Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240319-en -
resource tags
arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system -
submitted
28/03/2024, 07:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-03-28_c90f0c851f9a34f546ef7c86c713fac3_mafia.exe
Resource
win7-20240319-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-28_c90f0c851f9a34f546ef7c86c713fac3_mafia.exe
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
2024-03-28_c90f0c851f9a34f546ef7c86c713fac3_mafia.exe
-
Size
527KB
-
MD5
c90f0c851f9a34f546ef7c86c713fac3
-
SHA1
726c6bfd47b660a83e821908a380a76578b4e634
-
SHA256
9b72967d9c5b7870103d22530ab2e3c345355ff762798634fc93a56eef9c49ed
-
SHA512
a935c04ea215ed2956b7991952e975ff252672d9ab7b7858470950b9645c9aad69bd4f32d4ad52ade5f9d4d023cc6eb4277e5eac22d1db844ac85c7e094cfef1
-
SSDEEP
12288:fU5rCOTeid4bvgiNmaZ6P/mFlfvFpYrZP8EDZu:fUQOJd4bbNma+/mDXwPBDo
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2252 48A4.tmp 2708 4921.tmp 1100 4A78.tmp 2828 4BA0.tmp 3068 4C4C.tmp 2620 4CF8.tmp 2848 4DE2.tmp 2660 4ECC.tmp 2840 4FD5.tmp 2448 50AF.tmp 2588 514B.tmp 2416 5264.tmp 2356 538C.tmp 2924 5476.tmp 1912 558F.tmp 592 564A.tmp 1640 5754.tmp 1084 582E.tmp 612 5937.tmp 2488 5A12.tmp 272 5A7F.tmp 1644 5B98.tmp 2724 5C82.tmp 2716 5D0E.tmp 1676 5D8B.tmp 1684 5DE8.tmp 1648 5E56.tmp 2788 5EC3.tmp 2608 5F20.tmp 2516 5F8E.tmp 1232 5FFB.tmp 1724 6068.tmp 2304 60E5.tmp 2164 6152.tmp 1900 61CF.tmp 2132 623C.tmp 1960 62A9.tmp 3060 6326.tmp 2276 6384.tmp 1700 63F1.tmp 1812 646E.tmp 2024 64DB.tmp 952 6548.tmp 1948 65E4.tmp 3032 6661.tmp 1000 66DE.tmp 2352 675B.tmp 2992 67C8.tmp 2876 6835.tmp 552 6893.tmp 2228 690F.tmp 1692 697D.tmp 2036 6A09.tmp 752 6A67.tmp 1600 6AE3.tmp 2360 6B51.tmp 856 6BCD.tmp 2244 6C3B.tmp 2700 6C98.tmp 2320 6D15.tmp 2984 6D82.tmp 1388 6DEF.tmp 2572 6E6C.tmp 2640 6ECA.tmp -
Loads dropped DLL 64 IoCs
pid Process 2140 2024-03-28_c90f0c851f9a34f546ef7c86c713fac3_mafia.exe 2252 48A4.tmp 2708 4921.tmp 1100 4A78.tmp 2828 4BA0.tmp 3068 4C4C.tmp 2620 4CF8.tmp 2848 4DE2.tmp 2660 4ECC.tmp 2840 4FD5.tmp 2448 50AF.tmp 2588 514B.tmp 2416 5264.tmp 2356 538C.tmp 2924 5476.tmp 1912 558F.tmp 592 564A.tmp 1640 5754.tmp 1084 582E.tmp 612 5937.tmp 2488 5A12.tmp 272 5A7F.tmp 1644 5B98.tmp 2724 5C82.tmp 2716 5D0E.tmp 1676 5D8B.tmp 1684 5DE8.tmp 1648 5E56.tmp 2788 5EC3.tmp 2608 5F20.tmp 2516 5F8E.tmp 1232 5FFB.tmp 1724 6068.tmp 2304 60E5.tmp 2164 6152.tmp 1900 61CF.tmp 2132 623C.tmp 1960 62A9.tmp 3060 6326.tmp 2276 6384.tmp 1700 63F1.tmp 1812 646E.tmp 2024 64DB.tmp 952 6548.tmp 1948 65E4.tmp 3032 6661.tmp 1000 66DE.tmp 2352 675B.tmp 2992 67C8.tmp 2876 6835.tmp 552 6893.tmp 2228 690F.tmp 1692 697D.tmp 2036 6A09.tmp 752 6A67.tmp 1600 6AE3.tmp 2360 6B51.tmp 856 6BCD.tmp 2244 6C3B.tmp 2700 6C98.tmp 2320 6D15.tmp 2984 6D82.tmp 1388 6DEF.tmp 2572 6E6C.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2140 wrote to memory of 2252 2140 2024-03-28_c90f0c851f9a34f546ef7c86c713fac3_mafia.exe 28 PID 2140 wrote to memory of 2252 2140 2024-03-28_c90f0c851f9a34f546ef7c86c713fac3_mafia.exe 28 PID 2140 wrote to memory of 2252 2140 2024-03-28_c90f0c851f9a34f546ef7c86c713fac3_mafia.exe 28 PID 2140 wrote to memory of 2252 2140 2024-03-28_c90f0c851f9a34f546ef7c86c713fac3_mafia.exe 28 PID 2252 wrote to memory of 2708 2252 48A4.tmp 29 PID 2252 wrote to memory of 2708 2252 48A4.tmp 29 PID 2252 wrote to memory of 2708 2252 48A4.tmp 29 PID 2252 wrote to memory of 2708 2252 48A4.tmp 29 PID 2708 wrote to memory of 1100 2708 4921.tmp 30 PID 2708 wrote to memory of 1100 2708 4921.tmp 30 PID 2708 wrote to memory of 1100 2708 4921.tmp 30 PID 2708 wrote to memory of 1100 2708 4921.tmp 30 PID 1100 wrote to memory of 2828 1100 4A78.tmp 31 PID 1100 wrote to memory of 2828 1100 4A78.tmp 31 PID 1100 wrote to memory of 2828 1100 4A78.tmp 31 PID 1100 wrote to memory of 2828 1100 4A78.tmp 31 PID 2828 wrote to memory of 3068 2828 4BA0.tmp 32 PID 2828 wrote to memory of 3068 2828 4BA0.tmp 32 PID 2828 wrote to memory of 3068 2828 4BA0.tmp 32 PID 2828 wrote to memory of 3068 2828 4BA0.tmp 32 PID 3068 wrote to memory of 2620 3068 4C4C.tmp 33 PID 3068 wrote to memory of 2620 3068 4C4C.tmp 33 PID 3068 wrote to memory of 2620 3068 4C4C.tmp 33 PID 3068 wrote to memory of 2620 3068 4C4C.tmp 33 PID 2620 wrote to memory of 2848 2620 4CF8.tmp 34 PID 2620 wrote to memory of 2848 2620 4CF8.tmp 34 PID 2620 wrote to memory of 2848 2620 4CF8.tmp 34 PID 2620 wrote to memory of 2848 2620 4CF8.tmp 34 PID 2848 wrote to memory of 2660 2848 4DE2.tmp 35 PID 2848 wrote to memory of 2660 2848 4DE2.tmp 35 PID 2848 wrote to memory of 2660 2848 4DE2.tmp 35 PID 2848 wrote to memory of 2660 2848 4DE2.tmp 35 PID 2660 wrote to memory of 2840 2660 4ECC.tmp 36 PID 2660 wrote to memory of 2840 2660 4ECC.tmp 36 PID 2660 wrote to memory of 2840 2660 4ECC.tmp 36 PID 2660 wrote to memory of 2840 2660 4ECC.tmp 36 PID 2840 wrote to memory of 2448 2840 4FD5.tmp 37 PID 2840 wrote to memory of 2448 2840 4FD5.tmp 37 PID 2840 wrote to memory of 2448 2840 4FD5.tmp 37 PID 2840 wrote to memory of 2448 2840 4FD5.tmp 37 PID 2448 wrote to memory of 2588 2448 50AF.tmp 38 PID 2448 wrote to memory of 2588 2448 50AF.tmp 38 PID 2448 wrote to memory of 2588 2448 50AF.tmp 38 PID 2448 wrote to memory of 2588 2448 50AF.tmp 38 PID 2588 wrote to memory of 2416 2588 514B.tmp 39 PID 2588 wrote to memory of 2416 2588 514B.tmp 39 PID 2588 wrote to memory of 2416 2588 514B.tmp 39 PID 2588 wrote to memory of 2416 2588 514B.tmp 39 PID 2416 wrote to memory of 2356 2416 5264.tmp 40 PID 2416 wrote to memory of 2356 2416 5264.tmp 40 PID 2416 wrote to memory of 2356 2416 5264.tmp 40 PID 2416 wrote to memory of 2356 2416 5264.tmp 40 PID 2356 wrote to memory of 2924 2356 538C.tmp 41 PID 2356 wrote to memory of 2924 2356 538C.tmp 41 PID 2356 wrote to memory of 2924 2356 538C.tmp 41 PID 2356 wrote to memory of 2924 2356 538C.tmp 41 PID 2924 wrote to memory of 1912 2924 5476.tmp 42 PID 2924 wrote to memory of 1912 2924 5476.tmp 42 PID 2924 wrote to memory of 1912 2924 5476.tmp 42 PID 2924 wrote to memory of 1912 2924 5476.tmp 42 PID 1912 wrote to memory of 592 1912 558F.tmp 43 PID 1912 wrote to memory of 592 1912 558F.tmp 43 PID 1912 wrote to memory of 592 1912 558F.tmp 43 PID 1912 wrote to memory of 592 1912 558F.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_c90f0c851f9a34f546ef7c86c713fac3_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-28_c90f0c851f9a34f546ef7c86c713fac3_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\48A4.tmp"C:\Users\Admin\AppData\Local\Temp\48A4.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\4921.tmp"C:\Users\Admin\AppData\Local\Temp\4921.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\4A78.tmp"C:\Users\Admin\AppData\Local\Temp\4A78.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\4BA0.tmp"C:\Users\Admin\AppData\Local\Temp\4BA0.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\4C4C.tmp"C:\Users\Admin\AppData\Local\Temp\4C4C.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\4CF8.tmp"C:\Users\Admin\AppData\Local\Temp\4CF8.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\4DE2.tmp"C:\Users\Admin\AppData\Local\Temp\4DE2.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\50AF.tmp"C:\Users\Admin\AppData\Local\Temp\50AF.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\514B.tmp"C:\Users\Admin\AppData\Local\Temp\514B.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\5264.tmp"C:\Users\Admin\AppData\Local\Temp\5264.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\538C.tmp"C:\Users\Admin\AppData\Local\Temp\538C.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\5476.tmp"C:\Users\Admin\AppData\Local\Temp\5476.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\558F.tmp"C:\Users\Admin\AppData\Local\Temp\558F.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\564A.tmp"C:\Users\Admin\AppData\Local\Temp\564A.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:592 -
C:\Users\Admin\AppData\Local\Temp\5754.tmp"C:\Users\Admin\AppData\Local\Temp\5754.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\582E.tmp"C:\Users\Admin\AppData\Local\Temp\582E.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\5937.tmp"C:\Users\Admin\AppData\Local\Temp\5937.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:612 -
C:\Users\Admin\AppData\Local\Temp\5A12.tmp"C:\Users\Admin\AppData\Local\Temp\5A12.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\5A7F.tmp"C:\Users\Admin\AppData\Local\Temp\5A7F.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:272 -
C:\Users\Admin\AppData\Local\Temp\5B98.tmp"C:\Users\Admin\AppData\Local\Temp\5B98.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\5C82.tmp"C:\Users\Admin\AppData\Local\Temp\5C82.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\5D0E.tmp"C:\Users\Admin\AppData\Local\Temp\5D0E.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\5D8B.tmp"C:\Users\Admin\AppData\Local\Temp\5D8B.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\5DE8.tmp"C:\Users\Admin\AppData\Local\Temp\5DE8.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\5E56.tmp"C:\Users\Admin\AppData\Local\Temp\5E56.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\5EC3.tmp"C:\Users\Admin\AppData\Local\Temp\5EC3.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\5F20.tmp"C:\Users\Admin\AppData\Local\Temp\5F20.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\5F8E.tmp"C:\Users\Admin\AppData\Local\Temp\5F8E.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\5FFB.tmp"C:\Users\Admin\AppData\Local\Temp\5FFB.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\6068.tmp"C:\Users\Admin\AppData\Local\Temp\6068.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\60E5.tmp"C:\Users\Admin\AppData\Local\Temp\60E5.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\6152.tmp"C:\Users\Admin\AppData\Local\Temp\6152.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\61CF.tmp"C:\Users\Admin\AppData\Local\Temp\61CF.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\623C.tmp"C:\Users\Admin\AppData\Local\Temp\623C.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\62A9.tmp"C:\Users\Admin\AppData\Local\Temp\62A9.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\6326.tmp"C:\Users\Admin\AppData\Local\Temp\6326.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\6384.tmp"C:\Users\Admin\AppData\Local\Temp\6384.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\63F1.tmp"C:\Users\Admin\AppData\Local\Temp\63F1.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\646E.tmp"C:\Users\Admin\AppData\Local\Temp\646E.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\64DB.tmp"C:\Users\Admin\AppData\Local\Temp\64DB.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\6548.tmp"C:\Users\Admin\AppData\Local\Temp\6548.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:952 -
C:\Users\Admin\AppData\Local\Temp\65E4.tmp"C:\Users\Admin\AppData\Local\Temp\65E4.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\6661.tmp"C:\Users\Admin\AppData\Local\Temp\6661.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\66DE.tmp"C:\Users\Admin\AppData\Local\Temp\66DE.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\675B.tmp"C:\Users\Admin\AppData\Local\Temp\675B.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\67C8.tmp"C:\Users\Admin\AppData\Local\Temp\67C8.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\6835.tmp"C:\Users\Admin\AppData\Local\Temp\6835.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\6893.tmp"C:\Users\Admin\AppData\Local\Temp\6893.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:552 -
C:\Users\Admin\AppData\Local\Temp\690F.tmp"C:\Users\Admin\AppData\Local\Temp\690F.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\697D.tmp"C:\Users\Admin\AppData\Local\Temp\697D.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\6A09.tmp"C:\Users\Admin\AppData\Local\Temp\6A09.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\6A67.tmp"C:\Users\Admin\AppData\Local\Temp\6A67.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:752 -
C:\Users\Admin\AppData\Local\Temp\6AE3.tmp"C:\Users\Admin\AppData\Local\Temp\6AE3.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\6B51.tmp"C:\Users\Admin\AppData\Local\Temp\6B51.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\6BCD.tmp"C:\Users\Admin\AppData\Local\Temp\6BCD.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:856 -
C:\Users\Admin\AppData\Local\Temp\6C3B.tmp"C:\Users\Admin\AppData\Local\Temp\6C3B.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\6C98.tmp"C:\Users\Admin\AppData\Local\Temp\6C98.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\6D15.tmp"C:\Users\Admin\AppData\Local\Temp\6D15.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\6D82.tmp"C:\Users\Admin\AppData\Local\Temp\6D82.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\6DEF.tmp"C:\Users\Admin\AppData\Local\Temp\6DEF.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\6E6C.tmp"C:\Users\Admin\AppData\Local\Temp\6E6C.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\6ECA.tmp"C:\Users\Admin\AppData\Local\Temp\6ECA.tmp"65⤵
- Executes dropped EXE
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\6F37.tmp"C:\Users\Admin\AppData\Local\Temp\6F37.tmp"66⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\6FB4.tmp"C:\Users\Admin\AppData\Local\Temp\6FB4.tmp"67⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\70AD.tmp"C:\Users\Admin\AppData\Local\Temp\70AD.tmp"68⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\7149.tmp"C:\Users\Admin\AppData\Local\Temp\7149.tmp"69⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\71C6.tmp"C:\Users\Admin\AppData\Local\Temp\71C6.tmp"70⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\7243.tmp"C:\Users\Admin\AppData\Local\Temp\7243.tmp"71⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\72C0.tmp"C:\Users\Admin\AppData\Local\Temp\72C0.tmp"72⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\733D.tmp"C:\Users\Admin\AppData\Local\Temp\733D.tmp"73⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\73AA.tmp"C:\Users\Admin\AppData\Local\Temp\73AA.tmp"74⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"75⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\7494.tmp"C:\Users\Admin\AppData\Local\Temp\7494.tmp"76⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"77⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\757E.tmp"C:\Users\Admin\AppData\Local\Temp\757E.tmp"78⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\75EB.tmp"C:\Users\Admin\AppData\Local\Temp\75EB.tmp"79⤵PID:268
-
C:\Users\Admin\AppData\Local\Temp\7668.tmp"C:\Users\Admin\AppData\Local\Temp\7668.tmp"80⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\76D5.tmp"C:\Users\Admin\AppData\Local\Temp\76D5.tmp"81⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\7752.tmp"C:\Users\Admin\AppData\Local\Temp\7752.tmp"82⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\77BF.tmp"C:\Users\Admin\AppData\Local\Temp\77BF.tmp"83⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\783C.tmp"C:\Users\Admin\AppData\Local\Temp\783C.tmp"84⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\7899.tmp"C:\Users\Admin\AppData\Local\Temp\7899.tmp"85⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\7907.tmp"C:\Users\Admin\AppData\Local\Temp\7907.tmp"86⤵PID:364
-
C:\Users\Admin\AppData\Local\Temp\7964.tmp"C:\Users\Admin\AppData\Local\Temp\7964.tmp"87⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\79E1.tmp"C:\Users\Admin\AppData\Local\Temp\79E1.tmp"88⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\7A5E.tmp"C:\Users\Admin\AppData\Local\Temp\7A5E.tmp"89⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\7ADB.tmp"C:\Users\Admin\AppData\Local\Temp\7ADB.tmp"90⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\7B38.tmp"C:\Users\Admin\AppData\Local\Temp\7B38.tmp"91⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\7BB5.tmp"C:\Users\Admin\AppData\Local\Temp\7BB5.tmp"92⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\7C32.tmp"C:\Users\Admin\AppData\Local\Temp\7C32.tmp"93⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\7C8F.tmp"C:\Users\Admin\AppData\Local\Temp\7C8F.tmp"94⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\7CED.tmp"C:\Users\Admin\AppData\Local\Temp\7CED.tmp"95⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\7D6A.tmp"C:\Users\Admin\AppData\Local\Temp\7D6A.tmp"96⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\7DD7.tmp"C:\Users\Admin\AppData\Local\Temp\7DD7.tmp"97⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\7E44.tmp"C:\Users\Admin\AppData\Local\Temp\7E44.tmp"98⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\7EA2.tmp"C:\Users\Admin\AppData\Local\Temp\7EA2.tmp"99⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\7F1F.tmp"C:\Users\Admin\AppData\Local\Temp\7F1F.tmp"100⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\7F8C.tmp"C:\Users\Admin\AppData\Local\Temp\7F8C.tmp"101⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\7FDA.tmp"C:\Users\Admin\AppData\Local\Temp\7FDA.tmp"102⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\8047.tmp"C:\Users\Admin\AppData\Local\Temp\8047.tmp"103⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\80C4.tmp"C:\Users\Admin\AppData\Local\Temp\80C4.tmp"104⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\8131.tmp"C:\Users\Admin\AppData\Local\Temp\8131.tmp"105⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\81AE.tmp"C:\Users\Admin\AppData\Local\Temp\81AE.tmp"106⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\821B.tmp"C:\Users\Admin\AppData\Local\Temp\821B.tmp"107⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\82A7.tmp"C:\Users\Admin\AppData\Local\Temp\82A7.tmp"108⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\8334.tmp"C:\Users\Admin\AppData\Local\Temp\8334.tmp"109⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\83B1.tmp"C:\Users\Admin\AppData\Local\Temp\83B1.tmp"110⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\841E.tmp"C:\Users\Admin\AppData\Local\Temp\841E.tmp"111⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\849B.tmp"C:\Users\Admin\AppData\Local\Temp\849B.tmp"112⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\8546.tmp"C:\Users\Admin\AppData\Local\Temp\8546.tmp"113⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\85B3.tmp"C:\Users\Admin\AppData\Local\Temp\85B3.tmp"114⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\8611.tmp"C:\Users\Admin\AppData\Local\Temp\8611.tmp"115⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\868E.tmp"C:\Users\Admin\AppData\Local\Temp\868E.tmp"116⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\870B.tmp"C:\Users\Admin\AppData\Local\Temp\870B.tmp"117⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\8778.tmp"C:\Users\Admin\AppData\Local\Temp\8778.tmp"118⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\87E5.tmp"C:\Users\Admin\AppData\Local\Temp\87E5.tmp"119⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\8843.tmp"C:\Users\Admin\AppData\Local\Temp\8843.tmp"120⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\88B0.tmp"C:\Users\Admin\AppData\Local\Temp\88B0.tmp"121⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\891D.tmp"C:\Users\Admin\AppData\Local\Temp\891D.tmp"122⤵PID:1752
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-