Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
20-06-2024 01:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-20_2c21d0cc8d219861ccb235a58e8a212a_mafia.exe
Resource
win7-20240611-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-20_2c21d0cc8d219861ccb235a58e8a212a_mafia.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-06-20_2c21d0cc8d219861ccb235a58e8a212a_mafia.exe
-
Size
529KB
-
MD5
2c21d0cc8d219861ccb235a58e8a212a
-
SHA1
fba80ada8f385b628ca446287f6f75e02724a28f
-
SHA256
bae9a8c9aef67adf775c09cb500971dd2e9fd545fc4c63c3ae7b77a6d174d3f5
-
SHA512
d242d37feac66b2c6374335c73d5531e1785b65c0d2bcae37f937020f70a5ce76f233e993d7cff253c8053901d9b430ab1b438db563300920091ce263d6381f0
-
SSDEEP
12288:NU5rCOTeijbvsAJUG1nb4MVXk2TZwlH4Hp:NUQOJjbvsu1blVU2TSlH4Hp
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3000 25E8.tmp 2616 2636.tmp 2696 26B3.tmp 2720 2720.tmp 2328 278D.tmp 2572 27FA.tmp 2496 2858.tmp 2468 28C5.tmp 2548 2923.tmp 2528 29A0.tmp 1492 2A1C.tmp 2520 2A99.tmp 2732 2B06.tmp 2648 2B74.tmp 2820 2BE1.tmp 2168 2C4E.tmp 768 2CBB.tmp 376 2D28.tmp 2816 2D96.tmp 592 2E03.tmp 536 2E60.tmp 2172 2ECE.tmp 2028 2F2B.tmp 1992 2F79.tmp 2316 2FC7.tmp 3044 3006.tmp 1424 3054.tmp 2256 3092.tmp 1152 30D0.tmp 2448 310F.tmp 2220 314D.tmp 1788 319B.tmp 2000 31E9.tmp 2424 3228.tmp 2848 3276.tmp 2888 32B4.tmp 1112 3302.tmp 3056 3350.tmp 2824 338E.tmp 1332 33DC.tmp 1864 342A.tmp 1320 3478.tmp 900 34C6.tmp 2216 3514.tmp 880 3553.tmp 2984 35A1.tmp 1796 35EF.tmp 1876 362D.tmp 2212 367B.tmp 1944 36BA.tmp 984 36F8.tmp 2284 3746.tmp 876 3794.tmp 2340 37D2.tmp 1524 3811.tmp 1640 385F.tmp 2324 38AD.tmp 3024 391A.tmp 2680 3968.tmp 2844 39A6.tmp 2700 39F4.tmp 2476 3A33.tmp 2720 3A81.tmp 2812 3ACF.tmp -
Loads dropped DLL 64 IoCs
pid Process 2788 2024-06-20_2c21d0cc8d219861ccb235a58e8a212a_mafia.exe 3000 25E8.tmp 2616 2636.tmp 2696 26B3.tmp 2720 2720.tmp 2328 278D.tmp 2572 27FA.tmp 2496 2858.tmp 2468 28C5.tmp 2548 2923.tmp 2528 29A0.tmp 1492 2A1C.tmp 2520 2A99.tmp 2732 2B06.tmp 2648 2B74.tmp 2820 2BE1.tmp 2168 2C4E.tmp 768 2CBB.tmp 376 2D28.tmp 2816 2D96.tmp 592 2E03.tmp 536 2E60.tmp 2172 2ECE.tmp 2028 2F2B.tmp 1992 2F79.tmp 2316 2FC7.tmp 3044 3006.tmp 1424 3054.tmp 2256 3092.tmp 1152 30D0.tmp 2448 310F.tmp 2220 314D.tmp 1788 319B.tmp 2000 31E9.tmp 2424 3228.tmp 2848 3276.tmp 2888 32B4.tmp 1112 3302.tmp 3056 3350.tmp 2824 338E.tmp 1332 33DC.tmp 1864 342A.tmp 1320 3478.tmp 900 34C6.tmp 2216 3514.tmp 880 3553.tmp 2984 35A1.tmp 1796 35EF.tmp 1876 362D.tmp 2212 367B.tmp 1944 36BA.tmp 984 36F8.tmp 2284 3746.tmp 876 3794.tmp 2340 37D2.tmp 1524 3811.tmp 1640 385F.tmp 2324 38AD.tmp 3024 391A.tmp 2680 3968.tmp 2844 39A6.tmp 2700 39F4.tmp 2476 3A33.tmp 2720 3A81.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2788 wrote to memory of 3000 2788 2024-06-20_2c21d0cc8d219861ccb235a58e8a212a_mafia.exe 28 PID 2788 wrote to memory of 3000 2788 2024-06-20_2c21d0cc8d219861ccb235a58e8a212a_mafia.exe 28 PID 2788 wrote to memory of 3000 2788 2024-06-20_2c21d0cc8d219861ccb235a58e8a212a_mafia.exe 28 PID 2788 wrote to memory of 3000 2788 2024-06-20_2c21d0cc8d219861ccb235a58e8a212a_mafia.exe 28 PID 3000 wrote to memory of 2616 3000 25E8.tmp 29 PID 3000 wrote to memory of 2616 3000 25E8.tmp 29 PID 3000 wrote to memory of 2616 3000 25E8.tmp 29 PID 3000 wrote to memory of 2616 3000 25E8.tmp 29 PID 2616 wrote to memory of 2696 2616 2636.tmp 30 PID 2616 wrote to memory of 2696 2616 2636.tmp 30 PID 2616 wrote to memory of 2696 2616 2636.tmp 30 PID 2616 wrote to memory of 2696 2616 2636.tmp 30 PID 2696 wrote to memory of 2720 2696 26B3.tmp 31 PID 2696 wrote to memory of 2720 2696 26B3.tmp 31 PID 2696 wrote to memory of 2720 2696 26B3.tmp 31 PID 2696 wrote to memory of 2720 2696 26B3.tmp 31 PID 2720 wrote to memory of 2328 2720 2720.tmp 32 PID 2720 wrote to memory of 2328 2720 2720.tmp 32 PID 2720 wrote to memory of 2328 2720 2720.tmp 32 PID 2720 wrote to memory of 2328 2720 2720.tmp 32 PID 2328 wrote to memory of 2572 2328 278D.tmp 33 PID 2328 wrote to memory of 2572 2328 278D.tmp 33 PID 2328 wrote to memory of 2572 2328 278D.tmp 33 PID 2328 wrote to memory of 2572 2328 278D.tmp 33 PID 2572 wrote to memory of 2496 2572 27FA.tmp 34 PID 2572 wrote to memory of 2496 2572 27FA.tmp 34 PID 2572 wrote to memory of 2496 2572 27FA.tmp 34 PID 2572 wrote to memory of 2496 2572 27FA.tmp 34 PID 2496 wrote to memory of 2468 2496 2858.tmp 35 PID 2496 wrote to memory of 2468 2496 2858.tmp 35 PID 2496 wrote to memory of 2468 2496 2858.tmp 35 PID 2496 wrote to memory of 2468 2496 2858.tmp 35 PID 2468 wrote to memory of 2548 2468 28C5.tmp 36 PID 2468 wrote to memory of 2548 2468 28C5.tmp 36 PID 2468 wrote to memory of 2548 2468 28C5.tmp 36 PID 2468 wrote to memory of 2548 2468 28C5.tmp 36 PID 2548 wrote to memory of 2528 2548 2923.tmp 37 PID 2548 wrote to memory of 2528 2548 2923.tmp 37 PID 2548 wrote to memory of 2528 2548 2923.tmp 37 PID 2548 wrote to memory of 2528 2548 2923.tmp 37 PID 2528 wrote to memory of 1492 2528 29A0.tmp 38 PID 2528 wrote to memory of 1492 2528 29A0.tmp 38 PID 2528 wrote to memory of 1492 2528 29A0.tmp 38 PID 2528 wrote to memory of 1492 2528 29A0.tmp 38 PID 1492 wrote to memory of 2520 1492 2A1C.tmp 39 PID 1492 wrote to memory of 2520 1492 2A1C.tmp 39 PID 1492 wrote to memory of 2520 1492 2A1C.tmp 39 PID 1492 wrote to memory of 2520 1492 2A1C.tmp 39 PID 2520 wrote to memory of 2732 2520 2A99.tmp 40 PID 2520 wrote to memory of 2732 2520 2A99.tmp 40 PID 2520 wrote to memory of 2732 2520 2A99.tmp 40 PID 2520 wrote to memory of 2732 2520 2A99.tmp 40 PID 2732 wrote to memory of 2648 2732 2B06.tmp 41 PID 2732 wrote to memory of 2648 2732 2B06.tmp 41 PID 2732 wrote to memory of 2648 2732 2B06.tmp 41 PID 2732 wrote to memory of 2648 2732 2B06.tmp 41 PID 2648 wrote to memory of 2820 2648 2B74.tmp 42 PID 2648 wrote to memory of 2820 2648 2B74.tmp 42 PID 2648 wrote to memory of 2820 2648 2B74.tmp 42 PID 2648 wrote to memory of 2820 2648 2B74.tmp 42 PID 2820 wrote to memory of 2168 2820 2BE1.tmp 43 PID 2820 wrote to memory of 2168 2820 2BE1.tmp 43 PID 2820 wrote to memory of 2168 2820 2BE1.tmp 43 PID 2820 wrote to memory of 2168 2820 2BE1.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-20_2c21d0cc8d219861ccb235a58e8a212a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-20_2c21d0cc8d219861ccb235a58e8a212a_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\25E8.tmp"C:\Users\Admin\AppData\Local\Temp\25E8.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\2636.tmp"C:\Users\Admin\AppData\Local\Temp\2636.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\26B3.tmp"C:\Users\Admin\AppData\Local\Temp\26B3.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\2720.tmp"C:\Users\Admin\AppData\Local\Temp\2720.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\278D.tmp"C:\Users\Admin\AppData\Local\Temp\278D.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\27FA.tmp"C:\Users\Admin\AppData\Local\Temp\27FA.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\2858.tmp"C:\Users\Admin\AppData\Local\Temp\2858.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\28C5.tmp"C:\Users\Admin\AppData\Local\Temp\28C5.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\2923.tmp"C:\Users\Admin\AppData\Local\Temp\2923.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\29A0.tmp"C:\Users\Admin\AppData\Local\Temp\29A0.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\2A99.tmp"C:\Users\Admin\AppData\Local\Temp\2A99.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\2B06.tmp"C:\Users\Admin\AppData\Local\Temp\2B06.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\2B74.tmp"C:\Users\Admin\AppData\Local\Temp\2B74.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\2BE1.tmp"C:\Users\Admin\AppData\Local\Temp\2BE1.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:768 -
C:\Users\Admin\AppData\Local\Temp\2D28.tmp"C:\Users\Admin\AppData\Local\Temp\2D28.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:376 -
C:\Users\Admin\AppData\Local\Temp\2D96.tmp"C:\Users\Admin\AppData\Local\Temp\2D96.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\2E03.tmp"C:\Users\Admin\AppData\Local\Temp\2E03.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:592 -
C:\Users\Admin\AppData\Local\Temp\2E60.tmp"C:\Users\Admin\AppData\Local\Temp\2E60.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:536 -
C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\2F79.tmp"C:\Users\Admin\AppData\Local\Temp\2F79.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\3006.tmp"C:\Users\Admin\AppData\Local\Temp\3006.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\3054.tmp"C:\Users\Admin\AppData\Local\Temp\3054.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\3092.tmp"C:\Users\Admin\AppData\Local\Temp\3092.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\30D0.tmp"C:\Users\Admin\AppData\Local\Temp\30D0.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\310F.tmp"C:\Users\Admin\AppData\Local\Temp\310F.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\314D.tmp"C:\Users\Admin\AppData\Local\Temp\314D.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\319B.tmp"C:\Users\Admin\AppData\Local\Temp\319B.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\31E9.tmp"C:\Users\Admin\AppData\Local\Temp\31E9.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\3228.tmp"C:\Users\Admin\AppData\Local\Temp\3228.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\3276.tmp"C:\Users\Admin\AppData\Local\Temp\3276.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\32B4.tmp"C:\Users\Admin\AppData\Local\Temp\32B4.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\3302.tmp"C:\Users\Admin\AppData\Local\Temp\3302.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\3350.tmp"C:\Users\Admin\AppData\Local\Temp\3350.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\338E.tmp"C:\Users\Admin\AppData\Local\Temp\338E.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\33DC.tmp"C:\Users\Admin\AppData\Local\Temp\33DC.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\342A.tmp"C:\Users\Admin\AppData\Local\Temp\342A.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\3478.tmp"C:\Users\Admin\AppData\Local\Temp\3478.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\34C6.tmp"C:\Users\Admin\AppData\Local\Temp\34C6.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:900 -
C:\Users\Admin\AppData\Local\Temp\3514.tmp"C:\Users\Admin\AppData\Local\Temp\3514.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\3553.tmp"C:\Users\Admin\AppData\Local\Temp\3553.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:880 -
C:\Users\Admin\AppData\Local\Temp\35A1.tmp"C:\Users\Admin\AppData\Local\Temp\35A1.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\35EF.tmp"C:\Users\Admin\AppData\Local\Temp\35EF.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\362D.tmp"C:\Users\Admin\AppData\Local\Temp\362D.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\367B.tmp"C:\Users\Admin\AppData\Local\Temp\367B.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\36BA.tmp"C:\Users\Admin\AppData\Local\Temp\36BA.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\36F8.tmp"C:\Users\Admin\AppData\Local\Temp\36F8.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:984 -
C:\Users\Admin\AppData\Local\Temp\3746.tmp"C:\Users\Admin\AppData\Local\Temp\3746.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\3794.tmp"C:\Users\Admin\AppData\Local\Temp\3794.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:876 -
C:\Users\Admin\AppData\Local\Temp\37D2.tmp"C:\Users\Admin\AppData\Local\Temp\37D2.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\3811.tmp"C:\Users\Admin\AppData\Local\Temp\3811.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\385F.tmp"C:\Users\Admin\AppData\Local\Temp\385F.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\38AD.tmp"C:\Users\Admin\AppData\Local\Temp\38AD.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\391A.tmp"C:\Users\Admin\AppData\Local\Temp\391A.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\3968.tmp"C:\Users\Admin\AppData\Local\Temp\3968.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\39A6.tmp"C:\Users\Admin\AppData\Local\Temp\39A6.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\39F4.tmp"C:\Users\Admin\AppData\Local\Temp\39F4.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\3A33.tmp"C:\Users\Admin\AppData\Local\Temp\3A33.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\3A81.tmp"C:\Users\Admin\AppData\Local\Temp\3A81.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\3ACF.tmp"C:\Users\Admin\AppData\Local\Temp\3ACF.tmp"65⤵
- Executes dropped EXE
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\3B1D.tmp"C:\Users\Admin\AppData\Local\Temp\3B1D.tmp"66⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\3B6B.tmp"C:\Users\Admin\AppData\Local\Temp\3B6B.tmp"67⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\3BB9.tmp"C:\Users\Admin\AppData\Local\Temp\3BB9.tmp"68⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\3BF7.tmp"C:\Users\Admin\AppData\Local\Temp\3BF7.tmp"69⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\3C36.tmp"C:\Users\Admin\AppData\Local\Temp\3C36.tmp"70⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\3C74.tmp"C:\Users\Admin\AppData\Local\Temp\3C74.tmp"71⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\3CB2.tmp"C:\Users\Admin\AppData\Local\Temp\3CB2.tmp"72⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\3CF1.tmp"C:\Users\Admin\AppData\Local\Temp\3CF1.tmp"73⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\3D3F.tmp"C:\Users\Admin\AppData\Local\Temp\3D3F.tmp"74⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\3D7D.tmp"C:\Users\Admin\AppData\Local\Temp\3D7D.tmp"75⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\3DBC.tmp"C:\Users\Admin\AppData\Local\Temp\3DBC.tmp"76⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\3DFA.tmp"C:\Users\Admin\AppData\Local\Temp\3DFA.tmp"77⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\3E38.tmp"C:\Users\Admin\AppData\Local\Temp\3E38.tmp"78⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\3E86.tmp"C:\Users\Admin\AppData\Local\Temp\3E86.tmp"79⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\3ED4.tmp"C:\Users\Admin\AppData\Local\Temp\3ED4.tmp"80⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\3F13.tmp"C:\Users\Admin\AppData\Local\Temp\3F13.tmp"81⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\3F51.tmp"C:\Users\Admin\AppData\Local\Temp\3F51.tmp"82⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\3F90.tmp"C:\Users\Admin\AppData\Local\Temp\3F90.tmp"83⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\3FCE.tmp"C:\Users\Admin\AppData\Local\Temp\3FCE.tmp"84⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\401C.tmp"C:\Users\Admin\AppData\Local\Temp\401C.tmp"85⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\405A.tmp"C:\Users\Admin\AppData\Local\Temp\405A.tmp"86⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\40A8.tmp"C:\Users\Admin\AppData\Local\Temp\40A8.tmp"87⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\40E7.tmp"C:\Users\Admin\AppData\Local\Temp\40E7.tmp"88⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\4125.tmp"C:\Users\Admin\AppData\Local\Temp\4125.tmp"89⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\4164.tmp"C:\Users\Admin\AppData\Local\Temp\4164.tmp"90⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\41B2.tmp"C:\Users\Admin\AppData\Local\Temp\41B2.tmp"91⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\41F0.tmp"C:\Users\Admin\AppData\Local\Temp\41F0.tmp"92⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\422E.tmp"C:\Users\Admin\AppData\Local\Temp\422E.tmp"93⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\426D.tmp"C:\Users\Admin\AppData\Local\Temp\426D.tmp"94⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\42BB.tmp"C:\Users\Admin\AppData\Local\Temp\42BB.tmp"95⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\42F9.tmp"C:\Users\Admin\AppData\Local\Temp\42F9.tmp"96⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\4347.tmp"C:\Users\Admin\AppData\Local\Temp\4347.tmp"97⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\4386.tmp"C:\Users\Admin\AppData\Local\Temp\4386.tmp"98⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\43C4.tmp"C:\Users\Admin\AppData\Local\Temp\43C4.tmp"99⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\4402.tmp"C:\Users\Admin\AppData\Local\Temp\4402.tmp"100⤵PID:648
-
C:\Users\Admin\AppData\Local\Temp\4441.tmp"C:\Users\Admin\AppData\Local\Temp\4441.tmp"101⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\448F.tmp"C:\Users\Admin\AppData\Local\Temp\448F.tmp"102⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\44DD.tmp"C:\Users\Admin\AppData\Local\Temp\44DD.tmp"103⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\452B.tmp"C:\Users\Admin\AppData\Local\Temp\452B.tmp"104⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\4569.tmp"C:\Users\Admin\AppData\Local\Temp\4569.tmp"105⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\45A8.tmp"C:\Users\Admin\AppData\Local\Temp\45A8.tmp"106⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\45F6.tmp"C:\Users\Admin\AppData\Local\Temp\45F6.tmp"107⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\4634.tmp"C:\Users\Admin\AppData\Local\Temp\4634.tmp"108⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\4682.tmp"C:\Users\Admin\AppData\Local\Temp\4682.tmp"109⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\46C0.tmp"C:\Users\Admin\AppData\Local\Temp\46C0.tmp"110⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\470E.tmp"C:\Users\Admin\AppData\Local\Temp\470E.tmp"111⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\474D.tmp"C:\Users\Admin\AppData\Local\Temp\474D.tmp"112⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\478B.tmp"C:\Users\Admin\AppData\Local\Temp\478B.tmp"113⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\47CA.tmp"C:\Users\Admin\AppData\Local\Temp\47CA.tmp"114⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\4818.tmp"C:\Users\Admin\AppData\Local\Temp\4818.tmp"115⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\4866.tmp"C:\Users\Admin\AppData\Local\Temp\4866.tmp"116⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\48A4.tmp"C:\Users\Admin\AppData\Local\Temp\48A4.tmp"117⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\48E2.tmp"C:\Users\Admin\AppData\Local\Temp\48E2.tmp"118⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\4930.tmp"C:\Users\Admin\AppData\Local\Temp\4930.tmp"119⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\496F.tmp"C:\Users\Admin\AppData\Local\Temp\496F.tmp"120⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\49AD.tmp"C:\Users\Admin\AppData\Local\Temp\49AD.tmp"121⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\49EC.tmp"C:\Users\Admin\AppData\Local\Temp\49EC.tmp"122⤵PID:2292
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-