Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26-01-2024 07:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-01-26_0dfaa7091e6e372552a7898124ae29f4_mafia.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-01-26_0dfaa7091e6e372552a7898124ae29f4_mafia.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-01-26_0dfaa7091e6e372552a7898124ae29f4_mafia.exe
-
Size
486KB
-
MD5
0dfaa7091e6e372552a7898124ae29f4
-
SHA1
a8f4676dc52a007b53ea8021fdf95347dae37f35
-
SHA256
ecb9ae1fffca77c83fd1f088ebf62b0e00e09bcb4dca89cc3363db8a17b77bb6
-
SHA512
bf8bf2286a912c25870de7d054416276be4719b8cbd4f57c24b2dc5d5920448b55e02214557d95cdb2e8c827806a2cbc4b4374dafcfc59771809f2385bd8cc5d
-
SSDEEP
12288:UU5rCOTeiDiybGxPsJaaknuKQdh3sBYf+oNZ:UUQOJDKJPJnuKQdmB8N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2320 3717.tmp 2084 3756.tmp 2788 385F.tmp 2792 3949.tmp 2844 3A33.tmp 2764 3B2C.tmp 2000 3BE8.tmp 2648 3C74.tmp 2620 3D4E.tmp 1100 3DEA.tmp 836 3E96.tmp 2900 3F42.tmp 2912 400C.tmp 2784 40E7.tmp 1660 41A2.tmp 1628 426D.tmp 1764 4338.tmp 1924 43D4.tmp 1636 448F.tmp 472 4569.tmp 2588 4634.tmp 240 46EF.tmp 2516 47AA.tmp 1260 4837.tmp 1212 49FB.tmp 1496 4AA7.tmp 2076 4B33.tmp 2144 4BA0.tmp 3044 4C2D.tmp 1936 4CB9.tmp 2432 4D36.tmp 2404 4DD2.tmp 2576 4E3F.tmp 1880 4ECC.tmp 996 4F48.tmp 2380 4FC5.tmp 2104 5032.tmp 1540 50AF.tmp 1816 511C.tmp 1556 5199.tmp 1664 51F7.tmp 916 5274.tmp 1072 52F0.tmp 1080 536D.tmp 900 53CB.tmp 2052 5448.tmp 812 54B5.tmp 744 5532.tmp 2132 558F.tmp 3028 560C.tmp 2120 5679.tmp 2348 5706.tmp 2016 5782.tmp 2884 580F.tmp 1580 588C.tmp 1612 5918.tmp 2472 5995.tmp 2752 5A12.tmp 2804 5A6F.tmp 2820 5ACD.tmp 2840 5B3A.tmp 2756 5BB7.tmp 2844 5C14.tmp 2624 5C72.tmp -
Loads dropped DLL 64 IoCs
pid Process 2276 2024-01-26_0dfaa7091e6e372552a7898124ae29f4_mafia.exe 2320 3717.tmp 2084 3756.tmp 2788 385F.tmp 2792 3949.tmp 2844 3A33.tmp 2764 3B2C.tmp 2000 3BE8.tmp 2648 3C74.tmp 2620 3D4E.tmp 1100 3DEA.tmp 836 3E96.tmp 2900 3F42.tmp 2912 400C.tmp 2784 40E7.tmp 1660 41A2.tmp 1628 426D.tmp 1764 4338.tmp 1924 43D4.tmp 1636 448F.tmp 472 4569.tmp 2588 4634.tmp 240 46EF.tmp 2516 47AA.tmp 1260 4837.tmp 1212 49FB.tmp 1496 4AA7.tmp 2076 4B33.tmp 2144 4BA0.tmp 3044 4C2D.tmp 1936 4CB9.tmp 2432 4D36.tmp 2404 4DD2.tmp 2576 4E3F.tmp 1880 4ECC.tmp 996 4F48.tmp 2380 4FC5.tmp 2104 5032.tmp 1540 50AF.tmp 1816 511C.tmp 1556 5199.tmp 1664 51F7.tmp 916 5274.tmp 1072 52F0.tmp 1080 536D.tmp 900 53CB.tmp 2052 5448.tmp 812 54B5.tmp 744 5532.tmp 2132 558F.tmp 3028 560C.tmp 2120 5679.tmp 2348 5706.tmp 2016 5782.tmp 2884 580F.tmp 1580 588C.tmp 1612 5918.tmp 2472 5995.tmp 2752 5A12.tmp 2804 5A6F.tmp 2820 5ACD.tmp 2840 5B3A.tmp 2756 5BB7.tmp 2844 5C14.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2276 wrote to memory of 2320 2276 2024-01-26_0dfaa7091e6e372552a7898124ae29f4_mafia.exe 28 PID 2276 wrote to memory of 2320 2276 2024-01-26_0dfaa7091e6e372552a7898124ae29f4_mafia.exe 28 PID 2276 wrote to memory of 2320 2276 2024-01-26_0dfaa7091e6e372552a7898124ae29f4_mafia.exe 28 PID 2276 wrote to memory of 2320 2276 2024-01-26_0dfaa7091e6e372552a7898124ae29f4_mafia.exe 28 PID 2320 wrote to memory of 2084 2320 3717.tmp 29 PID 2320 wrote to memory of 2084 2320 3717.tmp 29 PID 2320 wrote to memory of 2084 2320 3717.tmp 29 PID 2320 wrote to memory of 2084 2320 3717.tmp 29 PID 2084 wrote to memory of 2788 2084 3756.tmp 30 PID 2084 wrote to memory of 2788 2084 3756.tmp 30 PID 2084 wrote to memory of 2788 2084 3756.tmp 30 PID 2084 wrote to memory of 2788 2084 3756.tmp 30 PID 2788 wrote to memory of 2792 2788 385F.tmp 31 PID 2788 wrote to memory of 2792 2788 385F.tmp 31 PID 2788 wrote to memory of 2792 2788 385F.tmp 31 PID 2788 wrote to memory of 2792 2788 385F.tmp 31 PID 2792 wrote to memory of 2844 2792 3949.tmp 32 PID 2792 wrote to memory of 2844 2792 3949.tmp 32 PID 2792 wrote to memory of 2844 2792 3949.tmp 32 PID 2792 wrote to memory of 2844 2792 3949.tmp 32 PID 2844 wrote to memory of 2764 2844 3A33.tmp 33 PID 2844 wrote to memory of 2764 2844 3A33.tmp 33 PID 2844 wrote to memory of 2764 2844 3A33.tmp 33 PID 2844 wrote to memory of 2764 2844 3A33.tmp 33 PID 2764 wrote to memory of 2000 2764 3B2C.tmp 34 PID 2764 wrote to memory of 2000 2764 3B2C.tmp 34 PID 2764 wrote to memory of 2000 2764 3B2C.tmp 34 PID 2764 wrote to memory of 2000 2764 3B2C.tmp 34 PID 2000 wrote to memory of 2648 2000 3BE8.tmp 35 PID 2000 wrote to memory of 2648 2000 3BE8.tmp 35 PID 2000 wrote to memory of 2648 2000 3BE8.tmp 35 PID 2000 wrote to memory of 2648 2000 3BE8.tmp 35 PID 2648 wrote to memory of 2620 2648 3C74.tmp 36 PID 2648 wrote to memory of 2620 2648 3C74.tmp 36 PID 2648 wrote to memory of 2620 2648 3C74.tmp 36 PID 2648 wrote to memory of 2620 2648 3C74.tmp 36 PID 2620 wrote to memory of 1100 2620 3D4E.tmp 37 PID 2620 wrote to memory of 1100 2620 3D4E.tmp 37 PID 2620 wrote to memory of 1100 2620 3D4E.tmp 37 PID 2620 wrote to memory of 1100 2620 3D4E.tmp 37 PID 1100 wrote to memory of 836 1100 3DEA.tmp 38 PID 1100 wrote to memory of 836 1100 3DEA.tmp 38 PID 1100 wrote to memory of 836 1100 3DEA.tmp 38 PID 1100 wrote to memory of 836 1100 3DEA.tmp 38 PID 836 wrote to memory of 2900 836 3E96.tmp 39 PID 836 wrote to memory of 2900 836 3E96.tmp 39 PID 836 wrote to memory of 2900 836 3E96.tmp 39 PID 836 wrote to memory of 2900 836 3E96.tmp 39 PID 2900 wrote to memory of 2912 2900 3F42.tmp 40 PID 2900 wrote to memory of 2912 2900 3F42.tmp 40 PID 2900 wrote to memory of 2912 2900 3F42.tmp 40 PID 2900 wrote to memory of 2912 2900 3F42.tmp 40 PID 2912 wrote to memory of 2784 2912 400C.tmp 41 PID 2912 wrote to memory of 2784 2912 400C.tmp 41 PID 2912 wrote to memory of 2784 2912 400C.tmp 41 PID 2912 wrote to memory of 2784 2912 400C.tmp 41 PID 2784 wrote to memory of 1660 2784 40E7.tmp 42 PID 2784 wrote to memory of 1660 2784 40E7.tmp 42 PID 2784 wrote to memory of 1660 2784 40E7.tmp 42 PID 2784 wrote to memory of 1660 2784 40E7.tmp 42 PID 1660 wrote to memory of 1628 1660 41A2.tmp 43 PID 1660 wrote to memory of 1628 1660 41A2.tmp 43 PID 1660 wrote to memory of 1628 1660 41A2.tmp 43 PID 1660 wrote to memory of 1628 1660 41A2.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_0dfaa7091e6e372552a7898124ae29f4_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-26_0dfaa7091e6e372552a7898124ae29f4_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\3717.tmp"C:\Users\Admin\AppData\Local\Temp\3717.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\3756.tmp"C:\Users\Admin\AppData\Local\Temp\3756.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\385F.tmp"C:\Users\Admin\AppData\Local\Temp\385F.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\3949.tmp"C:\Users\Admin\AppData\Local\Temp\3949.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\3A33.tmp"C:\Users\Admin\AppData\Local\Temp\3A33.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\3B2C.tmp"C:\Users\Admin\AppData\Local\Temp\3B2C.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\3BE8.tmp"C:\Users\Admin\AppData\Local\Temp\3BE8.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\3C74.tmp"C:\Users\Admin\AppData\Local\Temp\3C74.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\3D4E.tmp"C:\Users\Admin\AppData\Local\Temp\3D4E.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\3DEA.tmp"C:\Users\Admin\AppData\Local\Temp\3DEA.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\3E96.tmp"C:\Users\Admin\AppData\Local\Temp\3E96.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Users\Admin\AppData\Local\Temp\3F42.tmp"C:\Users\Admin\AppData\Local\Temp\3F42.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\400C.tmp"C:\Users\Admin\AppData\Local\Temp\400C.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\40E7.tmp"C:\Users\Admin\AppData\Local\Temp\40E7.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\41A2.tmp"C:\Users\Admin\AppData\Local\Temp\41A2.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\426D.tmp"C:\Users\Admin\AppData\Local\Temp\426D.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\4338.tmp"C:\Users\Admin\AppData\Local\Temp\4338.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\43D4.tmp"C:\Users\Admin\AppData\Local\Temp\43D4.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\448F.tmp"C:\Users\Admin\AppData\Local\Temp\448F.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\4569.tmp"C:\Users\Admin\AppData\Local\Temp\4569.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:472 -
C:\Users\Admin\AppData\Local\Temp\4634.tmp"C:\Users\Admin\AppData\Local\Temp\4634.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\46EF.tmp"C:\Users\Admin\AppData\Local\Temp\46EF.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:240 -
C:\Users\Admin\AppData\Local\Temp\47AA.tmp"C:\Users\Admin\AppData\Local\Temp\47AA.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\4837.tmp"C:\Users\Admin\AppData\Local\Temp\4837.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\49FB.tmp"C:\Users\Admin\AppData\Local\Temp\49FB.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\4AA7.tmp"C:\Users\Admin\AppData\Local\Temp\4AA7.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\4B33.tmp"C:\Users\Admin\AppData\Local\Temp\4B33.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\4BA0.tmp"C:\Users\Admin\AppData\Local\Temp\4BA0.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\4C2D.tmp"C:\Users\Admin\AppData\Local\Temp\4C2D.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\4CB9.tmp"C:\Users\Admin\AppData\Local\Temp\4CB9.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\4D36.tmp"C:\Users\Admin\AppData\Local\Temp\4D36.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\4F48.tmp"C:\Users\Admin\AppData\Local\Temp\4F48.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:996 -
C:\Users\Admin\AppData\Local\Temp\4FC5.tmp"C:\Users\Admin\AppData\Local\Temp\4FC5.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\5032.tmp"C:\Users\Admin\AppData\Local\Temp\5032.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\50AF.tmp"C:\Users\Admin\AppData\Local\Temp\50AF.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\511C.tmp"C:\Users\Admin\AppData\Local\Temp\511C.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\5199.tmp"C:\Users\Admin\AppData\Local\Temp\5199.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\51F7.tmp"C:\Users\Admin\AppData\Local\Temp\51F7.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\5274.tmp"C:\Users\Admin\AppData\Local\Temp\5274.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:916 -
C:\Users\Admin\AppData\Local\Temp\52F0.tmp"C:\Users\Admin\AppData\Local\Temp\52F0.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\536D.tmp"C:\Users\Admin\AppData\Local\Temp\536D.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\53CB.tmp"C:\Users\Admin\AppData\Local\Temp\53CB.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:900 -
C:\Users\Admin\AppData\Local\Temp\5448.tmp"C:\Users\Admin\AppData\Local\Temp\5448.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\54B5.tmp"C:\Users\Admin\AppData\Local\Temp\54B5.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:812 -
C:\Users\Admin\AppData\Local\Temp\5532.tmp"C:\Users\Admin\AppData\Local\Temp\5532.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:744 -
C:\Users\Admin\AppData\Local\Temp\558F.tmp"C:\Users\Admin\AppData\Local\Temp\558F.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\560C.tmp"C:\Users\Admin\AppData\Local\Temp\560C.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\5679.tmp"C:\Users\Admin\AppData\Local\Temp\5679.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\5706.tmp"C:\Users\Admin\AppData\Local\Temp\5706.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\5782.tmp"C:\Users\Admin\AppData\Local\Temp\5782.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\580F.tmp"C:\Users\Admin\AppData\Local\Temp\580F.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\588C.tmp"C:\Users\Admin\AppData\Local\Temp\588C.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\5918.tmp"C:\Users\Admin\AppData\Local\Temp\5918.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\5995.tmp"C:\Users\Admin\AppData\Local\Temp\5995.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\5A12.tmp"C:\Users\Admin\AppData\Local\Temp\5A12.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\5ACD.tmp"C:\Users\Admin\AppData\Local\Temp\5ACD.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\5B3A.tmp"C:\Users\Admin\AppData\Local\Temp\5B3A.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\5BB7.tmp"C:\Users\Admin\AppData\Local\Temp\5BB7.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\5C14.tmp"C:\Users\Admin\AppData\Local\Temp\5C14.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\5C72.tmp"C:\Users\Admin\AppData\Local\Temp\5C72.tmp"65⤵
- Executes dropped EXE
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\5CDF.tmp"C:\Users\Admin\AppData\Local\Temp\5CDF.tmp"66⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\5D6C.tmp"C:\Users\Admin\AppData\Local\Temp\5D6C.tmp"67⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\5DD9.tmp"C:\Users\Admin\AppData\Local\Temp\5DD9.tmp"68⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\5F11.tmp"C:\Users\Admin\AppData\Local\Temp\5F11.tmp"69⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\5FAD.tmp"C:\Users\Admin\AppData\Local\Temp\5FAD.tmp"70⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\600A.tmp"C:\Users\Admin\AppData\Local\Temp\600A.tmp"71⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\6078.tmp"C:\Users\Admin\AppData\Local\Temp\6078.tmp"72⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\60E5.tmp"C:\Users\Admin\AppData\Local\Temp\60E5.tmp"73⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\6142.tmp"C:\Users\Admin\AppData\Local\Temp\6142.tmp"74⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\61A0.tmp"C:\Users\Admin\AppData\Local\Temp\61A0.tmp"75⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\620D.tmp"C:\Users\Admin\AppData\Local\Temp\620D.tmp"76⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\628A.tmp"C:\Users\Admin\AppData\Local\Temp\628A.tmp"77⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\62F7.tmp"C:\Users\Admin\AppData\Local\Temp\62F7.tmp"78⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\6364.tmp"C:\Users\Admin\AppData\Local\Temp\6364.tmp"79⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\63E1.tmp"C:\Users\Admin\AppData\Local\Temp\63E1.tmp"80⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\644F.tmp"C:\Users\Admin\AppData\Local\Temp\644F.tmp"81⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\64BC.tmp"C:\Users\Admin\AppData\Local\Temp\64BC.tmp"82⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\6539.tmp"C:\Users\Admin\AppData\Local\Temp\6539.tmp"83⤵PID:296
-
C:\Users\Admin\AppData\Local\Temp\6596.tmp"C:\Users\Admin\AppData\Local\Temp\6596.tmp"84⤵PID:524
-
C:\Users\Admin\AppData\Local\Temp\6613.tmp"C:\Users\Admin\AppData\Local\Temp\6613.tmp"85⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\6680.tmp"C:\Users\Admin\AppData\Local\Temp\6680.tmp"86⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\66ED.tmp"C:\Users\Admin\AppData\Local\Temp\66ED.tmp"87⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\675B.tmp"C:\Users\Admin\AppData\Local\Temp\675B.tmp"88⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\67C8.tmp"C:\Users\Admin\AppData\Local\Temp\67C8.tmp"89⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\6825.tmp"C:\Users\Admin\AppData\Local\Temp\6825.tmp"90⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\68B2.tmp"C:\Users\Admin\AppData\Local\Temp\68B2.tmp"91⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\691F.tmp"C:\Users\Admin\AppData\Local\Temp\691F.tmp"92⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\698C.tmp"C:\Users\Admin\AppData\Local\Temp\698C.tmp"93⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\6A09.tmp"C:\Users\Admin\AppData\Local\Temp\6A09.tmp"94⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\6A76.tmp"C:\Users\Admin\AppData\Local\Temp\6A76.tmp"95⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\6AF3.tmp"C:\Users\Admin\AppData\Local\Temp\6AF3.tmp"96⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\6B7F.tmp"C:\Users\Admin\AppData\Local\Temp\6B7F.tmp"97⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\6BED.tmp"C:\Users\Admin\AppData\Local\Temp\6BED.tmp"98⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\6C5A.tmp"C:\Users\Admin\AppData\Local\Temp\6C5A.tmp"99⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\6CD7.tmp"C:\Users\Admin\AppData\Local\Temp\6CD7.tmp"100⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\6D34.tmp"C:\Users\Admin\AppData\Local\Temp\6D34.tmp"101⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\6DA1.tmp"C:\Users\Admin\AppData\Local\Temp\6DA1.tmp"102⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\6E1E.tmp"C:\Users\Admin\AppData\Local\Temp\6E1E.tmp"103⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\6E9B.tmp"C:\Users\Admin\AppData\Local\Temp\6E9B.tmp"104⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\6F18.tmp"C:\Users\Admin\AppData\Local\Temp\6F18.tmp"105⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\6F85.tmp"C:\Users\Admin\AppData\Local\Temp\6F85.tmp"106⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\6FF2.tmp"C:\Users\Admin\AppData\Local\Temp\6FF2.tmp"107⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\7050.tmp"C:\Users\Admin\AppData\Local\Temp\7050.tmp"108⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\70CD.tmp"C:\Users\Admin\AppData\Local\Temp\70CD.tmp"109⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\713A.tmp"C:\Users\Admin\AppData\Local\Temp\713A.tmp"110⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\71A7.tmp"C:\Users\Admin\AppData\Local\Temp\71A7.tmp"111⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\7214.tmp"C:\Users\Admin\AppData\Local\Temp\7214.tmp"112⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\7281.tmp"C:\Users\Admin\AppData\Local\Temp\7281.tmp"113⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\72FE.tmp"C:\Users\Admin\AppData\Local\Temp\72FE.tmp"114⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\73D9.tmp"C:\Users\Admin\AppData\Local\Temp\73D9.tmp"115⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\7446.tmp"C:\Users\Admin\AppData\Local\Temp\7446.tmp"116⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\74C3.tmp"C:\Users\Admin\AppData\Local\Temp\74C3.tmp"117⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\7530.tmp"C:\Users\Admin\AppData\Local\Temp\7530.tmp"118⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\75AD.tmp"C:\Users\Admin\AppData\Local\Temp\75AD.tmp"119⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"120⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\7687.tmp"C:\Users\Admin\AppData\Local\Temp\7687.tmp"121⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\7704.tmp"C:\Users\Admin\AppData\Local\Temp\7704.tmp"122⤵PID:1616
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-