Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15-06-2024 13:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-15_cc5c24a2afbfa0ca1c22fd9e2de627c4_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-15_cc5c24a2afbfa0ca1c22fd9e2de627c4_mafia.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-06-15_cc5c24a2afbfa0ca1c22fd9e2de627c4_mafia.exe
-
Size
765KB
-
MD5
cc5c24a2afbfa0ca1c22fd9e2de627c4
-
SHA1
cd3cf423c2e8d751f92c14285d09b70714fb9ce1
-
SHA256
fda5db7b99d7d8c5131f35b11ae8626af626bc17bf3d19de3073b90e9c63c51a
-
SHA512
a2c4e7f99e4962103ae1f3963807a280069137254c8d66fc4e7f2f0624cf1a257c11c71edc36b0771eebb35eba6b4b87291d35c7a381ba126caabc1520f5c70b
-
SSDEEP
12288:ZU5rCOTeiD5kBjOTW4BlVDDYSxjA/EmUV3/Hjxwwy3ZF5rn5rLOa54U5w5A:ZUQOJDSmbl+SR+KDxwb3vh5Oa+UOS
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1352 EFE.tmp 1768 F5C.tmp 2600 1017.tmp 2676 1084.tmp 2252 10F2.tmp 2592 118E.tmp 2712 120A.tmp 2488 1278.tmp 2680 1304.tmp 2492 1362.tmp 2912 13EE.tmp 2632 145B.tmp 1452 14D8.tmp 2772 1555.tmp 2548 15D2.tmp 1820 1620.tmp 2004 168D.tmp 1828 170A.tmp 2392 1777.tmp 784 17E4.tmp 828 1851.tmp 3016 18BE.tmp 1692 191C.tmp 2264 195A.tmp 2104 19A8.tmp 2180 19E7.tmp 2444 1A35.tmp 2992 1A92.tmp 2856 1AE0.tmp 2092 1B1F.tmp 596 1B6D.tmp 488 1BAB.tmp 1496 1BF9.tmp 3028 1C38.tmp 1704 1C76.tmp 1540 1CC4.tmp 1628 1D12.tmp 412 1D60.tmp 2168 1DBE.tmp 2152 1DFC.tmp 1396 1E4A.tmp 1788 1E88.tmp 1384 1EC7.tmp 1880 1F15.tmp 2336 1F63.tmp 280 1FB1.tmp 780 1FEF.tmp 2116 202E.tmp 2544 207C.tmp 1224 20CA.tmp 2880 2108.tmp 1012 2156.tmp 1756 2194.tmp 1408 21E2.tmp 1652 2230.tmp 1616 226F.tmp 2112 22DC.tmp 2320 231A.tmp 2196 2378.tmp 2608 23C6.tmp 2688 2404.tmp 2616 2472.tmp 3004 24C0.tmp 2828 251D.tmp -
Loads dropped DLL 64 IoCs
pid Process 2412 2024-06-15_cc5c24a2afbfa0ca1c22fd9e2de627c4_mafia.exe 1352 EFE.tmp 1768 F5C.tmp 2600 1017.tmp 2676 1084.tmp 2252 10F2.tmp 2592 118E.tmp 2712 120A.tmp 2488 1278.tmp 2680 1304.tmp 2492 1362.tmp 2912 13EE.tmp 2632 145B.tmp 1452 14D8.tmp 2772 1555.tmp 2548 15D2.tmp 1820 1620.tmp 2004 168D.tmp 1828 170A.tmp 2392 1777.tmp 784 17E4.tmp 828 1851.tmp 3016 18BE.tmp 1692 191C.tmp 2264 195A.tmp 2104 19A8.tmp 2180 19E7.tmp 2444 1A35.tmp 2992 1A92.tmp 2856 1AE0.tmp 2092 1B1F.tmp 596 1B6D.tmp 488 1BAB.tmp 1496 1BF9.tmp 3028 1C38.tmp 1704 1C76.tmp 1540 1CC4.tmp 1628 1D12.tmp 412 1D60.tmp 2168 1DBE.tmp 2152 1DFC.tmp 1396 1E4A.tmp 1788 1E88.tmp 1384 1EC7.tmp 1880 1F15.tmp 2336 1F63.tmp 280 1FB1.tmp 780 1FEF.tmp 2116 202E.tmp 2544 207C.tmp 1224 20CA.tmp 2880 2108.tmp 1012 2156.tmp 1756 2194.tmp 1408 21E2.tmp 1652 2230.tmp 1616 226F.tmp 2112 22DC.tmp 2320 231A.tmp 2196 2378.tmp 2608 23C6.tmp 2688 2404.tmp 2616 2472.tmp 3004 24C0.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2412 wrote to memory of 1352 2412 2024-06-15_cc5c24a2afbfa0ca1c22fd9e2de627c4_mafia.exe 28 PID 2412 wrote to memory of 1352 2412 2024-06-15_cc5c24a2afbfa0ca1c22fd9e2de627c4_mafia.exe 28 PID 2412 wrote to memory of 1352 2412 2024-06-15_cc5c24a2afbfa0ca1c22fd9e2de627c4_mafia.exe 28 PID 2412 wrote to memory of 1352 2412 2024-06-15_cc5c24a2afbfa0ca1c22fd9e2de627c4_mafia.exe 28 PID 1352 wrote to memory of 1768 1352 EFE.tmp 29 PID 1352 wrote to memory of 1768 1352 EFE.tmp 29 PID 1352 wrote to memory of 1768 1352 EFE.tmp 29 PID 1352 wrote to memory of 1768 1352 EFE.tmp 29 PID 1768 wrote to memory of 2600 1768 F5C.tmp 30 PID 1768 wrote to memory of 2600 1768 F5C.tmp 30 PID 1768 wrote to memory of 2600 1768 F5C.tmp 30 PID 1768 wrote to memory of 2600 1768 F5C.tmp 30 PID 2600 wrote to memory of 2676 2600 1017.tmp 31 PID 2600 wrote to memory of 2676 2600 1017.tmp 31 PID 2600 wrote to memory of 2676 2600 1017.tmp 31 PID 2600 wrote to memory of 2676 2600 1017.tmp 31 PID 2676 wrote to memory of 2252 2676 1084.tmp 32 PID 2676 wrote to memory of 2252 2676 1084.tmp 32 PID 2676 wrote to memory of 2252 2676 1084.tmp 32 PID 2676 wrote to memory of 2252 2676 1084.tmp 32 PID 2252 wrote to memory of 2592 2252 10F2.tmp 33 PID 2252 wrote to memory of 2592 2252 10F2.tmp 33 PID 2252 wrote to memory of 2592 2252 10F2.tmp 33 PID 2252 wrote to memory of 2592 2252 10F2.tmp 33 PID 2592 wrote to memory of 2712 2592 118E.tmp 34 PID 2592 wrote to memory of 2712 2592 118E.tmp 34 PID 2592 wrote to memory of 2712 2592 118E.tmp 34 PID 2592 wrote to memory of 2712 2592 118E.tmp 34 PID 2712 wrote to memory of 2488 2712 120A.tmp 35 PID 2712 wrote to memory of 2488 2712 120A.tmp 35 PID 2712 wrote to memory of 2488 2712 120A.tmp 35 PID 2712 wrote to memory of 2488 2712 120A.tmp 35 PID 2488 wrote to memory of 2680 2488 1278.tmp 36 PID 2488 wrote to memory of 2680 2488 1278.tmp 36 PID 2488 wrote to memory of 2680 2488 1278.tmp 36 PID 2488 wrote to memory of 2680 2488 1278.tmp 36 PID 2680 wrote to memory of 2492 2680 1304.tmp 37 PID 2680 wrote to memory of 2492 2680 1304.tmp 37 PID 2680 wrote to memory of 2492 2680 1304.tmp 37 PID 2680 wrote to memory of 2492 2680 1304.tmp 37 PID 2492 wrote to memory of 2912 2492 1362.tmp 38 PID 2492 wrote to memory of 2912 2492 1362.tmp 38 PID 2492 wrote to memory of 2912 2492 1362.tmp 38 PID 2492 wrote to memory of 2912 2492 1362.tmp 38 PID 2912 wrote to memory of 2632 2912 13EE.tmp 39 PID 2912 wrote to memory of 2632 2912 13EE.tmp 39 PID 2912 wrote to memory of 2632 2912 13EE.tmp 39 PID 2912 wrote to memory of 2632 2912 13EE.tmp 39 PID 2632 wrote to memory of 1452 2632 145B.tmp 40 PID 2632 wrote to memory of 1452 2632 145B.tmp 40 PID 2632 wrote to memory of 1452 2632 145B.tmp 40 PID 2632 wrote to memory of 1452 2632 145B.tmp 40 PID 1452 wrote to memory of 2772 1452 14D8.tmp 41 PID 1452 wrote to memory of 2772 1452 14D8.tmp 41 PID 1452 wrote to memory of 2772 1452 14D8.tmp 41 PID 1452 wrote to memory of 2772 1452 14D8.tmp 41 PID 2772 wrote to memory of 2548 2772 1555.tmp 42 PID 2772 wrote to memory of 2548 2772 1555.tmp 42 PID 2772 wrote to memory of 2548 2772 1555.tmp 42 PID 2772 wrote to memory of 2548 2772 1555.tmp 42 PID 2548 wrote to memory of 1820 2548 15D2.tmp 43 PID 2548 wrote to memory of 1820 2548 15D2.tmp 43 PID 2548 wrote to memory of 1820 2548 15D2.tmp 43 PID 2548 wrote to memory of 1820 2548 15D2.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-15_cc5c24a2afbfa0ca1c22fd9e2de627c4_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-15_cc5c24a2afbfa0ca1c22fd9e2de627c4_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\EFE.tmp"C:\Users\Admin\AppData\Local\Temp\EFE.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\F5C.tmp"C:\Users\Admin\AppData\Local\Temp\F5C.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\1017.tmp"C:\Users\Admin\AppData\Local\Temp\1017.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\1084.tmp"C:\Users\Admin\AppData\Local\Temp\1084.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\10F2.tmp"C:\Users\Admin\AppData\Local\Temp\10F2.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\118E.tmp"C:\Users\Admin\AppData\Local\Temp\118E.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\120A.tmp"C:\Users\Admin\AppData\Local\Temp\120A.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\1278.tmp"C:\Users\Admin\AppData\Local\Temp\1278.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\1304.tmp"C:\Users\Admin\AppData\Local\Temp\1304.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\1362.tmp"C:\Users\Admin\AppData\Local\Temp\1362.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\13EE.tmp"C:\Users\Admin\AppData\Local\Temp\13EE.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\145B.tmp"C:\Users\Admin\AppData\Local\Temp\145B.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\14D8.tmp"C:\Users\Admin\AppData\Local\Temp\14D8.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\1555.tmp"C:\Users\Admin\AppData\Local\Temp\1555.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\15D2.tmp"C:\Users\Admin\AppData\Local\Temp\15D2.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\1620.tmp"C:\Users\Admin\AppData\Local\Temp\1620.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\168D.tmp"C:\Users\Admin\AppData\Local\Temp\168D.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\170A.tmp"C:\Users\Admin\AppData\Local\Temp\170A.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\1777.tmp"C:\Users\Admin\AppData\Local\Temp\1777.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\17E4.tmp"C:\Users\Admin\AppData\Local\Temp\17E4.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:784 -
C:\Users\Admin\AppData\Local\Temp\1851.tmp"C:\Users\Admin\AppData\Local\Temp\1851.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:828 -
C:\Users\Admin\AppData\Local\Temp\18BE.tmp"C:\Users\Admin\AppData\Local\Temp\18BE.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\191C.tmp"C:\Users\Admin\AppData\Local\Temp\191C.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\195A.tmp"C:\Users\Admin\AppData\Local\Temp\195A.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\19A8.tmp"C:\Users\Admin\AppData\Local\Temp\19A8.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\19E7.tmp"C:\Users\Admin\AppData\Local\Temp\19E7.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\1A35.tmp"C:\Users\Admin\AppData\Local\Temp\1A35.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\1A92.tmp"C:\Users\Admin\AppData\Local\Temp\1A92.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\1AE0.tmp"C:\Users\Admin\AppData\Local\Temp\1AE0.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\1B6D.tmp"C:\Users\Admin\AppData\Local\Temp\1B6D.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:596 -
C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:488 -
C:\Users\Admin\AppData\Local\Temp\1BF9.tmp"C:\Users\Admin\AppData\Local\Temp\1BF9.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\1C38.tmp"C:\Users\Admin\AppData\Local\Temp\1C38.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\1C76.tmp"C:\Users\Admin\AppData\Local\Temp\1C76.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\1D12.tmp"C:\Users\Admin\AppData\Local\Temp\1D12.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\1D60.tmp"C:\Users\Admin\AppData\Local\Temp\1D60.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:412 -
C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\1E4A.tmp"C:\Users\Admin\AppData\Local\Temp\1E4A.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\1E88.tmp"C:\Users\Admin\AppData\Local\Temp\1E88.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\1F15.tmp"C:\Users\Admin\AppData\Local\Temp\1F15.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\1F63.tmp"C:\Users\Admin\AppData\Local\Temp\1F63.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:280 -
C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:780 -
C:\Users\Admin\AppData\Local\Temp\202E.tmp"C:\Users\Admin\AppData\Local\Temp\202E.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\207C.tmp"C:\Users\Admin\AppData\Local\Temp\207C.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\20CA.tmp"C:\Users\Admin\AppData\Local\Temp\20CA.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\2108.tmp"C:\Users\Admin\AppData\Local\Temp\2108.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\2156.tmp"C:\Users\Admin\AppData\Local\Temp\2156.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\2194.tmp"C:\Users\Admin\AppData\Local\Temp\2194.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\21E2.tmp"C:\Users\Admin\AppData\Local\Temp\21E2.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\2230.tmp"C:\Users\Admin\AppData\Local\Temp\2230.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\226F.tmp"C:\Users\Admin\AppData\Local\Temp\226F.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\22DC.tmp"C:\Users\Admin\AppData\Local\Temp\22DC.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\231A.tmp"C:\Users\Admin\AppData\Local\Temp\231A.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\2378.tmp"C:\Users\Admin\AppData\Local\Temp\2378.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\23C6.tmp"C:\Users\Admin\AppData\Local\Temp\23C6.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\2404.tmp"C:\Users\Admin\AppData\Local\Temp\2404.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\2472.tmp"C:\Users\Admin\AppData\Local\Temp\2472.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\24C0.tmp"C:\Users\Admin\AppData\Local\Temp\24C0.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\251D.tmp"C:\Users\Admin\AppData\Local\Temp\251D.tmp"65⤵
- Executes dropped EXE
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\257B.tmp"C:\Users\Admin\AppData\Local\Temp\257B.tmp"66⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\25C9.tmp"C:\Users\Admin\AppData\Local\Temp\25C9.tmp"67⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\2607.tmp"C:\Users\Admin\AppData\Local\Temp\2607.tmp"68⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\2655.tmp"C:\Users\Admin\AppData\Local\Temp\2655.tmp"69⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\2694.tmp"C:\Users\Admin\AppData\Local\Temp\2694.tmp"70⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\26E2.tmp"C:\Users\Admin\AppData\Local\Temp\26E2.tmp"71⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\2730.tmp"C:\Users\Admin\AppData\Local\Temp\2730.tmp"72⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\276E.tmp"C:\Users\Admin\AppData\Local\Temp\276E.tmp"73⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\27AC.tmp"C:\Users\Admin\AppData\Local\Temp\27AC.tmp"74⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\27EB.tmp"C:\Users\Admin\AppData\Local\Temp\27EB.tmp"75⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\2829.tmp"C:\Users\Admin\AppData\Local\Temp\2829.tmp"76⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\2868.tmp"C:\Users\Admin\AppData\Local\Temp\2868.tmp"77⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\28A6.tmp"C:\Users\Admin\AppData\Local\Temp\28A6.tmp"78⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\28E4.tmp"C:\Users\Admin\AppData\Local\Temp\28E4.tmp"79⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\2942.tmp"C:\Users\Admin\AppData\Local\Temp\2942.tmp"80⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\2980.tmp"C:\Users\Admin\AppData\Local\Temp\2980.tmp"81⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\29BF.tmp"C:\Users\Admin\AppData\Local\Temp\29BF.tmp"82⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"83⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"84⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\2A99.tmp"C:\Users\Admin\AppData\Local\Temp\2A99.tmp"85⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"86⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\2B26.tmp"C:\Users\Admin\AppData\Local\Temp\2B26.tmp"87⤵PID:312
-
C:\Users\Admin\AppData\Local\Temp\2B64.tmp"C:\Users\Admin\AppData\Local\Temp\2B64.tmp"88⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"89⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"90⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"91⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"92⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"93⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\2D09.tmp"C:\Users\Admin\AppData\Local\Temp\2D09.tmp"94⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\2D48.tmp"C:\Users\Admin\AppData\Local\Temp\2D48.tmp"95⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\2D86.tmp"C:\Users\Admin\AppData\Local\Temp\2D86.tmp"96⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"97⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\2E03.tmp"C:\Users\Admin\AppData\Local\Temp\2E03.tmp"98⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\2E41.tmp"C:\Users\Admin\AppData\Local\Temp\2E41.tmp"99⤵PID:604
-
C:\Users\Admin\AppData\Local\Temp\2E80.tmp"C:\Users\Admin\AppData\Local\Temp\2E80.tmp"100⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"101⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"102⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\2F5A.tmp"C:\Users\Admin\AppData\Local\Temp\2F5A.tmp"103⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\2F98.tmp"C:\Users\Admin\AppData\Local\Temp\2F98.tmp"104⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\2FD7.tmp"C:\Users\Admin\AppData\Local\Temp\2FD7.tmp"105⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\3015.tmp"C:\Users\Admin\AppData\Local\Temp\3015.tmp"106⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\3054.tmp"C:\Users\Admin\AppData\Local\Temp\3054.tmp"107⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\3092.tmp"C:\Users\Admin\AppData\Local\Temp\3092.tmp"108⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\30D0.tmp"C:\Users\Admin\AppData\Local\Temp\30D0.tmp"109⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\310F.tmp"C:\Users\Admin\AppData\Local\Temp\310F.tmp"110⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\315D.tmp"C:\Users\Admin\AppData\Local\Temp\315D.tmp"111⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\319B.tmp"C:\Users\Admin\AppData\Local\Temp\319B.tmp"112⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\31DA.tmp"C:\Users\Admin\AppData\Local\Temp\31DA.tmp"113⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\3228.tmp"C:\Users\Admin\AppData\Local\Temp\3228.tmp"114⤵PID:280
-
C:\Users\Admin\AppData\Local\Temp\3276.tmp"C:\Users\Admin\AppData\Local\Temp\3276.tmp"115⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\32C4.tmp"C:\Users\Admin\AppData\Local\Temp\32C4.tmp"116⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\3302.tmp"C:\Users\Admin\AppData\Local\Temp\3302.tmp"117⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\3350.tmp"C:\Users\Admin\AppData\Local\Temp\3350.tmp"118⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\339E.tmp"C:\Users\Admin\AppData\Local\Temp\339E.tmp"119⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\33DC.tmp"C:\Users\Admin\AppData\Local\Temp\33DC.tmp"120⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\342A.tmp"C:\Users\Admin\AppData\Local\Temp\342A.tmp"121⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\3469.tmp"C:\Users\Admin\AppData\Local\Temp\3469.tmp"122⤵PID:2124
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-