp\17E4.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\1822.tmp"C:\Users\Admin\AppData\Local\Temp\1822.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\1861.tmp"C:\Users\Admin\AppData\Local\Temp\1861.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\189F.tmp"C:\Users\Admin\AppData\Local\Temp\189F.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\18DE.tmp"C:\Users\Admin\AppData\Local\Temp\18DE.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\191C.tmp"C:\Users\Admin\AppData\Local\Temp\191C.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\195A.tmp"C:\Users\Admin\AppData\Local\Temp\195A.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\1999.tmp"C:\Users\Admin\AppData\Local\Temp\1999.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:888 -
C:\Users\Admin\AppData\Local\Temp\19D7.tmp"C:\Users\Admin\AppData\Local\Temp\19D7.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:876 -
C:\Users\Admin\AppData\Local\Temp\1A16.tmp"C:\Users\Admin\AppData\Local\Temp\1A16.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\1A54.tmp"C:\Users\Admin\AppData\Local\Temp\1A54.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\1A92.tmp"C:\Users\Admin\AppData\Local\Temp\1A92.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\1B0F.tmp"C:\Users\Admin\AppData\Local\Temp\1B0F.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\1B8C.tmp"C:\Users\Admin\AppData\Local\Temp\1B8C.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\1C09.tmp"C:\Users\Admin\AppData\Local\Temp\1C09.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\1C47.tmp"C:\Users\Admin\AppData\Local\Temp\1C47.tmp"65⤵
- Executes dropped EXE
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\1C86.tmp"C:\Users\Admin\AppData\Local\Temp\1C86.tmp"66⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"67⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\1D02.tmp"C:\Users\Admin\AppData\Local\Temp\1D02.tmp"68⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\1D41.tmp"C:\Users\Admin\AppData\Local\Temp\1D41.tmp"69⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"70⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"71⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"72⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"73⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\1E79.tmp"C:\Users\Admin\AppData\Local\Temp\1E79.tmp"74⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"75⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"76⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\1F34.tmp"C:\Users\Admin\AppData\Local\Temp\1F34.tmp"77⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\1F72.tmp"C:\Users\Admin\AppData\Local\Temp\1F72.tmp"78⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"79⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"80⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\202E.tmp"C:\Users\Admin\AppData\Local\Temp\202E.tmp"81⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\206C.tmp"C:\Users\Admin\AppData\Local\Temp\206C.tmp"82⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\20AA.tmp"C:\Users\Admin\AppData\Local\Temp\20AA.tmp"83⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\20E9.tmp"C:\Users\Admin\AppData\Local\Temp\20E9.tmp"84⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\2127.tmp"C:\Users\Admin\AppData\Local\Temp\2127.tmp"85⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\2166.tmp"C:\Users\Admin\AppData\Local\Temp\2166.tmp"86⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\21A4.tmp"C:\Users\Admin\AppData\Local\Temp\21A4.tmp"87⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\21E2.tmp"C:\Users\Admin\AppData\Local\Temp\21E2.tmp"88⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\2221.tmp"C:\Users\Admin\AppData\Local\Temp\2221.tmp"89⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\225F.tmp"C:\Users\Admin\AppData\Local\Temp\225F.tmp"90⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\22AD.tmp"C:\Users\Admin\AppData\Local\Temp\22AD.tmp"91⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\22EC.tmp"C:\Users\Admin\AppData\Local\Temp\22EC.tmp"92⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\232A.tmp"C:\Users\Admin\AppData\Local\Temp\232A.tmp"93⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\2368.tmp"C:\Users\Admin\AppData\Local\Temp\2368.tmp"94⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\23A7.tmp"C:\Users\Admin\AppData\Local\Temp\23A7.tmp"95⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"96⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\2424.tmp"C:\Users\Admin\AppData\Local\Temp\2424.tmp"97⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"98⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\24A0.tmp"C:\Users\Admin\AppData\Local\Temp\24A0.tmp"99⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\24DF.tmp"C:\Users\Admin\AppData\Local\Temp\24DF.tmp"100⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\251D.tmp"C:\Users\Admin\AppData\Local\Temp\251D.tmp"101⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"102⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\259A.tmp"C:\Users\Admin\AppData\Local\Temp\259A.tmp"103⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\25D8.tmp"C:\Users\Admin\AppData\Local\Temp\25D8.tmp"104⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"105⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\2655.tmp"C:\Users\Admin\AppData\Local\Temp\2655.tmp"106⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\2694.tmp"C:\Users\Admin\AppData\Local\Temp\2694.tmp"107⤵PID:284
-
C:\Users\Admin\AppData\Local\Temp\26D2.tmp"C:\Users\Admin\AppData\Local\Temp\26D2.tmp"108⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\2710.tmp"C:\Users\Admin\AppData\Local\Temp\2710.tmp"109⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\274F.tmp"C:\Users\Admin\AppData\Local\Temp\274F.tmp"110⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\278D.tmp"C:\Users\Admin\AppData\Local\Temp\278D.tmp"111⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\27CC.tmp"C:\Users\Admin\AppData\Local\Temp\27CC.tmp"112⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"113⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\2848.tmp"C:\Users\Admin\AppData\Local\Temp\2848.tmp"114⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\2887.tmp"C:\Users\Admin\AppData\Local\Temp\2887.tmp"115⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\28C5.tmp"C:\Users\Admin\AppData\Local\Temp\28C5.tmp"116⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\2904.tmp"C:\Users\Admin\AppData\Local\Temp\2904.tmp"117⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\2942.tmp"C:\Users\Admin\AppData\Local\Temp\2942.tmp"118⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\2980.tmp"C:\Users\Admin\AppData\Local\Temp\2980.tmp"119⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\29BF.tmp"C:\Users\Admin\AppData\Local\Temp\29BF.tmp"120⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\29FD.tmp"C:\Users\Admin\AppData\Local\Temp\29FD.tmp"121⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"122⤵PID:888
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-