Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
16/06/2024, 07:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-16_f72f5884b1b7cbc7d1ecccaa4069c2ad_mafia.exe
Resource
win7-20240611-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-16_f72f5884b1b7cbc7d1ecccaa4069c2ad_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-06-16_f72f5884b1b7cbc7d1ecccaa4069c2ad_mafia.exe
-
Size
520KB
-
MD5
f72f5884b1b7cbc7d1ecccaa4069c2ad
-
SHA1
a02ebf22ca87fd0cf4c2c781c73d7891675b7c90
-
SHA256
3a913ca3e717f01231c524091df8aff734973f4644a9213d50c87d19987e519d
-
SHA512
0fe8f518fca6fb9f562cab941d9df54850d6f175ac97152b8dc4c54658de62350b16810283db39393dbd792fa0e920c4dcf30392a2825ed4f83cffa5977faaa4
-
SSDEEP
12288:roRXOQjmOyEB0hMFO1ceh8Mk/i4SmkmblNxrtKNZ:rogQ9y1huO1mMk/NSspNxrtKN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1668 6680.tmp 2084 6799.tmp 1896 68F0.tmp 2656 6A09.tmp 2848 6AF3.tmp 2612 6C1B.tmp 2712 6D25.tmp 2696 6DFF.tmp 2684 6E6C.tmp 2484 6F95.tmp 2636 70BD.tmp 1680 71C6.tmp 1072 72CF.tmp 768 73D9.tmp 1020 74F1.tmp 2536 760A.tmp 2760 7704.tmp 2196 781D.tmp 1152 7A10.tmp 1984 7AFA.tmp 1972 7BD4.tmp 2408 7CDD.tmp 1928 7DC7.tmp 1820 7E54.tmp 920 7EE0.tmp 1708 7F7C.tmp 1780 8009.tmp 2268 8095.tmp 2116 8131.tmp 2856 81AE.tmp 1572 823A.tmp 2352 82B7.tmp 2012 8343.tmp 816 83DF.tmp 1448 844D.tmp 2172 84C9.tmp 2300 8546.tmp 2004 85B3.tmp 1104 8630.tmp 3048 869D.tmp 1536 86FB.tmp 1172 8787.tmp 648 8804.tmp 1112 8871.tmp 888 88FE.tmp 580 897B.tmp 2280 8A07.tmp 2020 8AA3.tmp 2428 8B20.tmp 1684 8BAC.tmp 1720 8C29.tmp 2840 8CA6.tmp 872 8D23.tmp 2436 8F06.tmp 1584 8F83.tmp 1688 9000.tmp 2068 909C.tmp 2724 9128.tmp 3004 91C4.tmp 2576 9241.tmp 1896 92CD.tmp 2700 935A.tmp 2620 93E6.tmp 2848 9473.tmp -
Loads dropped DLL 64 IoCs
pid Process 1704 2024-06-16_f72f5884b1b7cbc7d1ecccaa4069c2ad_mafia.exe 1668 6680.tmp 2084 6799.tmp 1896 68F0.tmp 2656 6A09.tmp 2848 6AF3.tmp 2612 6C1B.tmp 2712 6D25.tmp 2696 6DFF.tmp 2684 6E6C.tmp 2484 6F95.tmp 2636 70BD.tmp 1680 71C6.tmp 1072 72CF.tmp 768 73D9.tmp 1020 74F1.tmp 2536 760A.tmp 2760 7704.tmp 2196 781D.tmp 1152 7A10.tmp 1984 7AFA.tmp 1972 7BD4.tmp 2408 7CDD.tmp 1928 7DC7.tmp 1820 7E54.tmp 920 7EE0.tmp 1708 7F7C.tmp 1780 8009.tmp 2268 8095.tmp 2116 8131.tmp 2856 81AE.tmp 1572 823A.tmp 2352 82B7.tmp 2012 8343.tmp 816 83DF.tmp 1448 844D.tmp 2172 84C9.tmp 2300 8546.tmp 2004 85B3.tmp 1104 8630.tmp 3048 869D.tmp 1536 86FB.tmp 1172 8787.tmp 648 8804.tmp 1112 8871.tmp 888 88FE.tmp 580 897B.tmp 2280 8A07.tmp 2020 8AA3.tmp 2428 8B20.tmp 1684 8BAC.tmp 1720 8C29.tmp 2840 8CA6.tmp 872 8D23.tmp 2436 8F06.tmp 1584 8F83.tmp 1688 9000.tmp 2068 909C.tmp 2724 9128.tmp 3004 91C4.tmp 2576 9241.tmp 1896 92CD.tmp 2700 935A.tmp 2620 93E6.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1704 wrote to memory of 1668 1704 2024-06-16_f72f5884b1b7cbc7d1ecccaa4069c2ad_mafia.exe 28 PID 1704 wrote to memory of 1668 1704 2024-06-16_f72f5884b1b7cbc7d1ecccaa4069c2ad_mafia.exe 28 PID 1704 wrote to memory of 1668 1704 2024-06-16_f72f5884b1b7cbc7d1ecccaa4069c2ad_mafia.exe 28 PID 1704 wrote to memory of 1668 1704 2024-06-16_f72f5884b1b7cbc7d1ecccaa4069c2ad_mafia.exe 28 PID 1668 wrote to memory of 2084 1668 6680.tmp 29 PID 1668 wrote to memory of 2084 1668 6680.tmp 29 PID 1668 wrote to memory of 2084 1668 6680.tmp 29 PID 1668 wrote to memory of 2084 1668 6680.tmp 29 PID 2084 wrote to memory of 1896 2084 6799.tmp 30 PID 2084 wrote to memory of 1896 2084 6799.tmp 30 PID 2084 wrote to memory of 1896 2084 6799.tmp 30 PID 2084 wrote to memory of 1896 2084 6799.tmp 30 PID 1896 wrote to memory of 2656 1896 68F0.tmp 31 PID 1896 wrote to memory of 2656 1896 68F0.tmp 31 PID 1896 wrote to memory of 2656 1896 68F0.tmp 31 PID 1896 wrote to memory of 2656 1896 68F0.tmp 31 PID 2656 wrote to memory of 2848 2656 6A09.tmp 32 PID 2656 wrote to memory of 2848 2656 6A09.tmp 32 PID 2656 wrote to memory of 2848 2656 6A09.tmp 32 PID 2656 wrote to memory of 2848 2656 6A09.tmp 32 PID 2848 wrote to memory of 2612 2848 6AF3.tmp 33 PID 2848 wrote to memory of 2612 2848 6AF3.tmp 33 PID 2848 wrote to memory of 2612 2848 6AF3.tmp 33 PID 2848 wrote to memory of 2612 2848 6AF3.tmp 33 PID 2612 wrote to memory of 2712 2612 6C1B.tmp 34 PID 2612 wrote to memory of 2712 2612 6C1B.tmp 34 PID 2612 wrote to memory of 2712 2612 6C1B.tmp 34 PID 2612 wrote to memory of 2712 2612 6C1B.tmp 34 PID 2712 wrote to memory of 2696 2712 6D25.tmp 35 PID 2712 wrote to memory of 2696 2712 6D25.tmp 35 PID 2712 wrote to memory of 2696 2712 6D25.tmp 35 PID 2712 wrote to memory of 2696 2712 6D25.tmp 35 PID 2696 wrote to memory of 2684 2696 6DFF.tmp 36 PID 2696 wrote to memory of 2684 2696 6DFF.tmp 36 PID 2696 wrote to memory of 2684 2696 6DFF.tmp 36 PID 2696 wrote to memory of 2684 2696 6DFF.tmp 36 PID 2684 wrote to memory of 2484 2684 6E6C.tmp 37 PID 2684 wrote to memory of 2484 2684 6E6C.tmp 37 PID 2684 wrote to memory of 2484 2684 6E6C.tmp 37 PID 2684 wrote to memory of 2484 2684 6E6C.tmp 37 PID 2484 wrote to memory of 2636 2484 6F95.tmp 38 PID 2484 wrote to memory of 2636 2484 6F95.tmp 38 PID 2484 wrote to memory of 2636 2484 6F95.tmp 38 PID 2484 wrote to memory of 2636 2484 6F95.tmp 38 PID 2636 wrote to memory of 1680 2636 70BD.tmp 39 PID 2636 wrote to memory of 1680 2636 70BD.tmp 39 PID 2636 wrote to memory of 1680 2636 70BD.tmp 39 PID 2636 wrote to memory of 1680 2636 70BD.tmp 39 PID 1680 wrote to memory of 1072 1680 71C6.tmp 40 PID 1680 wrote to memory of 1072 1680 71C6.tmp 40 PID 1680 wrote to memory of 1072 1680 71C6.tmp 40 PID 1680 wrote to memory of 1072 1680 71C6.tmp 40 PID 1072 wrote to memory of 768 1072 72CF.tmp 41 PID 1072 wrote to memory of 768 1072 72CF.tmp 41 PID 1072 wrote to memory of 768 1072 72CF.tmp 41 PID 1072 wrote to memory of 768 1072 72CF.tmp 41 PID 768 wrote to memory of 1020 768 73D9.tmp 42 PID 768 wrote to memory of 1020 768 73D9.tmp 42 PID 768 wrote to memory of 1020 768 73D9.tmp 42 PID 768 wrote to memory of 1020 768 73D9.tmp 42 PID 1020 wrote to memory of 2536 1020 74F1.tmp 43 PID 1020 wrote to memory of 2536 1020 74F1.tmp 43 PID 1020 wrote to memory of 2536 1020 74F1.tmp 43 PID 1020 wrote to memory of 2536 1020 74F1.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-16_f72f5884b1b7cbc7d1ecccaa4069c2ad_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-16_f72f5884b1b7cbc7d1ecccaa4069c2ad_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\6680.tmp"C:\Users\Admin\AppData\Local\Temp\6680.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\6799.tmp"C:\Users\Admin\AppData\Local\Temp\6799.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\68F0.tmp"C:\Users\Admin\AppData\Local\Temp\68F0.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\6A09.tmp"C:\Users\Admin\AppData\Local\Temp\6A09.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\6AF3.tmp"C:\Users\Admin\AppData\Local\Temp\6AF3.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\6C1B.tmp"C:\Users\Admin\AppData\Local\Temp\6C1B.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\6D25.tmp"C:\Users\Admin\AppData\Local\Temp\6D25.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\6DFF.tmp"C:\Users\Admin\AppData\Local\Temp\6DFF.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\6E6C.tmp"C:\Users\Admin\AppData\Local\Temp\6E6C.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\6F95.tmp"C:\Users\Admin\AppData\Local\Temp\6F95.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\70BD.tmp"C:\Users\Admin\AppData\Local\Temp\70BD.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\71C6.tmp"C:\Users\Admin\AppData\Local\Temp\71C6.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\72CF.tmp"C:\Users\Admin\AppData\Local\Temp\72CF.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\73D9.tmp"C:\Users\Admin\AppData\Local\Temp\73D9.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Users\Admin\AppData\Local\Temp\74F1.tmp"C:\Users\Admin\AppData\Local\Temp\74F1.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\760A.tmp"C:\Users\Admin\AppData\Local\Temp\760A.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\7704.tmp"C:\Users\Admin\AppData\Local\Temp\7704.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\781D.tmp"C:\Users\Admin\AppData\Local\Temp\781D.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\7A10.tmp"C:\Users\Admin\AppData\Local\Temp\7A10.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\7AFA.tmp"C:\Users\Admin\AppData\Local\Temp\7AFA.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\7BD4.tmp"C:\Users\Admin\AppData\Local\Temp\7BD4.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\7CDD.tmp"C:\Users\Admin\AppData\Local\Temp\7CDD.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\7DC7.tmp"C:\Users\Admin\AppData\Local\Temp\7DC7.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\7E54.tmp"C:\Users\Admin\AppData\Local\Temp\7E54.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\7EE0.tmp"C:\Users\Admin\AppData\Local\Temp\7EE0.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:920 -
C:\Users\Admin\AppData\Local\Temp\7F7C.tmp"C:\Users\Admin\AppData\Local\Temp\7F7C.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\8009.tmp"C:\Users\Admin\AppData\Local\Temp\8009.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\8095.tmp"C:\Users\Admin\AppData\Local\Temp\8095.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\8131.tmp"C:\Users\Admin\AppData\Local\Temp\8131.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\81AE.tmp"C:\Users\Admin\AppData\Local\Temp\81AE.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\823A.tmp"C:\Users\Admin\AppData\Local\Temp\823A.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\82B7.tmp"C:\Users\Admin\AppData\Local\Temp\82B7.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\8343.tmp"C:\Users\Admin\AppData\Local\Temp\8343.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\83DF.tmp"C:\Users\Admin\AppData\Local\Temp\83DF.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:816 -
C:\Users\Admin\AppData\Local\Temp\844D.tmp"C:\Users\Admin\AppData\Local\Temp\844D.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\84C9.tmp"C:\Users\Admin\AppData\Local\Temp\84C9.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\8546.tmp"C:\Users\Admin\AppData\Local\Temp\8546.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\85B3.tmp"C:\Users\Admin\AppData\Local\Temp\85B3.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\8630.tmp"C:\Users\Admin\AppData\Local\Temp\8630.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\869D.tmp"C:\Users\Admin\AppData\Local\Temp\869D.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\86FB.tmp"C:\Users\Admin\AppData\Local\Temp\86FB.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\8787.tmp"C:\Users\Admin\AppData\Local\Temp\8787.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\8804.tmp"C:\Users\Admin\AppData\Local\Temp\8804.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:648 -
C:\Users\Admin\AppData\Local\Temp\8871.tmp"C:\Users\Admin\AppData\Local\Temp\8871.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\88FE.tmp"C:\Users\Admin\AppData\Local\Temp\88FE.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:888 -
C:\Users\Admin\AppData\Local\Temp\897B.tmp"C:\Users\Admin\AppData\Local\Temp\897B.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:580 -
C:\Users\Admin\AppData\Local\Temp\8A07.tmp"C:\Users\Admin\AppData\Local\Temp\8A07.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\8AA3.tmp"C:\Users\Admin\AppData\Local\Temp\8AA3.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\8B20.tmp"C:\Users\Admin\AppData\Local\Temp\8B20.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\8BAC.tmp"C:\Users\Admin\AppData\Local\Temp\8BAC.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\8C29.tmp"C:\Users\Admin\AppData\Local\Temp\8C29.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\8CA6.tmp"C:\Users\Admin\AppData\Local\Temp\8CA6.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\8D23.tmp"C:\Users\Admin\AppData\Local\Temp\8D23.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:872 -
C:\Users\Admin\AppData\Local\Temp\8F06.tmp"C:\Users\Admin\AppData\Local\Temp\8F06.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\8F83.tmp"C:\Users\Admin\AppData\Local\Temp\8F83.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\9000.tmp"C:\Users\Admin\AppData\Local\Temp\9000.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\909C.tmp"C:\Users\Admin\AppData\Local\Temp\909C.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\9128.tmp"C:\Users\Admin\AppData\Local\Temp\9128.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\91C4.tmp"C:\Users\Admin\AppData\Local\Temp\91C4.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\9241.tmp"C:\Users\Admin\AppData\Local\Temp\9241.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\92CD.tmp"C:\Users\Admin\AppData\Local\Temp\92CD.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\935A.tmp"C:\Users\Admin\AppData\Local\Temp\935A.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\93E6.tmp"C:\Users\Admin\AppData\Local\Temp\93E6.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\9473.tmp"C:\Users\Admin\AppData\Local\Temp\9473.tmp"65⤵
- Executes dropped EXE
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\94FF.tmp"C:\Users\Admin\AppData\Local\Temp\94FF.tmp"66⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\958B.tmp"C:\Users\Admin\AppData\Local\Temp\958B.tmp"67⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\95F9.tmp"C:\Users\Admin\AppData\Local\Temp\95F9.tmp"68⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\96A4.tmp"C:\Users\Admin\AppData\Local\Temp\96A4.tmp"69⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\9721.tmp"C:\Users\Admin\AppData\Local\Temp\9721.tmp"70⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\979E.tmp"C:\Users\Admin\AppData\Local\Temp\979E.tmp"71⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\981B.tmp"C:\Users\Admin\AppData\Local\Temp\981B.tmp"72⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\9878.tmp"C:\Users\Admin\AppData\Local\Temp\9878.tmp"73⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\98E5.tmp"C:\Users\Admin\AppData\Local\Temp\98E5.tmp"74⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\9962.tmp"C:\Users\Admin\AppData\Local\Temp\9962.tmp"75⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\99DF.tmp"C:\Users\Admin\AppData\Local\Temp\99DF.tmp"76⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"77⤵PID:472
-
C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"78⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"79⤵PID:108
-
C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"80⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\9C3F.tmp"C:\Users\Admin\AppData\Local\Temp\9C3F.tmp"81⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\9CBC.tmp"C:\Users\Admin\AppData\Local\Temp\9CBC.tmp"82⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\9D49.tmp"C:\Users\Admin\AppData\Local\Temp\9D49.tmp"83⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\9DC5.tmp"C:\Users\Admin\AppData\Local\Temp\9DC5.tmp"84⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\9E42.tmp"C:\Users\Admin\AppData\Local\Temp\9E42.tmp"85⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\9EDE.tmp"C:\Users\Admin\AppData\Local\Temp\9EDE.tmp"86⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\9F6B.tmp"C:\Users\Admin\AppData\Local\Temp\9F6B.tmp"87⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\9FE7.tmp"C:\Users\Admin\AppData\Local\Temp\9FE7.tmp"88⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\A064.tmp"C:\Users\Admin\AppData\Local\Temp\A064.tmp"89⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\A100.tmp"C:\Users\Admin\AppData\Local\Temp\A100.tmp"90⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\A16D.tmp"C:\Users\Admin\AppData\Local\Temp\A16D.tmp"91⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\A1EA.tmp"C:\Users\Admin\AppData\Local\Temp\A1EA.tmp"92⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\A267.tmp"C:\Users\Admin\AppData\Local\Temp\A267.tmp"93⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\A2D4.tmp"C:\Users\Admin\AppData\Local\Temp\A2D4.tmp"94⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\A351.tmp"C:\Users\Admin\AppData\Local\Temp\A351.tmp"95⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\A499.tmp"C:\Users\Admin\AppData\Local\Temp\A499.tmp"96⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\A525.tmp"C:\Users\Admin\AppData\Local\Temp\A525.tmp"97⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\A5A2.tmp"C:\Users\Admin\AppData\Local\Temp\A5A2.tmp"98⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\A5FF.tmp"C:\Users\Admin\AppData\Local\Temp\A5FF.tmp"99⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\A67C.tmp"C:\Users\Admin\AppData\Local\Temp\A67C.tmp"100⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\A6F9.tmp"C:\Users\Admin\AppData\Local\Temp\A6F9.tmp"101⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\A776.tmp"C:\Users\Admin\AppData\Local\Temp\A776.tmp"102⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\A7F3.tmp"C:\Users\Admin\AppData\Local\Temp\A7F3.tmp"103⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\A86F.tmp"C:\Users\Admin\AppData\Local\Temp\A86F.tmp"104⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\A8FC.tmp"C:\Users\Admin\AppData\Local\Temp\A8FC.tmp"105⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\A979.tmp"C:\Users\Admin\AppData\Local\Temp\A979.tmp"106⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\AA53.tmp"C:\Users\Admin\AppData\Local\Temp\AA53.tmp"107⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\AAD0.tmp"C:\Users\Admin\AppData\Local\Temp\AAD0.tmp"108⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\AB3D.tmp"C:\Users\Admin\AppData\Local\Temp\AB3D.tmp"109⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\ABBA.tmp"C:\Users\Admin\AppData\Local\Temp\ABBA.tmp"110⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\AC37.tmp"C:\Users\Admin\AppData\Local\Temp\AC37.tmp"111⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\ACC3.tmp"C:\Users\Admin\AppData\Local\Temp\ACC3.tmp"112⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\AD40.tmp"C:\Users\Admin\AppData\Local\Temp\AD40.tmp"113⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\ADBD.tmp"C:\Users\Admin\AppData\Local\Temp\ADBD.tmp"114⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\AE39.tmp"C:\Users\Admin\AppData\Local\Temp\AE39.tmp"115⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\AE97.tmp"C:\Users\Admin\AppData\Local\Temp\AE97.tmp"116⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\AF14.tmp"C:\Users\Admin\AppData\Local\Temp\AF14.tmp"117⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\AFA0.tmp"C:\Users\Admin\AppData\Local\Temp\AFA0.tmp"118⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\B02D.tmp"C:\Users\Admin\AppData\Local\Temp\B02D.tmp"119⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\B08A.tmp"C:\Users\Admin\AppData\Local\Temp\B08A.tmp"120⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\B107.tmp"C:\Users\Admin\AppData\Local\Temp\B107.tmp"121⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\B184.tmp"C:\Users\Admin\AppData\Local\Temp\B184.tmp"122⤵PID:1080
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-