Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
07/07/2024, 04:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-07-07_1d919ddc7c7b5f60754d3945e4f22913_mafia.exe
Resource
win7-20240508-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-07_1d919ddc7c7b5f60754d3945e4f22913_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-07-07_1d919ddc7c7b5f60754d3945e4f22913_mafia.exe
-
Size
488KB
-
MD5
1d919ddc7c7b5f60754d3945e4f22913
-
SHA1
e1de31489a56864b69ed707bf0c9271ea0f99a59
-
SHA256
994cd23bec5881b96e64387833b0aea8588ba46e0b22757ccd8923aeb6cb1ad1
-
SHA512
a1942ed76c0b93c40989dd258abb2c8631b6f1afb64ca3c1b54336b14816656ada24e94d41b73f5694cd22f1004ec9c62af89083e6c7430c8661b0379e592fed
-
SSDEEP
12288:/U5rCOTeiD5tPC4xmrNx3Wc/SSClDoNZ:/UQOJDr6xf3Wc/SlDoN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1960 1F53.tmp 2068 1FE0.tmp 1732 206C.tmp 2448 20D9.tmp 2084 2127.tmp 1300 2175.tmp 2620 21C3.tmp 2748 2211.tmp 2648 225F.tmp 2784 22CC.tmp 2828 233A.tmp 2680 2378.tmp 2512 23B6.tmp 2636 2424.tmp 2356 2462.tmp 1996 24C0.tmp 1756 252D.tmp 1988 257B.tmp 1980 2617.tmp 1992 2655.tmp 1444 26A3.tmp 304 26E2.tmp 1620 2720.tmp 1668 277E.tmp 2832 27BC.tmp 2848 27FA.tmp 2824 2839.tmp 2320 2877.tmp 2556 28B6.tmp 2136 28F4.tmp 2324 2923.tmp 780 2961.tmp 576 2990.tmp 1268 29CE.tmp 1484 2A0D.tmp 2312 2A4B.tmp 2812 2A7A.tmp 904 2AB8.tmp 1128 2AF7.tmp 2500 2B26.tmp 820 2B64.tmp 1360 2BA2.tmp 1524 2BE1.tmp 1356 2C1F.tmp 3016 2C7D.tmp 1864 2CBB.tmp 892 2D09.tmp 1252 2D57.tmp 2368 2D96.tmp 2880 2DE4.tmp 1256 2E41.tmp 2164 2E8F.tmp 2896 2EDD.tmp 1272 2F5A.tmp 3012 2FA8.tmp 2456 2FF6.tmp 1580 3044.tmp 2444 3082.tmp 1948 30C1.tmp 3004 30FF.tmp 2920 313E.tmp 1732 317C.tmp 2176 31CA.tmp 1944 3218.tmp -
Loads dropped DLL 64 IoCs
pid Process 2244 2024-07-07_1d919ddc7c7b5f60754d3945e4f22913_mafia.exe 1960 1F53.tmp 2068 1FE0.tmp 1732 206C.tmp 2448 20D9.tmp 2084 2127.tmp 1300 2175.tmp 2620 21C3.tmp 2748 2211.tmp 2648 225F.tmp 2784 22CC.tmp 2828 233A.tmp 2680 2378.tmp 2512 23B6.tmp 2636 2424.tmp 2356 2462.tmp 1996 24C0.tmp 1756 252D.tmp 1988 257B.tmp 1980 2617.tmp 1992 2655.tmp 1444 26A3.tmp 304 26E2.tmp 1620 2720.tmp 1668 277E.tmp 2832 27BC.tmp 2848 27FA.tmp 2824 2839.tmp 2320 2877.tmp 2556 28B6.tmp 2136 28F4.tmp 2324 2923.tmp 780 2961.tmp 576 2990.tmp 1268 29CE.tmp 1484 2A0D.tmp 2312 2A4B.tmp 2812 2A7A.tmp 904 2AB8.tmp 1128 2AF7.tmp 2500 2B26.tmp 820 2B64.tmp 1360 2BA2.tmp 1524 2BE1.tmp 1356 2C1F.tmp 3016 2C7D.tmp 1864 2CBB.tmp 892 2D09.tmp 1252 2D57.tmp 2368 2D96.tmp 2880 2DE4.tmp 1256 2E41.tmp 2164 2E8F.tmp 2896 2EDD.tmp 1272 2F5A.tmp 3012 2FA8.tmp 2456 2FF6.tmp 1580 3044.tmp 2444 3082.tmp 1948 30C1.tmp 3004 30FF.tmp 2920 313E.tmp 1732 317C.tmp 2176 31CA.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2244 wrote to memory of 1960 2244 2024-07-07_1d919ddc7c7b5f60754d3945e4f22913_mafia.exe 28 PID 2244 wrote to memory of 1960 2244 2024-07-07_1d919ddc7c7b5f60754d3945e4f22913_mafia.exe 28 PID 2244 wrote to memory of 1960 2244 2024-07-07_1d919ddc7c7b5f60754d3945e4f22913_mafia.exe 28 PID 2244 wrote to memory of 1960 2244 2024-07-07_1d919ddc7c7b5f60754d3945e4f22913_mafia.exe 28 PID 1960 wrote to memory of 2068 1960 1F53.tmp 29 PID 1960 wrote to memory of 2068 1960 1F53.tmp 29 PID 1960 wrote to memory of 2068 1960 1F53.tmp 29 PID 1960 wrote to memory of 2068 1960 1F53.tmp 29 PID 2068 wrote to memory of 1732 2068 1FE0.tmp 30 PID 2068 wrote to memory of 1732 2068 1FE0.tmp 30 PID 2068 wrote to memory of 1732 2068 1FE0.tmp 30 PID 2068 wrote to memory of 1732 2068 1FE0.tmp 30 PID 1732 wrote to memory of 2448 1732 206C.tmp 31 PID 1732 wrote to memory of 2448 1732 206C.tmp 31 PID 1732 wrote to memory of 2448 1732 206C.tmp 31 PID 1732 wrote to memory of 2448 1732 206C.tmp 31 PID 2448 wrote to memory of 2084 2448 20D9.tmp 32 PID 2448 wrote to memory of 2084 2448 20D9.tmp 32 PID 2448 wrote to memory of 2084 2448 20D9.tmp 32 PID 2448 wrote to memory of 2084 2448 20D9.tmp 32 PID 2084 wrote to memory of 1300 2084 2127.tmp 33 PID 2084 wrote to memory of 1300 2084 2127.tmp 33 PID 2084 wrote to memory of 1300 2084 2127.tmp 33 PID 2084 wrote to memory of 1300 2084 2127.tmp 33 PID 1300 wrote to memory of 2620 1300 2175.tmp 34 PID 1300 wrote to memory of 2620 1300 2175.tmp 34 PID 1300 wrote to memory of 2620 1300 2175.tmp 34 PID 1300 wrote to memory of 2620 1300 2175.tmp 34 PID 2620 wrote to memory of 2748 2620 21C3.tmp 35 PID 2620 wrote to memory of 2748 2620 21C3.tmp 35 PID 2620 wrote to memory of 2748 2620 21C3.tmp 35 PID 2620 wrote to memory of 2748 2620 21C3.tmp 35 PID 2748 wrote to memory of 2648 2748 2211.tmp 36 PID 2748 wrote to memory of 2648 2748 2211.tmp 36 PID 2748 wrote to memory of 2648 2748 2211.tmp 36 PID 2748 wrote to memory of 2648 2748 2211.tmp 36 PID 2648 wrote to memory of 2784 2648 225F.tmp 37 PID 2648 wrote to memory of 2784 2648 225F.tmp 37 PID 2648 wrote to memory of 2784 2648 225F.tmp 37 PID 2648 wrote to memory of 2784 2648 225F.tmp 37 PID 2784 wrote to memory of 2828 2784 22CC.tmp 38 PID 2784 wrote to memory of 2828 2784 22CC.tmp 38 PID 2784 wrote to memory of 2828 2784 22CC.tmp 38 PID 2784 wrote to memory of 2828 2784 22CC.tmp 38 PID 2828 wrote to memory of 2680 2828 233A.tmp 39 PID 2828 wrote to memory of 2680 2828 233A.tmp 39 PID 2828 wrote to memory of 2680 2828 233A.tmp 39 PID 2828 wrote to memory of 2680 2828 233A.tmp 39 PID 2680 wrote to memory of 2512 2680 2378.tmp 40 PID 2680 wrote to memory of 2512 2680 2378.tmp 40 PID 2680 wrote to memory of 2512 2680 2378.tmp 40 PID 2680 wrote to memory of 2512 2680 2378.tmp 40 PID 2512 wrote to memory of 2636 2512 23B6.tmp 41 PID 2512 wrote to memory of 2636 2512 23B6.tmp 41 PID 2512 wrote to memory of 2636 2512 23B6.tmp 41 PID 2512 wrote to memory of 2636 2512 23B6.tmp 41 PID 2636 wrote to memory of 2356 2636 2424.tmp 42 PID 2636 wrote to memory of 2356 2636 2424.tmp 42 PID 2636 wrote to memory of 2356 2636 2424.tmp 42 PID 2636 wrote to memory of 2356 2636 2424.tmp 42 PID 2356 wrote to memory of 1996 2356 2462.tmp 43 PID 2356 wrote to memory of 1996 2356 2462.tmp 43 PID 2356 wrote to memory of 1996 2356 2462.tmp 43 PID 2356 wrote to memory of 1996 2356 2462.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-07_1d919ddc7c7b5f60754d3945e4f22913_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-07_1d919ddc7c7b5f60754d3945e4f22913_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\1F53.tmp"C:\Users\Admin\AppData\Local\Temp\1F53.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\206C.tmp"C:\Users\Admin\AppData\Local\Temp\206C.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\20D9.tmp"C:\Users\Admin\AppData\Local\Temp\20D9.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\2127.tmp"C:\Users\Admin\AppData\Local\Temp\2127.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\2175.tmp"C:\Users\Admin\AppData\Local\Temp\2175.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\21C3.tmp"C:\Users\Admin\AppData\Local\Temp\21C3.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\2211.tmp"C:\Users\Admin\AppData\Local\Temp\2211.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\225F.tmp"C:\Users\Admin\AppData\Local\Temp\225F.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\22CC.tmp"C:\Users\Admin\AppData\Local\Temp\22CC.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\233A.tmp"C:\Users\Admin\AppData\Local\Temp\233A.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\2378.tmp"C:\Users\Admin\AppData\Local\Temp\2378.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\23B6.tmp"C:\Users\Admin\AppData\Local\Temp\23B6.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\2424.tmp"C:\Users\Admin\AppData\Local\Temp\2424.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\24C0.tmp"C:\Users\Admin\AppData\Local\Temp\24C0.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\252D.tmp"C:\Users\Admin\AppData\Local\Temp\252D.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\257B.tmp"C:\Users\Admin\AppData\Local\Temp\257B.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\2655.tmp"C:\Users\Admin\AppData\Local\Temp\2655.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\26A3.tmp"C:\Users\Admin\AppData\Local\Temp\26A3.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\26E2.tmp"C:\Users\Admin\AppData\Local\Temp\26E2.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:304 -
C:\Users\Admin\AppData\Local\Temp\2720.tmp"C:\Users\Admin\AppData\Local\Temp\2720.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\277E.tmp"C:\Users\Admin\AppData\Local\Temp\277E.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\27BC.tmp"C:\Users\Admin\AppData\Local\Temp\27BC.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\27FA.tmp"C:\Users\Admin\AppData\Local\Temp\27FA.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\2839.tmp"C:\Users\Admin\AppData\Local\Temp\2839.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\2877.tmp"C:\Users\Admin\AppData\Local\Temp\2877.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\28B6.tmp"C:\Users\Admin\AppData\Local\Temp\28B6.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\28F4.tmp"C:\Users\Admin\AppData\Local\Temp\28F4.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\2923.tmp"C:\Users\Admin\AppData\Local\Temp\2923.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\2961.tmp"C:\Users\Admin\AppData\Local\Temp\2961.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:780 -
C:\Users\Admin\AppData\Local\Temp\2990.tmp"C:\Users\Admin\AppData\Local\Temp\2990.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:576 -
C:\Users\Admin\AppData\Local\Temp\29CE.tmp"C:\Users\Admin\AppData\Local\Temp\29CE.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:904 -
C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\2B26.tmp"C:\Users\Admin\AppData\Local\Temp\2B26.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\2B64.tmp"C:\Users\Admin\AppData\Local\Temp\2B64.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:820 -
C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\2BE1.tmp"C:\Users\Admin\AppData\Local\Temp\2BE1.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\2C1F.tmp"C:\Users\Admin\AppData\Local\Temp\2C1F.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\2D09.tmp"C:\Users\Admin\AppData\Local\Temp\2D09.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:892 -
C:\Users\Admin\AppData\Local\Temp\2D57.tmp"C:\Users\Admin\AppData\Local\Temp\2D57.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\2D96.tmp"C:\Users\Admin\AppData\Local\Temp\2D96.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\2E41.tmp"C:\Users\Admin\AppData\Local\Temp\2E41.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\2EDD.tmp"C:\Users\Admin\AppData\Local\Temp\2EDD.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\2F5A.tmp"C:\Users\Admin\AppData\Local\Temp\2F5A.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\3044.tmp"C:\Users\Admin\AppData\Local\Temp\3044.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\3082.tmp"C:\Users\Admin\AppData\Local\Temp\3082.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\30C1.tmp"C:\Users\Admin\AppData\Local\Temp\30C1.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\30FF.tmp"C:\Users\Admin\AppData\Local\Temp\30FF.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\313E.tmp"C:\Users\Admin\AppData\Local\Temp\313E.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\317C.tmp"C:\Users\Admin\AppData\Local\Temp\317C.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\31CA.tmp"C:\Users\Admin\AppData\Local\Temp\31CA.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\3218.tmp"C:\Users\Admin\AppData\Local\Temp\3218.tmp"65⤵
- Executes dropped EXE
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\3276.tmp"C:\Users\Admin\AppData\Local\Temp\3276.tmp"66⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\32C4.tmp"C:\Users\Admin\AppData\Local\Temp\32C4.tmp"67⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\3312.tmp"C:\Users\Admin\AppData\Local\Temp\3312.tmp"68⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\3360.tmp"C:\Users\Admin\AppData\Local\Temp\3360.tmp"69⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\33AE.tmp"C:\Users\Admin\AppData\Local\Temp\33AE.tmp"70⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\33EC.tmp"C:\Users\Admin\AppData\Local\Temp\33EC.tmp"71⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\342A.tmp"C:\Users\Admin\AppData\Local\Temp\342A.tmp"72⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\3469.tmp"C:\Users\Admin\AppData\Local\Temp\3469.tmp"73⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\34B7.tmp"C:\Users\Admin\AppData\Local\Temp\34B7.tmp"74⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\34F5.tmp"C:\Users\Admin\AppData\Local\Temp\34F5.tmp"75⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\3534.tmp"C:\Users\Admin\AppData\Local\Temp\3534.tmp"76⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\3572.tmp"C:\Users\Admin\AppData\Local\Temp\3572.tmp"77⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\35B0.tmp"C:\Users\Admin\AppData\Local\Temp\35B0.tmp"78⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\35EF.tmp"C:\Users\Admin\AppData\Local\Temp\35EF.tmp"79⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\362D.tmp"C:\Users\Admin\AppData\Local\Temp\362D.tmp"80⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\366C.tmp"C:\Users\Admin\AppData\Local\Temp\366C.tmp"81⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\36AA.tmp"C:\Users\Admin\AppData\Local\Temp\36AA.tmp"82⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\36E8.tmp"C:\Users\Admin\AppData\Local\Temp\36E8.tmp"83⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\3727.tmp"C:\Users\Admin\AppData\Local\Temp\3727.tmp"84⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\3765.tmp"C:\Users\Admin\AppData\Local\Temp\3765.tmp"85⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\37A4.tmp"C:\Users\Admin\AppData\Local\Temp\37A4.tmp"86⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\37E2.tmp"C:\Users\Admin\AppData\Local\Temp\37E2.tmp"87⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\3820.tmp"C:\Users\Admin\AppData\Local\Temp\3820.tmp"88⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\385F.tmp"C:\Users\Admin\AppData\Local\Temp\385F.tmp"89⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\389D.tmp"C:\Users\Admin\AppData\Local\Temp\389D.tmp"90⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\38DC.tmp"C:\Users\Admin\AppData\Local\Temp\38DC.tmp"91⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\391A.tmp"C:\Users\Admin\AppData\Local\Temp\391A.tmp"92⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\3958.tmp"C:\Users\Admin\AppData\Local\Temp\3958.tmp"93⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\3997.tmp"C:\Users\Admin\AppData\Local\Temp\3997.tmp"94⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\39D5.tmp"C:\Users\Admin\AppData\Local\Temp\39D5.tmp"95⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\3A14.tmp"C:\Users\Admin\AppData\Local\Temp\3A14.tmp"96⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\3A52.tmp"C:\Users\Admin\AppData\Local\Temp\3A52.tmp"97⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\3A90.tmp"C:\Users\Admin\AppData\Local\Temp\3A90.tmp"98⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\3ACF.tmp"C:\Users\Admin\AppData\Local\Temp\3ACF.tmp"99⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\3B0D.tmp"C:\Users\Admin\AppData\Local\Temp\3B0D.tmp"100⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\3B4C.tmp"C:\Users\Admin\AppData\Local\Temp\3B4C.tmp"101⤵PID:484
-
C:\Users\Admin\AppData\Local\Temp\3B7A.tmp"C:\Users\Admin\AppData\Local\Temp\3B7A.tmp"102⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\3BB9.tmp"C:\Users\Admin\AppData\Local\Temp\3BB9.tmp"103⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\3BF7.tmp"C:\Users\Admin\AppData\Local\Temp\3BF7.tmp"104⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\3C36.tmp"C:\Users\Admin\AppData\Local\Temp\3C36.tmp"105⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\3C74.tmp"C:\Users\Admin\AppData\Local\Temp\3C74.tmp"106⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\3CB2.tmp"C:\Users\Admin\AppData\Local\Temp\3CB2.tmp"107⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\3CF1.tmp"C:\Users\Admin\AppData\Local\Temp\3CF1.tmp"108⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\3D2F.tmp"C:\Users\Admin\AppData\Local\Temp\3D2F.tmp"109⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\3D6E.tmp"C:\Users\Admin\AppData\Local\Temp\3D6E.tmp"110⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\3DAC.tmp"C:\Users\Admin\AppData\Local\Temp\3DAC.tmp"111⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\3DEA.tmp"C:\Users\Admin\AppData\Local\Temp\3DEA.tmp"112⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\3E29.tmp"C:\Users\Admin\AppData\Local\Temp\3E29.tmp"113⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\3E67.tmp"C:\Users\Admin\AppData\Local\Temp\3E67.tmp"114⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\3EA6.tmp"C:\Users\Admin\AppData\Local\Temp\3EA6.tmp"115⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"116⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\3F22.tmp"C:\Users\Admin\AppData\Local\Temp\3F22.tmp"117⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\3F61.tmp"C:\Users\Admin\AppData\Local\Temp\3F61.tmp"118⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\3F9F.tmp"C:\Users\Admin\AppData\Local\Temp\3F9F.tmp"119⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\3FDE.tmp"C:\Users\Admin\AppData\Local\Temp\3FDE.tmp"120⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\401C.tmp"C:\Users\Admin\AppData\Local\Temp\401C.tmp"121⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\405A.tmp"C:\Users\Admin\AppData\Local\Temp\405A.tmp"122⤵PID:2896
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-