Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
09/01/2024, 06:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-01-08_6fe69b3d46c8aff6675c2ef3295d47f7_mafia.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-01-08_6fe69b3d46c8aff6675c2ef3295d47f7_mafia.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
2024-01-08_6fe69b3d46c8aff6675c2ef3295d47f7_mafia.exe
-
Size
486KB
-
MD5
6fe69b3d46c8aff6675c2ef3295d47f7
-
SHA1
2de883e72b3c1f584bc0b8f5756a54e63609db94
-
SHA256
391701d16083fb059c322bb2fbf8d85442dc33db8642bcb6a09905e763b00934
-
SHA512
782035954f122ba2c8b588e9dee93d7f57ebbde6a1116e1c518bcd81dabe2902f90d0632222525377210c55301301e5ee8eec94eb1986e9c93a314147a03ae85
-
SSDEEP
12288:/U5rCOTeiDbSjIs7+9hL76kzOBt3L4nBhZypKNZ:/UQOJDHY+w1bL4nBhZysN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2608 8D9F.tmp 2396 8E1C.tmp 2660 8F16.tmp 2808 902F.tmp 2656 9147.tmp 804 9222.tmp 2556 92BE.tmp 2668 9473.tmp 2644 950F.tmp 2592 95E9.tmp 2580 96A4.tmp 1016 977F.tmp 1496 982A.tmp 868 9905.tmp 1856 99C0.tmp 2516 9A4C.tmp 2828 9B65.tmp 2872 9C3F.tmp 1764 9CEB.tmp 756 9DE5.tmp 1548 9EBF.tmp 1952 A0D1.tmp 2968 A17D.tmp 1992 A1EA.tmp 1796 A238.tmp 1812 A2B5.tmp 1820 A332.tmp 1932 A38F.tmp 2956 A41C.tmp 760 A499.tmp 1040 A525.tmp 2256 A5A2.tmp 3048 A5FF.tmp 380 A66D.tmp 2096 A6DA.tmp 2172 A737.tmp 1136 A7B4.tmp 1848 A812.tmp 1860 A87F.tmp 1636 A8EC.tmp 2416 A94A.tmp 1556 A9C7.tmp 2264 AA34.tmp 1336 AAA1.tmp 772 AB0E.tmp 2360 AB7B.tmp 2324 ABE9.tmp 2496 AC75.tmp 620 ACF2.tmp 2904 AD6F.tmp 2288 ADEB.tmp 1520 AE59.tmp 1112 AEC6.tmp 1648 AF33.tmp 1592 AFB0.tmp 2284 B02D.tmp 1052 B09A.tmp 3008 B107.tmp 2672 B184.tmp 2752 B1E1.tmp 2660 B26E.tmp 2676 B2FA.tmp 2800 B387.tmp 2656 B413.tmp -
Loads dropped DLL 64 IoCs
pid Process 1912 2024-01-08_6fe69b3d46c8aff6675c2ef3295d47f7_mafia.exe 2608 8D9F.tmp 2396 8E1C.tmp 2660 8F16.tmp 2808 902F.tmp 2656 9147.tmp 804 9222.tmp 2556 92BE.tmp 2668 9473.tmp 2644 950F.tmp 2592 95E9.tmp 2580 96A4.tmp 1016 977F.tmp 1496 982A.tmp 868 9905.tmp 1856 99C0.tmp 2516 9A4C.tmp 2828 9B65.tmp 2872 9C3F.tmp 1764 9CEB.tmp 756 9DE5.tmp 1548 9EBF.tmp 1952 A0D1.tmp 2968 A17D.tmp 1992 A1EA.tmp 1796 A238.tmp 1812 A2B5.tmp 1820 A332.tmp 1932 A38F.tmp 2956 A41C.tmp 760 A499.tmp 1040 A525.tmp 2256 A5A2.tmp 3048 A5FF.tmp 380 A66D.tmp 2096 A6DA.tmp 2172 A737.tmp 1136 A7B4.tmp 1848 A812.tmp 1860 A87F.tmp 1636 A8EC.tmp 2416 A94A.tmp 1556 A9C7.tmp 2264 AA34.tmp 1336 AAA1.tmp 772 AB0E.tmp 2360 AB7B.tmp 2324 ABE9.tmp 2496 AC75.tmp 620 ACF2.tmp 2904 AD6F.tmp 2288 ADEB.tmp 1520 AE59.tmp 1112 AEC6.tmp 1648 AF33.tmp 1592 AFB0.tmp 2284 B02D.tmp 1052 B09A.tmp 3008 B107.tmp 2672 B184.tmp 2752 B1E1.tmp 2660 B26E.tmp 2676 B2FA.tmp 2800 B387.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1912 wrote to memory of 2608 1912 2024-01-08_6fe69b3d46c8aff6675c2ef3295d47f7_mafia.exe 28 PID 1912 wrote to memory of 2608 1912 2024-01-08_6fe69b3d46c8aff6675c2ef3295d47f7_mafia.exe 28 PID 1912 wrote to memory of 2608 1912 2024-01-08_6fe69b3d46c8aff6675c2ef3295d47f7_mafia.exe 28 PID 1912 wrote to memory of 2608 1912 2024-01-08_6fe69b3d46c8aff6675c2ef3295d47f7_mafia.exe 28 PID 2608 wrote to memory of 2396 2608 8D9F.tmp 29 PID 2608 wrote to memory of 2396 2608 8D9F.tmp 29 PID 2608 wrote to memory of 2396 2608 8D9F.tmp 29 PID 2608 wrote to memory of 2396 2608 8D9F.tmp 29 PID 2396 wrote to memory of 2660 2396 8E1C.tmp 30 PID 2396 wrote to memory of 2660 2396 8E1C.tmp 30 PID 2396 wrote to memory of 2660 2396 8E1C.tmp 30 PID 2396 wrote to memory of 2660 2396 8E1C.tmp 30 PID 2660 wrote to memory of 2808 2660 8F16.tmp 31 PID 2660 wrote to memory of 2808 2660 8F16.tmp 31 PID 2660 wrote to memory of 2808 2660 8F16.tmp 31 PID 2660 wrote to memory of 2808 2660 8F16.tmp 31 PID 2808 wrote to memory of 2656 2808 902F.tmp 32 PID 2808 wrote to memory of 2656 2808 902F.tmp 32 PID 2808 wrote to memory of 2656 2808 902F.tmp 32 PID 2808 wrote to memory of 2656 2808 902F.tmp 32 PID 2656 wrote to memory of 804 2656 9147.tmp 33 PID 2656 wrote to memory of 804 2656 9147.tmp 33 PID 2656 wrote to memory of 804 2656 9147.tmp 33 PID 2656 wrote to memory of 804 2656 9147.tmp 33 PID 804 wrote to memory of 2556 804 9222.tmp 34 PID 804 wrote to memory of 2556 804 9222.tmp 34 PID 804 wrote to memory of 2556 804 9222.tmp 34 PID 804 wrote to memory of 2556 804 9222.tmp 34 PID 2556 wrote to memory of 2668 2556 92BE.tmp 35 PID 2556 wrote to memory of 2668 2556 92BE.tmp 35 PID 2556 wrote to memory of 2668 2556 92BE.tmp 35 PID 2556 wrote to memory of 2668 2556 92BE.tmp 35 PID 2668 wrote to memory of 2644 2668 9473.tmp 36 PID 2668 wrote to memory of 2644 2668 9473.tmp 36 PID 2668 wrote to memory of 2644 2668 9473.tmp 36 PID 2668 wrote to memory of 2644 2668 9473.tmp 36 PID 2644 wrote to memory of 2592 2644 950F.tmp 37 PID 2644 wrote to memory of 2592 2644 950F.tmp 37 PID 2644 wrote to memory of 2592 2644 950F.tmp 37 PID 2644 wrote to memory of 2592 2644 950F.tmp 37 PID 2592 wrote to memory of 2580 2592 95E9.tmp 38 PID 2592 wrote to memory of 2580 2592 95E9.tmp 38 PID 2592 wrote to memory of 2580 2592 95E9.tmp 38 PID 2592 wrote to memory of 2580 2592 95E9.tmp 38 PID 2580 wrote to memory of 1016 2580 96A4.tmp 39 PID 2580 wrote to memory of 1016 2580 96A4.tmp 39 PID 2580 wrote to memory of 1016 2580 96A4.tmp 39 PID 2580 wrote to memory of 1016 2580 96A4.tmp 39 PID 1016 wrote to memory of 1496 1016 977F.tmp 40 PID 1016 wrote to memory of 1496 1016 977F.tmp 40 PID 1016 wrote to memory of 1496 1016 977F.tmp 40 PID 1016 wrote to memory of 1496 1016 977F.tmp 40 PID 1496 wrote to memory of 868 1496 982A.tmp 41 PID 1496 wrote to memory of 868 1496 982A.tmp 41 PID 1496 wrote to memory of 868 1496 982A.tmp 41 PID 1496 wrote to memory of 868 1496 982A.tmp 41 PID 868 wrote to memory of 1856 868 9905.tmp 42 PID 868 wrote to memory of 1856 868 9905.tmp 42 PID 868 wrote to memory of 1856 868 9905.tmp 42 PID 868 wrote to memory of 1856 868 9905.tmp 42 PID 1856 wrote to memory of 2516 1856 99C0.tmp 43 PID 1856 wrote to memory of 2516 1856 99C0.tmp 43 PID 1856 wrote to memory of 2516 1856 99C0.tmp 43 PID 1856 wrote to memory of 2516 1856 99C0.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-08_6fe69b3d46c8aff6675c2ef3295d47f7_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-08_6fe69b3d46c8aff6675c2ef3295d47f7_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\8D9F.tmp"C:\Users\Admin\AppData\Local\Temp\8D9F.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\8E1C.tmp"C:\Users\Admin\AppData\Local\Temp\8E1C.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\8F16.tmp"C:\Users\Admin\AppData\Local\Temp\8F16.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\902F.tmp"C:\Users\Admin\AppData\Local\Temp\902F.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\9147.tmp"C:\Users\Admin\AppData\Local\Temp\9147.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\9222.tmp"C:\Users\Admin\AppData\Local\Temp\9222.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Users\Admin\AppData\Local\Temp\92BE.tmp"C:\Users\Admin\AppData\Local\Temp\92BE.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\9473.tmp"C:\Users\Admin\AppData\Local\Temp\9473.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\950F.tmp"C:\Users\Admin\AppData\Local\Temp\950F.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\95E9.tmp"C:\Users\Admin\AppData\Local\Temp\95E9.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\96A4.tmp"C:\Users\Admin\AppData\Local\Temp\96A4.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\977F.tmp"C:\Users\Admin\AppData\Local\Temp\977F.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\982A.tmp"C:\Users\Admin\AppData\Local\Temp\982A.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\9905.tmp"C:\Users\Admin\AppData\Local\Temp\9905.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Users\Admin\AppData\Local\Temp\99C0.tmp"C:\Users\Admin\AppData\Local\Temp\99C0.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\9B65.tmp"C:\Users\Admin\AppData\Local\Temp\9B65.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\9C3F.tmp"C:\Users\Admin\AppData\Local\Temp\9C3F.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\9CEB.tmp"C:\Users\Admin\AppData\Local\Temp\9CEB.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\9DE5.tmp"C:\Users\Admin\AppData\Local\Temp\9DE5.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:756 -
C:\Users\Admin\AppData\Local\Temp\9EBF.tmp"C:\Users\Admin\AppData\Local\Temp\9EBF.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\A0D1.tmp"C:\Users\Admin\AppData\Local\Temp\A0D1.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\A17D.tmp"C:\Users\Admin\AppData\Local\Temp\A17D.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\A1EA.tmp"C:\Users\Admin\AppData\Local\Temp\A1EA.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\A238.tmp"C:\Users\Admin\AppData\Local\Temp\A238.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\A2B5.tmp"C:\Users\Admin\AppData\Local\Temp\A2B5.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\A332.tmp"C:\Users\Admin\AppData\Local\Temp\A332.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\A38F.tmp"C:\Users\Admin\AppData\Local\Temp\A38F.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\A41C.tmp"C:\Users\Admin\AppData\Local\Temp\A41C.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\A499.tmp"C:\Users\Admin\AppData\Local\Temp\A499.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:760 -
C:\Users\Admin\AppData\Local\Temp\A525.tmp"C:\Users\Admin\AppData\Local\Temp\A525.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\A5A2.tmp"C:\Users\Admin\AppData\Local\Temp\A5A2.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\A5FF.tmp"C:\Users\Admin\AppData\Local\Temp\A5FF.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\A66D.tmp"C:\Users\Admin\AppData\Local\Temp\A66D.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:380 -
C:\Users\Admin\AppData\Local\Temp\A6DA.tmp"C:\Users\Admin\AppData\Local\Temp\A6DA.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\A737.tmp"C:\Users\Admin\AppData\Local\Temp\A737.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\A7B4.tmp"C:\Users\Admin\AppData\Local\Temp\A7B4.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\A812.tmp"C:\Users\Admin\AppData\Local\Temp\A812.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\A87F.tmp"C:\Users\Admin\AppData\Local\Temp\A87F.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\A8EC.tmp"C:\Users\Admin\AppData\Local\Temp\A8EC.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\A94A.tmp"C:\Users\Admin\AppData\Local\Temp\A94A.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\A9C7.tmp"C:\Users\Admin\AppData\Local\Temp\A9C7.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\AA34.tmp"C:\Users\Admin\AppData\Local\Temp\AA34.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\AAA1.tmp"C:\Users\Admin\AppData\Local\Temp\AAA1.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\AB0E.tmp"C:\Users\Admin\AppData\Local\Temp\AB0E.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:772 -
C:\Users\Admin\AppData\Local\Temp\AB7B.tmp"C:\Users\Admin\AppData\Local\Temp\AB7B.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\ABE9.tmp"C:\Users\Admin\AppData\Local\Temp\ABE9.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\AC75.tmp"C:\Users\Admin\AppData\Local\Temp\AC75.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\ACF2.tmp"C:\Users\Admin\AppData\Local\Temp\ACF2.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:620 -
C:\Users\Admin\AppData\Local\Temp\AD6F.tmp"C:\Users\Admin\AppData\Local\Temp\AD6F.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\ADEB.tmp"C:\Users\Admin\AppData\Local\Temp\ADEB.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\AE59.tmp"C:\Users\Admin\AppData\Local\Temp\AE59.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\AEC6.tmp"C:\Users\Admin\AppData\Local\Temp\AEC6.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\AF33.tmp"C:\Users\Admin\AppData\Local\Temp\AF33.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\AFB0.tmp"C:\Users\Admin\AppData\Local\Temp\AFB0.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\B02D.tmp"C:\Users\Admin\AppData\Local\Temp\B02D.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\B09A.tmp"C:\Users\Admin\AppData\Local\Temp\B09A.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\B107.tmp"C:\Users\Admin\AppData\Local\Temp\B107.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\B184.tmp"C:\Users\Admin\AppData\Local\Temp\B184.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\B1E1.tmp"C:\Users\Admin\AppData\Local\Temp\B1E1.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\B26E.tmp"C:\Users\Admin\AppData\Local\Temp\B26E.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\B2FA.tmp"C:\Users\Admin\AppData\Local\Temp\B2FA.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\B387.tmp"C:\Users\Admin\AppData\Local\Temp\B387.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\B413.tmp"C:\Users\Admin\AppData\Local\Temp\B413.tmp"65⤵
- Executes dropped EXE
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\B480.tmp"C:\Users\Admin\AppData\Local\Temp\B480.tmp"66⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\B5D7.tmp"C:\Users\Admin\AppData\Local\Temp\B5D7.tmp"67⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\B683.tmp"C:\Users\Admin\AppData\Local\Temp\B683.tmp"68⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\B73E.tmp"C:\Users\Admin\AppData\Local\Temp\B73E.tmp"69⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\B7BB.tmp"C:\Users\Admin\AppData\Local\Temp\B7BB.tmp"70⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\B828.tmp"C:\Users\Admin\AppData\Local\Temp\B828.tmp"71⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\B895.tmp"C:\Users\Admin\AppData\Local\Temp\B895.tmp"72⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\B912.tmp"C:\Users\Admin\AppData\Local\Temp\B912.tmp"73⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\B97F.tmp"C:\Users\Admin\AppData\Local\Temp\B97F.tmp"74⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\BA1B.tmp"C:\Users\Admin\AppData\Local\Temp\BA1B.tmp"75⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\BA79.tmp"C:\Users\Admin\AppData\Local\Temp\BA79.tmp"76⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\BAF6.tmp"C:\Users\Admin\AppData\Local\Temp\BAF6.tmp"77⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\BB73.tmp"C:\Users\Admin\AppData\Local\Temp\BB73.tmp"78⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\BBD0.tmp"C:\Users\Admin\AppData\Local\Temp\BBD0.tmp"79⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\BC4D.tmp"C:\Users\Admin\AppData\Local\Temp\BC4D.tmp"80⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\BCE9.tmp"C:\Users\Admin\AppData\Local\Temp\BCE9.tmp"81⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\BD75.tmp"C:\Users\Admin\AppData\Local\Temp\BD75.tmp"82⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\BE02.tmp"C:\Users\Admin\AppData\Local\Temp\BE02.tmp"83⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\BE8E.tmp"C:\Users\Admin\AppData\Local\Temp\BE8E.tmp"84⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\BF0B.tmp"C:\Users\Admin\AppData\Local\Temp\BF0B.tmp"85⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\BF88.tmp"C:\Users\Admin\AppData\Local\Temp\BF88.tmp"86⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\C005.tmp"C:\Users\Admin\AppData\Local\Temp\C005.tmp"87⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\C081.tmp"C:\Users\Admin\AppData\Local\Temp\C081.tmp"88⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\C0EF.tmp"C:\Users\Admin\AppData\Local\Temp\C0EF.tmp"89⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\C15C.tmp"C:\Users\Admin\AppData\Local\Temp\C15C.tmp"90⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"91⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\C275.tmp"C:\Users\Admin\AppData\Local\Temp\C275.tmp"92⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\C2F1.tmp"C:\Users\Admin\AppData\Local\Temp\C2F1.tmp"93⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\C35F.tmp"C:\Users\Admin\AppData\Local\Temp\C35F.tmp"94⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\C3BC.tmp"C:\Users\Admin\AppData\Local\Temp\C3BC.tmp"95⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\C429.tmp"C:\Users\Admin\AppData\Local\Temp\C429.tmp"96⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\C4A6.tmp"C:\Users\Admin\AppData\Local\Temp\C4A6.tmp"97⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\C523.tmp"C:\Users\Admin\AppData\Local\Temp\C523.tmp"98⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\C5A0.tmp"C:\Users\Admin\AppData\Local\Temp\C5A0.tmp"99⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\C5FD.tmp"C:\Users\Admin\AppData\Local\Temp\C5FD.tmp"100⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\C67A.tmp"C:\Users\Admin\AppData\Local\Temp\C67A.tmp"101⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\C6E7.tmp"C:\Users\Admin\AppData\Local\Temp\C6E7.tmp"102⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\C764.tmp"C:\Users\Admin\AppData\Local\Temp\C764.tmp"103⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\C7D1.tmp"C:\Users\Admin\AppData\Local\Temp\C7D1.tmp"104⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\C84E.tmp"C:\Users\Admin\AppData\Local\Temp\C84E.tmp"105⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\C8CB.tmp"C:\Users\Admin\AppData\Local\Temp\C8CB.tmp"106⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\C948.tmp"C:\Users\Admin\AppData\Local\Temp\C948.tmp"107⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\C9A5.tmp"C:\Users\Admin\AppData\Local\Temp\C9A5.tmp"108⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\CA13.tmp"C:\Users\Admin\AppData\Local\Temp\CA13.tmp"109⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\CA70.tmp"C:\Users\Admin\AppData\Local\Temp\CA70.tmp"110⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\CBB8.tmp"C:\Users\Admin\AppData\Local\Temp\CBB8.tmp"111⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\CC25.tmp"C:\Users\Admin\AppData\Local\Temp\CC25.tmp"112⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\CC83.tmp"C:\Users\Admin\AppData\Local\Temp\CC83.tmp"113⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\CD1F.tmp"C:\Users\Admin\AppData\Local\Temp\CD1F.tmp"114⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\CD8C.tmp"C:\Users\Admin\AppData\Local\Temp\CD8C.tmp"115⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\CE18.tmp"C:\Users\Admin\AppData\Local\Temp\CE18.tmp"116⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\CE85.tmp"C:\Users\Admin\AppData\Local\Temp\CE85.tmp"117⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\CEF3.tmp"C:\Users\Admin\AppData\Local\Temp\CEF3.tmp"118⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\CF50.tmp"C:\Users\Admin\AppData\Local\Temp\CF50.tmp"119⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\CFAE.tmp"C:\Users\Admin\AppData\Local\Temp\CFAE.tmp"120⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\D01B.tmp"C:\Users\Admin\AppData\Local\Temp\D01B.tmp"121⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\D098.tmp"C:\Users\Admin\AppData\Local\Temp\D098.tmp"122⤵PID:2088
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-