Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 10:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-07-01_3fa5a8d0e534805091dabf321e09aa7d_mafia.exe
Resource
win7-20240611-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-01_3fa5a8d0e534805091dabf321e09aa7d_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-07-01_3fa5a8d0e534805091dabf321e09aa7d_mafia.exe
-
Size
487KB
-
MD5
3fa5a8d0e534805091dabf321e09aa7d
-
SHA1
44e51b2dc73f2bd41ae1721911c29ecea784e240
-
SHA256
b0dd2ca2b252a9695c8b3cc0060bf965bc34e722a80087e0be480d69abc2384c
-
SHA512
7e7d64db942dace083d163ef58de75dde1e2dccd4c5408ded40375533ca3791f72bd82ebfb8a0915b9e605bb9ab8567b71098ff0ad9454b65cab3e5f72b156dc
-
SSDEEP
6144:qorf3lPvovsgZnqG2C7mOTeiL9DUBcyKDdpIzJ6N5xeOn/J0IHCFBIOkYXcPsH3j:HU5rCOTeiJEuQzJKneOnGIHCFiP0NZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2180 1CC4.tmp 2352 1D50.tmp 2332 1DFC.tmp 2780 1E69.tmp 2784 1EF6.tmp 2800 1F44.tmp 2804 1FD0.tmp 2740 204D.tmp 1216 20D9.tmp 2568 2137.tmp 1240 21D3.tmp 1732 2221.tmp 2932 22BD.tmp 2904 232A.tmp 2160 23A7.tmp 2612 2433.tmp 1952 24C0.tmp 960 250E.tmp 2756 258A.tmp 1640 2617.tmp 2744 26B3.tmp 2364 2730.tmp 316 278D.tmp 1624 27DB.tmp 2064 281A.tmp 2060 2868.tmp 536 28B6.tmp 784 2904.tmp 3012 2952.tmp 1988 29A0.tmp 2276 29EE.tmp 2116 2A3C.tmp 596 2A7A.tmp 1472 2AC8.tmp 2416 2B16.tmp 1060 2B74.tmp 1144 2BC2.tmp 1448 2C10.tmp 1696 2C4E.tmp 288 2C8C.tmp 1444 2CDA.tmp 1504 2D28.tmp 1140 2D76.tmp 3024 2DC4.tmp 1916 2E12.tmp 1924 2E60.tmp 972 2EAE.tmp 2292 2EFC.tmp 1684 2F3B.tmp 1776 2F89.tmp 2212 2FD7.tmp 2128 3025.tmp 896 3073.tmp 3036 30C1.tmp 2260 311E.tmp 2976 31E9.tmp 2880 3247.tmp 2320 3295.tmp 2692 32E3.tmp 2700 3331.tmp 2828 337F.tmp 2676 33CD.tmp 2796 341B.tmp 2120 3459.tmp -
Loads dropped DLL 64 IoCs
pid Process 2244 2024-07-01_3fa5a8d0e534805091dabf321e09aa7d_mafia.exe 2180 1CC4.tmp 2352 1D50.tmp 2332 1DFC.tmp 2780 1E69.tmp 2784 1EF6.tmp 2800 1F44.tmp 2804 1FD0.tmp 2740 204D.tmp 1216 20D9.tmp 2568 2137.tmp 1240 21D3.tmp 1732 2221.tmp 2932 22BD.tmp 2904 232A.tmp 2160 23A7.tmp 2612 2433.tmp 1952 24C0.tmp 960 250E.tmp 2756 258A.tmp 1640 2617.tmp 2744 26B3.tmp 2364 2730.tmp 316 278D.tmp 1624 27DB.tmp 2064 281A.tmp 2060 2868.tmp 536 28B6.tmp 784 2904.tmp 3012 2952.tmp 1988 29A0.tmp 2276 29EE.tmp 2116 2A3C.tmp 596 2A7A.tmp 1472 2AC8.tmp 2416 2B16.tmp 1060 2B74.tmp 1144 2BC2.tmp 1448 2C10.tmp 1696 2C4E.tmp 288 2C8C.tmp 1444 2CDA.tmp 1504 2D28.tmp 1140 2D76.tmp 3024 2DC4.tmp 1916 2E12.tmp 1924 2E60.tmp 972 2EAE.tmp 2292 2EFC.tmp 1684 2F3B.tmp 1776 2F89.tmp 2212 2FD7.tmp 2128 3025.tmp 896 3073.tmp 3036 30C1.tmp 1600 316C.tmp 2976 31E9.tmp 2880 3247.tmp 2320 3295.tmp 2692 32E3.tmp 2700 3331.tmp 2828 337F.tmp 2676 33CD.tmp 2796 341B.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2244 wrote to memory of 2180 2244 2024-07-01_3fa5a8d0e534805091dabf321e09aa7d_mafia.exe 28 PID 2244 wrote to memory of 2180 2244 2024-07-01_3fa5a8d0e534805091dabf321e09aa7d_mafia.exe 28 PID 2244 wrote to memory of 2180 2244 2024-07-01_3fa5a8d0e534805091dabf321e09aa7d_mafia.exe 28 PID 2244 wrote to memory of 2180 2244 2024-07-01_3fa5a8d0e534805091dabf321e09aa7d_mafia.exe 28 PID 2180 wrote to memory of 2352 2180 1CC4.tmp 29 PID 2180 wrote to memory of 2352 2180 1CC4.tmp 29 PID 2180 wrote to memory of 2352 2180 1CC4.tmp 29 PID 2180 wrote to memory of 2352 2180 1CC4.tmp 29 PID 2352 wrote to memory of 2332 2352 1D50.tmp 30 PID 2352 wrote to memory of 2332 2352 1D50.tmp 30 PID 2352 wrote to memory of 2332 2352 1D50.tmp 30 PID 2352 wrote to memory of 2332 2352 1D50.tmp 30 PID 2332 wrote to memory of 2780 2332 1DFC.tmp 31 PID 2332 wrote to memory of 2780 2332 1DFC.tmp 31 PID 2332 wrote to memory of 2780 2332 1DFC.tmp 31 PID 2332 wrote to memory of 2780 2332 1DFC.tmp 31 PID 2780 wrote to memory of 2784 2780 1E69.tmp 32 PID 2780 wrote to memory of 2784 2780 1E69.tmp 32 PID 2780 wrote to memory of 2784 2780 1E69.tmp 32 PID 2780 wrote to memory of 2784 2780 1E69.tmp 32 PID 2784 wrote to memory of 2800 2784 1EF6.tmp 33 PID 2784 wrote to memory of 2800 2784 1EF6.tmp 33 PID 2784 wrote to memory of 2800 2784 1EF6.tmp 33 PID 2784 wrote to memory of 2800 2784 1EF6.tmp 33 PID 2800 wrote to memory of 2804 2800 1F44.tmp 34 PID 2800 wrote to memory of 2804 2800 1F44.tmp 34 PID 2800 wrote to memory of 2804 2800 1F44.tmp 34 PID 2800 wrote to memory of 2804 2800 1F44.tmp 34 PID 2804 wrote to memory of 2740 2804 1FD0.tmp 35 PID 2804 wrote to memory of 2740 2804 1FD0.tmp 35 PID 2804 wrote to memory of 2740 2804 1FD0.tmp 35 PID 2804 wrote to memory of 2740 2804 1FD0.tmp 35 PID 2740 wrote to memory of 1216 2740 204D.tmp 36 PID 2740 wrote to memory of 1216 2740 204D.tmp 36 PID 2740 wrote to memory of 1216 2740 204D.tmp 36 PID 2740 wrote to memory of 1216 2740 204D.tmp 36 PID 1216 wrote to memory of 2568 1216 20D9.tmp 37 PID 1216 wrote to memory of 2568 1216 20D9.tmp 37 PID 1216 wrote to memory of 2568 1216 20D9.tmp 37 PID 1216 wrote to memory of 2568 1216 20D9.tmp 37 PID 2568 wrote to memory of 1240 2568 2137.tmp 38 PID 2568 wrote to memory of 1240 2568 2137.tmp 38 PID 2568 wrote to memory of 1240 2568 2137.tmp 38 PID 2568 wrote to memory of 1240 2568 2137.tmp 38 PID 1240 wrote to memory of 1732 1240 21D3.tmp 39 PID 1240 wrote to memory of 1732 1240 21D3.tmp 39 PID 1240 wrote to memory of 1732 1240 21D3.tmp 39 PID 1240 wrote to memory of 1732 1240 21D3.tmp 39 PID 1732 wrote to memory of 2932 1732 2221.tmp 40 PID 1732 wrote to memory of 2932 1732 2221.tmp 40 PID 1732 wrote to memory of 2932 1732 2221.tmp 40 PID 1732 wrote to memory of 2932 1732 2221.tmp 40 PID 2932 wrote to memory of 2904 2932 22BD.tmp 41 PID 2932 wrote to memory of 2904 2932 22BD.tmp 41 PID 2932 wrote to memory of 2904 2932 22BD.tmp 41 PID 2932 wrote to memory of 2904 2932 22BD.tmp 41 PID 2904 wrote to memory of 2160 2904 232A.tmp 42 PID 2904 wrote to memory of 2160 2904 232A.tmp 42 PID 2904 wrote to memory of 2160 2904 232A.tmp 42 PID 2904 wrote to memory of 2160 2904 232A.tmp 42 PID 2160 wrote to memory of 2612 2160 23A7.tmp 43 PID 2160 wrote to memory of 2612 2160 23A7.tmp 43 PID 2160 wrote to memory of 2612 2160 23A7.tmp 43 PID 2160 wrote to memory of 2612 2160 23A7.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-01_3fa5a8d0e534805091dabf321e09aa7d_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-01_3fa5a8d0e534805091dabf321e09aa7d_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\1D50.tmp"C:\Users\Admin\AppData\Local\Temp\1D50.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\1E69.tmp"C:\Users\Admin\AppData\Local\Temp\1E69.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\1F44.tmp"C:\Users\Admin\AppData\Local\Temp\1F44.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\204D.tmp"C:\Users\Admin\AppData\Local\Temp\204D.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\20D9.tmp"C:\Users\Admin\AppData\Local\Temp\20D9.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\2137.tmp"C:\Users\Admin\AppData\Local\Temp\2137.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\21D3.tmp"C:\Users\Admin\AppData\Local\Temp\21D3.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\2221.tmp"C:\Users\Admin\AppData\Local\Temp\2221.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\22BD.tmp"C:\Users\Admin\AppData\Local\Temp\22BD.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\232A.tmp"C:\Users\Admin\AppData\Local\Temp\232A.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\23A7.tmp"C:\Users\Admin\AppData\Local\Temp\23A7.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\2433.tmp"C:\Users\Admin\AppData\Local\Temp\2433.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\24C0.tmp"C:\Users\Admin\AppData\Local\Temp\24C0.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\250E.tmp"C:\Users\Admin\AppData\Local\Temp\250E.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:960 -
C:\Users\Admin\AppData\Local\Temp\258A.tmp"C:\Users\Admin\AppData\Local\Temp\258A.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\26B3.tmp"C:\Users\Admin\AppData\Local\Temp\26B3.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\2730.tmp"C:\Users\Admin\AppData\Local\Temp\2730.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\278D.tmp"C:\Users\Admin\AppData\Local\Temp\278D.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:316 -
C:\Users\Admin\AppData\Local\Temp\27DB.tmp"C:\Users\Admin\AppData\Local\Temp\27DB.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\281A.tmp"C:\Users\Admin\AppData\Local\Temp\281A.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\2868.tmp"C:\Users\Admin\AppData\Local\Temp\2868.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\28B6.tmp"C:\Users\Admin\AppData\Local\Temp\28B6.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:536 -
C:\Users\Admin\AppData\Local\Temp\2904.tmp"C:\Users\Admin\AppData\Local\Temp\2904.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:784 -
C:\Users\Admin\AppData\Local\Temp\2952.tmp"C:\Users\Admin\AppData\Local\Temp\2952.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\29A0.tmp"C:\Users\Admin\AppData\Local\Temp\29A0.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\29EE.tmp"C:\Users\Admin\AppData\Local\Temp\29EE.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:596 -
C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\2B16.tmp"C:\Users\Admin\AppData\Local\Temp\2B16.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\2B74.tmp"C:\Users\Admin\AppData\Local\Temp\2B74.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\2C10.tmp"C:\Users\Admin\AppData\Local\Temp\2C10.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:288 -
C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\2D28.tmp"C:\Users\Admin\AppData\Local\Temp\2D28.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\2D76.tmp"C:\Users\Admin\AppData\Local\Temp\2D76.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\2E12.tmp"C:\Users\Admin\AppData\Local\Temp\2E12.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\2E60.tmp"C:\Users\Admin\AppData\Local\Temp\2E60.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:972 -
C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\2F3B.tmp"C:\Users\Admin\AppData\Local\Temp\2F3B.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\2F89.tmp"C:\Users\Admin\AppData\Local\Temp\2F89.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\2FD7.tmp"C:\Users\Admin\AppData\Local\Temp\2FD7.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\3025.tmp"C:\Users\Admin\AppData\Local\Temp\3025.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\3073.tmp"C:\Users\Admin\AppData\Local\Temp\3073.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:896 -
C:\Users\Admin\AppData\Local\Temp\30C1.tmp"C:\Users\Admin\AppData\Local\Temp\30C1.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\311E.tmp"C:\Users\Admin\AppData\Local\Temp\311E.tmp"56⤵
- Executes dropped EXE
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\316C.tmp"C:\Users\Admin\AppData\Local\Temp\316C.tmp"57⤵
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\31E9.tmp"C:\Users\Admin\AppData\Local\Temp\31E9.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\3247.tmp"C:\Users\Admin\AppData\Local\Temp\3247.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\3295.tmp"C:\Users\Admin\AppData\Local\Temp\3295.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\32E3.tmp"C:\Users\Admin\AppData\Local\Temp\32E3.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\3331.tmp"C:\Users\Admin\AppData\Local\Temp\3331.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\337F.tmp"C:\Users\Admin\AppData\Local\Temp\337F.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\33CD.tmp"C:\Users\Admin\AppData\Local\Temp\33CD.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\341B.tmp"C:\Users\Admin\AppData\Local\Temp\341B.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\3459.tmp"C:\Users\Admin\AppData\Local\Temp\3459.tmp"66⤵
- Executes dropped EXE
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\3498.tmp"C:\Users\Admin\AppData\Local\Temp\3498.tmp"67⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\34D6.tmp"C:\Users\Admin\AppData\Local\Temp\34D6.tmp"68⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\3524.tmp"C:\Users\Admin\AppData\Local\Temp\3524.tmp"69⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\3562.tmp"C:\Users\Admin\AppData\Local\Temp\3562.tmp"70⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\35A1.tmp"C:\Users\Admin\AppData\Local\Temp\35A1.tmp"71⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\35DF.tmp"C:\Users\Admin\AppData\Local\Temp\35DF.tmp"72⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\361E.tmp"C:\Users\Admin\AppData\Local\Temp\361E.tmp"73⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\365C.tmp"C:\Users\Admin\AppData\Local\Temp\365C.tmp"74⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\369A.tmp"C:\Users\Admin\AppData\Local\Temp\369A.tmp"75⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\36D9.tmp"C:\Users\Admin\AppData\Local\Temp\36D9.tmp"76⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\3727.tmp"C:\Users\Admin\AppData\Local\Temp\3727.tmp"77⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\3765.tmp"C:\Users\Admin\AppData\Local\Temp\3765.tmp"78⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\37B3.tmp"C:\Users\Admin\AppData\Local\Temp\37B3.tmp"79⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\37F2.tmp"C:\Users\Admin\AppData\Local\Temp\37F2.tmp"80⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\3840.tmp"C:\Users\Admin\AppData\Local\Temp\3840.tmp"81⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\387E.tmp"C:\Users\Admin\AppData\Local\Temp\387E.tmp"82⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\38BC.tmp"C:\Users\Admin\AppData\Local\Temp\38BC.tmp"83⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\38FB.tmp"C:\Users\Admin\AppData\Local\Temp\38FB.tmp"84⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\3939.tmp"C:\Users\Admin\AppData\Local\Temp\3939.tmp"85⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\3978.tmp"C:\Users\Admin\AppData\Local\Temp\3978.tmp"86⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\39B6.tmp"C:\Users\Admin\AppData\Local\Temp\39B6.tmp"87⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\39F4.tmp"C:\Users\Admin\AppData\Local\Temp\39F4.tmp"88⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\3A42.tmp"C:\Users\Admin\AppData\Local\Temp\3A42.tmp"89⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\3A81.tmp"C:\Users\Admin\AppData\Local\Temp\3A81.tmp"90⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\3ABF.tmp"C:\Users\Admin\AppData\Local\Temp\3ABF.tmp"91⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\3B0D.tmp"C:\Users\Admin\AppData\Local\Temp\3B0D.tmp"92⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\3B5B.tmp"C:\Users\Admin\AppData\Local\Temp\3B5B.tmp"93⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\3BA9.tmp"C:\Users\Admin\AppData\Local\Temp\3BA9.tmp"94⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\3BF7.tmp"C:\Users\Admin\AppData\Local\Temp\3BF7.tmp"95⤵PID:604
-
C:\Users\Admin\AppData\Local\Temp\3C36.tmp"C:\Users\Admin\AppData\Local\Temp\3C36.tmp"96⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\3C84.tmp"C:\Users\Admin\AppData\Local\Temp\3C84.tmp"97⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\3CC2.tmp"C:\Users\Admin\AppData\Local\Temp\3CC2.tmp"98⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\3D00.tmp"C:\Users\Admin\AppData\Local\Temp\3D00.tmp"99⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\3D4E.tmp"C:\Users\Admin\AppData\Local\Temp\3D4E.tmp"100⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"101⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\3DDB.tmp"C:\Users\Admin\AppData\Local\Temp\3DDB.tmp"102⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\3E29.tmp"C:\Users\Admin\AppData\Local\Temp\3E29.tmp"103⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\3E67.tmp"C:\Users\Admin\AppData\Local\Temp\3E67.tmp"104⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\3EC5.tmp"C:\Users\Admin\AppData\Local\Temp\3EC5.tmp"105⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\3F13.tmp"C:\Users\Admin\AppData\Local\Temp\3F13.tmp"106⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\3F61.tmp"C:\Users\Admin\AppData\Local\Temp\3F61.tmp"107⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\3F9F.tmp"C:\Users\Admin\AppData\Local\Temp\3F9F.tmp"108⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\3FED.tmp"C:\Users\Admin\AppData\Local\Temp\3FED.tmp"109⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\402C.tmp"C:\Users\Admin\AppData\Local\Temp\402C.tmp"110⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\407A.tmp"C:\Users\Admin\AppData\Local\Temp\407A.tmp"111⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\40C8.tmp"C:\Users\Admin\AppData\Local\Temp\40C8.tmp"112⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\4116.tmp"C:\Users\Admin\AppData\Local\Temp\4116.tmp"113⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\4164.tmp"C:\Users\Admin\AppData\Local\Temp\4164.tmp"114⤵PID:648
-
C:\Users\Admin\AppData\Local\Temp\41B2.tmp"C:\Users\Admin\AppData\Local\Temp\41B2.tmp"115⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\41F0.tmp"C:\Users\Admin\AppData\Local\Temp\41F0.tmp"116⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\422E.tmp"C:\Users\Admin\AppData\Local\Temp\422E.tmp"117⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\427C.tmp"C:\Users\Admin\AppData\Local\Temp\427C.tmp"118⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\42CA.tmp"C:\Users\Admin\AppData\Local\Temp\42CA.tmp"119⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\4309.tmp"C:\Users\Admin\AppData\Local\Temp\4309.tmp"120⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\4347.tmp"C:\Users\Admin\AppData\Local\Temp\4347.tmp"121⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\4395.tmp"C:\Users\Admin\AppData\Local\Temp\4395.tmp"122⤵PID:400
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-