Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08-04-2024 22:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-08_0cdf896a384a861e2d5be9861b20955a_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-08_0cdf896a384a861e2d5be9861b20955a_mafia.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-04-08_0cdf896a384a861e2d5be9861b20955a_mafia.exe
-
Size
487KB
-
MD5
0cdf896a384a861e2d5be9861b20955a
-
SHA1
83b8edf83d1a49c7528bb515035e85048ce8e437
-
SHA256
335d1d42a3eb71b887da9b61cd57920689685f54c3567d799da4387857c01c30
-
SHA512
0902ab771b49d1881a2335efb1b9acbc46c54df50089001c2f8e730f3299b8f0da886853bdebf5ea11e9c97850336b3455d88beb1776b0f8b999f6ca9f449bce
-
SSDEEP
12288:yU5rCOTeiNHvzTZIihMGyLcP89Unt9SYXSCqPFikYp8JbZ:yUQOJNHvxNyc5tDXS5fCEb
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2980 4E9D.tmp 3028 4F77.tmp 2608 5071.tmp 2504 516A.tmp 2408 5226.tmp 2560 531F.tmp 2428 53EA.tmp 2512 54B5.tmp 2204 5570.tmp 2200 5689.tmp 2924 56D7.tmp 2308 5792.tmp 764 588C.tmp 1108 5947.tmp 2740 5A21.tmp 2648 5ADC.tmp 2752 5BB7.tmp 1200 5C72.tmp 1216 5D3D.tmp 996 5E08.tmp 1644 5EB3.tmp 1728 5F6E.tmp 2656 602A.tmp 2388 6133.tmp 320 623C.tmp 1708 62D8.tmp 1652 6345.tmp 1772 63B3.tmp 2496 643F.tmp 2060 64BC.tmp 2836 6529.tmp 2216 65A6.tmp 2212 6613.tmp 1880 6680.tmp 1816 66DE.tmp 1008 674B.tmp 1572 67C8.tmp 1996 6835.tmp 1976 68A2.tmp 1564 692F.tmp 2612 698C.tmp 2016 69F9.tmp 1828 6A67.tmp 2172 6AE3.tmp 1960 6B60.tmp 596 6BBE.tmp 1460 6C3B.tmp 2372 6CA8.tmp 2208 6D25.tmp 3060 6DA1.tmp 1428 6E1E.tmp 2112 6E8B.tmp 1464 6EF9.tmp 2932 6F66.tmp 1604 6FE3.tmp 2252 709E.tmp 2992 712A.tmp 2540 71A7.tmp 2628 7224.tmp 2556 72B0.tmp 1500 732D.tmp 1884 739A.tmp 2712 7407.tmp 2692 7484.tmp -
Loads dropped DLL 64 IoCs
pid Process 1756 2024-04-08_0cdf896a384a861e2d5be9861b20955a_mafia.exe 2980 4E9D.tmp 3028 4F77.tmp 2608 5071.tmp 2504 516A.tmp 2408 5226.tmp 2560 531F.tmp 2428 53EA.tmp 2512 54B5.tmp 2204 5570.tmp 2200 5689.tmp 2924 56D7.tmp 2308 5792.tmp 764 588C.tmp 1108 5947.tmp 2740 5A21.tmp 2648 5ADC.tmp 2752 5BB7.tmp 1200 5C72.tmp 1216 5D3D.tmp 996 5E08.tmp 1644 5EB3.tmp 1728 5F6E.tmp 2656 602A.tmp 2388 6133.tmp 320 623C.tmp 1708 62D8.tmp 1652 6345.tmp 1772 63B3.tmp 2496 643F.tmp 2060 64BC.tmp 2836 6529.tmp 2216 65A6.tmp 2212 6613.tmp 1880 6680.tmp 1816 66DE.tmp 1008 674B.tmp 1572 67C8.tmp 1996 6835.tmp 1976 68A2.tmp 1564 692F.tmp 2612 698C.tmp 2016 69F9.tmp 1828 6A67.tmp 2172 6AE3.tmp 1960 6B60.tmp 596 6BBE.tmp 1460 6C3B.tmp 2372 6CA8.tmp 2208 6D25.tmp 3060 6DA1.tmp 1428 6E1E.tmp 2112 6E8B.tmp 1464 6EF9.tmp 2932 6F66.tmp 1604 6FE3.tmp 2252 709E.tmp 2992 712A.tmp 2540 71A7.tmp 2628 7224.tmp 2556 72B0.tmp 1500 732D.tmp 1884 739A.tmp 2712 7407.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1756 wrote to memory of 2980 1756 2024-04-08_0cdf896a384a861e2d5be9861b20955a_mafia.exe 28 PID 1756 wrote to memory of 2980 1756 2024-04-08_0cdf896a384a861e2d5be9861b20955a_mafia.exe 28 PID 1756 wrote to memory of 2980 1756 2024-04-08_0cdf896a384a861e2d5be9861b20955a_mafia.exe 28 PID 1756 wrote to memory of 2980 1756 2024-04-08_0cdf896a384a861e2d5be9861b20955a_mafia.exe 28 PID 2980 wrote to memory of 3028 2980 4E9D.tmp 29 PID 2980 wrote to memory of 3028 2980 4E9D.tmp 29 PID 2980 wrote to memory of 3028 2980 4E9D.tmp 29 PID 2980 wrote to memory of 3028 2980 4E9D.tmp 29 PID 3028 wrote to memory of 2608 3028 4F77.tmp 30 PID 3028 wrote to memory of 2608 3028 4F77.tmp 30 PID 3028 wrote to memory of 2608 3028 4F77.tmp 30 PID 3028 wrote to memory of 2608 3028 4F77.tmp 30 PID 2608 wrote to memory of 2504 2608 5071.tmp 31 PID 2608 wrote to memory of 2504 2608 5071.tmp 31 PID 2608 wrote to memory of 2504 2608 5071.tmp 31 PID 2608 wrote to memory of 2504 2608 5071.tmp 31 PID 2504 wrote to memory of 2408 2504 516A.tmp 32 PID 2504 wrote to memory of 2408 2504 516A.tmp 32 PID 2504 wrote to memory of 2408 2504 516A.tmp 32 PID 2504 wrote to memory of 2408 2504 516A.tmp 32 PID 2408 wrote to memory of 2560 2408 5226.tmp 33 PID 2408 wrote to memory of 2560 2408 5226.tmp 33 PID 2408 wrote to memory of 2560 2408 5226.tmp 33 PID 2408 wrote to memory of 2560 2408 5226.tmp 33 PID 2560 wrote to memory of 2428 2560 531F.tmp 34 PID 2560 wrote to memory of 2428 2560 531F.tmp 34 PID 2560 wrote to memory of 2428 2560 531F.tmp 34 PID 2560 wrote to memory of 2428 2560 531F.tmp 34 PID 2428 wrote to memory of 2512 2428 53EA.tmp 35 PID 2428 wrote to memory of 2512 2428 53EA.tmp 35 PID 2428 wrote to memory of 2512 2428 53EA.tmp 35 PID 2428 wrote to memory of 2512 2428 53EA.tmp 35 PID 2512 wrote to memory of 2204 2512 54B5.tmp 36 PID 2512 wrote to memory of 2204 2512 54B5.tmp 36 PID 2512 wrote to memory of 2204 2512 54B5.tmp 36 PID 2512 wrote to memory of 2204 2512 54B5.tmp 36 PID 2204 wrote to memory of 2200 2204 5570.tmp 37 PID 2204 wrote to memory of 2200 2204 5570.tmp 37 PID 2204 wrote to memory of 2200 2204 5570.tmp 37 PID 2204 wrote to memory of 2200 2204 5570.tmp 37 PID 2200 wrote to memory of 2924 2200 5689.tmp 38 PID 2200 wrote to memory of 2924 2200 5689.tmp 38 PID 2200 wrote to memory of 2924 2200 5689.tmp 38 PID 2200 wrote to memory of 2924 2200 5689.tmp 38 PID 2924 wrote to memory of 2308 2924 56D7.tmp 39 PID 2924 wrote to memory of 2308 2924 56D7.tmp 39 PID 2924 wrote to memory of 2308 2924 56D7.tmp 39 PID 2924 wrote to memory of 2308 2924 56D7.tmp 39 PID 2308 wrote to memory of 764 2308 5792.tmp 40 PID 2308 wrote to memory of 764 2308 5792.tmp 40 PID 2308 wrote to memory of 764 2308 5792.tmp 40 PID 2308 wrote to memory of 764 2308 5792.tmp 40 PID 764 wrote to memory of 1108 764 588C.tmp 41 PID 764 wrote to memory of 1108 764 588C.tmp 41 PID 764 wrote to memory of 1108 764 588C.tmp 41 PID 764 wrote to memory of 1108 764 588C.tmp 41 PID 1108 wrote to memory of 2740 1108 5947.tmp 42 PID 1108 wrote to memory of 2740 1108 5947.tmp 42 PID 1108 wrote to memory of 2740 1108 5947.tmp 42 PID 1108 wrote to memory of 2740 1108 5947.tmp 42 PID 2740 wrote to memory of 2648 2740 5A21.tmp 43 PID 2740 wrote to memory of 2648 2740 5A21.tmp 43 PID 2740 wrote to memory of 2648 2740 5A21.tmp 43 PID 2740 wrote to memory of 2648 2740 5A21.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-08_0cdf896a384a861e2d5be9861b20955a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-08_0cdf896a384a861e2d5be9861b20955a_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\4F77.tmp"C:\Users\Admin\AppData\Local\Temp\4F77.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\5071.tmp"C:\Users\Admin\AppData\Local\Temp\5071.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\516A.tmp"C:\Users\Admin\AppData\Local\Temp\516A.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\5226.tmp"C:\Users\Admin\AppData\Local\Temp\5226.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\531F.tmp"C:\Users\Admin\AppData\Local\Temp\531F.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\53EA.tmp"C:\Users\Admin\AppData\Local\Temp\53EA.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\54B5.tmp"C:\Users\Admin\AppData\Local\Temp\54B5.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\5570.tmp"C:\Users\Admin\AppData\Local\Temp\5570.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\5689.tmp"C:\Users\Admin\AppData\Local\Temp\5689.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\56D7.tmp"C:\Users\Admin\AppData\Local\Temp\56D7.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\5792.tmp"C:\Users\Admin\AppData\Local\Temp\5792.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\588C.tmp"C:\Users\Admin\AppData\Local\Temp\588C.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Users\Admin\AppData\Local\Temp\5947.tmp"C:\Users\Admin\AppData\Local\Temp\5947.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\5A21.tmp"C:\Users\Admin\AppData\Local\Temp\5A21.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\5ADC.tmp"C:\Users\Admin\AppData\Local\Temp\5ADC.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\5BB7.tmp"C:\Users\Admin\AppData\Local\Temp\5BB7.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\5C72.tmp"C:\Users\Admin\AppData\Local\Temp\5C72.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\5D3D.tmp"C:\Users\Admin\AppData\Local\Temp\5D3D.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\5E08.tmp"C:\Users\Admin\AppData\Local\Temp\5E08.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:996 -
C:\Users\Admin\AppData\Local\Temp\5EB3.tmp"C:\Users\Admin\AppData\Local\Temp\5EB3.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\5F6E.tmp"C:\Users\Admin\AppData\Local\Temp\5F6E.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\602A.tmp"C:\Users\Admin\AppData\Local\Temp\602A.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\6133.tmp"C:\Users\Admin\AppData\Local\Temp\6133.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\623C.tmp"C:\Users\Admin\AppData\Local\Temp\623C.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:320 -
C:\Users\Admin\AppData\Local\Temp\62D8.tmp"C:\Users\Admin\AppData\Local\Temp\62D8.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\6345.tmp"C:\Users\Admin\AppData\Local\Temp\6345.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\63B3.tmp"C:\Users\Admin\AppData\Local\Temp\63B3.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\643F.tmp"C:\Users\Admin\AppData\Local\Temp\643F.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\64BC.tmp"C:\Users\Admin\AppData\Local\Temp\64BC.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\6529.tmp"C:\Users\Admin\AppData\Local\Temp\6529.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\65A6.tmp"C:\Users\Admin\AppData\Local\Temp\65A6.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\6613.tmp"C:\Users\Admin\AppData\Local\Temp\6613.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\6680.tmp"C:\Users\Admin\AppData\Local\Temp\6680.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\66DE.tmp"C:\Users\Admin\AppData\Local\Temp\66DE.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\674B.tmp"C:\Users\Admin\AppData\Local\Temp\674B.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\67C8.tmp"C:\Users\Admin\AppData\Local\Temp\67C8.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\6835.tmp"C:\Users\Admin\AppData\Local\Temp\6835.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\68A2.tmp"C:\Users\Admin\AppData\Local\Temp\68A2.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\692F.tmp"C:\Users\Admin\AppData\Local\Temp\692F.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\698C.tmp"C:\Users\Admin\AppData\Local\Temp\698C.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\69F9.tmp"C:\Users\Admin\AppData\Local\Temp\69F9.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\6A67.tmp"C:\Users\Admin\AppData\Local\Temp\6A67.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\6AE3.tmp"C:\Users\Admin\AppData\Local\Temp\6AE3.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\6B60.tmp"C:\Users\Admin\AppData\Local\Temp\6B60.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\6BBE.tmp"C:\Users\Admin\AppData\Local\Temp\6BBE.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:596 -
C:\Users\Admin\AppData\Local\Temp\6C3B.tmp"C:\Users\Admin\AppData\Local\Temp\6C3B.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\6CA8.tmp"C:\Users\Admin\AppData\Local\Temp\6CA8.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\6D25.tmp"C:\Users\Admin\AppData\Local\Temp\6D25.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\6DA1.tmp"C:\Users\Admin\AppData\Local\Temp\6DA1.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\6E1E.tmp"C:\Users\Admin\AppData\Local\Temp\6E1E.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\6E8B.tmp"C:\Users\Admin\AppData\Local\Temp\6E8B.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\6EF9.tmp"C:\Users\Admin\AppData\Local\Temp\6EF9.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\6F66.tmp"C:\Users\Admin\AppData\Local\Temp\6F66.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\6FE3.tmp"C:\Users\Admin\AppData\Local\Temp\6FE3.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\709E.tmp"C:\Users\Admin\AppData\Local\Temp\709E.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\712A.tmp"C:\Users\Admin\AppData\Local\Temp\712A.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\71A7.tmp"C:\Users\Admin\AppData\Local\Temp\71A7.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\7224.tmp"C:\Users\Admin\AppData\Local\Temp\7224.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\72B0.tmp"C:\Users\Admin\AppData\Local\Temp\72B0.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\732D.tmp"C:\Users\Admin\AppData\Local\Temp\732D.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\739A.tmp"C:\Users\Admin\AppData\Local\Temp\739A.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\7484.tmp"C:\Users\Admin\AppData\Local\Temp\7484.tmp"65⤵
- Executes dropped EXE
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"66⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\757E.tmp"C:\Users\Admin\AppData\Local\Temp\757E.tmp"67⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\7771.tmp"C:\Users\Admin\AppData\Local\Temp\7771.tmp"68⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\77EE.tmp"C:\Users\Admin\AppData\Local\Temp\77EE.tmp"69⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\78C8.tmp"C:\Users\Admin\AppData\Local\Temp\78C8.tmp"70⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\7935.tmp"C:\Users\Admin\AppData\Local\Temp\7935.tmp"71⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\79A3.tmp"C:\Users\Admin\AppData\Local\Temp\79A3.tmp"72⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\7A2F.tmp"C:\Users\Admin\AppData\Local\Temp\7A2F.tmp"73⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\7AAC.tmp"C:\Users\Admin\AppData\Local\Temp\7AAC.tmp"74⤵PID:660
-
C:\Users\Admin\AppData\Local\Temp\7B19.tmp"C:\Users\Admin\AppData\Local\Temp\7B19.tmp"75⤵PID:268
-
C:\Users\Admin\AppData\Local\Temp\7B96.tmp"C:\Users\Admin\AppData\Local\Temp\7B96.tmp"76⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\7C03.tmp"C:\Users\Admin\AppData\Local\Temp\7C03.tmp"77⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\7C70.tmp"C:\Users\Admin\AppData\Local\Temp\7C70.tmp"78⤵PID:312
-
C:\Users\Admin\AppData\Local\Temp\7CED.tmp"C:\Users\Admin\AppData\Local\Temp\7CED.tmp"79⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\7D6A.tmp"C:\Users\Admin\AppData\Local\Temp\7D6A.tmp"80⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\7DE7.tmp"C:\Users\Admin\AppData\Local\Temp\7DE7.tmp"81⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\7E63.tmp"C:\Users\Admin\AppData\Local\Temp\7E63.tmp"82⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\7EE0.tmp"C:\Users\Admin\AppData\Local\Temp\7EE0.tmp"83⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\7F4D.tmp"C:\Users\Admin\AppData\Local\Temp\7F4D.tmp"84⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\8028.tmp"C:\Users\Admin\AppData\Local\Temp\8028.tmp"85⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\8095.tmp"C:\Users\Admin\AppData\Local\Temp\8095.tmp"86⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\80F3.tmp"C:\Users\Admin\AppData\Local\Temp\80F3.tmp"87⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\8150.tmp"C:\Users\Admin\AppData\Local\Temp\8150.tmp"88⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\81CD.tmp"C:\Users\Admin\AppData\Local\Temp\81CD.tmp"89⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\823A.tmp"C:\Users\Admin\AppData\Local\Temp\823A.tmp"90⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\82B7.tmp"C:\Users\Admin\AppData\Local\Temp\82B7.tmp"91⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\8315.tmp"C:\Users\Admin\AppData\Local\Temp\8315.tmp"92⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\8391.tmp"C:\Users\Admin\AppData\Local\Temp\8391.tmp"93⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\83EF.tmp"C:\Users\Admin\AppData\Local\Temp\83EF.tmp"94⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\845C.tmp"C:\Users\Admin\AppData\Local\Temp\845C.tmp"95⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\84BA.tmp"C:\Users\Admin\AppData\Local\Temp\84BA.tmp"96⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\8527.tmp"C:\Users\Admin\AppData\Local\Temp\8527.tmp"97⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\8585.tmp"C:\Users\Admin\AppData\Local\Temp\8585.tmp"98⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\85F2.tmp"C:\Users\Admin\AppData\Local\Temp\85F2.tmp"99⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\865F.tmp"C:\Users\Admin\AppData\Local\Temp\865F.tmp"100⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\86EB.tmp"C:\Users\Admin\AppData\Local\Temp\86EB.tmp"101⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\8768.tmp"C:\Users\Admin\AppData\Local\Temp\8768.tmp"102⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\87D5.tmp"C:\Users\Admin\AppData\Local\Temp\87D5.tmp"103⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\8843.tmp"C:\Users\Admin\AppData\Local\Temp\8843.tmp"104⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\88BF.tmp"C:\Users\Admin\AppData\Local\Temp\88BF.tmp"105⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\892D.tmp"C:\Users\Admin\AppData\Local\Temp\892D.tmp"106⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\899A.tmp"C:\Users\Admin\AppData\Local\Temp\899A.tmp"107⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\89F7.tmp"C:\Users\Admin\AppData\Local\Temp\89F7.tmp"108⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\8A74.tmp"C:\Users\Admin\AppData\Local\Temp\8A74.tmp"109⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\8AC2.tmp"C:\Users\Admin\AppData\Local\Temp\8AC2.tmp"110⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\8B10.tmp"C:\Users\Admin\AppData\Local\Temp\8B10.tmp"111⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"112⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\8C0A.tmp"C:\Users\Admin\AppData\Local\Temp\8C0A.tmp"113⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\8CD5.tmp"C:\Users\Admin\AppData\Local\Temp\8CD5.tmp"114⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\8D32.tmp"C:\Users\Admin\AppData\Local\Temp\8D32.tmp"115⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\8DAF.tmp"C:\Users\Admin\AppData\Local\Temp\8DAF.tmp"116⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\8E2C.tmp"C:\Users\Admin\AppData\Local\Temp\8E2C.tmp"117⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\8E99.tmp"C:\Users\Admin\AppData\Local\Temp\8E99.tmp"118⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\8F06.tmp"C:\Users\Admin\AppData\Local\Temp\8F06.tmp"119⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\8F83.tmp"C:\Users\Admin\AppData\Local\Temp\8F83.tmp"120⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\9000.tmp"C:\Users\Admin\AppData\Local\Temp\9000.tmp"121⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\909C.tmp"C:\Users\Admin\AppData\Local\Temp\909C.tmp"122⤵PID:1756
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-