Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
07/01/2024, 12:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-01-06_758bdb0044be1bd0f32775cfb6435b16_mafia.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-01-06_758bdb0044be1bd0f32775cfb6435b16_mafia.exe
Resource
win10v2004-20231215-en
0 signatures
150 seconds
General
-
Target
2024-01-06_758bdb0044be1bd0f32775cfb6435b16_mafia.exe
-
Size
486KB
-
MD5
758bdb0044be1bd0f32775cfb6435b16
-
SHA1
8f6fe082850b9caf2e5b1e5c051eff0a63c2416e
-
SHA256
2ab8f05e02aef7dcbaa03da4eef7d1cbaf99cc213dc54e13030a0f0da8f6af0d
-
SHA512
797995f5e4b441fd2dd902f7576f26ce458371b6f98e807f956e0c3da7537631b2cdd89eb971307de9d4d943c562d959a91d29a0380e61e0ff96d5b0abb902e6
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7nWRilmNNVfQXrHkN5vbTSnQygtxqdAVSoHzo:/U5rCOTeiDnWYmNNN2E/b3/VSoHzmNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2652 73C9.tmp 2708 7484.tmp 2920 757E.tmp 2824 761A.tmp 2344 76D5.tmp 2448 7781.tmp 2480 786B.tmp 2564 7983.tmp 2636 7A8D.tmp 3056 7B57.tmp 676 7C22.tmp 584 7CFD.tmp 1464 7DC7.tmp 2208 7E83.tmp 2800 7F6D.tmp 2860 8047.tmp 2928 8131.tmp 844 824A.tmp 908 8334.tmp 1972 83FF.tmp 1968 84C9.tmp 924 865F.tmp 2548 870B.tmp 1712 8787.tmp 2504 8814.tmp 1664 8891.tmp 1328 890D.tmp 2420 899A.tmp 836 8A26.tmp 2372 8A93.tmp 2204 8B20.tmp 2336 8B8D.tmp 2252 8C19.tmp 1432 8C77.tmp 1676 8CD5.tmp 1548 8D51.tmp 2044 8DBF.tmp 1800 8E2C.tmp 1368 8EC8.tmp 1344 8F73.tmp 952 8FF0.tmp 1780 906D.tmp 2168 90EA.tmp 880 9176.tmp 3036 91F3.tmp 2084 927F.tmp 1304 92ED.tmp 524 9369.tmp 1308 93D7.tmp 680 9463.tmp 1008 94C1.tmp 872 952E.tmp 1916 959B.tmp 1600 9608.tmp 2244 9685.tmp 2460 9702.tmp 2288 977F.tmp 2888 980B.tmp 2692 9888.tmp 2688 9914.tmp 2568 9991.tmp 2972 9BE2.tmp 2940 9CAD.tmp 2584 9D29.tmp -
Loads dropped DLL 64 IoCs
pid Process 1748 2024-01-06_758bdb0044be1bd0f32775cfb6435b16_mafia.exe 2652 73C9.tmp 2708 7484.tmp 2920 757E.tmp 2824 761A.tmp 2344 76D5.tmp 2448 7781.tmp 2480 786B.tmp 2564 7983.tmp 2636 7A8D.tmp 3056 7B57.tmp 676 7C22.tmp 584 7CFD.tmp 1464 7DC7.tmp 2208 7E83.tmp 2800 7F6D.tmp 2860 8047.tmp 2928 8131.tmp 844 824A.tmp 908 8334.tmp 1972 83FF.tmp 1968 84C9.tmp 924 865F.tmp 2548 870B.tmp 1712 8787.tmp 2504 8814.tmp 1664 8891.tmp 1328 890D.tmp 2420 899A.tmp 836 8A26.tmp 2372 8A93.tmp 2204 8B20.tmp 2336 8B8D.tmp 2252 8C19.tmp 1432 8C77.tmp 1676 8CD5.tmp 1548 8D51.tmp 2044 8DBF.tmp 1800 8E2C.tmp 1368 8EC8.tmp 1344 8F73.tmp 952 8FF0.tmp 1780 906D.tmp 2168 90EA.tmp 880 9176.tmp 3036 91F3.tmp 2084 927F.tmp 1304 92ED.tmp 524 9369.tmp 1308 93D7.tmp 680 9463.tmp 1008 94C1.tmp 872 952E.tmp 1916 959B.tmp 1600 9608.tmp 2244 9685.tmp 2460 9702.tmp 2288 977F.tmp 2888 980B.tmp 2692 9888.tmp 2688 9914.tmp 2568 9991.tmp 2972 9BE2.tmp 2940 9CAD.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1748 wrote to memory of 2652 1748 2024-01-06_758bdb0044be1bd0f32775cfb6435b16_mafia.exe 28 PID 1748 wrote to memory of 2652 1748 2024-01-06_758bdb0044be1bd0f32775cfb6435b16_mafia.exe 28 PID 1748 wrote to memory of 2652 1748 2024-01-06_758bdb0044be1bd0f32775cfb6435b16_mafia.exe 28 PID 1748 wrote to memory of 2652 1748 2024-01-06_758bdb0044be1bd0f32775cfb6435b16_mafia.exe 28 PID 2652 wrote to memory of 2708 2652 73C9.tmp 29 PID 2652 wrote to memory of 2708 2652 73C9.tmp 29 PID 2652 wrote to memory of 2708 2652 73C9.tmp 29 PID 2652 wrote to memory of 2708 2652 73C9.tmp 29 PID 2708 wrote to memory of 2920 2708 7484.tmp 30 PID 2708 wrote to memory of 2920 2708 7484.tmp 30 PID 2708 wrote to memory of 2920 2708 7484.tmp 30 PID 2708 wrote to memory of 2920 2708 7484.tmp 30 PID 2920 wrote to memory of 2824 2920 757E.tmp 31 PID 2920 wrote to memory of 2824 2920 757E.tmp 31 PID 2920 wrote to memory of 2824 2920 757E.tmp 31 PID 2920 wrote to memory of 2824 2920 757E.tmp 31 PID 2824 wrote to memory of 2344 2824 761A.tmp 32 PID 2824 wrote to memory of 2344 2824 761A.tmp 32 PID 2824 wrote to memory of 2344 2824 761A.tmp 32 PID 2824 wrote to memory of 2344 2824 761A.tmp 32 PID 2344 wrote to memory of 2448 2344 76D5.tmp 33 PID 2344 wrote to memory of 2448 2344 76D5.tmp 33 PID 2344 wrote to memory of 2448 2344 76D5.tmp 33 PID 2344 wrote to memory of 2448 2344 76D5.tmp 33 PID 2448 wrote to memory of 2480 2448 7781.tmp 34 PID 2448 wrote to memory of 2480 2448 7781.tmp 34 PID 2448 wrote to memory of 2480 2448 7781.tmp 34 PID 2448 wrote to memory of 2480 2448 7781.tmp 34 PID 2480 wrote to memory of 2564 2480 786B.tmp 35 PID 2480 wrote to memory of 2564 2480 786B.tmp 35 PID 2480 wrote to memory of 2564 2480 786B.tmp 35 PID 2480 wrote to memory of 2564 2480 786B.tmp 35 PID 2564 wrote to memory of 2636 2564 7983.tmp 36 PID 2564 wrote to memory of 2636 2564 7983.tmp 36 PID 2564 wrote to memory of 2636 2564 7983.tmp 36 PID 2564 wrote to memory of 2636 2564 7983.tmp 36 PID 2636 wrote to memory of 3056 2636 7A8D.tmp 37 PID 2636 wrote to memory of 3056 2636 7A8D.tmp 37 PID 2636 wrote to memory of 3056 2636 7A8D.tmp 37 PID 2636 wrote to memory of 3056 2636 7A8D.tmp 37 PID 3056 wrote to memory of 676 3056 7B57.tmp 38 PID 3056 wrote to memory of 676 3056 7B57.tmp 38 PID 3056 wrote to memory of 676 3056 7B57.tmp 38 PID 3056 wrote to memory of 676 3056 7B57.tmp 38 PID 676 wrote to memory of 584 676 7C22.tmp 39 PID 676 wrote to memory of 584 676 7C22.tmp 39 PID 676 wrote to memory of 584 676 7C22.tmp 39 PID 676 wrote to memory of 584 676 7C22.tmp 39 PID 584 wrote to memory of 1464 584 7CFD.tmp 40 PID 584 wrote to memory of 1464 584 7CFD.tmp 40 PID 584 wrote to memory of 1464 584 7CFD.tmp 40 PID 584 wrote to memory of 1464 584 7CFD.tmp 40 PID 1464 wrote to memory of 2208 1464 7DC7.tmp 41 PID 1464 wrote to memory of 2208 1464 7DC7.tmp 41 PID 1464 wrote to memory of 2208 1464 7DC7.tmp 41 PID 1464 wrote to memory of 2208 1464 7DC7.tmp 41 PID 2208 wrote to memory of 2800 2208 7E83.tmp 42 PID 2208 wrote to memory of 2800 2208 7E83.tmp 42 PID 2208 wrote to memory of 2800 2208 7E83.tmp 42 PID 2208 wrote to memory of 2800 2208 7E83.tmp 42 PID 2800 wrote to memory of 2860 2800 7F6D.tmp 43 PID 2800 wrote to memory of 2860 2800 7F6D.tmp 43 PID 2800 wrote to memory of 2860 2800 7F6D.tmp 43 PID 2800 wrote to memory of 2860 2800 7F6D.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-06_758bdb0044be1bd0f32775cfb6435b16_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-06_758bdb0044be1bd0f32775cfb6435b16_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\73C9.tmp"C:\Users\Admin\AppData\Local\Temp\73C9.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\7484.tmp"C:\Users\Admin\AppData\Local\Temp\7484.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\757E.tmp"C:\Users\Admin\AppData\Local\Temp\757E.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\76D5.tmp"C:\Users\Admin\AppData\Local\Temp\76D5.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\7781.tmp"C:\Users\Admin\AppData\Local\Temp\7781.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\786B.tmp"C:\Users\Admin\AppData\Local\Temp\786B.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\7983.tmp"C:\Users\Admin\AppData\Local\Temp\7983.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\7A8D.tmp"C:\Users\Admin\AppData\Local\Temp\7A8D.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\7B57.tmp"C:\Users\Admin\AppData\Local\Temp\7B57.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\7C22.tmp"C:\Users\Admin\AppData\Local\Temp\7C22.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Users\Admin\AppData\Local\Temp\7CFD.tmp"C:\Users\Admin\AppData\Local\Temp\7CFD.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:584 -
C:\Users\Admin\AppData\Local\Temp\7DC7.tmp"C:\Users\Admin\AppData\Local\Temp\7DC7.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\7E83.tmp"C:\Users\Admin\AppData\Local\Temp\7E83.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\7F6D.tmp"C:\Users\Admin\AppData\Local\Temp\7F6D.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\8047.tmp"C:\Users\Admin\AppData\Local\Temp\8047.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\8131.tmp"C:\Users\Admin\AppData\Local\Temp\8131.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\824A.tmp"C:\Users\Admin\AppData\Local\Temp\824A.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:844 -
C:\Users\Admin\AppData\Local\Temp\8334.tmp"C:\Users\Admin\AppData\Local\Temp\8334.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:908 -
C:\Users\Admin\AppData\Local\Temp\83FF.tmp"C:\Users\Admin\AppData\Local\Temp\83FF.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\84C9.tmp"C:\Users\Admin\AppData\Local\Temp\84C9.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\865F.tmp"C:\Users\Admin\AppData\Local\Temp\865F.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:924 -
C:\Users\Admin\AppData\Local\Temp\870B.tmp"C:\Users\Admin\AppData\Local\Temp\870B.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\8787.tmp"C:\Users\Admin\AppData\Local\Temp\8787.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\8814.tmp"C:\Users\Admin\AppData\Local\Temp\8814.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\8891.tmp"C:\Users\Admin\AppData\Local\Temp\8891.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\890D.tmp"C:\Users\Admin\AppData\Local\Temp\890D.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\899A.tmp"C:\Users\Admin\AppData\Local\Temp\899A.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\8A26.tmp"C:\Users\Admin\AppData\Local\Temp\8A26.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:836 -
C:\Users\Admin\AppData\Local\Temp\8A93.tmp"C:\Users\Admin\AppData\Local\Temp\8A93.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\8B20.tmp"C:\Users\Admin\AppData\Local\Temp\8B20.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\8B8D.tmp"C:\Users\Admin\AppData\Local\Temp\8B8D.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\8C19.tmp"C:\Users\Admin\AppData\Local\Temp\8C19.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\8C77.tmp"C:\Users\Admin\AppData\Local\Temp\8C77.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\8CD5.tmp"C:\Users\Admin\AppData\Local\Temp\8CD5.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\8D51.tmp"C:\Users\Admin\AppData\Local\Temp\8D51.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\8DBF.tmp"C:\Users\Admin\AppData\Local\Temp\8DBF.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\8E2C.tmp"C:\Users\Admin\AppData\Local\Temp\8E2C.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\8EC8.tmp"C:\Users\Admin\AppData\Local\Temp\8EC8.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\8F73.tmp"C:\Users\Admin\AppData\Local\Temp\8F73.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\8FF0.tmp"C:\Users\Admin\AppData\Local\Temp\8FF0.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:952 -
C:\Users\Admin\AppData\Local\Temp\906D.tmp"C:\Users\Admin\AppData\Local\Temp\906D.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\90EA.tmp"C:\Users\Admin\AppData\Local\Temp\90EA.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\9176.tmp"C:\Users\Admin\AppData\Local\Temp\9176.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:880 -
C:\Users\Admin\AppData\Local\Temp\91F3.tmp"C:\Users\Admin\AppData\Local\Temp\91F3.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\927F.tmp"C:\Users\Admin\AppData\Local\Temp\927F.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\92ED.tmp"C:\Users\Admin\AppData\Local\Temp\92ED.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\9369.tmp"C:\Users\Admin\AppData\Local\Temp\9369.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:524 -
C:\Users\Admin\AppData\Local\Temp\93D7.tmp"C:\Users\Admin\AppData\Local\Temp\93D7.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\9463.tmp"C:\Users\Admin\AppData\Local\Temp\9463.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:680 -
C:\Users\Admin\AppData\Local\Temp\94C1.tmp"C:\Users\Admin\AppData\Local\Temp\94C1.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\952E.tmp"C:\Users\Admin\AppData\Local\Temp\952E.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:872 -
C:\Users\Admin\AppData\Local\Temp\959B.tmp"C:\Users\Admin\AppData\Local\Temp\959B.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\9608.tmp"C:\Users\Admin\AppData\Local\Temp\9608.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\9685.tmp"C:\Users\Admin\AppData\Local\Temp\9685.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\9702.tmp"C:\Users\Admin\AppData\Local\Temp\9702.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\977F.tmp"C:\Users\Admin\AppData\Local\Temp\977F.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\980B.tmp"C:\Users\Admin\AppData\Local\Temp\980B.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\9888.tmp"C:\Users\Admin\AppData\Local\Temp\9888.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\9914.tmp"C:\Users\Admin\AppData\Local\Temp\9914.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\9991.tmp"C:\Users\Admin\AppData\Local\Temp\9991.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\9D29.tmp"C:\Users\Admin\AppData\Local\Temp\9D29.tmp"65⤵
- Executes dropped EXE
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\9D97.tmp"C:\Users\Admin\AppData\Local\Temp\9D97.tmp"66⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\9E13.tmp"C:\Users\Admin\AppData\Local\Temp\9E13.tmp"67⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\9E81.tmp"C:\Users\Admin\AppData\Local\Temp\9E81.tmp"68⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\9EEE.tmp"C:\Users\Admin\AppData\Local\Temp\9EEE.tmp"69⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\9F6B.tmp"C:\Users\Admin\AppData\Local\Temp\9F6B.tmp"70⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\9FB9.tmp"C:\Users\Admin\AppData\Local\Temp\9FB9.tmp"71⤵PID:664
-
C:\Users\Admin\AppData\Local\Temp\A026.tmp"C:\Users\Admin\AppData\Local\Temp\A026.tmp"72⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\A0A3.tmp"C:\Users\Admin\AppData\Local\Temp\A0A3.tmp"73⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\A11F.tmp"C:\Users\Admin\AppData\Local\Temp\A11F.tmp"74⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\A19C.tmp"C:\Users\Admin\AppData\Local\Temp\A19C.tmp"75⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\A219.tmp"C:\Users\Admin\AppData\Local\Temp\A219.tmp"76⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\A296.tmp"C:\Users\Admin\AppData\Local\Temp\A296.tmp"77⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\A303.tmp"C:\Users\Admin\AppData\Local\Temp\A303.tmp"78⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\A380.tmp"C:\Users\Admin\AppData\Local\Temp\A380.tmp"79⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\A3FD.tmp"C:\Users\Admin\AppData\Local\Temp\A3FD.tmp"80⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\A46A.tmp"C:\Users\Admin\AppData\Local\Temp\A46A.tmp"81⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\A4D7.tmp"C:\Users\Admin\AppData\Local\Temp\A4D7.tmp"82⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\A544.tmp"C:\Users\Admin\AppData\Local\Temp\A544.tmp"83⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\A5C1.tmp"C:\Users\Admin\AppData\Local\Temp\A5C1.tmp"84⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\A63E.tmp"C:\Users\Admin\AppData\Local\Temp\A63E.tmp"85⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\A6CA.tmp"C:\Users\Admin\AppData\Local\Temp\A6CA.tmp"86⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\A728.tmp"C:\Users\Admin\AppData\Local\Temp\A728.tmp"87⤵PID:608
-
C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"88⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\A812.tmp"C:\Users\Admin\AppData\Local\Temp\A812.tmp"89⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\A87F.tmp"C:\Users\Admin\AppData\Local\Temp\A87F.tmp"90⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\A8FC.tmp"C:\Users\Admin\AppData\Local\Temp\A8FC.tmp"91⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\A969.tmp"C:\Users\Admin\AppData\Local\Temp\A969.tmp"92⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\A9D6.tmp"C:\Users\Admin\AppData\Local\Temp\A9D6.tmp"93⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\AA63.tmp"C:\Users\Admin\AppData\Local\Temp\AA63.tmp"94⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\AAD0.tmp"C:\Users\Admin\AppData\Local\Temp\AAD0.tmp"95⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\AB3D.tmp"C:\Users\Admin\AppData\Local\Temp\AB3D.tmp"96⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\ABAA.tmp"C:\Users\Admin\AppData\Local\Temp\ABAA.tmp"97⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\AC27.tmp"C:\Users\Admin\AppData\Local\Temp\AC27.tmp"98⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\ACA4.tmp"C:\Users\Admin\AppData\Local\Temp\ACA4.tmp"99⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\AD21.tmp"C:\Users\Admin\AppData\Local\Temp\AD21.tmp"100⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\AD7E.tmp"C:\Users\Admin\AppData\Local\Temp\AD7E.tmp"101⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\AE0B.tmp"C:\Users\Admin\AppData\Local\Temp\AE0B.tmp"102⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\AE87.tmp"C:\Users\Admin\AppData\Local\Temp\AE87.tmp"103⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\AF04.tmp"C:\Users\Admin\AppData\Local\Temp\AF04.tmp"104⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\AF81.tmp"C:\Users\Admin\AppData\Local\Temp\AF81.tmp"105⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\AFFE.tmp"C:\Users\Admin\AppData\Local\Temp\AFFE.tmp"106⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\B29D.tmp"C:\Users\Admin\AppData\Local\Temp\B29D.tmp"107⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\B30A.tmp"C:\Users\Admin\AppData\Local\Temp\B30A.tmp"108⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\B3A6.tmp"C:\Users\Admin\AppData\Local\Temp\B3A6.tmp"109⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\B413.tmp"C:\Users\Admin\AppData\Local\Temp\B413.tmp"110⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\B480.tmp"C:\Users\Admin\AppData\Local\Temp\B480.tmp"111⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\B4ED.tmp"C:\Users\Admin\AppData\Local\Temp\B4ED.tmp"112⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\B55B.tmp"C:\Users\Admin\AppData\Local\Temp\B55B.tmp"113⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\B5B8.tmp"C:\Users\Admin\AppData\Local\Temp\B5B8.tmp"114⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\B635.tmp"C:\Users\Admin\AppData\Local\Temp\B635.tmp"115⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\B6A2.tmp"C:\Users\Admin\AppData\Local\Temp\B6A2.tmp"116⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\B71F.tmp"C:\Users\Admin\AppData\Local\Temp\B71F.tmp"117⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\B78C.tmp"C:\Users\Admin\AppData\Local\Temp\B78C.tmp"118⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\B7F9.tmp"C:\Users\Admin\AppData\Local\Temp\B7F9.tmp"119⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\B867.tmp"C:\Users\Admin\AppData\Local\Temp\B867.tmp"120⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\B8D4.tmp"C:\Users\Admin\AppData\Local\Temp\B8D4.tmp"121⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\B941.tmp"C:\Users\Admin\AppData\Local\Temp\B941.tmp"122⤵PID:1916
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-