Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19/05/2024, 21:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-19_4d40fc3c762e411b7dfa4c7a81d38395_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-19_4d40fc3c762e411b7dfa4c7a81d38395_mafia.exe
Resource
win10v2004-20240426-en
2 signatures
150 seconds
General
-
Target
2024-05-19_4d40fc3c762e411b7dfa4c7a81d38395_mafia.exe
-
Size
488KB
-
MD5
4d40fc3c762e411b7dfa4c7a81d38395
-
SHA1
25f8a9ad280dafb5ee0de05fa0cebdb33af9f5d3
-
SHA256
67daa7064efacf4c7c7dc94ad1a9fdb151dff0317cc1aef6df4f71ead503c637
-
SHA512
85a85796e56e00c9a85f0b8353e8dfd81ae7e3e971f6d41c07089ec3b74e8021b0940b9ba3efd9e07b30f9763c05a7838d49fb9d41d2fe31f3120f9e3ca88cbc
-
SSDEEP
12288:/U5rCOTeiDueNFLclMDCL41hPoPA+Dcbx5WEIfPNZ:/UQOJDZ4lMDv1iA+4bmEIfPN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2088 16FA.tmp 3064 1738.tmp 2732 1796.tmp 2896 1803.tmp 2584 1870.tmp 2728 18CE.tmp 2852 192C.tmp 2504 1989.tmp 2468 19D7.tmp 3020 1A44.tmp 2968 1AA2.tmp 2436 1B0F.tmp 2684 1B5D.tmp 2808 1BBB.tmp 1580 1C18.tmp 712 1C86.tmp 1620 1CE3.tmp 1032 1D41.tmp 1492 1DAE.tmp 1476 1E0C.tmp 1652 1E69.tmp 1376 1EC7.tmp 1972 1F24.tmp 2488 1F63.tmp 1200 1FA1.tmp 2300 1FE0.tmp 2432 201E.tmp 2252 205C.tmp 268 209B.tmp 796 20D9.tmp 1072 2118.tmp 1416 2156.tmp 1452 2194.tmp 1484 21D3.tmp 1864 2211.tmp 3004 2250.tmp 448 228E.tmp 3036 22CC.tmp 2396 231A.tmp 852 2359.tmp 1596 2397.tmp 1304 23E5.tmp 972 2424.tmp 1932 2462.tmp 1252 24A0.tmp 3052 24DF.tmp 2920 251D.tmp 1952 255C.tmp 1456 259A.tmp 1152 25D8.tmp 1692 2617.tmp 2124 2655.tmp 1980 2694.tmp 2404 26D2.tmp 1696 2710.tmp 1724 279D.tmp 1216 27DB.tmp 2592 281A.tmp 3064 2858.tmp 2608 2896.tmp 2604 28D5.tmp 2896 2913.tmp 2780 2952.tmp 2648 2990.tmp -
Loads dropped DLL 64 IoCs
pid Process 1724 2024-05-19_4d40fc3c762e411b7dfa4c7a81d38395_mafia.exe 2088 16FA.tmp 3064 1738.tmp 2732 1796.tmp 2896 1803.tmp 2584 1870.tmp 2728 18CE.tmp 2852 192C.tmp 2504 1989.tmp 2468 19D7.tmp 3020 1A44.tmp 2968 1AA2.tmp 2436 1B0F.tmp 2684 1B5D.tmp 2808 1BBB.tmp 1580 1C18.tmp 712 1C86.tmp 1620 1CE3.tmp 1032 1D41.tmp 1492 1DAE.tmp 1476 1E0C.tmp 1652 1E69.tmp 1376 1EC7.tmp 1972 1F24.tmp 2488 1F63.tmp 1200 1FA1.tmp 2300 1FE0.tmp 2432 201E.tmp 2252 205C.tmp 268 209B.tmp 796 20D9.tmp 1072 2118.tmp 1416 2156.tmp 1452 2194.tmp 1484 21D3.tmp 1864 2211.tmp 3004 2250.tmp 448 228E.tmp 3036 22CC.tmp 2396 231A.tmp 852 2359.tmp 1596 2397.tmp 1304 23E5.tmp 972 2424.tmp 1932 2462.tmp 1252 24A0.tmp 3052 24DF.tmp 2920 251D.tmp 1952 255C.tmp 1456 259A.tmp 1152 25D8.tmp 1692 2617.tmp 2124 2655.tmp 1980 2694.tmp 2404 26D2.tmp 1548 275E.tmp 1724 279D.tmp 1216 27DB.tmp 2592 281A.tmp 3064 2858.tmp 2608 2896.tmp 2604 28D5.tmp 2896 2913.tmp 2780 2952.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1724 wrote to memory of 2088 1724 2024-05-19_4d40fc3c762e411b7dfa4c7a81d38395_mafia.exe 28 PID 1724 wrote to memory of 2088 1724 2024-05-19_4d40fc3c762e411b7dfa4c7a81d38395_mafia.exe 28 PID 1724 wrote to memory of 2088 1724 2024-05-19_4d40fc3c762e411b7dfa4c7a81d38395_mafia.exe 28 PID 1724 wrote to memory of 2088 1724 2024-05-19_4d40fc3c762e411b7dfa4c7a81d38395_mafia.exe 28 PID 2088 wrote to memory of 3064 2088 16FA.tmp 29 PID 2088 wrote to memory of 3064 2088 16FA.tmp 29 PID 2088 wrote to memory of 3064 2088 16FA.tmp 29 PID 2088 wrote to memory of 3064 2088 16FA.tmp 29 PID 3064 wrote to memory of 2732 3064 1738.tmp 30 PID 3064 wrote to memory of 2732 3064 1738.tmp 30 PID 3064 wrote to memory of 2732 3064 1738.tmp 30 PID 3064 wrote to memory of 2732 3064 1738.tmp 30 PID 2732 wrote to memory of 2896 2732 1796.tmp 31 PID 2732 wrote to memory of 2896 2732 1796.tmp 31 PID 2732 wrote to memory of 2896 2732 1796.tmp 31 PID 2732 wrote to memory of 2896 2732 1796.tmp 31 PID 2896 wrote to memory of 2584 2896 1803.tmp 32 PID 2896 wrote to memory of 2584 2896 1803.tmp 32 PID 2896 wrote to memory of 2584 2896 1803.tmp 32 PID 2896 wrote to memory of 2584 2896 1803.tmp 32 PID 2584 wrote to memory of 2728 2584 1870.tmp 33 PID 2584 wrote to memory of 2728 2584 1870.tmp 33 PID 2584 wrote to memory of 2728 2584 1870.tmp 33 PID 2584 wrote to memory of 2728 2584 1870.tmp 33 PID 2728 wrote to memory of 2852 2728 18CE.tmp 34 PID 2728 wrote to memory of 2852 2728 18CE.tmp 34 PID 2728 wrote to memory of 2852 2728 18CE.tmp 34 PID 2728 wrote to memory of 2852 2728 18CE.tmp 34 PID 2852 wrote to memory of 2504 2852 192C.tmp 35 PID 2852 wrote to memory of 2504 2852 192C.tmp 35 PID 2852 wrote to memory of 2504 2852 192C.tmp 35 PID 2852 wrote to memory of 2504 2852 192C.tmp 35 PID 2504 wrote to memory of 2468 2504 1989.tmp 36 PID 2504 wrote to memory of 2468 2504 1989.tmp 36 PID 2504 wrote to memory of 2468 2504 1989.tmp 36 PID 2504 wrote to memory of 2468 2504 1989.tmp 36 PID 2468 wrote to memory of 3020 2468 19D7.tmp 37 PID 2468 wrote to memory of 3020 2468 19D7.tmp 37 PID 2468 wrote to memory of 3020 2468 19D7.tmp 37 PID 2468 wrote to memory of 3020 2468 19D7.tmp 37 PID 3020 wrote to memory of 2968 3020 1A44.tmp 38 PID 3020 wrote to memory of 2968 3020 1A44.tmp 38 PID 3020 wrote to memory of 2968 3020 1A44.tmp 38 PID 3020 wrote to memory of 2968 3020 1A44.tmp 38 PID 2968 wrote to memory of 2436 2968 1AA2.tmp 39 PID 2968 wrote to memory of 2436 2968 1AA2.tmp 39 PID 2968 wrote to memory of 2436 2968 1AA2.tmp 39 PID 2968 wrote to memory of 2436 2968 1AA2.tmp 39 PID 2436 wrote to memory of 2684 2436 1B0F.tmp 40 PID 2436 wrote to memory of 2684 2436 1B0F.tmp 40 PID 2436 wrote to memory of 2684 2436 1B0F.tmp 40 PID 2436 wrote to memory of 2684 2436 1B0F.tmp 40 PID 2684 wrote to memory of 2808 2684 1B5D.tmp 41 PID 2684 wrote to memory of 2808 2684 1B5D.tmp 41 PID 2684 wrote to memory of 2808 2684 1B5D.tmp 41 PID 2684 wrote to memory of 2808 2684 1B5D.tmp 41 PID 2808 wrote to memory of 1580 2808 1BBB.tmp 42 PID 2808 wrote to memory of 1580 2808 1BBB.tmp 42 PID 2808 wrote to memory of 1580 2808 1BBB.tmp 42 PID 2808 wrote to memory of 1580 2808 1BBB.tmp 42 PID 1580 wrote to memory of 712 1580 1C18.tmp 43 PID 1580 wrote to memory of 712 1580 1C18.tmp 43 PID 1580 wrote to memory of 712 1580 1C18.tmp 43 PID 1580 wrote to memory of 712 1580 1C18.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-19_4d40fc3c762e411b7dfa4c7a81d38395_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-19_4d40fc3c762e411b7dfa4c7a81d38395_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\16FA.tmp"C:\Users\Admin\AppData\Local\Temp\16FA.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\1738.tmp"C:\Users\Admin\AppData\Local\Temp\1738.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\1796.tmp"C:\Users\Admin\AppData\Local\Temp\1796.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\1803.tmp"C:\Users\Admin\AppData\Local\Temp\1803.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\1870.tmp"C:\Users\Admin\AppData\Local\Temp\1870.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\18CE.tmp"C:\Users\Admin\AppData\Local\Temp\18CE.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\192C.tmp"C:\Users\Admin\AppData\Local\Temp\192C.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\1989.tmp"C:\Users\Admin\AppData\Local\Temp\1989.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\19D7.tmp"C:\Users\Admin\AppData\Local\Temp\19D7.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\1A44.tmp"C:\Users\Admin\AppData\Local\Temp\1A44.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\1B0F.tmp"C:\Users\Admin\AppData\Local\Temp\1B0F.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\1C18.tmp"C:\Users\Admin\AppData\Local\Temp\1C18.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\1C86.tmp"C:\Users\Admin\AppData\Local\Temp\1C86.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:712 -
C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\1D41.tmp"C:\Users\Admin\AppData\Local\Temp\1D41.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\1E69.tmp"C:\Users\Admin\AppData\Local\Temp\1E69.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\1F24.tmp"C:\Users\Admin\AppData\Local\Temp\1F24.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\1F63.tmp"C:\Users\Admin\AppData\Local\Temp\1F63.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\1FA1.tmp"C:\Users\Admin\AppData\Local\Temp\1FA1.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\201E.tmp"C:\Users\Admin\AppData\Local\Temp\201E.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\205C.tmp"C:\Users\Admin\AppData\Local\Temp\205C.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\209B.tmp"C:\Users\Admin\AppData\Local\Temp\209B.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:268 -
C:\Users\Admin\AppData\Local\Temp\20D9.tmp"C:\Users\Admin\AppData\Local\Temp\20D9.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:796 -
C:\Users\Admin\AppData\Local\Temp\2118.tmp"C:\Users\Admin\AppData\Local\Temp\2118.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\2156.tmp"C:\Users\Admin\AppData\Local\Temp\2156.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\2194.tmp"C:\Users\Admin\AppData\Local\Temp\2194.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\21D3.tmp"C:\Users\Admin\AppData\Local\Temp\21D3.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\2211.tmp"C:\Users\Admin\AppData\Local\Temp\2211.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\2250.tmp"C:\Users\Admin\AppData\Local\Temp\2250.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\228E.tmp"C:\Users\Admin\AppData\Local\Temp\228E.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:448 -
C:\Users\Admin\AppData\Local\Temp\22CC.tmp"C:\Users\Admin\AppData\Local\Temp\22CC.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\231A.tmp"C:\Users\Admin\AppData\Local\Temp\231A.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\2359.tmp"C:\Users\Admin\AppData\Local\Temp\2359.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:852 -
C:\Users\Admin\AppData\Local\Temp\2397.tmp"C:\Users\Admin\AppData\Local\Temp\2397.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\2424.tmp"C:\Users\Admin\AppData\Local\Temp\2424.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:972 -
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\24A0.tmp"C:\Users\Admin\AppData\Local\Temp\24A0.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\24DF.tmp"C:\Users\Admin\AppData\Local\Temp\24DF.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\251D.tmp"C:\Users\Admin\AppData\Local\Temp\251D.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\259A.tmp"C:\Users\Admin\AppData\Local\Temp\259A.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\25D8.tmp"C:\Users\Admin\AppData\Local\Temp\25D8.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\2655.tmp"C:\Users\Admin\AppData\Local\Temp\2655.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\2694.tmp"C:\Users\Admin\AppData\Local\Temp\2694.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\26D2.tmp"C:\Users\Admin\AppData\Local\Temp\26D2.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\2710.tmp"C:\Users\Admin\AppData\Local\Temp\2710.tmp"56⤵
- Executes dropped EXE
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\275E.tmp"C:\Users\Admin\AppData\Local\Temp\275E.tmp"57⤵
- Loads dropped DLL
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\279D.tmp"C:\Users\Admin\AppData\Local\Temp\279D.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\27DB.tmp"C:\Users\Admin\AppData\Local\Temp\27DB.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\281A.tmp"C:\Users\Admin\AppData\Local\Temp\281A.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\2858.tmp"C:\Users\Admin\AppData\Local\Temp\2858.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\2896.tmp"C:\Users\Admin\AppData\Local\Temp\2896.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\28D5.tmp"C:\Users\Admin\AppData\Local\Temp\28D5.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\2913.tmp"C:\Users\Admin\AppData\Local\Temp\2913.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\2952.tmp"C:\Users\Admin\AppData\Local\Temp\2952.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\2990.tmp"C:\Users\Admin\AppData\Local\Temp\2990.tmp"66⤵
- Executes dropped EXE
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\29CE.tmp"C:\Users\Admin\AppData\Local\Temp\29CE.tmp"67⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"68⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"69⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\2A99.tmp"C:\Users\Admin\AppData\Local\Temp\2A99.tmp"70⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"71⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\2B16.tmp"C:\Users\Admin\AppData\Local\Temp\2B16.tmp"72⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\2B54.tmp"C:\Users\Admin\AppData\Local\Temp\2B54.tmp"73⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\2B93.tmp"C:\Users\Admin\AppData\Local\Temp\2B93.tmp"74⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"75⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\2C10.tmp"C:\Users\Admin\AppData\Local\Temp\2C10.tmp"76⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"77⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"78⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"79⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\2D09.tmp"C:\Users\Admin\AppData\Local\Temp\2D09.tmp"80⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\2D48.tmp"C:\Users\Admin\AppData\Local\Temp\2D48.tmp"81⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\2D86.tmp"C:\Users\Admin\AppData\Local\Temp\2D86.tmp"82⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"83⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\2E12.tmp"C:\Users\Admin\AppData\Local\Temp\2E12.tmp"84⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\2E51.tmp"C:\Users\Admin\AppData\Local\Temp\2E51.tmp"85⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"86⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\2EDD.tmp"C:\Users\Admin\AppData\Local\Temp\2EDD.tmp"87⤵PID:292
-
C:\Users\Admin\AppData\Local\Temp\2F1C.tmp"C:\Users\Admin\AppData\Local\Temp\2F1C.tmp"88⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\2F6A.tmp"C:\Users\Admin\AppData\Local\Temp\2F6A.tmp"89⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"90⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"91⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\3034.tmp"C:\Users\Admin\AppData\Local\Temp\3034.tmp"92⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\3082.tmp"C:\Users\Admin\AppData\Local\Temp\3082.tmp"93⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\30C1.tmp"C:\Users\Admin\AppData\Local\Temp\30C1.tmp"94⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\310F.tmp"C:\Users\Admin\AppData\Local\Temp\310F.tmp"95⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\314D.tmp"C:\Users\Admin\AppData\Local\Temp\314D.tmp"96⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\318C.tmp"C:\Users\Admin\AppData\Local\Temp\318C.tmp"97⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\31CA.tmp"C:\Users\Admin\AppData\Local\Temp\31CA.tmp"98⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\3218.tmp"C:\Users\Admin\AppData\Local\Temp\3218.tmp"99⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"100⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\3295.tmp"C:\Users\Admin\AppData\Local\Temp\3295.tmp"101⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\32D3.tmp"C:\Users\Admin\AppData\Local\Temp\32D3.tmp"102⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\3321.tmp"C:\Users\Admin\AppData\Local\Temp\3321.tmp"103⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\3360.tmp"C:\Users\Admin\AppData\Local\Temp\3360.tmp"104⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\339E.tmp"C:\Users\Admin\AppData\Local\Temp\339E.tmp"105⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\33DC.tmp"C:\Users\Admin\AppData\Local\Temp\33DC.tmp"106⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\341B.tmp"C:\Users\Admin\AppData\Local\Temp\341B.tmp"107⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\3459.tmp"C:\Users\Admin\AppData\Local\Temp\3459.tmp"108⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\3498.tmp"C:\Users\Admin\AppData\Local\Temp\3498.tmp"109⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\34D6.tmp"C:\Users\Admin\AppData\Local\Temp\34D6.tmp"110⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\3514.tmp"C:\Users\Admin\AppData\Local\Temp\3514.tmp"111⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\3562.tmp"C:\Users\Admin\AppData\Local\Temp\3562.tmp"112⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\35B0.tmp"C:\Users\Admin\AppData\Local\Temp\35B0.tmp"113⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\35EF.tmp"C:\Users\Admin\AppData\Local\Temp\35EF.tmp"114⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\362D.tmp"C:\Users\Admin\AppData\Local\Temp\362D.tmp"115⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\366C.tmp"C:\Users\Admin\AppData\Local\Temp\366C.tmp"116⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\36AA.tmp"C:\Users\Admin\AppData\Local\Temp\36AA.tmp"117⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\36F8.tmp"C:\Users\Admin\AppData\Local\Temp\36F8.tmp"118⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\3746.tmp"C:\Users\Admin\AppData\Local\Temp\3746.tmp"119⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\3784.tmp"C:\Users\Admin\AppData\Local\Temp\3784.tmp"120⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\37C3.tmp"C:\Users\Admin\AppData\Local\Temp\37C3.tmp"121⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\3820.tmp"C:\Users\Admin\AppData\Local\Temp\3820.tmp"122⤵PID:1676
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-