Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
05/01/2024, 05:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-01-01_09baa2411a9c769950428882be7930c3_mafia.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-01-01_09baa2411a9c769950428882be7930c3_mafia.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
2024-01-01_09baa2411a9c769950428882be7930c3_mafia.exe
-
Size
527KB
-
MD5
09baa2411a9c769950428882be7930c3
-
SHA1
245e19bc8fbe2e9488a2e7c5b34a1d80509dabd5
-
SHA256
fea8935b0330141d3ddd2574e0cdf68f9699939674774c6a4cd3b0a69aa23736
-
SHA512
42e349c8a72bc600df8ff021b622d95dbc010ad291227ef0f0766cfee628308fbf88db8724b32e6c6572aacd65a51a4490b4a161a3a2d6b5643d99584df61ea9
-
SSDEEP
12288:fU5rCOTeid3lRQ2QyaVoNFM/lRLe3DZu:fUQOJdDK0NARS3Do
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2804 7F9B.tmp 2668 8028.tmp 2788 816F.tmp 2632 8298.tmp 1204 83C0.tmp 2716 84F8.tmp 2908 8640.tmp 2636 872A.tmp 2576 8814.tmp 3004 890D.tmp 524 89F7.tmp 960 8AD2.tmp 1996 8BBC.tmp 1480 8D13.tmp 832 8E3B.tmp 2872 8F83.tmp 2892 9212.tmp 544 934A.tmp 1164 9453.tmp 1936 957C.tmp 2004 9675.tmp 2172 976F.tmp 1680 9878.tmp 1712 98E5.tmp 1644 9953.tmp 1584 99C0.tmp 1100 9A2D.tmp 1512 9AC9.tmp 2464 9B46.tmp 2280 9BB3.tmp 2380 9C3F.tmp 2268 9CCC.tmp 2388 9D49.tmp 2320 9DD5.tmp 2416 9E52.tmp 2400 9ECF.tmp 1188 9F4B.tmp 2124 9FE7.tmp 696 A064.tmp 992 A0E1.tmp 1324 A16D.tmp 2488 A1FA.tmp 2112 A277.tmp 1804 A2F3.tmp 904 A39F.tmp 580 A43B.tmp 2412 A4B8.tmp 2052 A544.tmp 1752 A5B1.tmp 2084 A7F3.tmp 2064 A91B.tmp 876 A979.tmp 2960 AA05.tmp 632 AA72.tmp 2720 AAEF.tmp 848 AB7B.tmp 2328 ABE9.tmp 2760 AC94.tmp 2768 AD21.tmp 2744 AD8E.tmp 2628 AE0B.tmp 2632 AE87.tmp 2560 AF33.tmp 2696 AF91.tmp -
Loads dropped DLL 64 IoCs
pid Process 2448 2024-01-01_09baa2411a9c769950428882be7930c3_mafia.exe 2804 7F9B.tmp 2668 8028.tmp 2788 816F.tmp 2632 8298.tmp 1204 83C0.tmp 2716 84F8.tmp 2908 8640.tmp 2636 872A.tmp 2576 8814.tmp 3004 890D.tmp 524 89F7.tmp 960 8AD2.tmp 1996 8BBC.tmp 1480 8D13.tmp 832 8E3B.tmp 2872 8F83.tmp 2892 9212.tmp 544 934A.tmp 1164 9453.tmp 1936 957C.tmp 2004 9675.tmp 2172 976F.tmp 1680 9878.tmp 1712 98E5.tmp 1644 9953.tmp 1584 99C0.tmp 1100 9A2D.tmp 1512 9AC9.tmp 2464 9B46.tmp 2280 9BB3.tmp 2380 9C3F.tmp 2268 9CCC.tmp 2388 9D49.tmp 2320 9DD5.tmp 2416 9E52.tmp 2400 9ECF.tmp 1188 9F4B.tmp 2124 9FE7.tmp 696 A064.tmp 992 A0E1.tmp 1324 A16D.tmp 2488 A1FA.tmp 2112 A277.tmp 1804 A2F3.tmp 904 A39F.tmp 580 A43B.tmp 2412 A4B8.tmp 2052 A544.tmp 1752 A5B1.tmp 2084 A7F3.tmp 2064 A91B.tmp 876 A979.tmp 2960 AA05.tmp 632 AA72.tmp 2720 AAEF.tmp 848 AB7B.tmp 2328 ABE9.tmp 2760 AC94.tmp 2768 AD21.tmp 2744 AD8E.tmp 2628 AE0B.tmp 2632 AE87.tmp 2560 AF33.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2448 wrote to memory of 2804 2448 2024-01-01_09baa2411a9c769950428882be7930c3_mafia.exe 28 PID 2448 wrote to memory of 2804 2448 2024-01-01_09baa2411a9c769950428882be7930c3_mafia.exe 28 PID 2448 wrote to memory of 2804 2448 2024-01-01_09baa2411a9c769950428882be7930c3_mafia.exe 28 PID 2448 wrote to memory of 2804 2448 2024-01-01_09baa2411a9c769950428882be7930c3_mafia.exe 28 PID 2804 wrote to memory of 2668 2804 7F9B.tmp 29 PID 2804 wrote to memory of 2668 2804 7F9B.tmp 29 PID 2804 wrote to memory of 2668 2804 7F9B.tmp 29 PID 2804 wrote to memory of 2668 2804 7F9B.tmp 29 PID 2668 wrote to memory of 2788 2668 8028.tmp 30 PID 2668 wrote to memory of 2788 2668 8028.tmp 30 PID 2668 wrote to memory of 2788 2668 8028.tmp 30 PID 2668 wrote to memory of 2788 2668 8028.tmp 30 PID 2788 wrote to memory of 2632 2788 816F.tmp 31 PID 2788 wrote to memory of 2632 2788 816F.tmp 31 PID 2788 wrote to memory of 2632 2788 816F.tmp 31 PID 2788 wrote to memory of 2632 2788 816F.tmp 31 PID 2632 wrote to memory of 1204 2632 8298.tmp 32 PID 2632 wrote to memory of 1204 2632 8298.tmp 32 PID 2632 wrote to memory of 1204 2632 8298.tmp 32 PID 2632 wrote to memory of 1204 2632 8298.tmp 32 PID 1204 wrote to memory of 2716 1204 83C0.tmp 33 PID 1204 wrote to memory of 2716 1204 83C0.tmp 33 PID 1204 wrote to memory of 2716 1204 83C0.tmp 33 PID 1204 wrote to memory of 2716 1204 83C0.tmp 33 PID 2716 wrote to memory of 2908 2716 84F8.tmp 34 PID 2716 wrote to memory of 2908 2716 84F8.tmp 34 PID 2716 wrote to memory of 2908 2716 84F8.tmp 34 PID 2716 wrote to memory of 2908 2716 84F8.tmp 34 PID 2908 wrote to memory of 2636 2908 8640.tmp 35 PID 2908 wrote to memory of 2636 2908 8640.tmp 35 PID 2908 wrote to memory of 2636 2908 8640.tmp 35 PID 2908 wrote to memory of 2636 2908 8640.tmp 35 PID 2636 wrote to memory of 2576 2636 872A.tmp 36 PID 2636 wrote to memory of 2576 2636 872A.tmp 36 PID 2636 wrote to memory of 2576 2636 872A.tmp 36 PID 2636 wrote to memory of 2576 2636 872A.tmp 36 PID 2576 wrote to memory of 3004 2576 8814.tmp 37 PID 2576 wrote to memory of 3004 2576 8814.tmp 37 PID 2576 wrote to memory of 3004 2576 8814.tmp 37 PID 2576 wrote to memory of 3004 2576 8814.tmp 37 PID 3004 wrote to memory of 524 3004 890D.tmp 38 PID 3004 wrote to memory of 524 3004 890D.tmp 38 PID 3004 wrote to memory of 524 3004 890D.tmp 38 PID 3004 wrote to memory of 524 3004 890D.tmp 38 PID 524 wrote to memory of 960 524 89F7.tmp 39 PID 524 wrote to memory of 960 524 89F7.tmp 39 PID 524 wrote to memory of 960 524 89F7.tmp 39 PID 524 wrote to memory of 960 524 89F7.tmp 39 PID 960 wrote to memory of 1996 960 8AD2.tmp 40 PID 960 wrote to memory of 1996 960 8AD2.tmp 40 PID 960 wrote to memory of 1996 960 8AD2.tmp 40 PID 960 wrote to memory of 1996 960 8AD2.tmp 40 PID 1996 wrote to memory of 1480 1996 8BBC.tmp 41 PID 1996 wrote to memory of 1480 1996 8BBC.tmp 41 PID 1996 wrote to memory of 1480 1996 8BBC.tmp 41 PID 1996 wrote to memory of 1480 1996 8BBC.tmp 41 PID 1480 wrote to memory of 832 1480 8D13.tmp 42 PID 1480 wrote to memory of 832 1480 8D13.tmp 42 PID 1480 wrote to memory of 832 1480 8D13.tmp 42 PID 1480 wrote to memory of 832 1480 8D13.tmp 42 PID 832 wrote to memory of 2872 832 8E3B.tmp 43 PID 832 wrote to memory of 2872 832 8E3B.tmp 43 PID 832 wrote to memory of 2872 832 8E3B.tmp 43 PID 832 wrote to memory of 2872 832 8E3B.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-01_09baa2411a9c769950428882be7930c3_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-01_09baa2411a9c769950428882be7930c3_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\7F9B.tmp"C:\Users\Admin\AppData\Local\Temp\7F9B.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\8028.tmp"C:\Users\Admin\AppData\Local\Temp\8028.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\816F.tmp"C:\Users\Admin\AppData\Local\Temp\816F.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\8298.tmp"C:\Users\Admin\AppData\Local\Temp\8298.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\83C0.tmp"C:\Users\Admin\AppData\Local\Temp\83C0.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\84F8.tmp"C:\Users\Admin\AppData\Local\Temp\84F8.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\8640.tmp"C:\Users\Admin\AppData\Local\Temp\8640.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\872A.tmp"C:\Users\Admin\AppData\Local\Temp\872A.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\8814.tmp"C:\Users\Admin\AppData\Local\Temp\8814.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\890D.tmp"C:\Users\Admin\AppData\Local\Temp\890D.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\89F7.tmp"C:\Users\Admin\AppData\Local\Temp\89F7.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:524 -
C:\Users\Admin\AppData\Local\Temp\8AD2.tmp"C:\Users\Admin\AppData\Local\Temp\8AD2.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Users\Admin\AppData\Local\Temp\8BBC.tmp"C:\Users\Admin\AppData\Local\Temp\8BBC.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\8D13.tmp"C:\Users\Admin\AppData\Local\Temp\8D13.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\8E3B.tmp"C:\Users\Admin\AppData\Local\Temp\8E3B.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Users\Admin\AppData\Local\Temp\8F83.tmp"C:\Users\Admin\AppData\Local\Temp\8F83.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\9212.tmp"C:\Users\Admin\AppData\Local\Temp\9212.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\934A.tmp"C:\Users\Admin\AppData\Local\Temp\934A.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:544 -
C:\Users\Admin\AppData\Local\Temp\9453.tmp"C:\Users\Admin\AppData\Local\Temp\9453.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\957C.tmp"C:\Users\Admin\AppData\Local\Temp\957C.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\9675.tmp"C:\Users\Admin\AppData\Local\Temp\9675.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\976F.tmp"C:\Users\Admin\AppData\Local\Temp\976F.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\9878.tmp"C:\Users\Admin\AppData\Local\Temp\9878.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\98E5.tmp"C:\Users\Admin\AppData\Local\Temp\98E5.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\9953.tmp"C:\Users\Admin\AppData\Local\Temp\9953.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\99C0.tmp"C:\Users\Admin\AppData\Local\Temp\99C0.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\9C3F.tmp"C:\Users\Admin\AppData\Local\Temp\9C3F.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\9D49.tmp"C:\Users\Admin\AppData\Local\Temp\9D49.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\9DD5.tmp"C:\Users\Admin\AppData\Local\Temp\9DD5.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\9E52.tmp"C:\Users\Admin\AppData\Local\Temp\9E52.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\9ECF.tmp"C:\Users\Admin\AppData\Local\Temp\9ECF.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\9F4B.tmp"C:\Users\Admin\AppData\Local\Temp\9F4B.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\9FE7.tmp"C:\Users\Admin\AppData\Local\Temp\9FE7.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\A064.tmp"C:\Users\Admin\AppData\Local\Temp\A064.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:696 -
C:\Users\Admin\AppData\Local\Temp\A0E1.tmp"C:\Users\Admin\AppData\Local\Temp\A0E1.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:992 -
C:\Users\Admin\AppData\Local\Temp\A16D.tmp"C:\Users\Admin\AppData\Local\Temp\A16D.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\A1FA.tmp"C:\Users\Admin\AppData\Local\Temp\A1FA.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\A277.tmp"C:\Users\Admin\AppData\Local\Temp\A277.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\A2F3.tmp"C:\Users\Admin\AppData\Local\Temp\A2F3.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\A39F.tmp"C:\Users\Admin\AppData\Local\Temp\A39F.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:904 -
C:\Users\Admin\AppData\Local\Temp\A43B.tmp"C:\Users\Admin\AppData\Local\Temp\A43B.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:580 -
C:\Users\Admin\AppData\Local\Temp\A4B8.tmp"C:\Users\Admin\AppData\Local\Temp\A4B8.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\A544.tmp"C:\Users\Admin\AppData\Local\Temp\A544.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\A5B1.tmp"C:\Users\Admin\AppData\Local\Temp\A5B1.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\A7F3.tmp"C:\Users\Admin\AppData\Local\Temp\A7F3.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\A91B.tmp"C:\Users\Admin\AppData\Local\Temp\A91B.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\A979.tmp"C:\Users\Admin\AppData\Local\Temp\A979.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:876 -
C:\Users\Admin\AppData\Local\Temp\AA05.tmp"C:\Users\Admin\AppData\Local\Temp\AA05.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\AA72.tmp"C:\Users\Admin\AppData\Local\Temp\AA72.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:632 -
C:\Users\Admin\AppData\Local\Temp\AAEF.tmp"C:\Users\Admin\AppData\Local\Temp\AAEF.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\AB7B.tmp"C:\Users\Admin\AppData\Local\Temp\AB7B.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:848 -
C:\Users\Admin\AppData\Local\Temp\ABE9.tmp"C:\Users\Admin\AppData\Local\Temp\ABE9.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\AC94.tmp"C:\Users\Admin\AppData\Local\Temp\AC94.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\AD21.tmp"C:\Users\Admin\AppData\Local\Temp\AD21.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\AD8E.tmp"C:\Users\Admin\AppData\Local\Temp\AD8E.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\AE0B.tmp"C:\Users\Admin\AppData\Local\Temp\AE0B.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\AE87.tmp"C:\Users\Admin\AppData\Local\Temp\AE87.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\AF33.tmp"C:\Users\Admin\AppData\Local\Temp\AF33.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\AF91.tmp"C:\Users\Admin\AppData\Local\Temp\AF91.tmp"65⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\B00D.tmp"C:\Users\Admin\AppData\Local\Temp\B00D.tmp"66⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\B08A.tmp"C:\Users\Admin\AppData\Local\Temp\B08A.tmp"67⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\B107.tmp"C:\Users\Admin\AppData\Local\Temp\B107.tmp"68⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\B174.tmp"C:\Users\Admin\AppData\Local\Temp\B174.tmp"69⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\B1F1.tmp"C:\Users\Admin\AppData\Local\Temp\B1F1.tmp"70⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\B26E.tmp"C:\Users\Admin\AppData\Local\Temp\B26E.tmp"71⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\B2EB.tmp"C:\Users\Admin\AppData\Local\Temp\B2EB.tmp"72⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\B367.tmp"C:\Users\Admin\AppData\Local\Temp\B367.tmp"73⤵PID:524
-
C:\Users\Admin\AppData\Local\Temp\B3F4.tmp"C:\Users\Admin\AppData\Local\Temp\B3F4.tmp"74⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\B461.tmp"C:\Users\Admin\AppData\Local\Temp\B461.tmp"75⤵PID:240
-
C:\Users\Admin\AppData\Local\Temp\B4ED.tmp"C:\Users\Admin\AppData\Local\Temp\B4ED.tmp"76⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\B55B.tmp"C:\Users\Admin\AppData\Local\Temp\B55B.tmp"77⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\B5D7.tmp"C:\Users\Admin\AppData\Local\Temp\B5D7.tmp"78⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\B683.tmp"C:\Users\Admin\AppData\Local\Temp\B683.tmp"79⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\B72F.tmp"C:\Users\Admin\AppData\Local\Temp\B72F.tmp"80⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\B7BB.tmp"C:\Users\Admin\AppData\Local\Temp\B7BB.tmp"81⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\B847.tmp"C:\Users\Admin\AppData\Local\Temp\B847.tmp"82⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\B8B5.tmp"C:\Users\Admin\AppData\Local\Temp\B8B5.tmp"83⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\B922.tmp"C:\Users\Admin\AppData\Local\Temp\B922.tmp"84⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\B99F.tmp"C:\Users\Admin\AppData\Local\Temp\B99F.tmp"85⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\BA1B.tmp"C:\Users\Admin\AppData\Local\Temp\BA1B.tmp"86⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\BAA8.tmp"C:\Users\Admin\AppData\Local\Temp\BAA8.tmp"87⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\BB15.tmp"C:\Users\Admin\AppData\Local\Temp\BB15.tmp"88⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\BB92.tmp"C:\Users\Admin\AppData\Local\Temp\BB92.tmp"89⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\BBFF.tmp"C:\Users\Admin\AppData\Local\Temp\BBFF.tmp"90⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\BC9B.tmp"C:\Users\Admin\AppData\Local\Temp\BC9B.tmp"91⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\BE5F.tmp"C:\Users\Admin\AppData\Local\Temp\BE5F.tmp"92⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\BECD.tmp"C:\Users\Admin\AppData\Local\Temp\BECD.tmp"93⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\BF59.tmp"C:\Users\Admin\AppData\Local\Temp\BF59.tmp"94⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\BFB7.tmp"C:\Users\Admin\AppData\Local\Temp\BFB7.tmp"95⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\C014.tmp"C:\Users\Admin\AppData\Local\Temp\C014.tmp"96⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\C081.tmp"C:\Users\Admin\AppData\Local\Temp\C081.tmp"97⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"98⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\C18B.tmp"C:\Users\Admin\AppData\Local\Temp\C18B.tmp"99⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\C207.tmp"C:\Users\Admin\AppData\Local\Temp\C207.tmp"100⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\C284.tmp"C:\Users\Admin\AppData\Local\Temp\C284.tmp"101⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\C33F.tmp"C:\Users\Admin\AppData\Local\Temp\C33F.tmp"102⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\C3BC.tmp"C:\Users\Admin\AppData\Local\Temp\C3BC.tmp"103⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\C449.tmp"C:\Users\Admin\AppData\Local\Temp\C449.tmp"104⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\C4C5.tmp"C:\Users\Admin\AppData\Local\Temp\C4C5.tmp"105⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\C542.tmp"C:\Users\Admin\AppData\Local\Temp\C542.tmp"106⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\C5BF.tmp"C:\Users\Admin\AppData\Local\Temp\C5BF.tmp"107⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\C63C.tmp"C:\Users\Admin\AppData\Local\Temp\C63C.tmp"108⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\C6B9.tmp"C:\Users\Admin\AppData\Local\Temp\C6B9.tmp"109⤵PID:328
-
C:\Users\Admin\AppData\Local\Temp\C735.tmp"C:\Users\Admin\AppData\Local\Temp\C735.tmp"110⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\C793.tmp"C:\Users\Admin\AppData\Local\Temp\C793.tmp"111⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\C800.tmp"C:\Users\Admin\AppData\Local\Temp\C800.tmp"112⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\C87D.tmp"C:\Users\Admin\AppData\Local\Temp\C87D.tmp"113⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\C8FA.tmp"C:\Users\Admin\AppData\Local\Temp\C8FA.tmp"114⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\C996.tmp"C:\Users\Admin\AppData\Local\Temp\C996.tmp"115⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\CA32.tmp"C:\Users\Admin\AppData\Local\Temp\CA32.tmp"116⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\CABE.tmp"C:\Users\Admin\AppData\Local\Temp\CABE.tmp"117⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\CB4B.tmp"C:\Users\Admin\AppData\Local\Temp\CB4B.tmp"118⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\CBC7.tmp"C:\Users\Admin\AppData\Local\Temp\CBC7.tmp"119⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\CC35.tmp"C:\Users\Admin\AppData\Local\Temp\CC35.tmp"120⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\CCA2.tmp"C:\Users\Admin\AppData\Local\Temp\CCA2.tmp"121⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\CD0F.tmp"C:\Users\Admin\AppData\Local\Temp\CD0F.tmp"122⤵PID:1632
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-