Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
06/07/2024, 06:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-07-06_b611f4546dd7b1f3832599071e8a10c9_mafia.exe
Resource
win7-20240220-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-06_b611f4546dd7b1f3832599071e8a10c9_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-07-06_b611f4546dd7b1f3832599071e8a10c9_mafia.exe
-
Size
541KB
-
MD5
b611f4546dd7b1f3832599071e8a10c9
-
SHA1
93d51ffe0354ad0185b1aecac20fc05e1e9c7765
-
SHA256
453b75d39888e860f48e4562de71dc7be2fa4c420035ca8cd6bae8dd08f4a31e
-
SHA512
60e27efb20dfe13efd4c917e1a17a681057ebfc68ccb327063af4639cd27e220e08f0392a263737149f9bc8da60d6d3195d90c497abf19ddcb014ceaeb8989d9
-
SSDEEP
12288:UU5rCOTeifj7YVezgpxdzzlYnm6JQ72ASjrZa73ctO:UUQOJffGxBzXCMKrU73ctO
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2052 170A.tmp 2476 1758.tmp 2524 17D4.tmp 2644 1842.tmp 2508 189F.tmp 2420 18FD.tmp 2408 196A.tmp 2428 19D7.tmp 2400 1A44.tmp 2552 1AC1.tmp 2980 1B2E.tmp 1740 1BAB.tmp 1016 1C18.tmp 1500 1C76.tmp 1576 1CF3.tmp 2180 1D60.tmp 2292 1DAE.tmp 1828 1E1B.tmp 1724 1E88.tmp 2200 1F05.tmp 2316 1F63.tmp 2424 1FD0.tmp 1444 203D.tmp 1484 208B.tmp 1948 20CA.tmp 1956 2118.tmp 1084 2156.tmp 1088 2194.tmp 1192 21D3.tmp 676 2221.tmp 772 225F.tmp 1400 229E.tmp 352 22DC.tmp 1872 232A.tmp 2452 2368.tmp 1804 23A7.tmp 2820 23E5.tmp 784 2433.tmp 2352 2472.tmp 2896 24C0.tmp 2864 24FE.tmp 1480 253C.tmp 956 257B.tmp 1752 25C9.tmp 1680 2617.tmp 888 2655.tmp 2848 26A3.tmp 1244 26F1.tmp 2240 2730.tmp 2952 276E.tmp 984 27BC.tmp 3012 27FA.tmp 2064 2839.tmp 2256 2877.tmp 2464 28B6.tmp 1528 28F4.tmp 1992 2932.tmp 2696 2971.tmp 2880 29AF.tmp 2492 29FD.tmp 2608 2A3C.tmp 2584 2A7A.tmp 2540 2AB8.tmp 1352 2B06.tmp -
Loads dropped DLL 64 IoCs
pid Process 2088 2024-07-06_b611f4546dd7b1f3832599071e8a10c9_mafia.exe 2052 170A.tmp 2476 1758.tmp 2524 17D4.tmp 2644 1842.tmp 2508 189F.tmp 2420 18FD.tmp 2408 196A.tmp 2428 19D7.tmp 2400 1A44.tmp 2552 1AC1.tmp 2980 1B2E.tmp 1740 1BAB.tmp 1016 1C18.tmp 1500 1C76.tmp 1576 1CF3.tmp 2180 1D60.tmp 2292 1DAE.tmp 1828 1E1B.tmp 1724 1E88.tmp 2200 1F05.tmp 2316 1F63.tmp 2424 1FD0.tmp 1444 203D.tmp 1484 208B.tmp 1948 20CA.tmp 1956 2118.tmp 1084 2156.tmp 1088 2194.tmp 1192 21D3.tmp 676 2221.tmp 772 225F.tmp 1400 229E.tmp 352 22DC.tmp 1872 232A.tmp 2452 2368.tmp 1804 23A7.tmp 2820 23E5.tmp 784 2433.tmp 2352 2472.tmp 2896 24C0.tmp 2864 24FE.tmp 1480 253C.tmp 956 257B.tmp 1752 25C9.tmp 1680 2617.tmp 888 2655.tmp 2848 26A3.tmp 1244 26F1.tmp 2240 2730.tmp 2952 276E.tmp 984 27BC.tmp 3012 27FA.tmp 2064 2839.tmp 2256 2877.tmp 2464 28B6.tmp 1528 28F4.tmp 1992 2932.tmp 2696 2971.tmp 2880 29AF.tmp 2492 29FD.tmp 2608 2A3C.tmp 2584 2A7A.tmp 2540 2AB8.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2088 wrote to memory of 2052 2088 2024-07-06_b611f4546dd7b1f3832599071e8a10c9_mafia.exe 28 PID 2088 wrote to memory of 2052 2088 2024-07-06_b611f4546dd7b1f3832599071e8a10c9_mafia.exe 28 PID 2088 wrote to memory of 2052 2088 2024-07-06_b611f4546dd7b1f3832599071e8a10c9_mafia.exe 28 PID 2088 wrote to memory of 2052 2088 2024-07-06_b611f4546dd7b1f3832599071e8a10c9_mafia.exe 28 PID 2052 wrote to memory of 2476 2052 170A.tmp 29 PID 2052 wrote to memory of 2476 2052 170A.tmp 29 PID 2052 wrote to memory of 2476 2052 170A.tmp 29 PID 2052 wrote to memory of 2476 2052 170A.tmp 29 PID 2476 wrote to memory of 2524 2476 1758.tmp 30 PID 2476 wrote to memory of 2524 2476 1758.tmp 30 PID 2476 wrote to memory of 2524 2476 1758.tmp 30 PID 2476 wrote to memory of 2524 2476 1758.tmp 30 PID 2524 wrote to memory of 2644 2524 17D4.tmp 31 PID 2524 wrote to memory of 2644 2524 17D4.tmp 31 PID 2524 wrote to memory of 2644 2524 17D4.tmp 31 PID 2524 wrote to memory of 2644 2524 17D4.tmp 31 PID 2644 wrote to memory of 2508 2644 1842.tmp 32 PID 2644 wrote to memory of 2508 2644 1842.tmp 32 PID 2644 wrote to memory of 2508 2644 1842.tmp 32 PID 2644 wrote to memory of 2508 2644 1842.tmp 32 PID 2508 wrote to memory of 2420 2508 189F.tmp 33 PID 2508 wrote to memory of 2420 2508 189F.tmp 33 PID 2508 wrote to memory of 2420 2508 189F.tmp 33 PID 2508 wrote to memory of 2420 2508 189F.tmp 33 PID 2420 wrote to memory of 2408 2420 18FD.tmp 34 PID 2420 wrote to memory of 2408 2420 18FD.tmp 34 PID 2420 wrote to memory of 2408 2420 18FD.tmp 34 PID 2420 wrote to memory of 2408 2420 18FD.tmp 34 PID 2408 wrote to memory of 2428 2408 196A.tmp 35 PID 2408 wrote to memory of 2428 2408 196A.tmp 35 PID 2408 wrote to memory of 2428 2408 196A.tmp 35 PID 2408 wrote to memory of 2428 2408 196A.tmp 35 PID 2428 wrote to memory of 2400 2428 19D7.tmp 36 PID 2428 wrote to memory of 2400 2428 19D7.tmp 36 PID 2428 wrote to memory of 2400 2428 19D7.tmp 36 PID 2428 wrote to memory of 2400 2428 19D7.tmp 36 PID 2400 wrote to memory of 2552 2400 1A44.tmp 37 PID 2400 wrote to memory of 2552 2400 1A44.tmp 37 PID 2400 wrote to memory of 2552 2400 1A44.tmp 37 PID 2400 wrote to memory of 2552 2400 1A44.tmp 37 PID 2552 wrote to memory of 2980 2552 1AC1.tmp 38 PID 2552 wrote to memory of 2980 2552 1AC1.tmp 38 PID 2552 wrote to memory of 2980 2552 1AC1.tmp 38 PID 2552 wrote to memory of 2980 2552 1AC1.tmp 38 PID 2980 wrote to memory of 1740 2980 1B2E.tmp 39 PID 2980 wrote to memory of 1740 2980 1B2E.tmp 39 PID 2980 wrote to memory of 1740 2980 1B2E.tmp 39 PID 2980 wrote to memory of 1740 2980 1B2E.tmp 39 PID 1740 wrote to memory of 1016 1740 1BAB.tmp 40 PID 1740 wrote to memory of 1016 1740 1BAB.tmp 40 PID 1740 wrote to memory of 1016 1740 1BAB.tmp 40 PID 1740 wrote to memory of 1016 1740 1BAB.tmp 40 PID 1016 wrote to memory of 1500 1016 1C18.tmp 41 PID 1016 wrote to memory of 1500 1016 1C18.tmp 41 PID 1016 wrote to memory of 1500 1016 1C18.tmp 41 PID 1016 wrote to memory of 1500 1016 1C18.tmp 41 PID 1500 wrote to memory of 1576 1500 1C76.tmp 42 PID 1500 wrote to memory of 1576 1500 1C76.tmp 42 PID 1500 wrote to memory of 1576 1500 1C76.tmp 42 PID 1500 wrote to memory of 1576 1500 1C76.tmp 42 PID 1576 wrote to memory of 2180 1576 1CF3.tmp 43 PID 1576 wrote to memory of 2180 1576 1CF3.tmp 43 PID 1576 wrote to memory of 2180 1576 1CF3.tmp 43 PID 1576 wrote to memory of 2180 1576 1CF3.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_b611f4546dd7b1f3832599071e8a10c9_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-06_b611f4546dd7b1f3832599071e8a10c9_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\170A.tmp"C:\Users\Admin\AppData\Local\Temp\170A.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\1758.tmp"C:\Users\Admin\AppData\Local\Temp\1758.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\17D4.tmp"C:\Users\Admin\AppData\Local\Temp\17D4.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\1842.tmp"C:\Users\Admin\AppData\Local\Temp\1842.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\189F.tmp"C:\Users\Admin\AppData\Local\Temp\189F.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\18FD.tmp"C:\Users\Admin\AppData\Local\Temp\18FD.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\196A.tmp"C:\Users\Admin\AppData\Local\Temp\196A.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\19D7.tmp"C:\Users\Admin\AppData\Local\Temp\19D7.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\1A44.tmp"C:\Users\Admin\AppData\Local\Temp\1A44.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\1C18.tmp"C:\Users\Admin\AppData\Local\Temp\1C18.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\1C76.tmp"C:\Users\Admin\AppData\Local\Temp\1C76.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\1D60.tmp"C:\Users\Admin\AppData\Local\Temp\1D60.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\1E88.tmp"C:\Users\Admin\AppData\Local\Temp\1E88.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\1F05.tmp"C:\Users\Admin\AppData\Local\Temp\1F05.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\1F63.tmp"C:\Users\Admin\AppData\Local\Temp\1F63.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\203D.tmp"C:\Users\Admin\AppData\Local\Temp\203D.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\208B.tmp"C:\Users\Admin\AppData\Local\Temp\208B.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\20CA.tmp"C:\Users\Admin\AppData\Local\Temp\20CA.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\2118.tmp"C:\Users\Admin\AppData\Local\Temp\2118.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\2156.tmp"C:\Users\Admin\AppData\Local\Temp\2156.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\2194.tmp"C:\Users\Admin\AppData\Local\Temp\2194.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\21D3.tmp"C:\Users\Admin\AppData\Local\Temp\21D3.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\2221.tmp"C:\Users\Admin\AppData\Local\Temp\2221.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:676 -
C:\Users\Admin\AppData\Local\Temp\225F.tmp"C:\Users\Admin\AppData\Local\Temp\225F.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:772 -
C:\Users\Admin\AppData\Local\Temp\229E.tmp"C:\Users\Admin\AppData\Local\Temp\229E.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\22DC.tmp"C:\Users\Admin\AppData\Local\Temp\22DC.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:352 -
C:\Users\Admin\AppData\Local\Temp\232A.tmp"C:\Users\Admin\AppData\Local\Temp\232A.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\2368.tmp"C:\Users\Admin\AppData\Local\Temp\2368.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\23A7.tmp"C:\Users\Admin\AppData\Local\Temp\23A7.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\2433.tmp"C:\Users\Admin\AppData\Local\Temp\2433.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:784 -
C:\Users\Admin\AppData\Local\Temp\2472.tmp"C:\Users\Admin\AppData\Local\Temp\2472.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\24C0.tmp"C:\Users\Admin\AppData\Local\Temp\24C0.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\24FE.tmp"C:\Users\Admin\AppData\Local\Temp\24FE.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\253C.tmp"C:\Users\Admin\AppData\Local\Temp\253C.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\257B.tmp"C:\Users\Admin\AppData\Local\Temp\257B.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:956 -
C:\Users\Admin\AppData\Local\Temp\25C9.tmp"C:\Users\Admin\AppData\Local\Temp\25C9.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\2655.tmp"C:\Users\Admin\AppData\Local\Temp\2655.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:888 -
C:\Users\Admin\AppData\Local\Temp\26A3.tmp"C:\Users\Admin\AppData\Local\Temp\26A3.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\26F1.tmp"C:\Users\Admin\AppData\Local\Temp\26F1.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\2730.tmp"C:\Users\Admin\AppData\Local\Temp\2730.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\276E.tmp"C:\Users\Admin\AppData\Local\Temp\276E.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\27BC.tmp"C:\Users\Admin\AppData\Local\Temp\27BC.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:984 -
C:\Users\Admin\AppData\Local\Temp\27FA.tmp"C:\Users\Admin\AppData\Local\Temp\27FA.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\2839.tmp"C:\Users\Admin\AppData\Local\Temp\2839.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\2877.tmp"C:\Users\Admin\AppData\Local\Temp\2877.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\28B6.tmp"C:\Users\Admin\AppData\Local\Temp\28B6.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\28F4.tmp"C:\Users\Admin\AppData\Local\Temp\28F4.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\2932.tmp"C:\Users\Admin\AppData\Local\Temp\2932.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\2971.tmp"C:\Users\Admin\AppData\Local\Temp\2971.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\29AF.tmp"C:\Users\Admin\AppData\Local\Temp\29AF.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\29FD.tmp"C:\Users\Admin\AppData\Local\Temp\29FD.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\2B06.tmp"C:\Users\Admin\AppData\Local\Temp\2B06.tmp"65⤵
- Executes dropped EXE
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\2B45.tmp"C:\Users\Admin\AppData\Local\Temp\2B45.tmp"66⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\2B83.tmp"C:\Users\Admin\AppData\Local\Temp\2B83.tmp"67⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"68⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\2C00.tmp"C:\Users\Admin\AppData\Local\Temp\2C00.tmp"69⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"70⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"71⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"72⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\2D09.tmp"C:\Users\Admin\AppData\Local\Temp\2D09.tmp"73⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\2D48.tmp"C:\Users\Admin\AppData\Local\Temp\2D48.tmp"74⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\2D86.tmp"C:\Users\Admin\AppData\Local\Temp\2D86.tmp"75⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"76⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\2E03.tmp"C:\Users\Admin\AppData\Local\Temp\2E03.tmp"77⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\2E51.tmp"C:\Users\Admin\AppData\Local\Temp\2E51.tmp"78⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"79⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"80⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"81⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\2F5A.tmp"C:\Users\Admin\AppData\Local\Temp\2F5A.tmp"82⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\2F98.tmp"C:\Users\Admin\AppData\Local\Temp\2F98.tmp"83⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\2FD7.tmp"C:\Users\Admin\AppData\Local\Temp\2FD7.tmp"84⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\3025.tmp"C:\Users\Admin\AppData\Local\Temp\3025.tmp"85⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\3073.tmp"C:\Users\Admin\AppData\Local\Temp\3073.tmp"86⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\30C1.tmp"C:\Users\Admin\AppData\Local\Temp\30C1.tmp"87⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\30FF.tmp"C:\Users\Admin\AppData\Local\Temp\30FF.tmp"88⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\313E.tmp"C:\Users\Admin\AppData\Local\Temp\313E.tmp"89⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\317C.tmp"C:\Users\Admin\AppData\Local\Temp\317C.tmp"90⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\31BA.tmp"C:\Users\Admin\AppData\Local\Temp\31BA.tmp"91⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\31F9.tmp"C:\Users\Admin\AppData\Local\Temp\31F9.tmp"92⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\3237.tmp"C:\Users\Admin\AppData\Local\Temp\3237.tmp"93⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\3276.tmp"C:\Users\Admin\AppData\Local\Temp\3276.tmp"94⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\32B4.tmp"C:\Users\Admin\AppData\Local\Temp\32B4.tmp"95⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\32F2.tmp"C:\Users\Admin\AppData\Local\Temp\32F2.tmp"96⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\3331.tmp"C:\Users\Admin\AppData\Local\Temp\3331.tmp"97⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\336F.tmp"C:\Users\Admin\AppData\Local\Temp\336F.tmp"98⤵PID:296
-
C:\Users\Admin\AppData\Local\Temp\33BD.tmp"C:\Users\Admin\AppData\Local\Temp\33BD.tmp"99⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\33FC.tmp"C:\Users\Admin\AppData\Local\Temp\33FC.tmp"100⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\344A.tmp"C:\Users\Admin\AppData\Local\Temp\344A.tmp"101⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"102⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\34D6.tmp"C:\Users\Admin\AppData\Local\Temp\34D6.tmp"103⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\3524.tmp"C:\Users\Admin\AppData\Local\Temp\3524.tmp"104⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\3562.tmp"C:\Users\Admin\AppData\Local\Temp\3562.tmp"105⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\35B0.tmp"C:\Users\Admin\AppData\Local\Temp\35B0.tmp"106⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\35EF.tmp"C:\Users\Admin\AppData\Local\Temp\35EF.tmp"107⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\362D.tmp"C:\Users\Admin\AppData\Local\Temp\362D.tmp"108⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\366C.tmp"C:\Users\Admin\AppData\Local\Temp\366C.tmp"109⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\36AA.tmp"C:\Users\Admin\AppData\Local\Temp\36AA.tmp"110⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\36E8.tmp"C:\Users\Admin\AppData\Local\Temp\36E8.tmp"111⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\3727.tmp"C:\Users\Admin\AppData\Local\Temp\3727.tmp"112⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\3765.tmp"C:\Users\Admin\AppData\Local\Temp\3765.tmp"113⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\37B3.tmp"C:\Users\Admin\AppData\Local\Temp\37B3.tmp"114⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\37F2.tmp"C:\Users\Admin\AppData\Local\Temp\37F2.tmp"115⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\3830.tmp"C:\Users\Admin\AppData\Local\Temp\3830.tmp"116⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\386E.tmp"C:\Users\Admin\AppData\Local\Temp\386E.tmp"117⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\38AD.tmp"C:\Users\Admin\AppData\Local\Temp\38AD.tmp"118⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\38FB.tmp"C:\Users\Admin\AppData\Local\Temp\38FB.tmp"119⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\3939.tmp"C:\Users\Admin\AppData\Local\Temp\3939.tmp"120⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\3987.tmp"C:\Users\Admin\AppData\Local\Temp\3987.tmp"121⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\39C6.tmp"C:\Users\Admin\AppData\Local\Temp\39C6.tmp"122⤵PID:2868
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-