Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
06/07/2024, 06:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-07-06_57efef07b1fd87276a83d5023f41c219_mafia.exe
Resource
win7-20240705-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-06_57efef07b1fd87276a83d5023f41c219_mafia.exe
Resource
win10v2004-20240704-en
2 signatures
150 seconds
General
-
Target
2024-07-06_57efef07b1fd87276a83d5023f41c219_mafia.exe
-
Size
530KB
-
MD5
57efef07b1fd87276a83d5023f41c219
-
SHA1
cdd25ebe513361828814e618933d8c10d7860cde
-
SHA256
80b8d68f1522d97165c98c7ab89c2a61ffaaf0be63c34efdda7ecb1cb817f7a1
-
SHA512
a6bd651b7d23b8ca84d70a4e37b4f7e4cfae24c8712e7af9163cbdaa55908e710b71f1bed8ae018dc700ad5eb80cd30c8ea79ff90076b232757791dad23bdb17
-
SSDEEP
12288:AU5rCOTeio8KodUbL+o5qcPgPfNZulFVg0M1:AUQOJo8KZX+o9I3NclFV/M1
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3048 37A.tmp 2492 406.tmp 1704 4B2.tmp 2156 52F.tmp 2668 5AC.tmp 2764 638.tmp 2776 696.tmp 2636 732.tmp 2540 7BE.tmp 2564 84A.tmp 2532 8B8.tmp 1196 934.tmp 3000 9A2.tmp 1116 A2E.tmp 592 A8C.tmp 1628 B08.tmp 1144 B76.tmp 1488 C02.tmp 2740 C6F.tmp 2144 CFC.tmp 1896 D88.tmp 1212 E24.tmp 2428 E91.tmp 2488 EDF.tmp 1228 F1E.tmp 2940 F5C.tmp 2164 F9A.tmp 2932 FE8.tmp 2872 1027.tmp 1120 1065.tmp 2384 10B3.tmp 1648 1101.tmp 1852 1140.tmp 1728 118E.tmp 948 11CC.tmp 2148 121A.tmp 1944 1268.tmp 1376 12B6.tmp 1532 1304.tmp 848 1352.tmp 1840 1390.tmp 1952 13CF.tmp 1272 140D.tmp 2152 145B.tmp 2272 14A9.tmp 2316 14F7.tmp 2240 1545.tmp 984 1593.tmp 1536 15D2.tmp 872 1610.tmp 2332 165E.tmp 1568 16AC.tmp 2968 16FA.tmp 1984 1738.tmp 2796 1786.tmp 2160 17D4.tmp 2896 1813.tmp 2900 1861.tmp 1828 189F.tmp 2724 18ED.tmp 2744 193B.tmp 2672 1989.tmp 2664 19D7.tmp 2792 1A35.tmp -
Loads dropped DLL 64 IoCs
pid Process 1620 2024-07-06_57efef07b1fd87276a83d5023f41c219_mafia.exe 3048 37A.tmp 2492 406.tmp 1704 4B2.tmp 2156 52F.tmp 2668 5AC.tmp 2764 638.tmp 2776 696.tmp 2636 732.tmp 2540 7BE.tmp 2564 84A.tmp 2532 8B8.tmp 1196 934.tmp 3000 9A2.tmp 1116 A2E.tmp 592 A8C.tmp 1628 B08.tmp 1144 B76.tmp 1488 C02.tmp 2740 C6F.tmp 2144 CFC.tmp 1896 D88.tmp 1212 E24.tmp 2428 E91.tmp 2488 EDF.tmp 1228 F1E.tmp 2940 F5C.tmp 2164 F9A.tmp 2932 FE8.tmp 2872 1027.tmp 1120 1065.tmp 2384 10B3.tmp 1648 1101.tmp 1852 1140.tmp 1728 118E.tmp 948 11CC.tmp 2148 121A.tmp 1944 1268.tmp 1376 12B6.tmp 1532 1304.tmp 848 1352.tmp 1840 1390.tmp 1952 13CF.tmp 1272 140D.tmp 2152 145B.tmp 2272 14A9.tmp 2316 14F7.tmp 2240 1545.tmp 984 1593.tmp 1536 15D2.tmp 872 1610.tmp 2332 165E.tmp 1568 16AC.tmp 2968 16FA.tmp 1984 1738.tmp 2796 1786.tmp 2160 17D4.tmp 2896 1813.tmp 2900 1861.tmp 1828 189F.tmp 2724 18ED.tmp 2744 193B.tmp 2672 1989.tmp 2664 19D7.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1620 wrote to memory of 3048 1620 2024-07-06_57efef07b1fd87276a83d5023f41c219_mafia.exe 30 PID 1620 wrote to memory of 3048 1620 2024-07-06_57efef07b1fd87276a83d5023f41c219_mafia.exe 30 PID 1620 wrote to memory of 3048 1620 2024-07-06_57efef07b1fd87276a83d5023f41c219_mafia.exe 30 PID 1620 wrote to memory of 3048 1620 2024-07-06_57efef07b1fd87276a83d5023f41c219_mafia.exe 30 PID 3048 wrote to memory of 2492 3048 37A.tmp 31 PID 3048 wrote to memory of 2492 3048 37A.tmp 31 PID 3048 wrote to memory of 2492 3048 37A.tmp 31 PID 3048 wrote to memory of 2492 3048 37A.tmp 31 PID 2492 wrote to memory of 1704 2492 406.tmp 32 PID 2492 wrote to memory of 1704 2492 406.tmp 32 PID 2492 wrote to memory of 1704 2492 406.tmp 32 PID 2492 wrote to memory of 1704 2492 406.tmp 32 PID 1704 wrote to memory of 2156 1704 4B2.tmp 33 PID 1704 wrote to memory of 2156 1704 4B2.tmp 33 PID 1704 wrote to memory of 2156 1704 4B2.tmp 33 PID 1704 wrote to memory of 2156 1704 4B2.tmp 33 PID 2156 wrote to memory of 2668 2156 52F.tmp 34 PID 2156 wrote to memory of 2668 2156 52F.tmp 34 PID 2156 wrote to memory of 2668 2156 52F.tmp 34 PID 2156 wrote to memory of 2668 2156 52F.tmp 34 PID 2668 wrote to memory of 2764 2668 5AC.tmp 35 PID 2668 wrote to memory of 2764 2668 5AC.tmp 35 PID 2668 wrote to memory of 2764 2668 5AC.tmp 35 PID 2668 wrote to memory of 2764 2668 5AC.tmp 35 PID 2764 wrote to memory of 2776 2764 638.tmp 36 PID 2764 wrote to memory of 2776 2764 638.tmp 36 PID 2764 wrote to memory of 2776 2764 638.tmp 36 PID 2764 wrote to memory of 2776 2764 638.tmp 36 PID 2776 wrote to memory of 2636 2776 696.tmp 37 PID 2776 wrote to memory of 2636 2776 696.tmp 37 PID 2776 wrote to memory of 2636 2776 696.tmp 37 PID 2776 wrote to memory of 2636 2776 696.tmp 37 PID 2636 wrote to memory of 2540 2636 732.tmp 38 PID 2636 wrote to memory of 2540 2636 732.tmp 38 PID 2636 wrote to memory of 2540 2636 732.tmp 38 PID 2636 wrote to memory of 2540 2636 732.tmp 38 PID 2540 wrote to memory of 2564 2540 7BE.tmp 39 PID 2540 wrote to memory of 2564 2540 7BE.tmp 39 PID 2540 wrote to memory of 2564 2540 7BE.tmp 39 PID 2540 wrote to memory of 2564 2540 7BE.tmp 39 PID 2564 wrote to memory of 2532 2564 84A.tmp 40 PID 2564 wrote to memory of 2532 2564 84A.tmp 40 PID 2564 wrote to memory of 2532 2564 84A.tmp 40 PID 2564 wrote to memory of 2532 2564 84A.tmp 40 PID 2532 wrote to memory of 1196 2532 8B8.tmp 41 PID 2532 wrote to memory of 1196 2532 8B8.tmp 41 PID 2532 wrote to memory of 1196 2532 8B8.tmp 41 PID 2532 wrote to memory of 1196 2532 8B8.tmp 41 PID 1196 wrote to memory of 3000 1196 934.tmp 42 PID 1196 wrote to memory of 3000 1196 934.tmp 42 PID 1196 wrote to memory of 3000 1196 934.tmp 42 PID 1196 wrote to memory of 3000 1196 934.tmp 42 PID 3000 wrote to memory of 1116 3000 9A2.tmp 43 PID 3000 wrote to memory of 1116 3000 9A2.tmp 43 PID 3000 wrote to memory of 1116 3000 9A2.tmp 43 PID 3000 wrote to memory of 1116 3000 9A2.tmp 43 PID 1116 wrote to memory of 592 1116 A2E.tmp 44 PID 1116 wrote to memory of 592 1116 A2E.tmp 44 PID 1116 wrote to memory of 592 1116 A2E.tmp 44 PID 1116 wrote to memory of 592 1116 A2E.tmp 44 PID 592 wrote to memory of 1628 592 A8C.tmp 45 PID 592 wrote to memory of 1628 592 A8C.tmp 45 PID 592 wrote to memory of 1628 592 A8C.tmp 45 PID 592 wrote to memory of 1628 592 A8C.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_57efef07b1fd87276a83d5023f41c219_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-06_57efef07b1fd87276a83d5023f41c219_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\37A.tmp"C:\Users\Admin\AppData\Local\Temp\37A.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\406.tmp"C:\Users\Admin\AppData\Local\Temp\406.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\4B2.tmp"C:\Users\Admin\AppData\Local\Temp\4B2.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\52F.tmp"C:\Users\Admin\AppData\Local\Temp\52F.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\5AC.tmp"C:\Users\Admin\AppData\Local\Temp\5AC.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\638.tmp"C:\Users\Admin\AppData\Local\Temp\638.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\696.tmp"C:\Users\Admin\AppData\Local\Temp\696.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\732.tmp"C:\Users\Admin\AppData\Local\Temp\732.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\7BE.tmp"C:\Users\Admin\AppData\Local\Temp\7BE.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\84A.tmp"C:\Users\Admin\AppData\Local\Temp\84A.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\8B8.tmp"C:\Users\Admin\AppData\Local\Temp\8B8.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\934.tmp"C:\Users\Admin\AppData\Local\Temp\934.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\9A2.tmp"C:\Users\Admin\AppData\Local\Temp\9A2.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\A2E.tmp"C:\Users\Admin\AppData\Local\Temp\A2E.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\A8C.tmp"C:\Users\Admin\AppData\Local\Temp\A8C.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:592 -
C:\Users\Admin\AppData\Local\Temp\B08.tmp"C:\Users\Admin\AppData\Local\Temp\B08.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\B76.tmp"C:\Users\Admin\AppData\Local\Temp\B76.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\C02.tmp"C:\Users\Admin\AppData\Local\Temp\C02.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\C6F.tmp"C:\Users\Admin\AppData\Local\Temp\C6F.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\CFC.tmp"C:\Users\Admin\AppData\Local\Temp\CFC.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\D88.tmp"C:\Users\Admin\AppData\Local\Temp\D88.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\E24.tmp"C:\Users\Admin\AppData\Local\Temp\E24.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\E91.tmp"C:\Users\Admin\AppData\Local\Temp\E91.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\EDF.tmp"C:\Users\Admin\AppData\Local\Temp\EDF.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\F1E.tmp"C:\Users\Admin\AppData\Local\Temp\F1E.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\F5C.tmp"C:\Users\Admin\AppData\Local\Temp\F5C.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\F9A.tmp"C:\Users\Admin\AppData\Local\Temp\F9A.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\FE8.tmp"C:\Users\Admin\AppData\Local\Temp\FE8.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\1027.tmp"C:\Users\Admin\AppData\Local\Temp\1027.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\1065.tmp"C:\Users\Admin\AppData\Local\Temp\1065.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\10B3.tmp"C:\Users\Admin\AppData\Local\Temp\10B3.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\1101.tmp"C:\Users\Admin\AppData\Local\Temp\1101.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\1140.tmp"C:\Users\Admin\AppData\Local\Temp\1140.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\118E.tmp"C:\Users\Admin\AppData\Local\Temp\118E.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\11CC.tmp"C:\Users\Admin\AppData\Local\Temp\11CC.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:948 -
C:\Users\Admin\AppData\Local\Temp\121A.tmp"C:\Users\Admin\AppData\Local\Temp\121A.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\1268.tmp"C:\Users\Admin\AppData\Local\Temp\1268.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\12B6.tmp"C:\Users\Admin\AppData\Local\Temp\12B6.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\1304.tmp"C:\Users\Admin\AppData\Local\Temp\1304.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\1352.tmp"C:\Users\Admin\AppData\Local\Temp\1352.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:848 -
C:\Users\Admin\AppData\Local\Temp\1390.tmp"C:\Users\Admin\AppData\Local\Temp\1390.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\13CF.tmp"C:\Users\Admin\AppData\Local\Temp\13CF.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\140D.tmp"C:\Users\Admin\AppData\Local\Temp\140D.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\145B.tmp"C:\Users\Admin\AppData\Local\Temp\145B.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\14A9.tmp"C:\Users\Admin\AppData\Local\Temp\14A9.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\14F7.tmp"C:\Users\Admin\AppData\Local\Temp\14F7.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\1545.tmp"C:\Users\Admin\AppData\Local\Temp\1545.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\1593.tmp"C:\Users\Admin\AppData\Local\Temp\1593.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:984 -
C:\Users\Admin\AppData\Local\Temp\15D2.tmp"C:\Users\Admin\AppData\Local\Temp\15D2.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\1610.tmp"C:\Users\Admin\AppData\Local\Temp\1610.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:872 -
C:\Users\Admin\AppData\Local\Temp\165E.tmp"C:\Users\Admin\AppData\Local\Temp\165E.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\16AC.tmp"C:\Users\Admin\AppData\Local\Temp\16AC.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\16FA.tmp"C:\Users\Admin\AppData\Local\Temp\16FA.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\1738.tmp"C:\Users\Admin\AppData\Local\Temp\1738.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\1786.tmp"C:\Users\Admin\AppData\Local\Temp\1786.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\17D4.tmp"C:\Users\Admin\AppData\Local\Temp\17D4.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\1813.tmp"C:\Users\Admin\AppData\Local\Temp\1813.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\1861.tmp"C:\Users\Admin\AppData\Local\Temp\1861.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\189F.tmp"C:\Users\Admin\AppData\Local\Temp\189F.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\18ED.tmp"C:\Users\Admin\AppData\Local\Temp\18ED.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\193B.tmp"C:\Users\Admin\AppData\Local\Temp\193B.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\1989.tmp"C:\Users\Admin\AppData\Local\Temp\1989.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\19D7.tmp"C:\Users\Admin\AppData\Local\Temp\19D7.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\1A35.tmp"C:\Users\Admin\AppData\Local\Temp\1A35.tmp"65⤵
- Executes dropped EXE
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\1A83.tmp"C:\Users\Admin\AppData\Local\Temp\1A83.tmp"66⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"67⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\1B0F.tmp"C:\Users\Admin\AppData\Local\Temp\1B0F.tmp"68⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"69⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"70⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\1C09.tmp"C:\Users\Admin\AppData\Local\Temp\1C09.tmp"71⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\1C57.tmp"C:\Users\Admin\AppData\Local\Temp\1C57.tmp"72⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"73⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"74⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\1D31.tmp"C:\Users\Admin\AppData\Local\Temp\1D31.tmp"75⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"76⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\1DCD.tmp"C:\Users\Admin\AppData\Local\Temp\1DCD.tmp"77⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"78⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\1E69.tmp"C:\Users\Admin\AppData\Local\Temp\1E69.tmp"79⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"80⤵PID:332
-
C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"81⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\1F44.tmp"C:\Users\Admin\AppData\Local\Temp\1F44.tmp"82⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\1F92.tmp"C:\Users\Admin\AppData\Local\Temp\1F92.tmp"83⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"84⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\201E.tmp"C:\Users\Admin\AppData\Local\Temp\201E.tmp"85⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\205C.tmp"C:\Users\Admin\AppData\Local\Temp\205C.tmp"86⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\20AA.tmp"C:\Users\Admin\AppData\Local\Temp\20AA.tmp"87⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\20F8.tmp"C:\Users\Admin\AppData\Local\Temp\20F8.tmp"88⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\2146.tmp"C:\Users\Admin\AppData\Local\Temp\2146.tmp"89⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\2194.tmp"C:\Users\Admin\AppData\Local\Temp\2194.tmp"90⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\21E2.tmp"C:\Users\Admin\AppData\Local\Temp\21E2.tmp"91⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\2230.tmp"C:\Users\Admin\AppData\Local\Temp\2230.tmp"92⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\227E.tmp"C:\Users\Admin\AppData\Local\Temp\227E.tmp"93⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\22CC.tmp"C:\Users\Admin\AppData\Local\Temp\22CC.tmp"94⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\231A.tmp"C:\Users\Admin\AppData\Local\Temp\231A.tmp"95⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\2368.tmp"C:\Users\Admin\AppData\Local\Temp\2368.tmp"96⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\23B6.tmp"C:\Users\Admin\AppData\Local\Temp\23B6.tmp"97⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\2404.tmp"C:\Users\Admin\AppData\Local\Temp\2404.tmp"98⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\2452.tmp"C:\Users\Admin\AppData\Local\Temp\2452.tmp"99⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\2491.tmp"C:\Users\Admin\AppData\Local\Temp\2491.tmp"100⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\24CF.tmp"C:\Users\Admin\AppData\Local\Temp\24CF.tmp"101⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\250E.tmp"C:\Users\Admin\AppData\Local\Temp\250E.tmp"102⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"103⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\25AA.tmp"C:\Users\Admin\AppData\Local\Temp\25AA.tmp"104⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\25F8.tmp"C:\Users\Admin\AppData\Local\Temp\25F8.tmp"105⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\2636.tmp"C:\Users\Admin\AppData\Local\Temp\2636.tmp"106⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\2684.tmp"C:\Users\Admin\AppData\Local\Temp\2684.tmp"107⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\26C2.tmp"C:\Users\Admin\AppData\Local\Temp\26C2.tmp"108⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\2710.tmp"C:\Users\Admin\AppData\Local\Temp\2710.tmp"109⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\274F.tmp"C:\Users\Admin\AppData\Local\Temp\274F.tmp"110⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\279D.tmp"C:\Users\Admin\AppData\Local\Temp\279D.tmp"111⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\27EB.tmp"C:\Users\Admin\AppData\Local\Temp\27EB.tmp"112⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\2829.tmp"C:\Users\Admin\AppData\Local\Temp\2829.tmp"113⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\2868.tmp"C:\Users\Admin\AppData\Local\Temp\2868.tmp"114⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\28A6.tmp"C:\Users\Admin\AppData\Local\Temp\28A6.tmp"115⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\28E4.tmp"C:\Users\Admin\AppData\Local\Temp\28E4.tmp"116⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\2923.tmp"C:\Users\Admin\AppData\Local\Temp\2923.tmp"117⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\2961.tmp"C:\Users\Admin\AppData\Local\Temp\2961.tmp"118⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\29AF.tmp"C:\Users\Admin\AppData\Local\Temp\29AF.tmp"119⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"120⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"121⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"122⤵PID:2896
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-