Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
27-08-2023 17:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b77dad892b227deb0bffd4bbf1960cdb_mafia_JC.exe
Resource
win7-20230712-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
b77dad892b227deb0bffd4bbf1960cdb_mafia_JC.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
b77dad892b227deb0bffd4bbf1960cdb_mafia_JC.exe
-
Size
487KB
-
MD5
b77dad892b227deb0bffd4bbf1960cdb
-
SHA1
efcc8a674c85559dfd190e4ff0900cacae86966c
-
SHA256
daaf13ecd9bb39e94dc65ae226ef41639cbb124214a5974ee99093ee8231edc8
-
SHA512
227a714d0b166473f705454c604c25de1e2337a4ff41a988c6455840784d2932ca61cc8520dcffb05c7574b1a54c17efe2b96031906a1e199fdc4472eda7791b
-
SSDEEP
12288:yU5rCOTeiNLxsFpUyR7wI4wt1i/+BYbZ:yUQOJNLWFpUyR78wt1i/IYb
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2184 6A67.tmp 1280 6B31.tmp 2216 6C5A.tmp 1672 6D63.tmp 2460 6E3D.tmp 2820 6ECA.tmp 2972 6FA4.tmp 308 707F.tmp 2696 7178.tmp 2724 7291.tmp 2828 735C.tmp 2700 7436.tmp 2600 7501.tmp 2288 75EB.tmp 756 7704.tmp 1296 77FD.tmp 536 78E7.tmp 1940 79C2.tmp 2244 7ACB.tmp 2652 7BD4.tmp 1708 7D99.tmp 2944 7E83.tmp 2928 7F8C.tmp 1612 7FF9.tmp 1784 8076.tmp 1628 80F3.tmp 1596 8160.tmp 2872 81DD.tmp 2560 8259.tmp 2080 82C7.tmp 1676 8334.tmp 2108 83A1.tmp 2556 842D.tmp 2088 84AA.tmp 940 8517.tmp 2132 8575.tmp 1244 85F2.tmp 1200 865F.tmp 2040 86DC.tmp 1472 8749.tmp 1328 87C6.tmp 1648 8852.tmp 2424 88BF.tmp 2092 893C.tmp 904 899A.tmp 1764 8A17.tmp 1640 8A84.tmp 1716 8AF1.tmp 812 8B5E.tmp 272 8BCB.tmp 2352 8C29.tmp 1740 8CA6.tmp 1712 8D13.tmp 2292 8D80.tmp 1584 8DED.tmp 2180 8E7A.tmp 2500 8EF7.tmp 2220 8F73.tmp 1968 8FF0.tmp 2504 904E.tmp 2228 90AB.tmp 2588 90F9.tmp 2568 9157.tmp 2564 91D4.tmp -
Loads dropped DLL 64 IoCs
pid Process 2772 b77dad892b227deb0bffd4bbf1960cdb_mafia_JC.exe 2184 6A67.tmp 1280 6B31.tmp 2216 6C5A.tmp 1672 6D63.tmp 2460 6E3D.tmp 2820 6ECA.tmp 2972 6FA4.tmp 308 707F.tmp 2696 7178.tmp 2724 7291.tmp 2828 735C.tmp 2700 7436.tmp 2600 7501.tmp 2288 75EB.tmp 756 7704.tmp 1296 77FD.tmp 536 78E7.tmp 1940 79C2.tmp 2244 7ACB.tmp 2652 7BD4.tmp 1708 7D99.tmp 2944 7E83.tmp 2928 7F8C.tmp 1612 7FF9.tmp 1784 8076.tmp 1628 80F3.tmp 1596 8160.tmp 2872 81DD.tmp 2560 8259.tmp 2080 82C7.tmp 1676 8334.tmp 2108 83A1.tmp 2556 842D.tmp 2088 84AA.tmp 940 8517.tmp 2132 8575.tmp 1244 85F2.tmp 1200 865F.tmp 2040 86DC.tmp 1472 8749.tmp 1328 87C6.tmp 1648 8852.tmp 2424 88BF.tmp 2092 893C.tmp 904 899A.tmp 1764 8A17.tmp 1640 8A84.tmp 1716 8AF1.tmp 812 8B5E.tmp 272 8BCB.tmp 2352 8C29.tmp 1740 8CA6.tmp 1712 8D13.tmp 2292 8D80.tmp 1584 8DED.tmp 2180 8E7A.tmp 2500 8EF7.tmp 2220 8F73.tmp 1968 8FF0.tmp 2504 904E.tmp 2228 90AB.tmp 2588 90F9.tmp 2568 9157.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2772 wrote to memory of 2184 2772 b77dad892b227deb0bffd4bbf1960cdb_mafia_JC.exe 28 PID 2772 wrote to memory of 2184 2772 b77dad892b227deb0bffd4bbf1960cdb_mafia_JC.exe 28 PID 2772 wrote to memory of 2184 2772 b77dad892b227deb0bffd4bbf1960cdb_mafia_JC.exe 28 PID 2772 wrote to memory of 2184 2772 b77dad892b227deb0bffd4bbf1960cdb_mafia_JC.exe 28 PID 2184 wrote to memory of 1280 2184 6A67.tmp 29 PID 2184 wrote to memory of 1280 2184 6A67.tmp 29 PID 2184 wrote to memory of 1280 2184 6A67.tmp 29 PID 2184 wrote to memory of 1280 2184 6A67.tmp 29 PID 1280 wrote to memory of 2216 1280 6B31.tmp 30 PID 1280 wrote to memory of 2216 1280 6B31.tmp 30 PID 1280 wrote to memory of 2216 1280 6B31.tmp 30 PID 1280 wrote to memory of 2216 1280 6B31.tmp 30 PID 2216 wrote to memory of 1672 2216 6C5A.tmp 31 PID 2216 wrote to memory of 1672 2216 6C5A.tmp 31 PID 2216 wrote to memory of 1672 2216 6C5A.tmp 31 PID 2216 wrote to memory of 1672 2216 6C5A.tmp 31 PID 1672 wrote to memory of 2460 1672 6D63.tmp 32 PID 1672 wrote to memory of 2460 1672 6D63.tmp 32 PID 1672 wrote to memory of 2460 1672 6D63.tmp 32 PID 1672 wrote to memory of 2460 1672 6D63.tmp 32 PID 2460 wrote to memory of 2820 2460 6E3D.tmp 33 PID 2460 wrote to memory of 2820 2460 6E3D.tmp 33 PID 2460 wrote to memory of 2820 2460 6E3D.tmp 33 PID 2460 wrote to memory of 2820 2460 6E3D.tmp 33 PID 2820 wrote to memory of 2972 2820 6ECA.tmp 34 PID 2820 wrote to memory of 2972 2820 6ECA.tmp 34 PID 2820 wrote to memory of 2972 2820 6ECA.tmp 34 PID 2820 wrote to memory of 2972 2820 6ECA.tmp 34 PID 2972 wrote to memory of 308 2972 6FA4.tmp 35 PID 2972 wrote to memory of 308 2972 6FA4.tmp 35 PID 2972 wrote to memory of 308 2972 6FA4.tmp 35 PID 2972 wrote to memory of 308 2972 6FA4.tmp 35 PID 308 wrote to memory of 2696 308 707F.tmp 36 PID 308 wrote to memory of 2696 308 707F.tmp 36 PID 308 wrote to memory of 2696 308 707F.tmp 36 PID 308 wrote to memory of 2696 308 707F.tmp 36 PID 2696 wrote to memory of 2724 2696 7178.tmp 37 PID 2696 wrote to memory of 2724 2696 7178.tmp 37 PID 2696 wrote to memory of 2724 2696 7178.tmp 37 PID 2696 wrote to memory of 2724 2696 7178.tmp 37 PID 2724 wrote to memory of 2828 2724 7291.tmp 38 PID 2724 wrote to memory of 2828 2724 7291.tmp 38 PID 2724 wrote to memory of 2828 2724 7291.tmp 38 PID 2724 wrote to memory of 2828 2724 7291.tmp 38 PID 2828 wrote to memory of 2700 2828 735C.tmp 39 PID 2828 wrote to memory of 2700 2828 735C.tmp 39 PID 2828 wrote to memory of 2700 2828 735C.tmp 39 PID 2828 wrote to memory of 2700 2828 735C.tmp 39 PID 2700 wrote to memory of 2600 2700 7436.tmp 40 PID 2700 wrote to memory of 2600 2700 7436.tmp 40 PID 2700 wrote to memory of 2600 2700 7436.tmp 40 PID 2700 wrote to memory of 2600 2700 7436.tmp 40 PID 2600 wrote to memory of 2288 2600 7501.tmp 41 PID 2600 wrote to memory of 2288 2600 7501.tmp 41 PID 2600 wrote to memory of 2288 2600 7501.tmp 41 PID 2600 wrote to memory of 2288 2600 7501.tmp 41 PID 2288 wrote to memory of 756 2288 75EB.tmp 42 PID 2288 wrote to memory of 756 2288 75EB.tmp 42 PID 2288 wrote to memory of 756 2288 75EB.tmp 42 PID 2288 wrote to memory of 756 2288 75EB.tmp 42 PID 756 wrote to memory of 1296 756 7704.tmp 43 PID 756 wrote to memory of 1296 756 7704.tmp 43 PID 756 wrote to memory of 1296 756 7704.tmp 43 PID 756 wrote to memory of 1296 756 7704.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\b77dad892b227deb0bffd4bbf1960cdb_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\b77dad892b227deb0bffd4bbf1960cdb_mafia_JC.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\6A67.tmp"C:\Users\Admin\AppData\Local\Temp\6A67.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\6B31.tmp"C:\Users\Admin\AppData\Local\Temp\6B31.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\6C5A.tmp"C:\Users\Admin\AppData\Local\Temp\6C5A.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\6D63.tmp"C:\Users\Admin\AppData\Local\Temp\6D63.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\6E3D.tmp"C:\Users\Admin\AppData\Local\Temp\6E3D.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\6ECA.tmp"C:\Users\Admin\AppData\Local\Temp\6ECA.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\6FA4.tmp"C:\Users\Admin\AppData\Local\Temp\6FA4.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\707F.tmp"C:\Users\Admin\AppData\Local\Temp\707F.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:308 -
C:\Users\Admin\AppData\Local\Temp\7178.tmp"C:\Users\Admin\AppData\Local\Temp\7178.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\7291.tmp"C:\Users\Admin\AppData\Local\Temp\7291.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\735C.tmp"C:\Users\Admin\AppData\Local\Temp\735C.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\7436.tmp"C:\Users\Admin\AppData\Local\Temp\7436.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\7501.tmp"C:\Users\Admin\AppData\Local\Temp\7501.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\75EB.tmp"C:\Users\Admin\AppData\Local\Temp\75EB.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\7704.tmp"C:\Users\Admin\AppData\Local\Temp\7704.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\77FD.tmp"C:\Users\Admin\AppData\Local\Temp\77FD.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\78E7.tmp"C:\Users\Admin\AppData\Local\Temp\78E7.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:536 -
C:\Users\Admin\AppData\Local\Temp\79C2.tmp"C:\Users\Admin\AppData\Local\Temp\79C2.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\7ACB.tmp"C:\Users\Admin\AppData\Local\Temp\7ACB.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\7BD4.tmp"C:\Users\Admin\AppData\Local\Temp\7BD4.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\7D99.tmp"C:\Users\Admin\AppData\Local\Temp\7D99.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\7E83.tmp"C:\Users\Admin\AppData\Local\Temp\7E83.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\7F8C.tmp"C:\Users\Admin\AppData\Local\Temp\7F8C.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\7FF9.tmp"C:\Users\Admin\AppData\Local\Temp\7FF9.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\8076.tmp"C:\Users\Admin\AppData\Local\Temp\8076.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\80F3.tmp"C:\Users\Admin\AppData\Local\Temp\80F3.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\8160.tmp"C:\Users\Admin\AppData\Local\Temp\8160.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\81DD.tmp"C:\Users\Admin\AppData\Local\Temp\81DD.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\8259.tmp"C:\Users\Admin\AppData\Local\Temp\8259.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\82C7.tmp"C:\Users\Admin\AppData\Local\Temp\82C7.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\8334.tmp"C:\Users\Admin\AppData\Local\Temp\8334.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\83A1.tmp"C:\Users\Admin\AppData\Local\Temp\83A1.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\842D.tmp"C:\Users\Admin\AppData\Local\Temp\842D.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\84AA.tmp"C:\Users\Admin\AppData\Local\Temp\84AA.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\8517.tmp"C:\Users\Admin\AppData\Local\Temp\8517.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:940 -
C:\Users\Admin\AppData\Local\Temp\8575.tmp"C:\Users\Admin\AppData\Local\Temp\8575.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\85F2.tmp"C:\Users\Admin\AppData\Local\Temp\85F2.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\865F.tmp"C:\Users\Admin\AppData\Local\Temp\865F.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\86DC.tmp"C:\Users\Admin\AppData\Local\Temp\86DC.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\8749.tmp"C:\Users\Admin\AppData\Local\Temp\8749.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\87C6.tmp"C:\Users\Admin\AppData\Local\Temp\87C6.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\8852.tmp"C:\Users\Admin\AppData\Local\Temp\8852.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\88BF.tmp"C:\Users\Admin\AppData\Local\Temp\88BF.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\893C.tmp"C:\Users\Admin\AppData\Local\Temp\893C.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\899A.tmp"C:\Users\Admin\AppData\Local\Temp\899A.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:904 -
C:\Users\Admin\AppData\Local\Temp\8A17.tmp"C:\Users\Admin\AppData\Local\Temp\8A17.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\8A84.tmp"C:\Users\Admin\AppData\Local\Temp\8A84.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\8AF1.tmp"C:\Users\Admin\AppData\Local\Temp\8AF1.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\8B5E.tmp"C:\Users\Admin\AppData\Local\Temp\8B5E.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:812 -
C:\Users\Admin\AppData\Local\Temp\8BCB.tmp"C:\Users\Admin\AppData\Local\Temp\8BCB.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:272 -
C:\Users\Admin\AppData\Local\Temp\8C29.tmp"C:\Users\Admin\AppData\Local\Temp\8C29.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\8CA6.tmp"C:\Users\Admin\AppData\Local\Temp\8CA6.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\8D13.tmp"C:\Users\Admin\AppData\Local\Temp\8D13.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\8D80.tmp"C:\Users\Admin\AppData\Local\Temp\8D80.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\8DED.tmp"C:\Users\Admin\AppData\Local\Temp\8DED.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\8E7A.tmp"C:\Users\Admin\AppData\Local\Temp\8E7A.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\8EF7.tmp"C:\Users\Admin\AppData\Local\Temp\8EF7.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\8F73.tmp"C:\Users\Admin\AppData\Local\Temp\8F73.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\8FF0.tmp"C:\Users\Admin\AppData\Local\Temp\8FF0.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\904E.tmp"C:\Users\Admin\AppData\Local\Temp\904E.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\90AB.tmp"C:\Users\Admin\AppData\Local\Temp\90AB.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\90F9.tmp"C:\Users\Admin\AppData\Local\Temp\90F9.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\9157.tmp"C:\Users\Admin\AppData\Local\Temp\9157.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\91D4.tmp"C:\Users\Admin\AppData\Local\Temp\91D4.tmp"65⤵
- Executes dropped EXE
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\9231.tmp"C:\Users\Admin\AppData\Local\Temp\9231.tmp"66⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\9379.tmp"C:\Users\Admin\AppData\Local\Temp\9379.tmp"67⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\93E6.tmp"C:\Users\Admin\AppData\Local\Temp\93E6.tmp"68⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\9473.tmp"C:\Users\Admin\AppData\Local\Temp\9473.tmp"69⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\94EF.tmp"C:\Users\Admin\AppData\Local\Temp\94EF.tmp"70⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\953D.tmp"C:\Users\Admin\AppData\Local\Temp\953D.tmp"71⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\95AB.tmp"C:\Users\Admin\AppData\Local\Temp\95AB.tmp"72⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\9627.tmp"C:\Users\Admin\AppData\Local\Temp\9627.tmp"73⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\9685.tmp"C:\Users\Admin\AppData\Local\Temp\9685.tmp"74⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\96E3.tmp"C:\Users\Admin\AppData\Local\Temp\96E3.tmp"75⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\9750.tmp"C:\Users\Admin\AppData\Local\Temp\9750.tmp"76⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\97DC.tmp"C:\Users\Admin\AppData\Local\Temp\97DC.tmp"77⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\9849.tmp"C:\Users\Admin\AppData\Local\Temp\9849.tmp"78⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\98B7.tmp"C:\Users\Admin\AppData\Local\Temp\98B7.tmp"79⤵PID:268
-
C:\Users\Admin\AppData\Local\Temp\9924.tmp"C:\Users\Admin\AppData\Local\Temp\9924.tmp"80⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\9981.tmp"C:\Users\Admin\AppData\Local\Temp\9981.tmp"81⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\99EF.tmp"C:\Users\Admin\AppData\Local\Temp\99EF.tmp"82⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"83⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"84⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\9B27.tmp"C:\Users\Admin\AppData\Local\Temp\9B27.tmp"85⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\9B94.tmp"C:\Users\Admin\AppData\Local\Temp\9B94.tmp"86⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\9C01.tmp"C:\Users\Admin\AppData\Local\Temp\9C01.tmp"87⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"88⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"89⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\9D29.tmp"C:\Users\Admin\AppData\Local\Temp\9D29.tmp"90⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\9D87.tmp"C:\Users\Admin\AppData\Local\Temp\9D87.tmp"91⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\9DF4.tmp"C:\Users\Admin\AppData\Local\Temp\9DF4.tmp"92⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\9E71.tmp"C:\Users\Admin\AppData\Local\Temp\9E71.tmp"93⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\9EEE.tmp"C:\Users\Admin\AppData\Local\Temp\9EEE.tmp"94⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\9F6B.tmp"C:\Users\Admin\AppData\Local\Temp\9F6B.tmp"95⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\9FD8.tmp"C:\Users\Admin\AppData\Local\Temp\9FD8.tmp"96⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\A055.tmp"C:\Users\Admin\AppData\Local\Temp\A055.tmp"97⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\A0C2.tmp"C:\Users\Admin\AppData\Local\Temp\A0C2.tmp"98⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\A13F.tmp"C:\Users\Admin\AppData\Local\Temp\A13F.tmp"99⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\A1BB.tmp"C:\Users\Admin\AppData\Local\Temp\A1BB.tmp"100⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\A238.tmp"C:\Users\Admin\AppData\Local\Temp\A238.tmp"101⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\A2A5.tmp"C:\Users\Admin\AppData\Local\Temp\A2A5.tmp"102⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\A322.tmp"C:\Users\Admin\AppData\Local\Temp\A322.tmp"103⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\A370.tmp"C:\Users\Admin\AppData\Local\Temp\A370.tmp"104⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\A3ED.tmp"C:\Users\Admin\AppData\Local\Temp\A3ED.tmp"105⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\A44B.tmp"C:\Users\Admin\AppData\Local\Temp\A44B.tmp"106⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\A4A8.tmp"C:\Users\Admin\AppData\Local\Temp\A4A8.tmp"107⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\A515.tmp"C:\Users\Admin\AppData\Local\Temp\A515.tmp"108⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\A592.tmp"C:\Users\Admin\AppData\Local\Temp\A592.tmp"109⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\A5FF.tmp"C:\Users\Admin\AppData\Local\Temp\A5FF.tmp"110⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\A67C.tmp"C:\Users\Admin\AppData\Local\Temp\A67C.tmp"111⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\A6F9.tmp"C:\Users\Admin\AppData\Local\Temp\A6F9.tmp"112⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\A7C4.tmp"C:\Users\Admin\AppData\Local\Temp\A7C4.tmp"113⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\A821.tmp"C:\Users\Admin\AppData\Local\Temp\A821.tmp"114⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\A88F.tmp"C:\Users\Admin\AppData\Local\Temp\A88F.tmp"115⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\A8EC.tmp"C:\Users\Admin\AppData\Local\Temp\A8EC.tmp"116⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\A959.tmp"C:\Users\Admin\AppData\Local\Temp\A959.tmp"117⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\A9C7.tmp"C:\Users\Admin\AppData\Local\Temp\A9C7.tmp"118⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\AA34.tmp"C:\Users\Admin\AppData\Local\Temp\AA34.tmp"119⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\AAA1.tmp"C:\Users\Admin\AppData\Local\Temp\AAA1.tmp"120⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\AB0E.tmp"C:\Users\Admin\AppData\Local\Temp\AB0E.tmp"121⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\AB7B.tmp"C:\Users\Admin\AppData\Local\Temp\AB7B.tmp"122⤵PID:2580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-