Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
23/01/2024, 05:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-01-23_a1fd2b572f7f19edc04590ca6acd86ba_mafia.exe
Resource
win7-20231129-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-01-23_a1fd2b572f7f19edc04590ca6acd86ba_mafia.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
2024-01-23_a1fd2b572f7f19edc04590ca6acd86ba_mafia.exe
-
Size
486KB
-
MD5
a1fd2b572f7f19edc04590ca6acd86ba
-
SHA1
a821839995064684ee0c75fdaf26c28b816a6b00
-
SHA256
8ee0765a7fbef742711bd4e75d15797901f88cd279716863fc5cee2e76956808
-
SHA512
efe94c0ea66da73e47127c785641dbb3329f4c06535260e26b89f7cee8c01ff757bee0f1761c5db53be87b1af3d2d58afa04befd03f087848553e3a8586a52f2
-
SSDEEP
12288:oU5rCOTeiD8oULnrWpYJzjqltoBNiWdFNZ:oUQOJD8oULntJzqmNiWLN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3008 741.tmp 3068 79F.tmp 2136 7ED.tmp 3016 83B.tmp 2668 889.tmp 2616 8C7.tmp 2472 906.tmp 2500 944.tmp 788 982.tmp 2520 9C1.tmp 2516 9FF.tmp 2964 A4D.tmp 2976 A8C.tmp 2820 B08.tmp 2696 B66.tmp 860 BA4.tmp 1320 BE3.tmp 2180 C31.tmp 2712 C6F.tmp 2640 2C1F.tmp 1436 CEC.tmp 1376 2C9C.tmp 2040 2CDA.tmp 2080 DA7.tmp 2052 DF5.tmp 1836 E34.tmp 2312 E72.tmp 2308 EB0.tmp 2700 1EC7.tmp 688 F3D.tmp 596 F7B.tmp 1652 FBA.tmp 580 FF8.tmp 1820 1036.tmp 1840 1075.tmp 852 10B3.tmp 1224 10F2.tmp 2068 313E.tmp 2072 117E.tmp 1816 11BC.tmp 1216 31F9.tmp 956 3247.tmp 308 1268.tmp 1788 12A6.tmp 1120 22DC.tmp 3024 231A.tmp 1892 1362.tmp 1724 13A0.tmp 2228 13DE.tmp 628 141D.tmp 2152 145B.tmp 892 149A.tmp 1096 14D8.tmp 2380 1516.tmp 2936 1593.tmp 2996 15D2.tmp 2144 1610.tmp 2608 164E.tmp 3056 168D.tmp 2572 16CB.tmp 2752 170A.tmp 2760 1748.tmp 2580 1786.tmp 2488 17C5.tmp -
Loads dropped DLL 64 IoCs
pid Process 2936 2024-01-23_a1fd2b572f7f19edc04590ca6acd86ba_mafia.exe 3008 25B9.tmp 3068 79F.tmp 2136 7ED.tmp 3016 83B.tmp 2668 889.tmp 2616 8C7.tmp 2472 906.tmp 2500 944.tmp 788 982.tmp 2520 9C1.tmp 2516 9FF.tmp 2964 A4D.tmp 2976 A8C.tmp 2820 B08.tmp 2696 B66.tmp 860 BA4.tmp 1320 BE3.tmp 2180 C31.tmp 2712 C6F.tmp 2640 2C1F.tmp 1436 CEC.tmp 1376 2C9C.tmp 2040 2CDA.tmp 2080 DA7.tmp 2052 DF5.tmp 1836 E34.tmp 2312 E72.tmp 2308 EB0.tmp 2700 1EC7.tmp 688 F3D.tmp 596 F7B.tmp 1652 FBA.tmp 580 FF8.tmp 1820 1036.tmp 1840 1075.tmp 852 10B3.tmp 1224 10F2.tmp 2068 313E.tmp 2072 117E.tmp 1816 11BC.tmp 1216 31F9.tmp 956 3247.tmp 308 1268.tmp 1788 12A6.tmp 1120 22DC.tmp 3024 231A.tmp 1892 1362.tmp 1724 13A0.tmp 2228 13DE.tmp 628 141D.tmp 2152 145B.tmp 892 149A.tmp 1096 14D8.tmp 1608 1555.tmp 2936 1593.tmp 2996 15D2.tmp 2144 1610.tmp 2608 164E.tmp 3056 168D.tmp 2572 16CB.tmp 2752 170A.tmp 2760 1748.tmp 2580 1786.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2936 wrote to memory of 3008 2936 2024-01-23_a1fd2b572f7f19edc04590ca6acd86ba_mafia.exe 28 PID 2936 wrote to memory of 3008 2936 2024-01-23_a1fd2b572f7f19edc04590ca6acd86ba_mafia.exe 28 PID 2936 wrote to memory of 3008 2936 2024-01-23_a1fd2b572f7f19edc04590ca6acd86ba_mafia.exe 28 PID 2936 wrote to memory of 3008 2936 2024-01-23_a1fd2b572f7f19edc04590ca6acd86ba_mafia.exe 28 PID 3008 wrote to memory of 3068 3008 25B9.tmp 29 PID 3008 wrote to memory of 3068 3008 25B9.tmp 29 PID 3008 wrote to memory of 3068 3008 25B9.tmp 29 PID 3008 wrote to memory of 3068 3008 25B9.tmp 29 PID 3068 wrote to memory of 2136 3068 79F.tmp 30 PID 3068 wrote to memory of 2136 3068 79F.tmp 30 PID 3068 wrote to memory of 2136 3068 79F.tmp 30 PID 3068 wrote to memory of 2136 3068 79F.tmp 30 PID 2136 wrote to memory of 3016 2136 7ED.tmp 31 PID 2136 wrote to memory of 3016 2136 7ED.tmp 31 PID 2136 wrote to memory of 3016 2136 7ED.tmp 31 PID 2136 wrote to memory of 3016 2136 7ED.tmp 31 PID 3016 wrote to memory of 2668 3016 83B.tmp 32 PID 3016 wrote to memory of 2668 3016 83B.tmp 32 PID 3016 wrote to memory of 2668 3016 83B.tmp 32 PID 3016 wrote to memory of 2668 3016 83B.tmp 32 PID 2668 wrote to memory of 2616 2668 889.tmp 137 PID 2668 wrote to memory of 2616 2668 889.tmp 137 PID 2668 wrote to memory of 2616 2668 889.tmp 137 PID 2668 wrote to memory of 2616 2668 889.tmp 137 PID 2616 wrote to memory of 2472 2616 8C7.tmp 136 PID 2616 wrote to memory of 2472 2616 8C7.tmp 136 PID 2616 wrote to memory of 2472 2616 8C7.tmp 136 PID 2616 wrote to memory of 2472 2616 8C7.tmp 136 PID 2472 wrote to memory of 2500 2472 906.tmp 135 PID 2472 wrote to memory of 2500 2472 906.tmp 135 PID 2472 wrote to memory of 2500 2472 906.tmp 135 PID 2472 wrote to memory of 2500 2472 906.tmp 135 PID 2500 wrote to memory of 788 2500 944.tmp 33 PID 2500 wrote to memory of 788 2500 944.tmp 33 PID 2500 wrote to memory of 788 2500 944.tmp 33 PID 2500 wrote to memory of 788 2500 944.tmp 33 PID 788 wrote to memory of 2520 788 982.tmp 34 PID 788 wrote to memory of 2520 788 982.tmp 34 PID 788 wrote to memory of 2520 788 982.tmp 34 PID 788 wrote to memory of 2520 788 982.tmp 34 PID 2520 wrote to memory of 2516 2520 9C1.tmp 134 PID 2520 wrote to memory of 2516 2520 9C1.tmp 134 PID 2520 wrote to memory of 2516 2520 9C1.tmp 134 PID 2520 wrote to memory of 2516 2520 9C1.tmp 134 PID 2516 wrote to memory of 2964 2516 9FF.tmp 35 PID 2516 wrote to memory of 2964 2516 9FF.tmp 35 PID 2516 wrote to memory of 2964 2516 9FF.tmp 35 PID 2516 wrote to memory of 2964 2516 9FF.tmp 35 PID 2964 wrote to memory of 2976 2964 A4D.tmp 36 PID 2964 wrote to memory of 2976 2964 A4D.tmp 36 PID 2964 wrote to memory of 2976 2964 A4D.tmp 36 PID 2964 wrote to memory of 2976 2964 A4D.tmp 36 PID 2976 wrote to memory of 2820 2976 A8C.tmp 132 PID 2976 wrote to memory of 2820 2976 A8C.tmp 132 PID 2976 wrote to memory of 2820 2976 A8C.tmp 132 PID 2976 wrote to memory of 2820 2976 A8C.tmp 132 PID 2820 wrote to memory of 2696 2820 B08.tmp 131 PID 2820 wrote to memory of 2696 2820 B08.tmp 131 PID 2820 wrote to memory of 2696 2820 B08.tmp 131 PID 2820 wrote to memory of 2696 2820 B08.tmp 131 PID 2696 wrote to memory of 860 2696 B66.tmp 130 PID 2696 wrote to memory of 860 2696 B66.tmp 130 PID 2696 wrote to memory of 860 2696 B66.tmp 130 PID 2696 wrote to memory of 860 2696 B66.tmp 130
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-23_a1fd2b572f7f19edc04590ca6acd86ba_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-23_a1fd2b572f7f19edc04590ca6acd86ba_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\741.tmp"C:\Users\Admin\AppData\Local\Temp\741.tmp"2⤵
- Executes dropped EXE
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\79F.tmp"C:\Users\Admin\AppData\Local\Temp\79F.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\7ED.tmp"C:\Users\Admin\AppData\Local\Temp\7ED.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\83B.tmp"C:\Users\Admin\AppData\Local\Temp\83B.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\889.tmp"C:\Users\Admin\AppData\Local\Temp\889.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\8C7.tmp"C:\Users\Admin\AppData\Local\Temp\8C7.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2616
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\15D2.tmp"C:\Users\Admin\AppData\Local\Temp\15D2.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\1610.tmp"C:\Users\Admin\AppData\Local\Temp\1610.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\164E.tmp"C:\Users\Admin\AppData\Local\Temp\164E.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\982.tmp"C:\Users\Admin\AppData\Local\Temp\982.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Users\Admin\AppData\Local\Temp\9C1.tmp"C:\Users\Admin\AppData\Local\Temp\9C1.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\9FF.tmp"C:\Users\Admin\AppData\Local\Temp\9FF.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2516
-
-
-
C:\Users\Admin\AppData\Local\Temp\A4D.tmp"C:\Users\Admin\AppData\Local\Temp\A4D.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\A8C.tmp"C:\Users\Admin\AppData\Local\Temp\A8C.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\B08.tmp"C:\Users\Admin\AppData\Local\Temp\B08.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2820
-
-
-
C:\Users\Admin\AppData\Local\Temp\DA7.tmp"C:\Users\Admin\AppData\Local\Temp\DA7.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\DF5.tmp"C:\Users\Admin\AppData\Local\Temp\DF5.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2052
-
-
C:\Users\Admin\AppData\Local\Temp\E34.tmp"C:\Users\Admin\AppData\Local\Temp\E34.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\E72.tmp"C:\Users\Admin\AppData\Local\Temp\E72.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312
-
-
C:\Users\Admin\AppData\Local\Temp\EEF.tmp"C:\Users\Admin\AppData\Local\Temp\EEF.tmp"1⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\F3D.tmp"C:\Users\Admin\AppData\Local\Temp\F3D.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:688
-
-
C:\Users\Admin\AppData\Local\Temp\F7B.tmp"C:\Users\Admin\AppData\Local\Temp\F7B.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:596 -
C:\Users\Admin\AppData\Local\Temp\FBA.tmp"C:\Users\Admin\AppData\Local\Temp\FBA.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\FF8.tmp"C:\Users\Admin\AppData\Local\Temp\FF8.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:580
-
-
-
C:\Users\Admin\AppData\Local\Temp\10B3.tmp"C:\Users\Admin\AppData\Local\Temp\10B3.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:852 -
C:\Users\Admin\AppData\Local\Temp\10F2.tmp"C:\Users\Admin\AppData\Local\Temp\10F2.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\1130.tmp"C:\Users\Admin\AppData\Local\Temp\1130.tmp"3⤵PID:2068
-
-
-
C:\Users\Admin\AppData\Local\Temp\117E.tmp"C:\Users\Admin\AppData\Local\Temp\117E.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\11BC.tmp"C:\Users\Admin\AppData\Local\Temp\11BC.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1816
-
-
C:\Users\Admin\AppData\Local\Temp\1239.tmp"C:\Users\Admin\AppData\Local\Temp\1239.tmp"1⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\1268.tmp"C:\Users\Admin\AppData\Local\Temp\1268.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:308 -
C:\Users\Admin\AppData\Local\Temp\12A6.tmp"C:\Users\Admin\AppData\Local\Temp\12A6.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788
-
-
-
C:\Users\Admin\AppData\Local\Temp\1323.tmp"C:\Users\Admin\AppData\Local\Temp\1323.tmp"1⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\1362.tmp"C:\Users\Admin\AppData\Local\Temp\1362.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\13A0.tmp"C:\Users\Admin\AppData\Local\Temp\13A0.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724
-
-
-
C:\Users\Admin\AppData\Local\Temp\13DE.tmp"C:\Users\Admin\AppData\Local\Temp\13DE.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\141D.tmp"C:\Users\Admin\AppData\Local\Temp\141D.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:628
-
-
C:\Users\Admin\AppData\Local\Temp\149A.tmp"C:\Users\Admin\AppData\Local\Temp\149A.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:892 -
C:\Users\Admin\AppData\Local\Temp\14D8.tmp"C:\Users\Admin\AppData\Local\Temp\14D8.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\1516.tmp"C:\Users\Admin\AppData\Local\Temp\1516.tmp"3⤵
- Executes dropped EXE
PID:2380
-
-
-
C:\Users\Admin\AppData\Local\Temp\1555.tmp"C:\Users\Admin\AppData\Local\Temp\1555.tmp"1⤵
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\1593.tmp"C:\Users\Admin\AppData\Local\Temp\1593.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2936
-
-
C:\Users\Admin\AppData\Local\Temp\16CB.tmp"C:\Users\Admin\AppData\Local\Temp\16CB.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\170A.tmp"C:\Users\Admin\AppData\Local\Temp\170A.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752
-
-
C:\Users\Admin\AppData\Local\Temp\1748.tmp"C:\Users\Admin\AppData\Local\Temp\1748.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\1786.tmp"C:\Users\Admin\AppData\Local\Temp\1786.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2580
-
-
C:\Users\Admin\AppData\Local\Temp\17C5.tmp"C:\Users\Admin\AppData\Local\Temp\17C5.tmp"1⤵
- Executes dropped EXE
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\1803.tmp"C:\Users\Admin\AppData\Local\Temp\1803.tmp"2⤵PID:2604
-
-
C:\Users\Admin\AppData\Local\Temp\18BE.tmp"C:\Users\Admin\AppData\Local\Temp\18BE.tmp"1⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\18FD.tmp"C:\Users\Admin\AppData\Local\Temp\18FD.tmp"2⤵PID:2768
-
-
C:\Users\Admin\AppData\Local\Temp\197A.tmp"C:\Users\Admin\AppData\Local\Temp\197A.tmp"1⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\19B8.tmp"C:\Users\Admin\AppData\Local\Temp\19B8.tmp"2⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\19F6.tmp"C:\Users\Admin\AppData\Local\Temp\19F6.tmp"3⤵PID:1744
-
-
-
C:\Users\Admin\AppData\Local\Temp\1A73.tmp"C:\Users\Admin\AppData\Local\Temp\1A73.tmp"1⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"2⤵PID:1524
-
-
C:\Users\Admin\AppData\Local\Temp\1A35.tmp"C:\Users\Admin\AppData\Local\Temp\1A35.tmp"1⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"1⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"2⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"3⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\CAE.tmp"C:\Users\Admin\AppData\Local\Temp\CAE.tmp"4⤵PID:2640
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1C18.tmp"C:\Users\Admin\AppData\Local\Temp\1C18.tmp"1⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\1C57.tmp"C:\Users\Admin\AppData\Local\Temp\1C57.tmp"2⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\1C95.tmp"C:\Users\Admin\AppData\Local\Temp\1C95.tmp"3⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\1CD4.tmp"C:\Users\Admin\AppData\Local\Temp\1CD4.tmp"4⤵PID:2652
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1D12.tmp"C:\Users\Admin\AppData\Local\Temp\1D12.tmp"1⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\1D50.tmp"C:\Users\Admin\AppData\Local\Temp\1D50.tmp"2⤵PID:2720
-
-
C:\Users\Admin\AppData\Local\Temp\1D8F.tmp"C:\Users\Admin\AppData\Local\Temp\1D8F.tmp"1⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\1DCD.tmp"C:\Users\Admin\AppData\Local\Temp\1DCD.tmp"2⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"3⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\1E4A.tmp"C:\Users\Admin\AppData\Local\Temp\1E4A.tmp"4⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\1E88.tmp"C:\Users\Admin\AppData\Local\Temp\1E88.tmp"5⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\1F05.tmp"C:\Users\Admin\AppData\Local\Temp\1F05.tmp"7⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\1F44.tmp"C:\Users\Admin\AppData\Local\Temp\1F44.tmp"8⤵PID:240
-
C:\Users\Admin\AppData\Local\Temp\1F82.tmp"C:\Users\Admin\AppData\Local\Temp\1F82.tmp"9⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"10⤵PID:1520
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"1⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"1⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"1⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\202E.tmp"C:\Users\Admin\AppData\Local\Temp\202E.tmp"2⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\206C.tmp"C:\Users\Admin\AppData\Local\Temp\206C.tmp"3⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\20AA.tmp"C:\Users\Admin\AppData\Local\Temp\20AA.tmp"4⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\20E9.tmp"C:\Users\Admin\AppData\Local\Temp\20E9.tmp"5⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\2127.tmp"C:\Users\Admin\AppData\Local\Temp\2127.tmp"6⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\2166.tmp"C:\Users\Admin\AppData\Local\Temp\2166.tmp"7⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\21A4.tmp"C:\Users\Admin\AppData\Local\Temp\21A4.tmp"8⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\21E2.tmp"C:\Users\Admin\AppData\Local\Temp\21E2.tmp"9⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\2221.tmp"C:\Users\Admin\AppData\Local\Temp\2221.tmp"10⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\225F.tmp"C:\Users\Admin\AppData\Local\Temp\225F.tmp"11⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\229E.tmp"C:\Users\Admin\AppData\Local\Temp\229E.tmp"12⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\22DC.tmp"C:\Users\Admin\AppData\Local\Temp\22DC.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\231A.tmp"C:\Users\Admin\AppData\Local\Temp\231A.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\2359.tmp"C:\Users\Admin\AppData\Local\Temp\2359.tmp"15⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\2397.tmp"C:\Users\Admin\AppData\Local\Temp\2397.tmp"16⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\23D6.tmp"C:\Users\Admin\AppData\Local\Temp\23D6.tmp"17⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\2414.tmp"C:\Users\Admin\AppData\Local\Temp\2414.tmp"18⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\2452.tmp"C:\Users\Admin\AppData\Local\Temp\2452.tmp"19⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\2491.tmp"C:\Users\Admin\AppData\Local\Temp\2491.tmp"20⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\24CF.tmp"C:\Users\Admin\AppData\Local\Temp\24CF.tmp"21⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\24FE.tmp"C:\Users\Admin\AppData\Local\Temp\24FE.tmp"22⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\253C.tmp"C:\Users\Admin\AppData\Local\Temp\253C.tmp"23⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\257B.tmp"C:\Users\Admin\AppData\Local\Temp\257B.tmp"24⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\25B9.tmp"C:\Users\Admin\AppData\Local\Temp\25B9.tmp"25⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\25F8.tmp"C:\Users\Admin\AppData\Local\Temp\25F8.tmp"26⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\2655.tmp"C:\Users\Admin\AppData\Local\Temp\2655.tmp"27⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\2694.tmp"C:\Users\Admin\AppData\Local\Temp\2694.tmp"28⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\26D2.tmp"C:\Users\Admin\AppData\Local\Temp\26D2.tmp"29⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\2710.tmp"C:\Users\Admin\AppData\Local\Temp\2710.tmp"30⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\274F.tmp"C:\Users\Admin\AppData\Local\Temp\274F.tmp"31⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\278D.tmp"C:\Users\Admin\AppData\Local\Temp\278D.tmp"32⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\27CC.tmp"C:\Users\Admin\AppData\Local\Temp\27CC.tmp"33⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"34⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\2848.tmp"C:\Users\Admin\AppData\Local\Temp\2848.tmp"35⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\2887.tmp"C:\Users\Admin\AppData\Local\Temp\2887.tmp"36⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\28C5.tmp"C:\Users\Admin\AppData\Local\Temp\28C5.tmp"37⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\2904.tmp"C:\Users\Admin\AppData\Local\Temp\2904.tmp"38⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\2942.tmp"C:\Users\Admin\AppData\Local\Temp\2942.tmp"39⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\2980.tmp"C:\Users\Admin\AppData\Local\Temp\2980.tmp"40⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\29BF.tmp"C:\Users\Admin\AppData\Local\Temp\29BF.tmp"41⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\29FD.tmp"C:\Users\Admin\AppData\Local\Temp\29FD.tmp"42⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"43⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"44⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"45⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"46⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\2B26.tmp"C:\Users\Admin\AppData\Local\Temp\2B26.tmp"47⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\2B64.tmp"C:\Users\Admin\AppData\Local\Temp\2B64.tmp"48⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"49⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\2BE1.tmp"C:\Users\Admin\AppData\Local\Temp\2BE1.tmp"50⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\2C1F.tmp"C:\Users\Admin\AppData\Local\Temp\2C1F.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"52⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\2C9C.tmp"C:\Users\Admin\AppData\Local\Temp\2C9C.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\2D19.tmp"C:\Users\Admin\AppData\Local\Temp\2D19.tmp"55⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\2D57.tmp"C:\Users\Admin\AppData\Local\Temp\2D57.tmp"56⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\2D96.tmp"C:\Users\Admin\AppData\Local\Temp\2D96.tmp"57⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"58⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\2E12.tmp"C:\Users\Admin\AppData\Local\Temp\2E12.tmp"59⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\2E51.tmp"C:\Users\Admin\AppData\Local\Temp\2E51.tmp"60⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"61⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"62⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"63⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"64⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\2F89.tmp"C:\Users\Admin\AppData\Local\Temp\2F89.tmp"65⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"66⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\3006.tmp"C:\Users\Admin\AppData\Local\Temp\3006.tmp"67⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\3044.tmp"C:\Users\Admin\AppData\Local\Temp\3044.tmp"68⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\3082.tmp"C:\Users\Admin\AppData\Local\Temp\3082.tmp"69⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\30C1.tmp"C:\Users\Admin\AppData\Local\Temp\30C1.tmp"70⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\30FF.tmp"C:\Users\Admin\AppData\Local\Temp\30FF.tmp"71⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\313E.tmp"C:\Users\Admin\AppData\Local\Temp\313E.tmp"72⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\317C.tmp"C:\Users\Admin\AppData\Local\Temp\317C.tmp"73⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\31BA.tmp"C:\Users\Admin\AppData\Local\Temp\31BA.tmp"74⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\31F9.tmp"C:\Users\Admin\AppData\Local\Temp\31F9.tmp"75⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\3247.tmp"C:\Users\Admin\AppData\Local\Temp\3247.tmp"76⤵
- Executes dropped EXE
- Loads dropped DLL
PID:956 -
C:\Users\Admin\AppData\Local\Temp\3295.tmp"C:\Users\Admin\AppData\Local\Temp\3295.tmp"77⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\32D3.tmp"C:\Users\Admin\AppData\Local\Temp\32D3.tmp"78⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\337F.tmp"C:\Users\Admin\AppData\Local\Temp\337F.tmp"79⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\341B.tmp"C:\Users\Admin\AppData\Local\Temp\341B.tmp"80⤵PID:720
-
C:\Users\Admin\AppData\Local\Temp\3469.tmp"C:\Users\Admin\AppData\Local\Temp\3469.tmp"81⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\34B7.tmp"C:\Users\Admin\AppData\Local\Temp\34B7.tmp"82⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\3514.tmp"C:\Users\Admin\AppData\Local\Temp\3514.tmp"83⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\3572.tmp"C:\Users\Admin\AppData\Local\Temp\3572.tmp"84⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\35C0.tmp"C:\Users\Admin\AppData\Local\Temp\35C0.tmp"85⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\35FE.tmp"C:\Users\Admin\AppData\Local\Temp\35FE.tmp"86⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\364C.tmp"C:\Users\Admin\AppData\Local\Temp\364C.tmp"87⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\369A.tmp"C:\Users\Admin\AppData\Local\Temp\369A.tmp"88⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\36F8.tmp"C:\Users\Admin\AppData\Local\Temp\36F8.tmp"89⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\3736.tmp"C:\Users\Admin\AppData\Local\Temp\3736.tmp"90⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\3784.tmp"C:\Users\Admin\AppData\Local\Temp\3784.tmp"91⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\37D2.tmp"C:\Users\Admin\AppData\Local\Temp\37D2.tmp"92⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\3820.tmp"C:\Users\Admin\AppData\Local\Temp\3820.tmp"93⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\386E.tmp"C:\Users\Admin\AppData\Local\Temp\386E.tmp"94⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\38AD.tmp"C:\Users\Admin\AppData\Local\Temp\38AD.tmp"95⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\38EB.tmp"C:\Users\Admin\AppData\Local\Temp\38EB.tmp"96⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\392A.tmp"C:\Users\Admin\AppData\Local\Temp\392A.tmp"97⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\3968.tmp"C:\Users\Admin\AppData\Local\Temp\3968.tmp"98⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\39A6.tmp"C:\Users\Admin\AppData\Local\Temp\39A6.tmp"99⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\39E5.tmp"C:\Users\Admin\AppData\Local\Temp\39E5.tmp"100⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\3A23.tmp"C:\Users\Admin\AppData\Local\Temp\3A23.tmp"101⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\3A62.tmp"C:\Users\Admin\AppData\Local\Temp\3A62.tmp"102⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\3AA0.tmp"C:\Users\Admin\AppData\Local\Temp\3AA0.tmp"103⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\3ADE.tmp"C:\Users\Admin\AppData\Local\Temp\3ADE.tmp"104⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\3B1D.tmp"C:\Users\Admin\AppData\Local\Temp\3B1D.tmp"105⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\3B5B.tmp"C:\Users\Admin\AppData\Local\Temp\3B5B.tmp"106⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\3B9A.tmp"C:\Users\Admin\AppData\Local\Temp\3B9A.tmp"107⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\3BD8.tmp"C:\Users\Admin\AppData\Local\Temp\3BD8.tmp"108⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\3C16.tmp"C:\Users\Admin\AppData\Local\Temp\3C16.tmp"109⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\3C55.tmp"C:\Users\Admin\AppData\Local\Temp\3C55.tmp"110⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\3C93.tmp"C:\Users\Admin\AppData\Local\Temp\3C93.tmp"111⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\3CD2.tmp"C:\Users\Admin\AppData\Local\Temp\3CD2.tmp"112⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\3D10.tmp"C:\Users\Admin\AppData\Local\Temp\3D10.tmp"113⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\3D3F.tmp"C:\Users\Admin\AppData\Local\Temp\3D3F.tmp"114⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\3D6E.tmp"C:\Users\Admin\AppData\Local\Temp\3D6E.tmp"115⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\3DAC.tmp"C:\Users\Admin\AppData\Local\Temp\3DAC.tmp"116⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\3DEA.tmp"C:\Users\Admin\AppData\Local\Temp\3DEA.tmp"117⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\3E29.tmp"C:\Users\Admin\AppData\Local\Temp\3E29.tmp"118⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\3E67.tmp"C:\Users\Admin\AppData\Local\Temp\3E67.tmp"119⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\3EA6.tmp"C:\Users\Admin\AppData\Local\Temp\3EA6.tmp"120⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"121⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\3F22.tmp"C:\Users\Admin\AppData\Local\Temp\3F22.tmp"122⤵PID:1044
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-