Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
22-07-2024 13:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-07-22_189c3304a74b9ea470b0972063005b99_mafia.exe
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-22_189c3304a74b9ea470b0972063005b99_mafia.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-07-22_189c3304a74b9ea470b0972063005b99_mafia.exe
-
Size
765KB
-
MD5
189c3304a74b9ea470b0972063005b99
-
SHA1
2ddaef4030d80b4e3c9f976e49a7f205b5c71d98
-
SHA256
cec1249b9d7fee89ebf847b81e4e64479e2ac900bb4abb5d498a5bc0c5402793
-
SHA512
a34aef90a3643fcc5ce732b1e4ed610ee659a63780801a2ab6bdf9216c78b43ae870e7abbb495ae8ca94e5fbac11a718df0030e3fe46e6926f8690d5363ea6d7
-
SSDEEP
12288:ZU5rCOTeiD7Fky5Oo4QLvXWS3PAP3ZF5rn5rLOa54U5w5A:ZUQOJD7eyMoTL+S343vh5Oa+UOS
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1672 CCD1.tmp 2692 CD4D.tmp 2060 CDF9.tmp 1684 CE85.tmp 2748 CEE3.tmp 2880 CF6F.tmp 2984 CFDD.tmp 2824 D079.tmp 2960 D0E6.tmp 2772 D172.tmp 2604 D1FF.tmp 2728 D27B.tmp 2292 D2D9.tmp 1560 D356.tmp 1128 D3E2.tmp 1188 D46F.tmp 1392 D4EB.tmp 1720 D568.tmp 1512 D5F5.tmp 548 D691.tmp 1636 D70D.tmp 2012 D79A.tmp 2944 D7F7.tmp 2940 D836.tmp 2228 D874.tmp 2204 D8B3.tmp 2432 D901.tmp 2224 D93F.tmp 1224 D97D.tmp 2280 D9BC.tmp 316 DA0A.tmp 2904 DA58.tmp 700 DA96.tmp 1328 DAE4.tmp 1740 DB23.tmp 1988 DB71.tmp 1056 DBAF.tmp 1488 DBFD.tmp 1916 DC3B.tmp 1536 DC89.tmp 1524 DCC8.tmp 3004 DD16.tmp 1144 DD54.tmp 1736 DD93.tmp 2564 DDD1.tmp 2484 DE2F.tmp 1064 DE7D.tmp 1828 DECB.tmp 888 DF09.tmp 1184 DF57.tmp 2572 DF96.tmp 1688 DFE4.tmp 2404 E032.tmp 2172 E080.tmp 2164 E0BE.tmp 2900 E10C.tmp 2148 E14A.tmp 2492 E189.tmp 2840 E1C7.tmp 2856 E206.tmp 2736 E254.tmp 2884 E292.tmp 2644 E2D0.tmp 2516 E30F.tmp -
Loads dropped DLL 64 IoCs
pid Process 2404 2024-07-22_189c3304a74b9ea470b0972063005b99_mafia.exe 1672 CCD1.tmp 2692 CD4D.tmp 2060 CDF9.tmp 1684 CE85.tmp 2748 CEE3.tmp 2880 CF6F.tmp 2984 CFDD.tmp 2824 D079.tmp 2960 D0E6.tmp 2772 D172.tmp 2604 D1FF.tmp 2728 D27B.tmp 2292 D2D9.tmp 1560 D356.tmp 1128 D3E2.tmp 1188 D46F.tmp 1392 D4EB.tmp 1720 D568.tmp 1512 D5F5.tmp 548 D691.tmp 1636 D70D.tmp 2012 D79A.tmp 2944 D7F7.tmp 2940 D836.tmp 2228 D874.tmp 2204 D8B3.tmp 2432 D901.tmp 2224 D93F.tmp 1224 D97D.tmp 2280 D9BC.tmp 316 DA0A.tmp 2904 DA58.tmp 700 DA96.tmp 1328 DAE4.tmp 1740 DB23.tmp 1988 DB71.tmp 1056 DBAF.tmp 1488 DBFD.tmp 1916 DC3B.tmp 1536 DC89.tmp 1524 DCC8.tmp 3004 DD16.tmp 1144 DD54.tmp 1736 DD93.tmp 2564 DDD1.tmp 2484 DE2F.tmp 1064 DE7D.tmp 1828 DECB.tmp 888 DF09.tmp 1184 DF57.tmp 2572 DF96.tmp 1688 DFE4.tmp 2404 E032.tmp 2172 E080.tmp 2164 E0BE.tmp 2900 E10C.tmp 2148 E14A.tmp 2492 E189.tmp 2840 E1C7.tmp 2856 E206.tmp 2736 E254.tmp 2884 E292.tmp 2644 E2D0.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2404 wrote to memory of 1672 2404 2024-07-22_189c3304a74b9ea470b0972063005b99_mafia.exe 30 PID 2404 wrote to memory of 1672 2404 2024-07-22_189c3304a74b9ea470b0972063005b99_mafia.exe 30 PID 2404 wrote to memory of 1672 2404 2024-07-22_189c3304a74b9ea470b0972063005b99_mafia.exe 30 PID 2404 wrote to memory of 1672 2404 2024-07-22_189c3304a74b9ea470b0972063005b99_mafia.exe 30 PID 1672 wrote to memory of 2692 1672 CCD1.tmp 32 PID 1672 wrote to memory of 2692 1672 CCD1.tmp 32 PID 1672 wrote to memory of 2692 1672 CCD1.tmp 32 PID 1672 wrote to memory of 2692 1672 CCD1.tmp 32 PID 2692 wrote to memory of 2060 2692 CD4D.tmp 33 PID 2692 wrote to memory of 2060 2692 CD4D.tmp 33 PID 2692 wrote to memory of 2060 2692 CD4D.tmp 33 PID 2692 wrote to memory of 2060 2692 CD4D.tmp 33 PID 2060 wrote to memory of 1684 2060 CDF9.tmp 34 PID 2060 wrote to memory of 1684 2060 CDF9.tmp 34 PID 2060 wrote to memory of 1684 2060 CDF9.tmp 34 PID 2060 wrote to memory of 1684 2060 CDF9.tmp 34 PID 1684 wrote to memory of 2748 1684 CE85.tmp 35 PID 1684 wrote to memory of 2748 1684 CE85.tmp 35 PID 1684 wrote to memory of 2748 1684 CE85.tmp 35 PID 1684 wrote to memory of 2748 1684 CE85.tmp 35 PID 2748 wrote to memory of 2880 2748 CEE3.tmp 36 PID 2748 wrote to memory of 2880 2748 CEE3.tmp 36 PID 2748 wrote to memory of 2880 2748 CEE3.tmp 36 PID 2748 wrote to memory of 2880 2748 CEE3.tmp 36 PID 2880 wrote to memory of 2984 2880 CF6F.tmp 37 PID 2880 wrote to memory of 2984 2880 CF6F.tmp 37 PID 2880 wrote to memory of 2984 2880 CF6F.tmp 37 PID 2880 wrote to memory of 2984 2880 CF6F.tmp 37 PID 2984 wrote to memory of 2824 2984 CFDD.tmp 38 PID 2984 wrote to memory of 2824 2984 CFDD.tmp 38 PID 2984 wrote to memory of 2824 2984 CFDD.tmp 38 PID 2984 wrote to memory of 2824 2984 CFDD.tmp 38 PID 2824 wrote to memory of 2960 2824 D079.tmp 39 PID 2824 wrote to memory of 2960 2824 D079.tmp 39 PID 2824 wrote to memory of 2960 2824 D079.tmp 39 PID 2824 wrote to memory of 2960 2824 D079.tmp 39 PID 2960 wrote to memory of 2772 2960 D0E6.tmp 40 PID 2960 wrote to memory of 2772 2960 D0E6.tmp 40 PID 2960 wrote to memory of 2772 2960 D0E6.tmp 40 PID 2960 wrote to memory of 2772 2960 D0E6.tmp 40 PID 2772 wrote to memory of 2604 2772 D172.tmp 41 PID 2772 wrote to memory of 2604 2772 D172.tmp 41 PID 2772 wrote to memory of 2604 2772 D172.tmp 41 PID 2772 wrote to memory of 2604 2772 D172.tmp 41 PID 2604 wrote to memory of 2728 2604 D1FF.tmp 42 PID 2604 wrote to memory of 2728 2604 D1FF.tmp 42 PID 2604 wrote to memory of 2728 2604 D1FF.tmp 42 PID 2604 wrote to memory of 2728 2604 D1FF.tmp 42 PID 2728 wrote to memory of 2292 2728 D27B.tmp 43 PID 2728 wrote to memory of 2292 2728 D27B.tmp 43 PID 2728 wrote to memory of 2292 2728 D27B.tmp 43 PID 2728 wrote to memory of 2292 2728 D27B.tmp 43 PID 2292 wrote to memory of 1560 2292 D2D9.tmp 44 PID 2292 wrote to memory of 1560 2292 D2D9.tmp 44 PID 2292 wrote to memory of 1560 2292 D2D9.tmp 44 PID 2292 wrote to memory of 1560 2292 D2D9.tmp 44 PID 1560 wrote to memory of 1128 1560 D356.tmp 45 PID 1560 wrote to memory of 1128 1560 D356.tmp 45 PID 1560 wrote to memory of 1128 1560 D356.tmp 45 PID 1560 wrote to memory of 1128 1560 D356.tmp 45 PID 1128 wrote to memory of 1188 1128 D3E2.tmp 46 PID 1128 wrote to memory of 1188 1128 D3E2.tmp 46 PID 1128 wrote to memory of 1188 1128 D3E2.tmp 46 PID 1128 wrote to memory of 1188 1128 D3E2.tmp 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-22_189c3304a74b9ea470b0972063005b99_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-22_189c3304a74b9ea470b0972063005b99_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\CCD1.tmp"C:\Users\Admin\AppData\Local\Temp\CCD1.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\CD4D.tmp"C:\Users\Admin\AppData\Local\Temp\CD4D.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\CDF9.tmp"C:\Users\Admin\AppData\Local\Temp\CDF9.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\CE85.tmp"C:\Users\Admin\AppData\Local\Temp\CE85.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\CEE3.tmp"C:\Users\Admin\AppData\Local\Temp\CEE3.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\CF6F.tmp"C:\Users\Admin\AppData\Local\Temp\CF6F.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\CFDD.tmp"C:\Users\Admin\AppData\Local\Temp\CFDD.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\D079.tmp"C:\Users\Admin\AppData\Local\Temp\D079.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\D0E6.tmp"C:\Users\Admin\AppData\Local\Temp\D0E6.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\D172.tmp"C:\Users\Admin\AppData\Local\Temp\D172.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\D1FF.tmp"C:\Users\Admin\AppData\Local\Temp\D1FF.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\D27B.tmp"C:\Users\Admin\AppData\Local\Temp\D27B.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\D2D9.tmp"C:\Users\Admin\AppData\Local\Temp\D2D9.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\D356.tmp"C:\Users\Admin\AppData\Local\Temp\D356.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\D3E2.tmp"C:\Users\Admin\AppData\Local\Temp\D3E2.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\D46F.tmp"C:\Users\Admin\AppData\Local\Temp\D46F.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\D4EB.tmp"C:\Users\Admin\AppData\Local\Temp\D4EB.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\D568.tmp"C:\Users\Admin\AppData\Local\Temp\D568.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\D5F5.tmp"C:\Users\Admin\AppData\Local\Temp\D5F5.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\D691.tmp"C:\Users\Admin\AppData\Local\Temp\D691.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:548 -
C:\Users\Admin\AppData\Local\Temp\D70D.tmp"C:\Users\Admin\AppData\Local\Temp\D70D.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\D79A.tmp"C:\Users\Admin\AppData\Local\Temp\D79A.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\D7F7.tmp"C:\Users\Admin\AppData\Local\Temp\D7F7.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\D836.tmp"C:\Users\Admin\AppData\Local\Temp\D836.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\D874.tmp"C:\Users\Admin\AppData\Local\Temp\D874.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\D8B3.tmp"C:\Users\Admin\AppData\Local\Temp\D8B3.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\D901.tmp"C:\Users\Admin\AppData\Local\Temp\D901.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\D93F.tmp"C:\Users\Admin\AppData\Local\Temp\D93F.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\D97D.tmp"C:\Users\Admin\AppData\Local\Temp\D97D.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\D9BC.tmp"C:\Users\Admin\AppData\Local\Temp\D9BC.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\DA0A.tmp"C:\Users\Admin\AppData\Local\Temp\DA0A.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:316 -
C:\Users\Admin\AppData\Local\Temp\DA58.tmp"C:\Users\Admin\AppData\Local\Temp\DA58.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\DA96.tmp"C:\Users\Admin\AppData\Local\Temp\DA96.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:700 -
C:\Users\Admin\AppData\Local\Temp\DAE4.tmp"C:\Users\Admin\AppData\Local\Temp\DAE4.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\DB23.tmp"C:\Users\Admin\AppData\Local\Temp\DB23.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\DB71.tmp"C:\Users\Admin\AppData\Local\Temp\DB71.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\DBAF.tmp"C:\Users\Admin\AppData\Local\Temp\DBAF.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\DBFD.tmp"C:\Users\Admin\AppData\Local\Temp\DBFD.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\DC3B.tmp"C:\Users\Admin\AppData\Local\Temp\DC3B.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\DC89.tmp"C:\Users\Admin\AppData\Local\Temp\DC89.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\DCC8.tmp"C:\Users\Admin\AppData\Local\Temp\DCC8.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\DD16.tmp"C:\Users\Admin\AppData\Local\Temp\DD16.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\DD54.tmp"C:\Users\Admin\AppData\Local\Temp\DD54.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\DD93.tmp"C:\Users\Admin\AppData\Local\Temp\DD93.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\DDD1.tmp"C:\Users\Admin\AppData\Local\Temp\DDD1.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\DE2F.tmp"C:\Users\Admin\AppData\Local\Temp\DE2F.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\DE7D.tmp"C:\Users\Admin\AppData\Local\Temp\DE7D.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\DECB.tmp"C:\Users\Admin\AppData\Local\Temp\DECB.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\DF09.tmp"C:\Users\Admin\AppData\Local\Temp\DF09.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:888 -
C:\Users\Admin\AppData\Local\Temp\DF57.tmp"C:\Users\Admin\AppData\Local\Temp\DF57.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\DF96.tmp"C:\Users\Admin\AppData\Local\Temp\DF96.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\DFE4.tmp"C:\Users\Admin\AppData\Local\Temp\DFE4.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\E032.tmp"C:\Users\Admin\AppData\Local\Temp\E032.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\E080.tmp"C:\Users\Admin\AppData\Local\Temp\E080.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\E0BE.tmp"C:\Users\Admin\AppData\Local\Temp\E0BE.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\E10C.tmp"C:\Users\Admin\AppData\Local\Temp\E10C.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\E14A.tmp"C:\Users\Admin\AppData\Local\Temp\E14A.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\E189.tmp"C:\Users\Admin\AppData\Local\Temp\E189.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\E1C7.tmp"C:\Users\Admin\AppData\Local\Temp\E1C7.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\E206.tmp"C:\Users\Admin\AppData\Local\Temp\E206.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\E254.tmp"C:\Users\Admin\AppData\Local\Temp\E254.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\E292.tmp"C:\Users\Admin\AppData\Local\Temp\E292.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\E2D0.tmp"C:\Users\Admin\AppData\Local\Temp\E2D0.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\E30F.tmp"C:\Users\Admin\AppData\Local\Temp\E30F.tmp"65⤵
- Executes dropped EXE
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\E34D.tmp"C:\Users\Admin\AppData\Local\Temp\E34D.tmp"66⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\E39B.tmp"C:\Users\Admin\AppData\Local\Temp\E39B.tmp"67⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\E3DA.tmp"C:\Users\Admin\AppData\Local\Temp\E3DA.tmp"68⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\E428.tmp"C:\Users\Admin\AppData\Local\Temp\E428.tmp"69⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\E476.tmp"C:\Users\Admin\AppData\Local\Temp\E476.tmp"70⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\E4B4.tmp"C:\Users\Admin\AppData\Local\Temp\E4B4.tmp"71⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\E4F2.tmp"C:\Users\Admin\AppData\Local\Temp\E4F2.tmp"72⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\E540.tmp"C:\Users\Admin\AppData\Local\Temp\E540.tmp"73⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\E57F.tmp"C:\Users\Admin\AppData\Local\Temp\E57F.tmp"74⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\E5BD.tmp"C:\Users\Admin\AppData\Local\Temp\E5BD.tmp"75⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\E5FC.tmp"C:\Users\Admin\AppData\Local\Temp\E5FC.tmp"76⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\E63A.tmp"C:\Users\Admin\AppData\Local\Temp\E63A.tmp"77⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\E678.tmp"C:\Users\Admin\AppData\Local\Temp\E678.tmp"78⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\E6B7.tmp"C:\Users\Admin\AppData\Local\Temp\E6B7.tmp"79⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"80⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\E734.tmp"C:\Users\Admin\AppData\Local\Temp\E734.tmp"81⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\E772.tmp"C:\Users\Admin\AppData\Local\Temp\E772.tmp"82⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"83⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"84⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\E82D.tmp"C:\Users\Admin\AppData\Local\Temp\E82D.tmp"85⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\E87B.tmp"C:\Users\Admin\AppData\Local\Temp\E87B.tmp"86⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"87⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\E8F8.tmp"C:\Users\Admin\AppData\Local\Temp\E8F8.tmp"88⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\E936.tmp"C:\Users\Admin\AppData\Local\Temp\E936.tmp"89⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\E975.tmp"C:\Users\Admin\AppData\Local\Temp\E975.tmp"90⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\E9B3.tmp"C:\Users\Admin\AppData\Local\Temp\E9B3.tmp"91⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\E9F2.tmp"C:\Users\Admin\AppData\Local\Temp\E9F2.tmp"92⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\EA40.tmp"C:\Users\Admin\AppData\Local\Temp\EA40.tmp"93⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\EA8E.tmp"C:\Users\Admin\AppData\Local\Temp\EA8E.tmp"94⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\EACC.tmp"C:\Users\Admin\AppData\Local\Temp\EACC.tmp"95⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\EB0A.tmp"C:\Users\Admin\AppData\Local\Temp\EB0A.tmp"96⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\EB49.tmp"C:\Users\Admin\AppData\Local\Temp\EB49.tmp"97⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\EB87.tmp"C:\Users\Admin\AppData\Local\Temp\EB87.tmp"98⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\EBC6.tmp"C:\Users\Admin\AppData\Local\Temp\EBC6.tmp"99⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\EC14.tmp"C:\Users\Admin\AppData\Local\Temp\EC14.tmp"100⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\EC52.tmp"C:\Users\Admin\AppData\Local\Temp\EC52.tmp"101⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\EC90.tmp"C:\Users\Admin\AppData\Local\Temp\EC90.tmp"102⤵PID:604
-
C:\Users\Admin\AppData\Local\Temp\ECCF.tmp"C:\Users\Admin\AppData\Local\Temp\ECCF.tmp"103⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\ED0D.tmp"C:\Users\Admin\AppData\Local\Temp\ED0D.tmp"104⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\ED4C.tmp"C:\Users\Admin\AppData\Local\Temp\ED4C.tmp"105⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\ED8A.tmp"C:\Users\Admin\AppData\Local\Temp\ED8A.tmp"106⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\EDC8.tmp"C:\Users\Admin\AppData\Local\Temp\EDC8.tmp"107⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\EE07.tmp"C:\Users\Admin\AppData\Local\Temp\EE07.tmp"108⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\EE45.tmp"C:\Users\Admin\AppData\Local\Temp\EE45.tmp"109⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\EE84.tmp"C:\Users\Admin\AppData\Local\Temp\EE84.tmp"110⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\EEC2.tmp"C:\Users\Admin\AppData\Local\Temp\EEC2.tmp"111⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\EF00.tmp"C:\Users\Admin\AppData\Local\Temp\EF00.tmp"112⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\EF3F.tmp"C:\Users\Admin\AppData\Local\Temp\EF3F.tmp"113⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\EF8D.tmp"C:\Users\Admin\AppData\Local\Temp\EF8D.tmp"114⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\EFCB.tmp"C:\Users\Admin\AppData\Local\Temp\EFCB.tmp"115⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\F00A.tmp"C:\Users\Admin\AppData\Local\Temp\F00A.tmp"116⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\F048.tmp"C:\Users\Admin\AppData\Local\Temp\F048.tmp"117⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\F086.tmp"C:\Users\Admin\AppData\Local\Temp\F086.tmp"118⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\F0C5.tmp"C:\Users\Admin\AppData\Local\Temp\F0C5.tmp"119⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\F103.tmp"C:\Users\Admin\AppData\Local\Temp\F103.tmp"120⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\F142.tmp"C:\Users\Admin\AppData\Local\Temp\F142.tmp"121⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\F180.tmp"C:\Users\Admin\AppData\Local\Temp\F180.tmp"122⤵PID:568
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-