Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04-06-2024 17:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-04_d64353735694661d4544fbe04ce2f179_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-04_d64353735694661d4544fbe04ce2f179_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-06-04_d64353735694661d4544fbe04ce2f179_mafia.exe
-
Size
527KB
-
MD5
d64353735694661d4544fbe04ce2f179
-
SHA1
2afd1ecfe6eed7e86147c153bc962c1902d39ece
-
SHA256
c7e410b2fa61a515298ef00da84dd383eae7b30158ecaa5afd831097e9b3338e
-
SHA512
d9becf8209df26b5dd8eb0521113192bd49d224fc2765dd789e6139f69c98b9c2bd96d15a3f90a74627b8b3bc1d12ee302e37129af364a3ea6f772208eca6a52
-
SSDEEP
12288:fU5rCOTeidqpuVdy/41sp0LEzPdkdZYDZu:fUQOJdiay8spaErdksDo
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1036 5226.tmp 2344 52C2.tmp 1204 539C.tmp 1532 5467.tmp 1416 5522.tmp 1972 558F.tmp 1964 565A.tmp 2000 5706.tmp 1984 57E0.tmp 268 586D.tmp 548 5909.tmp 1096 5A21.tmp 2404 5AAE.tmp 1520 5B59.tmp 2672 5C43.tmp 2464 5CD0.tmp 680 5E27.tmp 2876 5EC3.tmp 2632 5F6F.tmp 2624 6059.tmp 2652 6123.tmp 1868 625B.tmp 1896 62F7.tmp 1808 63C2.tmp 1872 64CB.tmp 2944 6558.tmp 2916 65E4.tmp 3036 6661.tmp 3012 66DE.tmp 2104 675B.tmp 2980 67F7.tmp 2100 68D1.tmp 984 696D.tmp 1892 6A28.tmp 1688 6AB5.tmp 308 6B60.tmp 1456 6BDD.tmp 1724 6C98.tmp 896 6D25.tmp 2440 6DEF.tmp 2796 6E6C.tmp 800 6F08.tmp 2068 6F85.tmp 2108 7011.tmp 1784 70CD.tmp 888 7188.tmp 2824 7214.tmp 900 72A1.tmp 2264 731D.tmp 1156 73AA.tmp 2316 7436.tmp 988 74C3.tmp 2040 7649.tmp 1684 76E5.tmp 2348 7752.tmp 1252 77EE.tmp 1124 786B.tmp 1620 79B2.tmp 1048 7A8D.tmp 2324 7B29.tmp 1972 7BA5.tmp 1760 7C51.tmp 1264 7CDD.tmp 572 7D89.tmp -
Loads dropped DLL 64 IoCs
pid Process 2336 2024-06-04_d64353735694661d4544fbe04ce2f179_mafia.exe 1036 5226.tmp 2344 52C2.tmp 1204 539C.tmp 1532 5467.tmp 1416 5522.tmp 1972 558F.tmp 1964 565A.tmp 2000 5706.tmp 1984 57E0.tmp 268 586D.tmp 548 5909.tmp 1096 5A21.tmp 2404 5AAE.tmp 1520 5B59.tmp 2672 5C43.tmp 2464 5CD0.tmp 680 5E27.tmp 2876 5EC3.tmp 2632 5F6F.tmp 2624 6059.tmp 2652 6123.tmp 1868 625B.tmp 1896 62F7.tmp 1808 63C2.tmp 1872 64CB.tmp 2944 6558.tmp 2916 65E4.tmp 3036 6661.tmp 3012 66DE.tmp 2104 675B.tmp 2980 67F7.tmp 2100 68D1.tmp 984 696D.tmp 1892 6A28.tmp 1688 6AB5.tmp 308 6B60.tmp 1456 6BDD.tmp 1724 6C98.tmp 896 6D25.tmp 2440 6DEF.tmp 2796 6E6C.tmp 800 6F08.tmp 2068 6F85.tmp 2108 7011.tmp 1784 70CD.tmp 888 7188.tmp 2824 7214.tmp 900 72A1.tmp 2264 731D.tmp 1156 73AA.tmp 2316 7436.tmp 1552 754F.tmp 2040 7649.tmp 1684 76E5.tmp 2348 7752.tmp 1252 77EE.tmp 1124 786B.tmp 1620 79B2.tmp 1048 7A8D.tmp 2324 7B29.tmp 1972 7BA5.tmp 1760 7C51.tmp 1264 7CDD.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2336 wrote to memory of 1036 2336 2024-06-04_d64353735694661d4544fbe04ce2f179_mafia.exe 30 PID 2336 wrote to memory of 1036 2336 2024-06-04_d64353735694661d4544fbe04ce2f179_mafia.exe 30 PID 2336 wrote to memory of 1036 2336 2024-06-04_d64353735694661d4544fbe04ce2f179_mafia.exe 30 PID 2336 wrote to memory of 1036 2336 2024-06-04_d64353735694661d4544fbe04ce2f179_mafia.exe 30 PID 1036 wrote to memory of 2344 1036 5226.tmp 31 PID 1036 wrote to memory of 2344 1036 5226.tmp 31 PID 1036 wrote to memory of 2344 1036 5226.tmp 31 PID 1036 wrote to memory of 2344 1036 5226.tmp 31 PID 2344 wrote to memory of 1204 2344 52C2.tmp 32 PID 2344 wrote to memory of 1204 2344 52C2.tmp 32 PID 2344 wrote to memory of 1204 2344 52C2.tmp 32 PID 2344 wrote to memory of 1204 2344 52C2.tmp 32 PID 1204 wrote to memory of 1532 1204 539C.tmp 33 PID 1204 wrote to memory of 1532 1204 539C.tmp 33 PID 1204 wrote to memory of 1532 1204 539C.tmp 33 PID 1204 wrote to memory of 1532 1204 539C.tmp 33 PID 1532 wrote to memory of 1416 1532 5467.tmp 34 PID 1532 wrote to memory of 1416 1532 5467.tmp 34 PID 1532 wrote to memory of 1416 1532 5467.tmp 34 PID 1532 wrote to memory of 1416 1532 5467.tmp 34 PID 1416 wrote to memory of 1972 1416 5522.tmp 35 PID 1416 wrote to memory of 1972 1416 5522.tmp 35 PID 1416 wrote to memory of 1972 1416 5522.tmp 35 PID 1416 wrote to memory of 1972 1416 5522.tmp 35 PID 1972 wrote to memory of 1964 1972 558F.tmp 36 PID 1972 wrote to memory of 1964 1972 558F.tmp 36 PID 1972 wrote to memory of 1964 1972 558F.tmp 36 PID 1972 wrote to memory of 1964 1972 558F.tmp 36 PID 1964 wrote to memory of 2000 1964 565A.tmp 37 PID 1964 wrote to memory of 2000 1964 565A.tmp 37 PID 1964 wrote to memory of 2000 1964 565A.tmp 37 PID 1964 wrote to memory of 2000 1964 565A.tmp 37 PID 2000 wrote to memory of 1984 2000 5706.tmp 38 PID 2000 wrote to memory of 1984 2000 5706.tmp 38 PID 2000 wrote to memory of 1984 2000 5706.tmp 38 PID 2000 wrote to memory of 1984 2000 5706.tmp 38 PID 1984 wrote to memory of 268 1984 57E0.tmp 39 PID 1984 wrote to memory of 268 1984 57E0.tmp 39 PID 1984 wrote to memory of 268 1984 57E0.tmp 39 PID 1984 wrote to memory of 268 1984 57E0.tmp 39 PID 268 wrote to memory of 548 268 586D.tmp 40 PID 268 wrote to memory of 548 268 586D.tmp 40 PID 268 wrote to memory of 548 268 586D.tmp 40 PID 268 wrote to memory of 548 268 586D.tmp 40 PID 548 wrote to memory of 1096 548 5909.tmp 41 PID 548 wrote to memory of 1096 548 5909.tmp 41 PID 548 wrote to memory of 1096 548 5909.tmp 41 PID 548 wrote to memory of 1096 548 5909.tmp 41 PID 1096 wrote to memory of 2404 1096 5A21.tmp 42 PID 1096 wrote to memory of 2404 1096 5A21.tmp 42 PID 1096 wrote to memory of 2404 1096 5A21.tmp 42 PID 1096 wrote to memory of 2404 1096 5A21.tmp 42 PID 2404 wrote to memory of 1520 2404 5AAE.tmp 43 PID 2404 wrote to memory of 1520 2404 5AAE.tmp 43 PID 2404 wrote to memory of 1520 2404 5AAE.tmp 43 PID 2404 wrote to memory of 1520 2404 5AAE.tmp 43 PID 1520 wrote to memory of 2672 1520 5B59.tmp 44 PID 1520 wrote to memory of 2672 1520 5B59.tmp 44 PID 1520 wrote to memory of 2672 1520 5B59.tmp 44 PID 1520 wrote to memory of 2672 1520 5B59.tmp 44 PID 2672 wrote to memory of 2464 2672 5C43.tmp 45 PID 2672 wrote to memory of 2464 2672 5C43.tmp 45 PID 2672 wrote to memory of 2464 2672 5C43.tmp 45 PID 2672 wrote to memory of 2464 2672 5C43.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-04_d64353735694661d4544fbe04ce2f179_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-04_d64353735694661d4544fbe04ce2f179_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\5226.tmp"C:\Users\Admin\AppData\Local\Temp\5226.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\52C2.tmp"C:\Users\Admin\AppData\Local\Temp\52C2.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\539C.tmp"C:\Users\Admin\AppData\Local\Temp\539C.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\5467.tmp"C:\Users\Admin\AppData\Local\Temp\5467.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\5522.tmp"C:\Users\Admin\AppData\Local\Temp\5522.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\558F.tmp"C:\Users\Admin\AppData\Local\Temp\558F.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\565A.tmp"C:\Users\Admin\AppData\Local\Temp\565A.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\5706.tmp"C:\Users\Admin\AppData\Local\Temp\5706.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\57E0.tmp"C:\Users\Admin\AppData\Local\Temp\57E0.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\586D.tmp"C:\Users\Admin\AppData\Local\Temp\586D.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:268 -
C:\Users\Admin\AppData\Local\Temp\5909.tmp"C:\Users\Admin\AppData\Local\Temp\5909.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\5A21.tmp"C:\Users\Admin\AppData\Local\Temp\5A21.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\5AAE.tmp"C:\Users\Admin\AppData\Local\Temp\5AAE.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\5B59.tmp"C:\Users\Admin\AppData\Local\Temp\5B59.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\5C43.tmp"C:\Users\Admin\AppData\Local\Temp\5C43.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\5CD0.tmp"C:\Users\Admin\AppData\Local\Temp\5CD0.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\5E27.tmp"C:\Users\Admin\AppData\Local\Temp\5E27.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:680 -
C:\Users\Admin\AppData\Local\Temp\5EC3.tmp"C:\Users\Admin\AppData\Local\Temp\5EC3.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\5F6F.tmp"C:\Users\Admin\AppData\Local\Temp\5F6F.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\6059.tmp"C:\Users\Admin\AppData\Local\Temp\6059.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\6123.tmp"C:\Users\Admin\AppData\Local\Temp\6123.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\625B.tmp"C:\Users\Admin\AppData\Local\Temp\625B.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\62F7.tmp"C:\Users\Admin\AppData\Local\Temp\62F7.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\63C2.tmp"C:\Users\Admin\AppData\Local\Temp\63C2.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\64CB.tmp"C:\Users\Admin\AppData\Local\Temp\64CB.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\6558.tmp"C:\Users\Admin\AppData\Local\Temp\6558.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\65E4.tmp"C:\Users\Admin\AppData\Local\Temp\65E4.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\6661.tmp"C:\Users\Admin\AppData\Local\Temp\6661.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\66DE.tmp"C:\Users\Admin\AppData\Local\Temp\66DE.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\675B.tmp"C:\Users\Admin\AppData\Local\Temp\675B.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\67F7.tmp"C:\Users\Admin\AppData\Local\Temp\67F7.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\68D1.tmp"C:\Users\Admin\AppData\Local\Temp\68D1.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\696D.tmp"C:\Users\Admin\AppData\Local\Temp\696D.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:984 -
C:\Users\Admin\AppData\Local\Temp\6A28.tmp"C:\Users\Admin\AppData\Local\Temp\6A28.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\6AB5.tmp"C:\Users\Admin\AppData\Local\Temp\6AB5.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\6B60.tmp"C:\Users\Admin\AppData\Local\Temp\6B60.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:308 -
C:\Users\Admin\AppData\Local\Temp\6BDD.tmp"C:\Users\Admin\AppData\Local\Temp\6BDD.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\6C98.tmp"C:\Users\Admin\AppData\Local\Temp\6C98.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\6D25.tmp"C:\Users\Admin\AppData\Local\Temp\6D25.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:896 -
C:\Users\Admin\AppData\Local\Temp\6DEF.tmp"C:\Users\Admin\AppData\Local\Temp\6DEF.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\6E6C.tmp"C:\Users\Admin\AppData\Local\Temp\6E6C.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\6F08.tmp"C:\Users\Admin\AppData\Local\Temp\6F08.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:800 -
C:\Users\Admin\AppData\Local\Temp\6F85.tmp"C:\Users\Admin\AppData\Local\Temp\6F85.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\7011.tmp"C:\Users\Admin\AppData\Local\Temp\7011.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\70CD.tmp"C:\Users\Admin\AppData\Local\Temp\70CD.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\7188.tmp"C:\Users\Admin\AppData\Local\Temp\7188.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:888 -
C:\Users\Admin\AppData\Local\Temp\7214.tmp"C:\Users\Admin\AppData\Local\Temp\7214.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\72A1.tmp"C:\Users\Admin\AppData\Local\Temp\72A1.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:900 -
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\73AA.tmp"C:\Users\Admin\AppData\Local\Temp\73AA.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\7436.tmp"C:\Users\Admin\AppData\Local\Temp\7436.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\74C3.tmp"C:\Users\Admin\AppData\Local\Temp\74C3.tmp"53⤵
- Executes dropped EXE
PID:988 -
C:\Users\Admin\AppData\Local\Temp\754F.tmp"C:\Users\Admin\AppData\Local\Temp\754F.tmp"54⤵
- Loads dropped DLL
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\7649.tmp"C:\Users\Admin\AppData\Local\Temp\7649.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\76E5.tmp"C:\Users\Admin\AppData\Local\Temp\76E5.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\7752.tmp"C:\Users\Admin\AppData\Local\Temp\7752.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\77EE.tmp"C:\Users\Admin\AppData\Local\Temp\77EE.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\786B.tmp"C:\Users\Admin\AppData\Local\Temp\786B.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\79B2.tmp"C:\Users\Admin\AppData\Local\Temp\79B2.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\7A8D.tmp"C:\Users\Admin\AppData\Local\Temp\7A8D.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\7B29.tmp"C:\Users\Admin\AppData\Local\Temp\7B29.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\7BA5.tmp"C:\Users\Admin\AppData\Local\Temp\7BA5.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\7C51.tmp"C:\Users\Admin\AppData\Local\Temp\7C51.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\7CDD.tmp"C:\Users\Admin\AppData\Local\Temp\7CDD.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\7D89.tmp"C:\Users\Admin\AppData\Local\Temp\7D89.tmp"66⤵
- Executes dropped EXE
PID:572 -
C:\Users\Admin\AppData\Local\Temp\7DF6.tmp"C:\Users\Admin\AppData\Local\Temp\7DF6.tmp"67⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\7E83.tmp"C:\Users\Admin\AppData\Local\Temp\7E83.tmp"68⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\7F0F.tmp"C:\Users\Admin\AppData\Local\Temp\7F0F.tmp"69⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\7F9B.tmp"C:\Users\Admin\AppData\Local\Temp\7F9B.tmp"70⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\8028.tmp"C:\Users\Admin\AppData\Local\Temp\8028.tmp"71⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\80C4.tmp"C:\Users\Admin\AppData\Local\Temp\80C4.tmp"72⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\8141.tmp"C:\Users\Admin\AppData\Local\Temp\8141.tmp"73⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\81AE.tmp"C:\Users\Admin\AppData\Local\Temp\81AE.tmp"74⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\821B.tmp"C:\Users\Admin\AppData\Local\Temp\821B.tmp"75⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\82A7.tmp"C:\Users\Admin\AppData\Local\Temp\82A7.tmp"76⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\8315.tmp"C:\Users\Admin\AppData\Local\Temp\8315.tmp"77⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\83A1.tmp"C:\Users\Admin\AppData\Local\Temp\83A1.tmp"78⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\840E.tmp"C:\Users\Admin\AppData\Local\Temp\840E.tmp"79⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\848B.tmp"C:\Users\Admin\AppData\Local\Temp\848B.tmp"80⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\8517.tmp"C:\Users\Admin\AppData\Local\Temp\8517.tmp"81⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\8585.tmp"C:\Users\Admin\AppData\Local\Temp\8585.tmp"82⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\8611.tmp"C:\Users\Admin\AppData\Local\Temp\8611.tmp"83⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\868E.tmp"C:\Users\Admin\AppData\Local\Temp\868E.tmp"84⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\870B.tmp"C:\Users\Admin\AppData\Local\Temp\870B.tmp"85⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\8778.tmp"C:\Users\Admin\AppData\Local\Temp\8778.tmp"86⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\8804.tmp"C:\Users\Admin\AppData\Local\Temp\8804.tmp"87⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\8881.tmp"C:\Users\Admin\AppData\Local\Temp\8881.tmp"88⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\88EE.tmp"C:\Users\Admin\AppData\Local\Temp\88EE.tmp"89⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\896B.tmp"C:\Users\Admin\AppData\Local\Temp\896B.tmp"90⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\89C9.tmp"C:\Users\Admin\AppData\Local\Temp\89C9.tmp"91⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\8A45.tmp"C:\Users\Admin\AppData\Local\Temp\8A45.tmp"92⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\8AD2.tmp"C:\Users\Admin\AppData\Local\Temp\8AD2.tmp"93⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\8B3F.tmp"C:\Users\Admin\AppData\Local\Temp\8B3F.tmp"94⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\8BEB.tmp"C:\Users\Admin\AppData\Local\Temp\8BEB.tmp"95⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\8C77.tmp"C:\Users\Admin\AppData\Local\Temp\8C77.tmp"96⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\8D13.tmp"C:\Users\Admin\AppData\Local\Temp\8D13.tmp"97⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\8DDE.tmp"C:\Users\Admin\AppData\Local\Temp\8DDE.tmp"98⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\8E6A.tmp"C:\Users\Admin\AppData\Local\Temp\8E6A.tmp"99⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\8FD1.tmp"C:\Users\Admin\AppData\Local\Temp\8FD1.tmp"100⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\903E.tmp"C:\Users\Admin\AppData\Local\Temp\903E.tmp"101⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\90BB.tmp"C:\Users\Admin\AppData\Local\Temp\90BB.tmp"102⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\9128.tmp"C:\Users\Admin\AppData\Local\Temp\9128.tmp"103⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\91B5.tmp"C:\Users\Admin\AppData\Local\Temp\91B5.tmp"104⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\9241.tmp"C:\Users\Admin\AppData\Local\Temp\9241.tmp"105⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\929F.tmp"C:\Users\Admin\AppData\Local\Temp\929F.tmp"106⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\930C.tmp"C:\Users\Admin\AppData\Local\Temp\930C.tmp"107⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\93A8.tmp"C:\Users\Admin\AppData\Local\Temp\93A8.tmp"108⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\9453.tmp"C:\Users\Admin\AppData\Local\Temp\9453.tmp"109⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\94D0.tmp"C:\Users\Admin\AppData\Local\Temp\94D0.tmp"110⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\953D.tmp"C:\Users\Admin\AppData\Local\Temp\953D.tmp"111⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\95BA.tmp"C:\Users\Admin\AppData\Local\Temp\95BA.tmp"112⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\9656.tmp"C:\Users\Admin\AppData\Local\Temp\9656.tmp"113⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\96D3.tmp"C:\Users\Admin\AppData\Local\Temp\96D3.tmp"114⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\9750.tmp"C:\Users\Admin\AppData\Local\Temp\9750.tmp"115⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\97BD.tmp"C:\Users\Admin\AppData\Local\Temp\97BD.tmp"116⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\981B.tmp"C:\Users\Admin\AppData\Local\Temp\981B.tmp"117⤵PID:280
-
C:\Users\Admin\AppData\Local\Temp\9897.tmp"C:\Users\Admin\AppData\Local\Temp\9897.tmp"118⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\9914.tmp"C:\Users\Admin\AppData\Local\Temp\9914.tmp"119⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\99C0.tmp"C:\Users\Admin\AppData\Local\Temp\99C0.tmp"120⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"121⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"122⤵PID:1316
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-