Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22/01/2024, 17:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-01-22_c9bd2a28f72621f08e45e64cc9567c38_mafia.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-01-22_c9bd2a28f72621f08e45e64cc9567c38_mafia.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
2024-01-22_c9bd2a28f72621f08e45e64cc9567c38_mafia.exe
-
Size
486KB
-
MD5
c9bd2a28f72621f08e45e64cc9567c38
-
SHA1
c938626d749b48aa708f82292383a46982fbf46f
-
SHA256
ae056b14ec7bd4f6d0ae478e1650d87559849862f596c324025e1d98700abd51
-
SHA512
8c54be794d800bf04250118a21d3b141d1784556aeda6ee26b965dbffe4f64e25b875adcae7f8e86f450b832e276d66da076e34870281ddf6a647935ed25ca91
-
SSDEEP
12288:/U5rCOTeiDyWLqhGChyO7PbGeojTyO18cNPoVNZ:/UQOJDgwN9bjBteVN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2332 3F42.tmp 2652 3FBE.tmp 2704 40A8.tmp 2780 4135.tmp 2964 41F0.tmp 2752 429C.tmp 2884 4318.tmp 2696 4376.tmp 2552 4441.tmp 2636 44CD.tmp 2396 4569.tmp 1864 45E6.tmp 2660 46FF.tmp 2924 477C.tmp 2932 4808.tmp 2944 48C3.tmp 1232 495F.tmp 756 49CC.tmp 2488 4A97.tmp 592 4B43.tmp 884 4BC0.tmp 1588 4CE8.tmp 2544 4DA3.tmp 1636 4E4F.tmp 1540 4EAC.tmp 1528 4F1A.tmp 2292 4F87.tmp 1080 4FF4.tmp 1224 5052.tmp 2016 51A9.tmp 1944 5274.tmp 2368 531F.tmp 2232 537D.tmp 1764 5419.tmp 2452 5476.tmp 760 5522.tmp 396 559F.tmp 2444 561C.tmp 1924 566A.tmp 1660 56B8.tmp 1840 5715.tmp 1624 5782.tmp 2156 57F0.tmp 1088 586C.tmp 1076 58CA.tmp 656 5937.tmp 1708 5995.tmp 1512 5A02.tmp 548 5A6F.tmp 1172 5ADC.tmp 2528 5B4A.tmp 1228 5BB7.tmp 2472 5C24.tmp 1256 5C91.tmp 1608 5CEF.tmp 1420 5D5C.tmp 2132 5DAA.tmp 2412 5E27.tmp 2968 5E84.tmp 2684 5F01.tmp 2692 5F7E.tmp 2852 5FEB.tmp 2840 6058.tmp 2752 60D5.tmp -
Loads dropped DLL 64 IoCs
pid Process 2312 2024-01-22_c9bd2a28f72621f08e45e64cc9567c38_mafia.exe 2332 3F42.tmp 2652 3FBE.tmp 2704 40A8.tmp 2780 4135.tmp 2964 41F0.tmp 2752 429C.tmp 2884 4318.tmp 2696 4376.tmp 2552 4441.tmp 2636 44CD.tmp 2396 4569.tmp 1864 45E6.tmp 2660 46FF.tmp 2924 477C.tmp 2932 4808.tmp 2944 48C3.tmp 1232 495F.tmp 756 49CC.tmp 2488 4A97.tmp 592 4B43.tmp 884 4BC0.tmp 1588 4CE8.tmp 2544 4DA3.tmp 1636 4E4F.tmp 1540 4EAC.tmp 1528 4F1A.tmp 2292 4F87.tmp 1080 4FF4.tmp 1224 5052.tmp 2016 51A9.tmp 1944 5274.tmp 2368 531F.tmp 2232 537D.tmp 1764 5419.tmp 2452 5476.tmp 760 5522.tmp 396 559F.tmp 2444 561C.tmp 1924 566A.tmp 1660 56B8.tmp 1840 5715.tmp 1624 5782.tmp 2156 57F0.tmp 1088 586C.tmp 1076 58CA.tmp 656 5937.tmp 1708 5995.tmp 1512 5A02.tmp 548 5A6F.tmp 1172 5ADC.tmp 2528 5B4A.tmp 1228 5BB7.tmp 2472 5C24.tmp 1256 5C91.tmp 1608 5CEF.tmp 1420 5D5C.tmp 2132 5DAA.tmp 2412 5E27.tmp 2968 5E84.tmp 2684 5F01.tmp 2692 5F7E.tmp 2852 5FEB.tmp 2840 6058.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2312 wrote to memory of 2332 2312 2024-01-22_c9bd2a28f72621f08e45e64cc9567c38_mafia.exe 28 PID 2312 wrote to memory of 2332 2312 2024-01-22_c9bd2a28f72621f08e45e64cc9567c38_mafia.exe 28 PID 2312 wrote to memory of 2332 2312 2024-01-22_c9bd2a28f72621f08e45e64cc9567c38_mafia.exe 28 PID 2312 wrote to memory of 2332 2312 2024-01-22_c9bd2a28f72621f08e45e64cc9567c38_mafia.exe 28 PID 2332 wrote to memory of 2652 2332 3F42.tmp 29 PID 2332 wrote to memory of 2652 2332 3F42.tmp 29 PID 2332 wrote to memory of 2652 2332 3F42.tmp 29 PID 2332 wrote to memory of 2652 2332 3F42.tmp 29 PID 2652 wrote to memory of 2704 2652 3FBE.tmp 30 PID 2652 wrote to memory of 2704 2652 3FBE.tmp 30 PID 2652 wrote to memory of 2704 2652 3FBE.tmp 30 PID 2652 wrote to memory of 2704 2652 3FBE.tmp 30 PID 2704 wrote to memory of 2780 2704 40A8.tmp 31 PID 2704 wrote to memory of 2780 2704 40A8.tmp 31 PID 2704 wrote to memory of 2780 2704 40A8.tmp 31 PID 2704 wrote to memory of 2780 2704 40A8.tmp 31 PID 2780 wrote to memory of 2964 2780 4135.tmp 32 PID 2780 wrote to memory of 2964 2780 4135.tmp 32 PID 2780 wrote to memory of 2964 2780 4135.tmp 32 PID 2780 wrote to memory of 2964 2780 4135.tmp 32 PID 2964 wrote to memory of 2752 2964 41F0.tmp 33 PID 2964 wrote to memory of 2752 2964 41F0.tmp 33 PID 2964 wrote to memory of 2752 2964 41F0.tmp 33 PID 2964 wrote to memory of 2752 2964 41F0.tmp 33 PID 2752 wrote to memory of 2884 2752 429C.tmp 34 PID 2752 wrote to memory of 2884 2752 429C.tmp 34 PID 2752 wrote to memory of 2884 2752 429C.tmp 34 PID 2752 wrote to memory of 2884 2752 429C.tmp 34 PID 2884 wrote to memory of 2696 2884 4318.tmp 35 PID 2884 wrote to memory of 2696 2884 4318.tmp 35 PID 2884 wrote to memory of 2696 2884 4318.tmp 35 PID 2884 wrote to memory of 2696 2884 4318.tmp 35 PID 2696 wrote to memory of 2552 2696 4376.tmp 36 PID 2696 wrote to memory of 2552 2696 4376.tmp 36 PID 2696 wrote to memory of 2552 2696 4376.tmp 36 PID 2696 wrote to memory of 2552 2696 4376.tmp 36 PID 2552 wrote to memory of 2636 2552 4441.tmp 37 PID 2552 wrote to memory of 2636 2552 4441.tmp 37 PID 2552 wrote to memory of 2636 2552 4441.tmp 37 PID 2552 wrote to memory of 2636 2552 4441.tmp 37 PID 2636 wrote to memory of 2396 2636 44CD.tmp 38 PID 2636 wrote to memory of 2396 2636 44CD.tmp 38 PID 2636 wrote to memory of 2396 2636 44CD.tmp 38 PID 2636 wrote to memory of 2396 2636 44CD.tmp 38 PID 2396 wrote to memory of 1864 2396 4569.tmp 39 PID 2396 wrote to memory of 1864 2396 4569.tmp 39 PID 2396 wrote to memory of 1864 2396 4569.tmp 39 PID 2396 wrote to memory of 1864 2396 4569.tmp 39 PID 1864 wrote to memory of 2660 1864 45E6.tmp 40 PID 1864 wrote to memory of 2660 1864 45E6.tmp 40 PID 1864 wrote to memory of 2660 1864 45E6.tmp 40 PID 1864 wrote to memory of 2660 1864 45E6.tmp 40 PID 2660 wrote to memory of 2924 2660 46FF.tmp 45 PID 2660 wrote to memory of 2924 2660 46FF.tmp 45 PID 2660 wrote to memory of 2924 2660 46FF.tmp 45 PID 2660 wrote to memory of 2924 2660 46FF.tmp 45 PID 2924 wrote to memory of 2932 2924 477C.tmp 41 PID 2924 wrote to memory of 2932 2924 477C.tmp 41 PID 2924 wrote to memory of 2932 2924 477C.tmp 41 PID 2924 wrote to memory of 2932 2924 477C.tmp 41 PID 2932 wrote to memory of 2944 2932 4808.tmp 42 PID 2932 wrote to memory of 2944 2932 4808.tmp 42 PID 2932 wrote to memory of 2944 2932 4808.tmp 42 PID 2932 wrote to memory of 2944 2932 4808.tmp 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-22_c9bd2a28f72621f08e45e64cc9567c38_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-22_c9bd2a28f72621f08e45e64cc9567c38_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\3F42.tmp"C:\Users\Admin\AppData\Local\Temp\3F42.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\3FBE.tmp"C:\Users\Admin\AppData\Local\Temp\3FBE.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\40A8.tmp"C:\Users\Admin\AppData\Local\Temp\40A8.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\4135.tmp"C:\Users\Admin\AppData\Local\Temp\4135.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\41F0.tmp"C:\Users\Admin\AppData\Local\Temp\41F0.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\429C.tmp"C:\Users\Admin\AppData\Local\Temp\429C.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\4318.tmp"C:\Users\Admin\AppData\Local\Temp\4318.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\4376.tmp"C:\Users\Admin\AppData\Local\Temp\4376.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\4441.tmp"C:\Users\Admin\AppData\Local\Temp\4441.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\44CD.tmp"C:\Users\Admin\AppData\Local\Temp\44CD.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\4569.tmp"C:\Users\Admin\AppData\Local\Temp\4569.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\45E6.tmp"C:\Users\Admin\AppData\Local\Temp\45E6.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\46FF.tmp"C:\Users\Admin\AppData\Local\Temp\46FF.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\477C.tmp"C:\Users\Admin\AppData\Local\Temp\477C.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2924
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\4808.tmp"C:\Users\Admin\AppData\Local\Temp\4808.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\48C3.tmp"C:\Users\Admin\AppData\Local\Temp\48C3.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\495F.tmp"C:\Users\Admin\AppData\Local\Temp\495F.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1232
-
-
-
C:\Users\Admin\AppData\Local\Temp\49CC.tmp"C:\Users\Admin\AppData\Local\Temp\49CC.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:756 -
C:\Users\Admin\AppData\Local\Temp\4A97.tmp"C:\Users\Admin\AppData\Local\Temp\4A97.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\4B43.tmp"C:\Users\Admin\AppData\Local\Temp\4B43.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:592 -
C:\Users\Admin\AppData\Local\Temp\4BC0.tmp"C:\Users\Admin\AppData\Local\Temp\4BC0.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:884 -
C:\Users\Admin\AppData\Local\Temp\4CE8.tmp"C:\Users\Admin\AppData\Local\Temp\4CE8.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\4FF4.tmp"C:\Users\Admin\AppData\Local\Temp\4FF4.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\51A9.tmp"C:\Users\Admin\AppData\Local\Temp\51A9.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\5274.tmp"C:\Users\Admin\AppData\Local\Temp\5274.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\531F.tmp"C:\Users\Admin\AppData\Local\Temp\531F.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\537D.tmp"C:\Users\Admin\AppData\Local\Temp\537D.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\5419.tmp"C:\Users\Admin\AppData\Local\Temp\5419.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\5476.tmp"C:\Users\Admin\AppData\Local\Temp\5476.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\5522.tmp"C:\Users\Admin\AppData\Local\Temp\5522.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:760 -
C:\Users\Admin\AppData\Local\Temp\559F.tmp"C:\Users\Admin\AppData\Local\Temp\559F.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:396 -
C:\Users\Admin\AppData\Local\Temp\561C.tmp"C:\Users\Admin\AppData\Local\Temp\561C.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\566A.tmp"C:\Users\Admin\AppData\Local\Temp\566A.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\56B8.tmp"C:\Users\Admin\AppData\Local\Temp\56B8.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\5715.tmp"C:\Users\Admin\AppData\Local\Temp\5715.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\5782.tmp"C:\Users\Admin\AppData\Local\Temp\5782.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\57F0.tmp"C:\Users\Admin\AppData\Local\Temp\57F0.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\586C.tmp"C:\Users\Admin\AppData\Local\Temp\586C.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\58CA.tmp"C:\Users\Admin\AppData\Local\Temp\58CA.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\5937.tmp"C:\Users\Admin\AppData\Local\Temp\5937.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:656 -
C:\Users\Admin\AppData\Local\Temp\5995.tmp"C:\Users\Admin\AppData\Local\Temp\5995.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\5A02.tmp"C:\Users\Admin\AppData\Local\Temp\5A02.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:548 -
C:\Users\Admin\AppData\Local\Temp\5ADC.tmp"C:\Users\Admin\AppData\Local\Temp\5ADC.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\5B4A.tmp"C:\Users\Admin\AppData\Local\Temp\5B4A.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\5BB7.tmp"C:\Users\Admin\AppData\Local\Temp\5BB7.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\5C24.tmp"C:\Users\Admin\AppData\Local\Temp\5C24.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\5C91.tmp"C:\Users\Admin\AppData\Local\Temp\5C91.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\5CEF.tmp"C:\Users\Admin\AppData\Local\Temp\5CEF.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\5D5C.tmp"C:\Users\Admin\AppData\Local\Temp\5D5C.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\5DAA.tmp"C:\Users\Admin\AppData\Local\Temp\5DAA.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\5E27.tmp"C:\Users\Admin\AppData\Local\Temp\5E27.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\5E84.tmp"C:\Users\Admin\AppData\Local\Temp\5E84.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\5F01.tmp"C:\Users\Admin\AppData\Local\Temp\5F01.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\5F7E.tmp"C:\Users\Admin\AppData\Local\Temp\5F7E.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\5FEB.tmp"C:\Users\Admin\AppData\Local\Temp\5FEB.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\6058.tmp"C:\Users\Admin\AppData\Local\Temp\6058.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\60D5.tmp"C:\Users\Admin\AppData\Local\Temp\60D5.tmp"47⤵
- Executes dropped EXE
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\6133.tmp"C:\Users\Admin\AppData\Local\Temp\6133.tmp"48⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\6190.tmp"C:\Users\Admin\AppData\Local\Temp\6190.tmp"49⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\61FE.tmp"C:\Users\Admin\AppData\Local\Temp\61FE.tmp"50⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\626B.tmp"C:\Users\Admin\AppData\Local\Temp\626B.tmp"51⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\62D8.tmp"C:\Users\Admin\AppData\Local\Temp\62D8.tmp"52⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\6345.tmp"C:\Users\Admin\AppData\Local\Temp\6345.tmp"53⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\63B3.tmp"C:\Users\Admin\AppData\Local\Temp\63B3.tmp"54⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\642F.tmp"C:\Users\Admin\AppData\Local\Temp\642F.tmp"55⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\649D.tmp"C:\Users\Admin\AppData\Local\Temp\649D.tmp"56⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\650A.tmp"C:\Users\Admin\AppData\Local\Temp\650A.tmp"57⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\6577.tmp"C:\Users\Admin\AppData\Local\Temp\6577.tmp"58⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\6680.tmp"C:\Users\Admin\AppData\Local\Temp\6680.tmp"59⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\671C.tmp"C:\Users\Admin\AppData\Local\Temp\671C.tmp"60⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\6789.tmp"C:\Users\Admin\AppData\Local\Temp\6789.tmp"61⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\67E7.tmp"C:\Users\Admin\AppData\Local\Temp\67E7.tmp"62⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\6854.tmp"C:\Users\Admin\AppData\Local\Temp\6854.tmp"63⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\68B2.tmp"C:\Users\Admin\AppData\Local\Temp\68B2.tmp"64⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\690F.tmp"C:\Users\Admin\AppData\Local\Temp\690F.tmp"65⤵PID:268
-
C:\Users\Admin\AppData\Local\Temp\696D.tmp"C:\Users\Admin\AppData\Local\Temp\696D.tmp"66⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\69DA.tmp"C:\Users\Admin\AppData\Local\Temp\69DA.tmp"67⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\6A57.tmp"C:\Users\Admin\AppData\Local\Temp\6A57.tmp"68⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\6AD4.tmp"C:\Users\Admin\AppData\Local\Temp\6AD4.tmp"69⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\6B51.tmp"C:\Users\Admin\AppData\Local\Temp\6B51.tmp"70⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\6BBE.tmp"C:\Users\Admin\AppData\Local\Temp\6BBE.tmp"71⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\6C2B.tmp"C:\Users\Admin\AppData\Local\Temp\6C2B.tmp"72⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\6C89.tmp"C:\Users\Admin\AppData\Local\Temp\6C89.tmp"73⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\6D05.tmp"C:\Users\Admin\AppData\Local\Temp\6D05.tmp"74⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\6D73.tmp"C:\Users\Admin\AppData\Local\Temp\6D73.tmp"75⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\6DD0.tmp"C:\Users\Admin\AppData\Local\Temp\6DD0.tmp"76⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\6E4D.tmp"C:\Users\Admin\AppData\Local\Temp\6E4D.tmp"77⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\6EBA.tmp"C:\Users\Admin\AppData\Local\Temp\6EBA.tmp"78⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\6F27.tmp"C:\Users\Admin\AppData\Local\Temp\6F27.tmp"79⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\6F85.tmp"C:\Users\Admin\AppData\Local\Temp\6F85.tmp"80⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\6FF2.tmp"C:\Users\Admin\AppData\Local\Temp\6FF2.tmp"81⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\705F.tmp"C:\Users\Admin\AppData\Local\Temp\705F.tmp"82⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\70DC.tmp"C:\Users\Admin\AppData\Local\Temp\70DC.tmp"83⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\7149.tmp"C:\Users\Admin\AppData\Local\Temp\7149.tmp"84⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\71A7.tmp"C:\Users\Admin\AppData\Local\Temp\71A7.tmp"85⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\7214.tmp"C:\Users\Admin\AppData\Local\Temp\7214.tmp"86⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\7281.tmp"C:\Users\Admin\AppData\Local\Temp\7281.tmp"87⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\72CF.tmp"C:\Users\Admin\AppData\Local\Temp\72CF.tmp"88⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\733D.tmp"C:\Users\Admin\AppData\Local\Temp\733D.tmp"89⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\73B9.tmp"C:\Users\Admin\AppData\Local\Temp\73B9.tmp"90⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\7427.tmp"C:\Users\Admin\AppData\Local\Temp\7427.tmp"91⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\7494.tmp"C:\Users\Admin\AppData\Local\Temp\7494.tmp"92⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\7501.tmp"C:\Users\Admin\AppData\Local\Temp\7501.tmp"93⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"94⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\75DB.tmp"C:\Users\Admin\AppData\Local\Temp\75DB.tmp"95⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\7639.tmp"C:\Users\Admin\AppData\Local\Temp\7639.tmp"96⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\76A6.tmp"C:\Users\Admin\AppData\Local\Temp\76A6.tmp"97⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\7704.tmp"C:\Users\Admin\AppData\Local\Temp\7704.tmp"98⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\7771.tmp"C:\Users\Admin\AppData\Local\Temp\7771.tmp"99⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\77DE.tmp"C:\Users\Admin\AppData\Local\Temp\77DE.tmp"100⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\784B.tmp"C:\Users\Admin\AppData\Local\Temp\784B.tmp"101⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\78A9.tmp"C:\Users\Admin\AppData\Local\Temp\78A9.tmp"102⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\7926.tmp"C:\Users\Admin\AppData\Local\Temp\7926.tmp"103⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\7993.tmp"C:\Users\Admin\AppData\Local\Temp\7993.tmp"104⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\7A10.tmp"C:\Users\Admin\AppData\Local\Temp\7A10.tmp"105⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\7A6D.tmp"C:\Users\Admin\AppData\Local\Temp\7A6D.tmp"106⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\7B19.tmp"C:\Users\Admin\AppData\Local\Temp\7B19.tmp"107⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\7B77.tmp"C:\Users\Admin\AppData\Local\Temp\7B77.tmp"108⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\7BD4.tmp"C:\Users\Admin\AppData\Local\Temp\7BD4.tmp"109⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\7C41.tmp"C:\Users\Admin\AppData\Local\Temp\7C41.tmp"110⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\7CBE.tmp"C:\Users\Admin\AppData\Local\Temp\7CBE.tmp"111⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\7D2B.tmp"C:\Users\Admin\AppData\Local\Temp\7D2B.tmp"112⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\7D89.tmp"C:\Users\Admin\AppData\Local\Temp\7D89.tmp"113⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\7DF6.tmp"C:\Users\Admin\AppData\Local\Temp\7DF6.tmp"114⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\7E83.tmp"C:\Users\Admin\AppData\Local\Temp\7E83.tmp"115⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\7EE0.tmp"C:\Users\Admin\AppData\Local\Temp\7EE0.tmp"116⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\7F3E.tmp"C:\Users\Admin\AppData\Local\Temp\7F3E.tmp"117⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\7FBB.tmp"C:\Users\Admin\AppData\Local\Temp\7FBB.tmp"118⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\8018.tmp"C:\Users\Admin\AppData\Local\Temp\8018.tmp"119⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\8076.tmp"C:\Users\Admin\AppData\Local\Temp\8076.tmp"120⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\80E3.tmp"C:\Users\Admin\AppData\Local\Temp\80E3.tmp"121⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\8150.tmp"C:\Users\Admin\AppData\Local\Temp\8150.tmp"122⤵PID:2816
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-