Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
05-07-2024 06:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-07-05_b98a5102fef224967870b1f589fdd5ff_mafia.exe
Resource
win7-20240508-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-05_b98a5102fef224967870b1f589fdd5ff_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-07-05_b98a5102fef224967870b1f589fdd5ff_mafia.exe
-
Size
520KB
-
MD5
b98a5102fef224967870b1f589fdd5ff
-
SHA1
b2d6e03ee3711211c4235d7dd83f8da807b5eec6
-
SHA256
706572b1b0eaf480478c7f020b3c222123ec4bb3fc4661dedd005f41fff68c13
-
SHA512
3d174f85fe1258f7c2136aef2f58052f4f5ccdfe3cb5febb9b8732bf686bbdfaf101c2bcf8a1307608e1385f82f7dd0d7db88c5e30241d0f960586e487238bba
-
SSDEEP
12288:gj8fuxR21t5i8fjUnftgH1S5c8X+j+mo55T3gpsoNpNZ:gj8fuK1GYjU1KSC8Xoo5lc7N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2144 9A2.tmp 2528 A0F.tmp 2564 A8C.tmp 2664 AF9.tmp 2560 B37.tmp 2152 BA4.tmp 2464 C02.tmp 2484 C6F.tmp 2432 CEC.tmp 2556 D59.tmp 2916 DC6.tmp 1468 E34.tmp 1132 EB0.tmp 2424 F2D.tmp 992 F9A.tmp 2104 1008.tmp 1504 1075.tmp 796 10E2.tmp 1556 115F.tmp 1336 11CC.tmp 2244 121A.tmp 2036 1268.tmp 2020 12B6.tmp 2056 12F4.tmp 2892 1333.tmp 2200 1381.tmp 1928 13DE.tmp 2768 141D.tmp 2176 145B.tmp 264 149A.tmp 724 14D8.tmp 1412 1526.tmp 1392 1574.tmp 1808 15B2.tmp 1716 1600.tmp 1688 163F.tmp 1944 168D.tmp 448 16DB.tmp 844 1729.tmp 2264 1767.tmp 2076 17B5.tmp 1476 17F4.tmp 1872 1842.tmp 928 1880.tmp 2136 18BE.tmp 1600 190C.tmp 2320 195A.tmp 2924 19A8.tmp 1656 19E7.tmp 2132 1A25.tmp 1732 1A64.tmp 1784 1AA2.tmp 888 1AF0.tmp 3016 1B3E.tmp 2384 1B7C.tmp 2084 1BCA.tmp 1524 1C09.tmp 2980 1C47.tmp 3004 1C86.tmp 2640 1CD4.tmp 2644 1D12.tmp 2564 1D50.tmp 2544 1D9E.tmp 2728 1DDD.tmp -
Loads dropped DLL 64 IoCs
pid Process 2284 2024-07-05_b98a5102fef224967870b1f589fdd5ff_mafia.exe 2144 9A2.tmp 2528 A0F.tmp 2564 A8C.tmp 2664 AF9.tmp 2560 B37.tmp 2152 BA4.tmp 2464 C02.tmp 2484 C6F.tmp 2432 CEC.tmp 2556 D59.tmp 2916 DC6.tmp 1468 E34.tmp 1132 EB0.tmp 2424 F2D.tmp 992 F9A.tmp 2104 1008.tmp 1504 1075.tmp 796 10E2.tmp 1556 115F.tmp 1336 11CC.tmp 2244 121A.tmp 2036 1268.tmp 2020 12B6.tmp 2056 12F4.tmp 2892 1333.tmp 2200 1381.tmp 1928 13DE.tmp 2768 141D.tmp 2176 145B.tmp 264 149A.tmp 724 14D8.tmp 1412 1526.tmp 1392 1574.tmp 1808 15B2.tmp 1716 1600.tmp 1688 163F.tmp 1944 168D.tmp 448 16DB.tmp 844 1729.tmp 2264 1767.tmp 2076 17B5.tmp 1476 17F4.tmp 1872 1842.tmp 928 1880.tmp 2136 18BE.tmp 1600 190C.tmp 2320 195A.tmp 2924 19A8.tmp 1656 19E7.tmp 2132 1A25.tmp 1732 1A64.tmp 1784 1AA2.tmp 888 1AF0.tmp 3016 1B3E.tmp 2384 1B7C.tmp 2084 1BCA.tmp 1524 1C09.tmp 2980 1C47.tmp 3004 1C86.tmp 2640 1CD4.tmp 2644 1D12.tmp 2564 1D50.tmp 2544 1D9E.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2284 wrote to memory of 2144 2284 2024-07-05_b98a5102fef224967870b1f589fdd5ff_mafia.exe 28 PID 2284 wrote to memory of 2144 2284 2024-07-05_b98a5102fef224967870b1f589fdd5ff_mafia.exe 28 PID 2284 wrote to memory of 2144 2284 2024-07-05_b98a5102fef224967870b1f589fdd5ff_mafia.exe 28 PID 2284 wrote to memory of 2144 2284 2024-07-05_b98a5102fef224967870b1f589fdd5ff_mafia.exe 28 PID 2144 wrote to memory of 2528 2144 9A2.tmp 29 PID 2144 wrote to memory of 2528 2144 9A2.tmp 29 PID 2144 wrote to memory of 2528 2144 9A2.tmp 29 PID 2144 wrote to memory of 2528 2144 9A2.tmp 29 PID 2528 wrote to memory of 2564 2528 A0F.tmp 30 PID 2528 wrote to memory of 2564 2528 A0F.tmp 30 PID 2528 wrote to memory of 2564 2528 A0F.tmp 30 PID 2528 wrote to memory of 2564 2528 A0F.tmp 30 PID 2564 wrote to memory of 2664 2564 A8C.tmp 31 PID 2564 wrote to memory of 2664 2564 A8C.tmp 31 PID 2564 wrote to memory of 2664 2564 A8C.tmp 31 PID 2564 wrote to memory of 2664 2564 A8C.tmp 31 PID 2664 wrote to memory of 2560 2664 AF9.tmp 32 PID 2664 wrote to memory of 2560 2664 AF9.tmp 32 PID 2664 wrote to memory of 2560 2664 AF9.tmp 32 PID 2664 wrote to memory of 2560 2664 AF9.tmp 32 PID 2560 wrote to memory of 2152 2560 B37.tmp 33 PID 2560 wrote to memory of 2152 2560 B37.tmp 33 PID 2560 wrote to memory of 2152 2560 B37.tmp 33 PID 2560 wrote to memory of 2152 2560 B37.tmp 33 PID 2152 wrote to memory of 2464 2152 BA4.tmp 34 PID 2152 wrote to memory of 2464 2152 BA4.tmp 34 PID 2152 wrote to memory of 2464 2152 BA4.tmp 34 PID 2152 wrote to memory of 2464 2152 BA4.tmp 34 PID 2464 wrote to memory of 2484 2464 C02.tmp 35 PID 2464 wrote to memory of 2484 2464 C02.tmp 35 PID 2464 wrote to memory of 2484 2464 C02.tmp 35 PID 2464 wrote to memory of 2484 2464 C02.tmp 35 PID 2484 wrote to memory of 2432 2484 C6F.tmp 36 PID 2484 wrote to memory of 2432 2484 C6F.tmp 36 PID 2484 wrote to memory of 2432 2484 C6F.tmp 36 PID 2484 wrote to memory of 2432 2484 C6F.tmp 36 PID 2432 wrote to memory of 2556 2432 CEC.tmp 37 PID 2432 wrote to memory of 2556 2432 CEC.tmp 37 PID 2432 wrote to memory of 2556 2432 CEC.tmp 37 PID 2432 wrote to memory of 2556 2432 CEC.tmp 37 PID 2556 wrote to memory of 2916 2556 D59.tmp 38 PID 2556 wrote to memory of 2916 2556 D59.tmp 38 PID 2556 wrote to memory of 2916 2556 D59.tmp 38 PID 2556 wrote to memory of 2916 2556 D59.tmp 38 PID 2916 wrote to memory of 1468 2916 DC6.tmp 39 PID 2916 wrote to memory of 1468 2916 DC6.tmp 39 PID 2916 wrote to memory of 1468 2916 DC6.tmp 39 PID 2916 wrote to memory of 1468 2916 DC6.tmp 39 PID 1468 wrote to memory of 1132 1468 E34.tmp 40 PID 1468 wrote to memory of 1132 1468 E34.tmp 40 PID 1468 wrote to memory of 1132 1468 E34.tmp 40 PID 1468 wrote to memory of 1132 1468 E34.tmp 40 PID 1132 wrote to memory of 2424 1132 EB0.tmp 41 PID 1132 wrote to memory of 2424 1132 EB0.tmp 41 PID 1132 wrote to memory of 2424 1132 EB0.tmp 41 PID 1132 wrote to memory of 2424 1132 EB0.tmp 41 PID 2424 wrote to memory of 992 2424 F2D.tmp 42 PID 2424 wrote to memory of 992 2424 F2D.tmp 42 PID 2424 wrote to memory of 992 2424 F2D.tmp 42 PID 2424 wrote to memory of 992 2424 F2D.tmp 42 PID 992 wrote to memory of 2104 992 F9A.tmp 43 PID 992 wrote to memory of 2104 992 F9A.tmp 43 PID 992 wrote to memory of 2104 992 F9A.tmp 43 PID 992 wrote to memory of 2104 992 F9A.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-05_b98a5102fef224967870b1f589fdd5ff_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-05_b98a5102fef224967870b1f589fdd5ff_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\9A2.tmp"C:\Users\Admin\AppData\Local\Temp\9A2.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\A0F.tmp"C:\Users\Admin\AppData\Local\Temp\A0F.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\A8C.tmp"C:\Users\Admin\AppData\Local\Temp\A8C.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\AF9.tmp"C:\Users\Admin\AppData\Local\Temp\AF9.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\B37.tmp"C:\Users\Admin\AppData\Local\Temp\B37.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\BA4.tmp"C:\Users\Admin\AppData\Local\Temp\BA4.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\C02.tmp"C:\Users\Admin\AppData\Local\Temp\C02.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\C6F.tmp"C:\Users\Admin\AppData\Local\Temp\C6F.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\CEC.tmp"C:\Users\Admin\AppData\Local\Temp\CEC.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\D59.tmp"C:\Users\Admin\AppData\Local\Temp\D59.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\DC6.tmp"C:\Users\Admin\AppData\Local\Temp\DC6.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\E34.tmp"C:\Users\Admin\AppData\Local\Temp\E34.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\EB0.tmp"C:\Users\Admin\AppData\Local\Temp\EB0.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\F2D.tmp"C:\Users\Admin\AppData\Local\Temp\F2D.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\F9A.tmp"C:\Users\Admin\AppData\Local\Temp\F9A.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\AppData\Local\Temp\1008.tmp"C:\Users\Admin\AppData\Local\Temp\1008.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\1075.tmp"C:\Users\Admin\AppData\Local\Temp\1075.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\10E2.tmp"C:\Users\Admin\AppData\Local\Temp\10E2.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:796 -
C:\Users\Admin\AppData\Local\Temp\115F.tmp"C:\Users\Admin\AppData\Local\Temp\115F.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\11CC.tmp"C:\Users\Admin\AppData\Local\Temp\11CC.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\121A.tmp"C:\Users\Admin\AppData\Local\Temp\121A.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\1268.tmp"C:\Users\Admin\AppData\Local\Temp\1268.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\12B6.tmp"C:\Users\Admin\AppData\Local\Temp\12B6.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\12F4.tmp"C:\Users\Admin\AppData\Local\Temp\12F4.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\1333.tmp"C:\Users\Admin\AppData\Local\Temp\1333.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\1381.tmp"C:\Users\Admin\AppData\Local\Temp\1381.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\13DE.tmp"C:\Users\Admin\AppData\Local\Temp\13DE.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\141D.tmp"C:\Users\Admin\AppData\Local\Temp\141D.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\145B.tmp"C:\Users\Admin\AppData\Local\Temp\145B.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\149A.tmp"C:\Users\Admin\AppData\Local\Temp\149A.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:264 -
C:\Users\Admin\AppData\Local\Temp\14D8.tmp"C:\Users\Admin\AppData\Local\Temp\14D8.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:724 -
C:\Users\Admin\AppData\Local\Temp\1526.tmp"C:\Users\Admin\AppData\Local\Temp\1526.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\1574.tmp"C:\Users\Admin\AppData\Local\Temp\1574.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\15B2.tmp"C:\Users\Admin\AppData\Local\Temp\15B2.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\1600.tmp"C:\Users\Admin\AppData\Local\Temp\1600.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\163F.tmp"C:\Users\Admin\AppData\Local\Temp\163F.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\168D.tmp"C:\Users\Admin\AppData\Local\Temp\168D.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\16DB.tmp"C:\Users\Admin\AppData\Local\Temp\16DB.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:448 -
C:\Users\Admin\AppData\Local\Temp\1729.tmp"C:\Users\Admin\AppData\Local\Temp\1729.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:844 -
C:\Users\Admin\AppData\Local\Temp\1767.tmp"C:\Users\Admin\AppData\Local\Temp\1767.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\17B5.tmp"C:\Users\Admin\AppData\Local\Temp\17B5.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\17F4.tmp"C:\Users\Admin\AppData\Local\Temp\17F4.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\1842.tmp"C:\Users\Admin\AppData\Local\Temp\1842.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\1880.tmp"C:\Users\Admin\AppData\Local\Temp\1880.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:928 -
C:\Users\Admin\AppData\Local\Temp\18BE.tmp"C:\Users\Admin\AppData\Local\Temp\18BE.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\190C.tmp"C:\Users\Admin\AppData\Local\Temp\190C.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\195A.tmp"C:\Users\Admin\AppData\Local\Temp\195A.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\19A8.tmp"C:\Users\Admin\AppData\Local\Temp\19A8.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\19E7.tmp"C:\Users\Admin\AppData\Local\Temp\19E7.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\1A25.tmp"C:\Users\Admin\AppData\Local\Temp\1A25.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\1A64.tmp"C:\Users\Admin\AppData\Local\Temp\1A64.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:888 -
C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\1C09.tmp"C:\Users\Admin\AppData\Local\Temp\1C09.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\1C47.tmp"C:\Users\Admin\AppData\Local\Temp\1C47.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\1C86.tmp"C:\Users\Admin\AppData\Local\Temp\1C86.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\1CD4.tmp"C:\Users\Admin\AppData\Local\Temp\1CD4.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\1D12.tmp"C:\Users\Admin\AppData\Local\Temp\1D12.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\1D50.tmp"C:\Users\Admin\AppData\Local\Temp\1D50.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"65⤵
- Executes dropped EXE
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"66⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"67⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\1E98.tmp"C:\Users\Admin\AppData\Local\Temp\1E98.tmp"68⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"69⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\1F15.tmp"C:\Users\Admin\AppData\Local\Temp\1F15.tmp"70⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\1F53.tmp"C:\Users\Admin\AppData\Local\Temp\1F53.tmp"71⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\1F92.tmp"C:\Users\Admin\AppData\Local\Temp\1F92.tmp"72⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"73⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\200E.tmp"C:\Users\Admin\AppData\Local\Temp\200E.tmp"74⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\204D.tmp"C:\Users\Admin\AppData\Local\Temp\204D.tmp"75⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\208B.tmp"C:\Users\Admin\AppData\Local\Temp\208B.tmp"76⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\20CA.tmp"C:\Users\Admin\AppData\Local\Temp\20CA.tmp"77⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\2108.tmp"C:\Users\Admin\AppData\Local\Temp\2108.tmp"78⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\2146.tmp"C:\Users\Admin\AppData\Local\Temp\2146.tmp"79⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\2185.tmp"C:\Users\Admin\AppData\Local\Temp\2185.tmp"80⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\21C3.tmp"C:\Users\Admin\AppData\Local\Temp\21C3.tmp"81⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\2202.tmp"C:\Users\Admin\AppData\Local\Temp\2202.tmp"82⤵PID:292
-
C:\Users\Admin\AppData\Local\Temp\2240.tmp"C:\Users\Admin\AppData\Local\Temp\2240.tmp"83⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\227E.tmp"C:\Users\Admin\AppData\Local\Temp\227E.tmp"84⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\22BD.tmp"C:\Users\Admin\AppData\Local\Temp\22BD.tmp"85⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\22FB.tmp"C:\Users\Admin\AppData\Local\Temp\22FB.tmp"86⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\232A.tmp"C:\Users\Admin\AppData\Local\Temp\232A.tmp"87⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\2359.tmp"C:\Users\Admin\AppData\Local\Temp\2359.tmp"88⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\2397.tmp"C:\Users\Admin\AppData\Local\Temp\2397.tmp"89⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\23C6.tmp"C:\Users\Admin\AppData\Local\Temp\23C6.tmp"90⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\2404.tmp"C:\Users\Admin\AppData\Local\Temp\2404.tmp"91⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\2443.tmp"C:\Users\Admin\AppData\Local\Temp\2443.tmp"92⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\2481.tmp"C:\Users\Admin\AppData\Local\Temp\2481.tmp"93⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\24C0.tmp"C:\Users\Admin\AppData\Local\Temp\24C0.tmp"94⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\24FE.tmp"C:\Users\Admin\AppData\Local\Temp\24FE.tmp"95⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\253C.tmp"C:\Users\Admin\AppData\Local\Temp\253C.tmp"96⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\257B.tmp"C:\Users\Admin\AppData\Local\Temp\257B.tmp"97⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\25B9.tmp"C:\Users\Admin\AppData\Local\Temp\25B9.tmp"98⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\25F8.tmp"C:\Users\Admin\AppData\Local\Temp\25F8.tmp"99⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\2636.tmp"C:\Users\Admin\AppData\Local\Temp\2636.tmp"100⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\2674.tmp"C:\Users\Admin\AppData\Local\Temp\2674.tmp"101⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\26A3.tmp"C:\Users\Admin\AppData\Local\Temp\26A3.tmp"102⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\26E2.tmp"C:\Users\Admin\AppData\Local\Temp\26E2.tmp"103⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\2710.tmp"C:\Users\Admin\AppData\Local\Temp\2710.tmp"104⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\274F.tmp"C:\Users\Admin\AppData\Local\Temp\274F.tmp"105⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\278D.tmp"C:\Users\Admin\AppData\Local\Temp\278D.tmp"106⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\27CC.tmp"C:\Users\Admin\AppData\Local\Temp\27CC.tmp"107⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"108⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\2848.tmp"C:\Users\Admin\AppData\Local\Temp\2848.tmp"109⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\2887.tmp"C:\Users\Admin\AppData\Local\Temp\2887.tmp"110⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\28C5.tmp"C:\Users\Admin\AppData\Local\Temp\28C5.tmp"111⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\28F4.tmp"C:\Users\Admin\AppData\Local\Temp\28F4.tmp"112⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\2932.tmp"C:\Users\Admin\AppData\Local\Temp\2932.tmp"113⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\2971.tmp"C:\Users\Admin\AppData\Local\Temp\2971.tmp"114⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\29AF.tmp"C:\Users\Admin\AppData\Local\Temp\29AF.tmp"115⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\29DE.tmp"C:\Users\Admin\AppData\Local\Temp\29DE.tmp"116⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"117⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"118⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"119⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"120⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"121⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\2B35.tmp"C:\Users\Admin\AppData\Local\Temp\2B35.tmp"122⤵PID:888
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-