Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23/02/2024, 10:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-23_38f16b2406a664142876391d0754a935_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-23_38f16b2406a664142876391d0754a935_mafia.exe
Resource
win10v2004-20240221-en
2 signatures
150 seconds
General
-
Target
2024-02-23_38f16b2406a664142876391d0754a935_mafia.exe
-
Size
488KB
-
MD5
38f16b2406a664142876391d0754a935
-
SHA1
3d19ebd231b3bb6ddfed518636e3254352b2894a
-
SHA256
843062369a9e6c02a6d5b757c92b0ca5fb8664b9dbf8b5061345bf8f6ddff559
-
SHA512
a7bf2ab6ad193e325c9f1b61c4119fee6c7b8a3fc744af92ed5a63d55824ca5d92b931d0ff4eb9fe6b163d3e7dbb4ea39f5d1dc4fe4bb24ec233b8a5040b27bc
-
SSDEEP
12288:/U5rCOTeiDGZB6kYW/wAf/WGkcxNatONZ:/UQOJDGZVY8GGkANatON
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1700 40F6.tmp 2996 420F.tmp 2644 4318.tmp 2588 4412.tmp 2696 450C.tmp 2708 45F6.tmp 2460 46E0.tmp 2484 478B.tmp 2456 48A4.tmp 2904 496F.tmp 2924 4A59.tmp 2764 4B62.tmp 2808 4C5C.tmp 3016 4D36.tmp 1912 4E10.tmp 1532 4EFA.tmp 2180 4FE4.tmp 612 50DE.tmp 1004 51D8.tmp 268 52E1.tmp 2740 53FA.tmp 1308 5532.tmp 1716 55FC.tmp 1168 5679.tmp 2284 5706.tmp 576 5782.tmp 2132 57FF.tmp 2300 585D.tmp 2128 58DA.tmp 2992 5947.tmp 2064 59C4.tmp 3012 5A31.tmp 2116 5ABD.tmp 564 5B2A.tmp 1236 5BA7.tmp 1212 5C05.tmp 3060 5CA1.tmp 2332 5D0E.tmp 2324 5D9A.tmp 340 5E17.tmp 1556 5E94.tmp 1252 5F20.tmp 1828 5F8E.tmp 1972 601A.tmp 888 6097.tmp 672 6114.tmp 1376 6190.tmp 1868 61FE.tmp 1936 624C.tmp 2372 62B9.tmp 2100 6326.tmp 1756 6393.tmp 1704 6401.tmp 1940 647D.tmp 2004 64FA.tmp 1528 6587.tmp 2080 65E4.tmp 2580 6651.tmp 2564 66CE.tmp 2632 674B.tmp 2404 67C8.tmp 2108 694E.tmp 2832 6A19.tmp 2464 6A95.tmp -
Loads dropped DLL 64 IoCs
pid Process 2380 2024-02-23_38f16b2406a664142876391d0754a935_mafia.exe 1700 40F6.tmp 2996 420F.tmp 2644 4318.tmp 2588 4412.tmp 2696 450C.tmp 2708 45F6.tmp 2460 46E0.tmp 2484 478B.tmp 2456 48A4.tmp 2904 496F.tmp 2924 4A59.tmp 2764 4B62.tmp 2808 4C5C.tmp 3016 4D36.tmp 1912 4E10.tmp 1532 4EFA.tmp 2180 4FE4.tmp 612 50DE.tmp 1004 51D8.tmp 268 52E1.tmp 2740 53FA.tmp 1308 5532.tmp 1716 55FC.tmp 1168 5679.tmp 2284 5706.tmp 576 5782.tmp 2132 57FF.tmp 2300 585D.tmp 2128 58DA.tmp 2992 5947.tmp 2064 59C4.tmp 3012 5A31.tmp 2116 5ABD.tmp 564 5B2A.tmp 1236 5BA7.tmp 1212 5C05.tmp 3060 5CA1.tmp 2332 5D0E.tmp 2324 5D9A.tmp 340 5E17.tmp 1556 5E94.tmp 1252 5F20.tmp 1828 5F8E.tmp 1972 601A.tmp 888 6097.tmp 672 6114.tmp 1376 6190.tmp 1868 61FE.tmp 1936 624C.tmp 2372 62B9.tmp 2100 6326.tmp 1756 6393.tmp 1704 6401.tmp 1940 647D.tmp 2004 64FA.tmp 1528 6587.tmp 2080 65E4.tmp 2580 6651.tmp 2564 66CE.tmp 2632 674B.tmp 2404 67C8.tmp 2108 694E.tmp 2832 6A19.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2380 wrote to memory of 1700 2380 2024-02-23_38f16b2406a664142876391d0754a935_mafia.exe 28 PID 2380 wrote to memory of 1700 2380 2024-02-23_38f16b2406a664142876391d0754a935_mafia.exe 28 PID 2380 wrote to memory of 1700 2380 2024-02-23_38f16b2406a664142876391d0754a935_mafia.exe 28 PID 2380 wrote to memory of 1700 2380 2024-02-23_38f16b2406a664142876391d0754a935_mafia.exe 28 PID 1700 wrote to memory of 2996 1700 40F6.tmp 29 PID 1700 wrote to memory of 2996 1700 40F6.tmp 29 PID 1700 wrote to memory of 2996 1700 40F6.tmp 29 PID 1700 wrote to memory of 2996 1700 40F6.tmp 29 PID 2996 wrote to memory of 2644 2996 420F.tmp 30 PID 2996 wrote to memory of 2644 2996 420F.tmp 30 PID 2996 wrote to memory of 2644 2996 420F.tmp 30 PID 2996 wrote to memory of 2644 2996 420F.tmp 30 PID 2644 wrote to memory of 2588 2644 4318.tmp 31 PID 2644 wrote to memory of 2588 2644 4318.tmp 31 PID 2644 wrote to memory of 2588 2644 4318.tmp 31 PID 2644 wrote to memory of 2588 2644 4318.tmp 31 PID 2588 wrote to memory of 2696 2588 4412.tmp 32 PID 2588 wrote to memory of 2696 2588 4412.tmp 32 PID 2588 wrote to memory of 2696 2588 4412.tmp 32 PID 2588 wrote to memory of 2696 2588 4412.tmp 32 PID 2696 wrote to memory of 2708 2696 450C.tmp 33 PID 2696 wrote to memory of 2708 2696 450C.tmp 33 PID 2696 wrote to memory of 2708 2696 450C.tmp 33 PID 2696 wrote to memory of 2708 2696 450C.tmp 33 PID 2708 wrote to memory of 2460 2708 45F6.tmp 34 PID 2708 wrote to memory of 2460 2708 45F6.tmp 34 PID 2708 wrote to memory of 2460 2708 45F6.tmp 34 PID 2708 wrote to memory of 2460 2708 45F6.tmp 34 PID 2460 wrote to memory of 2484 2460 46E0.tmp 35 PID 2460 wrote to memory of 2484 2460 46E0.tmp 35 PID 2460 wrote to memory of 2484 2460 46E0.tmp 35 PID 2460 wrote to memory of 2484 2460 46E0.tmp 35 PID 2484 wrote to memory of 2456 2484 478B.tmp 36 PID 2484 wrote to memory of 2456 2484 478B.tmp 36 PID 2484 wrote to memory of 2456 2484 478B.tmp 36 PID 2484 wrote to memory of 2456 2484 478B.tmp 36 PID 2456 wrote to memory of 2904 2456 48A4.tmp 37 PID 2456 wrote to memory of 2904 2456 48A4.tmp 37 PID 2456 wrote to memory of 2904 2456 48A4.tmp 37 PID 2456 wrote to memory of 2904 2456 48A4.tmp 37 PID 2904 wrote to memory of 2924 2904 496F.tmp 38 PID 2904 wrote to memory of 2924 2904 496F.tmp 38 PID 2904 wrote to memory of 2924 2904 496F.tmp 38 PID 2904 wrote to memory of 2924 2904 496F.tmp 38 PID 2924 wrote to memory of 2764 2924 4A59.tmp 39 PID 2924 wrote to memory of 2764 2924 4A59.tmp 39 PID 2924 wrote to memory of 2764 2924 4A59.tmp 39 PID 2924 wrote to memory of 2764 2924 4A59.tmp 39 PID 2764 wrote to memory of 2808 2764 4B62.tmp 40 PID 2764 wrote to memory of 2808 2764 4B62.tmp 40 PID 2764 wrote to memory of 2808 2764 4B62.tmp 40 PID 2764 wrote to memory of 2808 2764 4B62.tmp 40 PID 2808 wrote to memory of 3016 2808 4C5C.tmp 41 PID 2808 wrote to memory of 3016 2808 4C5C.tmp 41 PID 2808 wrote to memory of 3016 2808 4C5C.tmp 41 PID 2808 wrote to memory of 3016 2808 4C5C.tmp 41 PID 3016 wrote to memory of 1912 3016 4D36.tmp 42 PID 3016 wrote to memory of 1912 3016 4D36.tmp 42 PID 3016 wrote to memory of 1912 3016 4D36.tmp 42 PID 3016 wrote to memory of 1912 3016 4D36.tmp 42 PID 1912 wrote to memory of 1532 1912 4E10.tmp 43 PID 1912 wrote to memory of 1532 1912 4E10.tmp 43 PID 1912 wrote to memory of 1532 1912 4E10.tmp 43 PID 1912 wrote to memory of 1532 1912 4E10.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_38f16b2406a664142876391d0754a935_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-23_38f16b2406a664142876391d0754a935_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\40F6.tmp"C:\Users\Admin\AppData\Local\Temp\40F6.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\420F.tmp"C:\Users\Admin\AppData\Local\Temp\420F.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\4318.tmp"C:\Users\Admin\AppData\Local\Temp\4318.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\4412.tmp"C:\Users\Admin\AppData\Local\Temp\4412.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\450C.tmp"C:\Users\Admin\AppData\Local\Temp\450C.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\45F6.tmp"C:\Users\Admin\AppData\Local\Temp\45F6.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\46E0.tmp"C:\Users\Admin\AppData\Local\Temp\46E0.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\478B.tmp"C:\Users\Admin\AppData\Local\Temp\478B.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\48A4.tmp"C:\Users\Admin\AppData\Local\Temp\48A4.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\496F.tmp"C:\Users\Admin\AppData\Local\Temp\496F.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\4A59.tmp"C:\Users\Admin\AppData\Local\Temp\4A59.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\4B62.tmp"C:\Users\Admin\AppData\Local\Temp\4B62.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\4C5C.tmp"C:\Users\Admin\AppData\Local\Temp\4C5C.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\4D36.tmp"C:\Users\Admin\AppData\Local\Temp\4D36.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\4EFA.tmp"C:\Users\Admin\AppData\Local\Temp\4EFA.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\4FE4.tmp"C:\Users\Admin\AppData\Local\Temp\4FE4.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\50DE.tmp"C:\Users\Admin\AppData\Local\Temp\50DE.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:612 -
C:\Users\Admin\AppData\Local\Temp\51D8.tmp"C:\Users\Admin\AppData\Local\Temp\51D8.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\52E1.tmp"C:\Users\Admin\AppData\Local\Temp\52E1.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:268 -
C:\Users\Admin\AppData\Local\Temp\53FA.tmp"C:\Users\Admin\AppData\Local\Temp\53FA.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\5532.tmp"C:\Users\Admin\AppData\Local\Temp\5532.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\55FC.tmp"C:\Users\Admin\AppData\Local\Temp\55FC.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\5679.tmp"C:\Users\Admin\AppData\Local\Temp\5679.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\5706.tmp"C:\Users\Admin\AppData\Local\Temp\5706.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\5782.tmp"C:\Users\Admin\AppData\Local\Temp\5782.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:576 -
C:\Users\Admin\AppData\Local\Temp\57FF.tmp"C:\Users\Admin\AppData\Local\Temp\57FF.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\585D.tmp"C:\Users\Admin\AppData\Local\Temp\585D.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\58DA.tmp"C:\Users\Admin\AppData\Local\Temp\58DA.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\5947.tmp"C:\Users\Admin\AppData\Local\Temp\5947.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\59C4.tmp"C:\Users\Admin\AppData\Local\Temp\59C4.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\5A31.tmp"C:\Users\Admin\AppData\Local\Temp\5A31.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\5ABD.tmp"C:\Users\Admin\AppData\Local\Temp\5ABD.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\5B2A.tmp"C:\Users\Admin\AppData\Local\Temp\5B2A.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:564 -
C:\Users\Admin\AppData\Local\Temp\5BA7.tmp"C:\Users\Admin\AppData\Local\Temp\5BA7.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\5C05.tmp"C:\Users\Admin\AppData\Local\Temp\5C05.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\5CA1.tmp"C:\Users\Admin\AppData\Local\Temp\5CA1.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\5D0E.tmp"C:\Users\Admin\AppData\Local\Temp\5D0E.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\5D9A.tmp"C:\Users\Admin\AppData\Local\Temp\5D9A.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\5E17.tmp"C:\Users\Admin\AppData\Local\Temp\5E17.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:340 -
C:\Users\Admin\AppData\Local\Temp\5E94.tmp"C:\Users\Admin\AppData\Local\Temp\5E94.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\5F20.tmp"C:\Users\Admin\AppData\Local\Temp\5F20.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\5F8E.tmp"C:\Users\Admin\AppData\Local\Temp\5F8E.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\601A.tmp"C:\Users\Admin\AppData\Local\Temp\601A.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\6097.tmp"C:\Users\Admin\AppData\Local\Temp\6097.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:888 -
C:\Users\Admin\AppData\Local\Temp\6114.tmp"C:\Users\Admin\AppData\Local\Temp\6114.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:672 -
C:\Users\Admin\AppData\Local\Temp\6190.tmp"C:\Users\Admin\AppData\Local\Temp\6190.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\61FE.tmp"C:\Users\Admin\AppData\Local\Temp\61FE.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\624C.tmp"C:\Users\Admin\AppData\Local\Temp\624C.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\62B9.tmp"C:\Users\Admin\AppData\Local\Temp\62B9.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\6326.tmp"C:\Users\Admin\AppData\Local\Temp\6326.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\6393.tmp"C:\Users\Admin\AppData\Local\Temp\6393.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\6401.tmp"C:\Users\Admin\AppData\Local\Temp\6401.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\647D.tmp"C:\Users\Admin\AppData\Local\Temp\647D.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\64FA.tmp"C:\Users\Admin\AppData\Local\Temp\64FA.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\6587.tmp"C:\Users\Admin\AppData\Local\Temp\6587.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\65E4.tmp"C:\Users\Admin\AppData\Local\Temp\65E4.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\6651.tmp"C:\Users\Admin\AppData\Local\Temp\6651.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\66CE.tmp"C:\Users\Admin\AppData\Local\Temp\66CE.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\674B.tmp"C:\Users\Admin\AppData\Local\Temp\674B.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\67C8.tmp"C:\Users\Admin\AppData\Local\Temp\67C8.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\694E.tmp"C:\Users\Admin\AppData\Local\Temp\694E.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\6A19.tmp"C:\Users\Admin\AppData\Local\Temp\6A19.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\6A95.tmp"C:\Users\Admin\AppData\Local\Temp\6A95.tmp"65⤵
- Executes dropped EXE
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\6B03.tmp"C:\Users\Admin\AppData\Local\Temp\6B03.tmp"66⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\6B7F.tmp"C:\Users\Admin\AppData\Local\Temp\6B7F.tmp"67⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\6BED.tmp"C:\Users\Admin\AppData\Local\Temp\6BED.tmp"68⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\6C5A.tmp"C:\Users\Admin\AppData\Local\Temp\6C5A.tmp"69⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\6CC7.tmp"C:\Users\Admin\AppData\Local\Temp\6CC7.tmp"70⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\6D53.tmp"C:\Users\Admin\AppData\Local\Temp\6D53.tmp"71⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\6DD0.tmp"C:\Users\Admin\AppData\Local\Temp\6DD0.tmp"72⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\6E3D.tmp"C:\Users\Admin\AppData\Local\Temp\6E3D.tmp"73⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\6EBA.tmp"C:\Users\Admin\AppData\Local\Temp\6EBA.tmp"74⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\6F27.tmp"C:\Users\Admin\AppData\Local\Temp\6F27.tmp"75⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\6F85.tmp"C:\Users\Admin\AppData\Local\Temp\6F85.tmp"76⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\6FE3.tmp"C:\Users\Admin\AppData\Local\Temp\6FE3.tmp"77⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\7050.tmp"C:\Users\Admin\AppData\Local\Temp\7050.tmp"78⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\70BD.tmp"C:\Users\Admin\AppData\Local\Temp\70BD.tmp"79⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\7169.tmp"C:\Users\Admin\AppData\Local\Temp\7169.tmp"80⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\71D6.tmp"C:\Users\Admin\AppData\Local\Temp\71D6.tmp"81⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\7253.tmp"C:\Users\Admin\AppData\Local\Temp\7253.tmp"82⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\72EF.tmp"C:\Users\Admin\AppData\Local\Temp\72EF.tmp"83⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\735C.tmp"C:\Users\Admin\AppData\Local\Temp\735C.tmp"84⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\73AA.tmp"C:\Users\Admin\AppData\Local\Temp\73AA.tmp"85⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\7436.tmp"C:\Users\Admin\AppData\Local\Temp\7436.tmp"86⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\7494.tmp"C:\Users\Admin\AppData\Local\Temp\7494.tmp"87⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\7501.tmp"C:\Users\Admin\AppData\Local\Temp\7501.tmp"88⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\755F.tmp"C:\Users\Admin\AppData\Local\Temp\755F.tmp"89⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\75DB.tmp"C:\Users\Admin\AppData\Local\Temp\75DB.tmp"90⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\7658.tmp"C:\Users\Admin\AppData\Local\Temp\7658.tmp"91⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\76B6.tmp"C:\Users\Admin\AppData\Local\Temp\76B6.tmp"92⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"93⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\77BF.tmp"C:\Users\Admin\AppData\Local\Temp\77BF.tmp"94⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\785B.tmp"C:\Users\Admin\AppData\Local\Temp\785B.tmp"95⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\78A9.tmp"C:\Users\Admin\AppData\Local\Temp\78A9.tmp"96⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\7907.tmp"C:\Users\Admin\AppData\Local\Temp\7907.tmp"97⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\7993.tmp"C:\Users\Admin\AppData\Local\Temp\7993.tmp"98⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\79E1.tmp"C:\Users\Admin\AppData\Local\Temp\79E1.tmp"99⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\7A4E.tmp"C:\Users\Admin\AppData\Local\Temp\7A4E.tmp"100⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\7ABB.tmp"C:\Users\Admin\AppData\Local\Temp\7ABB.tmp"101⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\7B29.tmp"C:\Users\Admin\AppData\Local\Temp\7B29.tmp"102⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\7BA5.tmp"C:\Users\Admin\AppData\Local\Temp\7BA5.tmp"103⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\7C03.tmp"C:\Users\Admin\AppData\Local\Temp\7C03.tmp"104⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\7C61.tmp"C:\Users\Admin\AppData\Local\Temp\7C61.tmp"105⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\7CDD.tmp"C:\Users\Admin\AppData\Local\Temp\7CDD.tmp"106⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\7D6A.tmp"C:\Users\Admin\AppData\Local\Temp\7D6A.tmp"107⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\7E83.tmp"C:\Users\Admin\AppData\Local\Temp\7E83.tmp"108⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\7F0F.tmp"C:\Users\Admin\AppData\Local\Temp\7F0F.tmp"109⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\7F9B.tmp"C:\Users\Admin\AppData\Local\Temp\7F9B.tmp"110⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\7FF9.tmp"C:\Users\Admin\AppData\Local\Temp\7FF9.tmp"111⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\8066.tmp"C:\Users\Admin\AppData\Local\Temp\8066.tmp"112⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\80D3.tmp"C:\Users\Admin\AppData\Local\Temp\80D3.tmp"113⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\8141.tmp"C:\Users\Admin\AppData\Local\Temp\8141.tmp"114⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\81BD.tmp"C:\Users\Admin\AppData\Local\Temp\81BD.tmp"115⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\820B.tmp"C:\Users\Admin\AppData\Local\Temp\820B.tmp"116⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\8279.tmp"C:\Users\Admin\AppData\Local\Temp\8279.tmp"117⤵PID:344
-
C:\Users\Admin\AppData\Local\Temp\82F5.tmp"C:\Users\Admin\AppData\Local\Temp\82F5.tmp"118⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\8363.tmp"C:\Users\Admin\AppData\Local\Temp\8363.tmp"119⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\83C0.tmp"C:\Users\Admin\AppData\Local\Temp\83C0.tmp"120⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\844D.tmp"C:\Users\Admin\AppData\Local\Temp\844D.tmp"121⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\84BA.tmp"C:\Users\Admin\AppData\Local\Temp\84BA.tmp"122⤵PID:1704
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-