Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22/02/2024, 06:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-22_a51aadfe2c2fac492052876e2b8be06f_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-22_a51aadfe2c2fac492052876e2b8be06f_mafia.exe
Resource
win10v2004-20240221-en
2 signatures
150 seconds
General
-
Target
2024-02-22_a51aadfe2c2fac492052876e2b8be06f_mafia.exe
-
Size
486KB
-
MD5
a51aadfe2c2fac492052876e2b8be06f
-
SHA1
ad5b999402131a375db4b7f11b6ddec34ebe64f0
-
SHA256
0e9753d77e2d1f1fe61bb53cdf391f001c6505eab7a90c4897a635f2fec48d1d
-
SHA512
ebad1ba779fdace46e266cc60cc66b3730e77be381e12b778a488126eefc045010fb0a5663f8a264066339470546e4f08de07b4fa8686e49857f4fbc18f541d3
-
SSDEEP
12288:/U5rCOTeiDhYZtenYJ5M7u0Sg6EZO8NZ:/UQOJDhYraY386ENN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2212 46D0.tmp 2740 47AA.tmp 2976 48C3.tmp 2640 49BD.tmp 2584 4AB6.tmp 2672 4B91.tmp 2688 4C7B.tmp 2452 4D55.tmp 2480 4E3F.tmp 2444 4EEB.tmp 2352 4FA6.tmp 2892 5071.tmp 1708 515B.tmp 2732 5226.tmp 2716 531F.tmp 2860 53DA.tmp 1716 54C4.tmp 1988 5580.tmp 308 565A.tmp 2328 5706.tmp 1176 57B1.tmp 1532 5947.tmp 2496 5A50.tmp 1116 5AFC.tmp 1380 5B69.tmp 1408 5BE6.tmp 1312 5C62.tmp 2276 5CDF.tmp 1136 5D5C.tmp 2828 5DC9.tmp 1984 5E56.tmp 2952 5ED2.tmp 2096 5F4F.tmp 2832 5FCC.tmp 2908 6049.tmp 1744 60D5.tmp 1980 6162.tmp 440 61EE.tmp 980 627A.tmp 1484 6307.tmp 364 6384.tmp 1244 6410.tmp 792 649D.tmp 1088 64FA.tmp 900 6567.tmp 2292 65D5.tmp 2344 6651.tmp 2924 66AF.tmp 2916 672C.tmp 2920 67B8.tmp 3024 6845.tmp 1056 68C1.tmp 2836 693E.tmp 1608 69BB.tmp 2236 6A47.tmp 2052 6AD4.tmp 2060 6B51.tmp 2556 6BAE.tmp 2644 6C2B.tmp 2976 6C89.tmp 2536 6D05.tmp 2552 6D63.tmp 2980 6DD0.tmp 2460 6FB4.tmp -
Loads dropped DLL 64 IoCs
pid Process 2216 2024-02-22_a51aadfe2c2fac492052876e2b8be06f_mafia.exe 2212 46D0.tmp 2740 47AA.tmp 2976 48C3.tmp 2640 49BD.tmp 2584 4AB6.tmp 2672 4B91.tmp 2688 4C7B.tmp 2452 4D55.tmp 2480 4E3F.tmp 2444 4EEB.tmp 2352 4FA6.tmp 2892 5071.tmp 1708 515B.tmp 2732 5226.tmp 2716 531F.tmp 2860 53DA.tmp 1716 54C4.tmp 1988 5580.tmp 308 565A.tmp 2328 5706.tmp 1176 57B1.tmp 1532 5947.tmp 2496 5A50.tmp 1116 5AFC.tmp 1380 5B69.tmp 1408 5BE6.tmp 1312 5C62.tmp 2276 5CDF.tmp 1136 5D5C.tmp 2828 5DC9.tmp 1984 5E56.tmp 2952 5ED2.tmp 2096 5F4F.tmp 2832 5FCC.tmp 2908 6049.tmp 1744 60D5.tmp 1980 6162.tmp 440 61EE.tmp 980 627A.tmp 1484 6307.tmp 364 6384.tmp 1244 6410.tmp 792 649D.tmp 1088 64FA.tmp 900 6567.tmp 2292 65D5.tmp 2344 6651.tmp 2924 66AF.tmp 2916 672C.tmp 2920 67B8.tmp 3024 6845.tmp 1056 68C1.tmp 2836 693E.tmp 1608 69BB.tmp 2236 6A47.tmp 2052 6AD4.tmp 2060 6B51.tmp 2556 6BAE.tmp 2644 6C2B.tmp 2976 6C89.tmp 2536 6D05.tmp 2552 6D63.tmp 2980 6DD0.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2216 wrote to memory of 2212 2216 2024-02-22_a51aadfe2c2fac492052876e2b8be06f_mafia.exe 28 PID 2216 wrote to memory of 2212 2216 2024-02-22_a51aadfe2c2fac492052876e2b8be06f_mafia.exe 28 PID 2216 wrote to memory of 2212 2216 2024-02-22_a51aadfe2c2fac492052876e2b8be06f_mafia.exe 28 PID 2216 wrote to memory of 2212 2216 2024-02-22_a51aadfe2c2fac492052876e2b8be06f_mafia.exe 28 PID 2212 wrote to memory of 2740 2212 46D0.tmp 29 PID 2212 wrote to memory of 2740 2212 46D0.tmp 29 PID 2212 wrote to memory of 2740 2212 46D0.tmp 29 PID 2212 wrote to memory of 2740 2212 46D0.tmp 29 PID 2740 wrote to memory of 2976 2740 47AA.tmp 30 PID 2740 wrote to memory of 2976 2740 47AA.tmp 30 PID 2740 wrote to memory of 2976 2740 47AA.tmp 30 PID 2740 wrote to memory of 2976 2740 47AA.tmp 30 PID 2976 wrote to memory of 2640 2976 48C3.tmp 31 PID 2976 wrote to memory of 2640 2976 48C3.tmp 31 PID 2976 wrote to memory of 2640 2976 48C3.tmp 31 PID 2976 wrote to memory of 2640 2976 48C3.tmp 31 PID 2640 wrote to memory of 2584 2640 49BD.tmp 32 PID 2640 wrote to memory of 2584 2640 49BD.tmp 32 PID 2640 wrote to memory of 2584 2640 49BD.tmp 32 PID 2640 wrote to memory of 2584 2640 49BD.tmp 32 PID 2584 wrote to memory of 2672 2584 4AB6.tmp 33 PID 2584 wrote to memory of 2672 2584 4AB6.tmp 33 PID 2584 wrote to memory of 2672 2584 4AB6.tmp 33 PID 2584 wrote to memory of 2672 2584 4AB6.tmp 33 PID 2672 wrote to memory of 2688 2672 4B91.tmp 34 PID 2672 wrote to memory of 2688 2672 4B91.tmp 34 PID 2672 wrote to memory of 2688 2672 4B91.tmp 34 PID 2672 wrote to memory of 2688 2672 4B91.tmp 34 PID 2688 wrote to memory of 2452 2688 4C7B.tmp 35 PID 2688 wrote to memory of 2452 2688 4C7B.tmp 35 PID 2688 wrote to memory of 2452 2688 4C7B.tmp 35 PID 2688 wrote to memory of 2452 2688 4C7B.tmp 35 PID 2452 wrote to memory of 2480 2452 4D55.tmp 36 PID 2452 wrote to memory of 2480 2452 4D55.tmp 36 PID 2452 wrote to memory of 2480 2452 4D55.tmp 36 PID 2452 wrote to memory of 2480 2452 4D55.tmp 36 PID 2480 wrote to memory of 2444 2480 4E3F.tmp 37 PID 2480 wrote to memory of 2444 2480 4E3F.tmp 37 PID 2480 wrote to memory of 2444 2480 4E3F.tmp 37 PID 2480 wrote to memory of 2444 2480 4E3F.tmp 37 PID 2444 wrote to memory of 2352 2444 4EEB.tmp 38 PID 2444 wrote to memory of 2352 2444 4EEB.tmp 38 PID 2444 wrote to memory of 2352 2444 4EEB.tmp 38 PID 2444 wrote to memory of 2352 2444 4EEB.tmp 38 PID 2352 wrote to memory of 2892 2352 4FA6.tmp 39 PID 2352 wrote to memory of 2892 2352 4FA6.tmp 39 PID 2352 wrote to memory of 2892 2352 4FA6.tmp 39 PID 2352 wrote to memory of 2892 2352 4FA6.tmp 39 PID 2892 wrote to memory of 1708 2892 5071.tmp 40 PID 2892 wrote to memory of 1708 2892 5071.tmp 40 PID 2892 wrote to memory of 1708 2892 5071.tmp 40 PID 2892 wrote to memory of 1708 2892 5071.tmp 40 PID 1708 wrote to memory of 2732 1708 515B.tmp 41 PID 1708 wrote to memory of 2732 1708 515B.tmp 41 PID 1708 wrote to memory of 2732 1708 515B.tmp 41 PID 1708 wrote to memory of 2732 1708 515B.tmp 41 PID 2732 wrote to memory of 2716 2732 5226.tmp 42 PID 2732 wrote to memory of 2716 2732 5226.tmp 42 PID 2732 wrote to memory of 2716 2732 5226.tmp 42 PID 2732 wrote to memory of 2716 2732 5226.tmp 42 PID 2716 wrote to memory of 2860 2716 531F.tmp 43 PID 2716 wrote to memory of 2860 2716 531F.tmp 43 PID 2716 wrote to memory of 2860 2716 531F.tmp 43 PID 2716 wrote to memory of 2860 2716 531F.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-22_a51aadfe2c2fac492052876e2b8be06f_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-22_a51aadfe2c2fac492052876e2b8be06f_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\46D0.tmp"C:\Users\Admin\AppData\Local\Temp\46D0.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\47AA.tmp"C:\Users\Admin\AppData\Local\Temp\47AA.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\48C3.tmp"C:\Users\Admin\AppData\Local\Temp\48C3.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\49BD.tmp"C:\Users\Admin\AppData\Local\Temp\49BD.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\4AB6.tmp"C:\Users\Admin\AppData\Local\Temp\4AB6.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\4B91.tmp"C:\Users\Admin\AppData\Local\Temp\4B91.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\4C7B.tmp"C:\Users\Admin\AppData\Local\Temp\4C7B.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\5071.tmp"C:\Users\Admin\AppData\Local\Temp\5071.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\515B.tmp"C:\Users\Admin\AppData\Local\Temp\515B.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\5226.tmp"C:\Users\Admin\AppData\Local\Temp\5226.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\531F.tmp"C:\Users\Admin\AppData\Local\Temp\531F.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\53DA.tmp"C:\Users\Admin\AppData\Local\Temp\53DA.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\54C4.tmp"C:\Users\Admin\AppData\Local\Temp\54C4.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\5580.tmp"C:\Users\Admin\AppData\Local\Temp\5580.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\565A.tmp"C:\Users\Admin\AppData\Local\Temp\565A.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:308 -
C:\Users\Admin\AppData\Local\Temp\5706.tmp"C:\Users\Admin\AppData\Local\Temp\5706.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\57B1.tmp"C:\Users\Admin\AppData\Local\Temp\57B1.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\5947.tmp"C:\Users\Admin\AppData\Local\Temp\5947.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\5A50.tmp"C:\Users\Admin\AppData\Local\Temp\5A50.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\5AFC.tmp"C:\Users\Admin\AppData\Local\Temp\5AFC.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\5B69.tmp"C:\Users\Admin\AppData\Local\Temp\5B69.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\5BE6.tmp"C:\Users\Admin\AppData\Local\Temp\5BE6.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\5C62.tmp"C:\Users\Admin\AppData\Local\Temp\5C62.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\5CDF.tmp"C:\Users\Admin\AppData\Local\Temp\5CDF.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\5D5C.tmp"C:\Users\Admin\AppData\Local\Temp\5D5C.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\5DC9.tmp"C:\Users\Admin\AppData\Local\Temp\5DC9.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\5E56.tmp"C:\Users\Admin\AppData\Local\Temp\5E56.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\5ED2.tmp"C:\Users\Admin\AppData\Local\Temp\5ED2.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\5F4F.tmp"C:\Users\Admin\AppData\Local\Temp\5F4F.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\5FCC.tmp"C:\Users\Admin\AppData\Local\Temp\5FCC.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\6049.tmp"C:\Users\Admin\AppData\Local\Temp\6049.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\60D5.tmp"C:\Users\Admin\AppData\Local\Temp\60D5.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\6162.tmp"C:\Users\Admin\AppData\Local\Temp\6162.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\61EE.tmp"C:\Users\Admin\AppData\Local\Temp\61EE.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:440 -
C:\Users\Admin\AppData\Local\Temp\627A.tmp"C:\Users\Admin\AppData\Local\Temp\627A.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:980 -
C:\Users\Admin\AppData\Local\Temp\6307.tmp"C:\Users\Admin\AppData\Local\Temp\6307.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\6384.tmp"C:\Users\Admin\AppData\Local\Temp\6384.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:364 -
C:\Users\Admin\AppData\Local\Temp\6410.tmp"C:\Users\Admin\AppData\Local\Temp\6410.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\649D.tmp"C:\Users\Admin\AppData\Local\Temp\649D.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:792 -
C:\Users\Admin\AppData\Local\Temp\64FA.tmp"C:\Users\Admin\AppData\Local\Temp\64FA.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\6567.tmp"C:\Users\Admin\AppData\Local\Temp\6567.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:900 -
C:\Users\Admin\AppData\Local\Temp\65D5.tmp"C:\Users\Admin\AppData\Local\Temp\65D5.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\6651.tmp"C:\Users\Admin\AppData\Local\Temp\6651.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\66AF.tmp"C:\Users\Admin\AppData\Local\Temp\66AF.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\672C.tmp"C:\Users\Admin\AppData\Local\Temp\672C.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\67B8.tmp"C:\Users\Admin\AppData\Local\Temp\67B8.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\6845.tmp"C:\Users\Admin\AppData\Local\Temp\6845.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\68C1.tmp"C:\Users\Admin\AppData\Local\Temp\68C1.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\693E.tmp"C:\Users\Admin\AppData\Local\Temp\693E.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\69BB.tmp"C:\Users\Admin\AppData\Local\Temp\69BB.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\6A47.tmp"C:\Users\Admin\AppData\Local\Temp\6A47.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\6AD4.tmp"C:\Users\Admin\AppData\Local\Temp\6AD4.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\6B51.tmp"C:\Users\Admin\AppData\Local\Temp\6B51.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\6BAE.tmp"C:\Users\Admin\AppData\Local\Temp\6BAE.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\6C2B.tmp"C:\Users\Admin\AppData\Local\Temp\6C2B.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\6C89.tmp"C:\Users\Admin\AppData\Local\Temp\6C89.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\6D05.tmp"C:\Users\Admin\AppData\Local\Temp\6D05.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\6D63.tmp"C:\Users\Admin\AppData\Local\Temp\6D63.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\6DD0.tmp"C:\Users\Admin\AppData\Local\Temp\6DD0.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\6FB4.tmp"C:\Users\Admin\AppData\Local\Temp\6FB4.tmp"65⤵
- Executes dropped EXE
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\705F.tmp"C:\Users\Admin\AppData\Local\Temp\705F.tmp"66⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\70CD.tmp"C:\Users\Admin\AppData\Local\Temp\70CD.tmp"67⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\7159.tmp"C:\Users\Admin\AppData\Local\Temp\7159.tmp"68⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\71C6.tmp"C:\Users\Admin\AppData\Local\Temp\71C6.tmp"69⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\7243.tmp"C:\Users\Admin\AppData\Local\Temp\7243.tmp"70⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\72B0.tmp"C:\Users\Admin\AppData\Local\Temp\72B0.tmp"71⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\733D.tmp"C:\Users\Admin\AppData\Local\Temp\733D.tmp"72⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\739A.tmp"C:\Users\Admin\AppData\Local\Temp\739A.tmp"73⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"74⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\7475.tmp"C:\Users\Admin\AppData\Local\Temp\7475.tmp"75⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\7501.tmp"C:\Users\Admin\AppData\Local\Temp\7501.tmp"76⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\755F.tmp"C:\Users\Admin\AppData\Local\Temp\755F.tmp"77⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\75BC.tmp"C:\Users\Admin\AppData\Local\Temp\75BC.tmp"78⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\7639.tmp"C:\Users\Admin\AppData\Local\Temp\7639.tmp"79⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\76B6.tmp"C:\Users\Admin\AppData\Local\Temp\76B6.tmp"80⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\7713.tmp"C:\Users\Admin\AppData\Local\Temp\7713.tmp"81⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\7771.tmp"C:\Users\Admin\AppData\Local\Temp\7771.tmp"82⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\77EE.tmp"C:\Users\Admin\AppData\Local\Temp\77EE.tmp"83⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\786B.tmp"C:\Users\Admin\AppData\Local\Temp\786B.tmp"84⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\78D8.tmp"C:\Users\Admin\AppData\Local\Temp\78D8.tmp"85⤵PID:340
-
C:\Users\Admin\AppData\Local\Temp\7945.tmp"C:\Users\Admin\AppData\Local\Temp\7945.tmp"86⤵PID:476
-
C:\Users\Admin\AppData\Local\Temp\79D1.tmp"C:\Users\Admin\AppData\Local\Temp\79D1.tmp"87⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\7A3F.tmp"C:\Users\Admin\AppData\Local\Temp\7A3F.tmp"88⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\7AAC.tmp"C:\Users\Admin\AppData\Local\Temp\7AAC.tmp"89⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\7B19.tmp"C:\Users\Admin\AppData\Local\Temp\7B19.tmp"90⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\7B96.tmp"C:\Users\Admin\AppData\Local\Temp\7B96.tmp"91⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\7BF3.tmp"C:\Users\Admin\AppData\Local\Temp\7BF3.tmp"92⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\7C61.tmp"C:\Users\Admin\AppData\Local\Temp\7C61.tmp"93⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\7CCE.tmp"C:\Users\Admin\AppData\Local\Temp\7CCE.tmp"94⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\7D3B.tmp"C:\Users\Admin\AppData\Local\Temp\7D3B.tmp"95⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\7DB8.tmp"C:\Users\Admin\AppData\Local\Temp\7DB8.tmp"96⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\7E35.tmp"C:\Users\Admin\AppData\Local\Temp\7E35.tmp"97⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\7EB1.tmp"C:\Users\Admin\AppData\Local\Temp\7EB1.tmp"98⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\7F2E.tmp"C:\Users\Admin\AppData\Local\Temp\7F2E.tmp"99⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\7F9B.tmp"C:\Users\Admin\AppData\Local\Temp\7F9B.tmp"100⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\8009.tmp"C:\Users\Admin\AppData\Local\Temp\8009.tmp"101⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\8066.tmp"C:\Users\Admin\AppData\Local\Temp\8066.tmp"102⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\80E3.tmp"C:\Users\Admin\AppData\Local\Temp\80E3.tmp"103⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\8141.tmp"C:\Users\Admin\AppData\Local\Temp\8141.tmp"104⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\81AE.tmp"C:\Users\Admin\AppData\Local\Temp\81AE.tmp"105⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\821B.tmp"C:\Users\Admin\AppData\Local\Temp\821B.tmp"106⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\82A7.tmp"C:\Users\Admin\AppData\Local\Temp\82A7.tmp"107⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\8305.tmp"C:\Users\Admin\AppData\Local\Temp\8305.tmp"108⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\8363.tmp"C:\Users\Admin\AppData\Local\Temp\8363.tmp"109⤵PID:344
-
C:\Users\Admin\AppData\Local\Temp\83D0.tmp"C:\Users\Admin\AppData\Local\Temp\83D0.tmp"110⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\849B.tmp"C:\Users\Admin\AppData\Local\Temp\849B.tmp"111⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\8517.tmp"C:\Users\Admin\AppData\Local\Temp\8517.tmp"112⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\8575.tmp"C:\Users\Admin\AppData\Local\Temp\8575.tmp"113⤵PID:600
-
C:\Users\Admin\AppData\Local\Temp\85F2.tmp"C:\Users\Admin\AppData\Local\Temp\85F2.tmp"114⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\865F.tmp"C:\Users\Admin\AppData\Local\Temp\865F.tmp"115⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\86BD.tmp"C:\Users\Admin\AppData\Local\Temp\86BD.tmp"116⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\871A.tmp"C:\Users\Admin\AppData\Local\Temp\871A.tmp"117⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\8787.tmp"C:\Users\Admin\AppData\Local\Temp\8787.tmp"118⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\8804.tmp"C:\Users\Admin\AppData\Local\Temp\8804.tmp"119⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\8871.tmp"C:\Users\Admin\AppData\Local\Temp\8871.tmp"120⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\88DF.tmp"C:\Users\Admin\AppData\Local\Temp\88DF.tmp"121⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\895B.tmp"C:\Users\Admin\AppData\Local\Temp\895B.tmp"122⤵PID:1672
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-