Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
27/01/2024, 21:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-01-27_a7f00ebda44caf18706b11432e34ac19_mafia.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-01-27_a7f00ebda44caf18706b11432e34ac19_mafia.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
2024-01-27_a7f00ebda44caf18706b11432e34ac19_mafia.exe
-
Size
486KB
-
MD5
a7f00ebda44caf18706b11432e34ac19
-
SHA1
e3c40c9bb7f7e40c63cf20cb004a5790eab0433c
-
SHA256
e9bce5839f69658cb4aa4165b80814bf65550abcfabc7523e2d4354684f8dbb4
-
SHA512
b74ae1f2f1adba3f9a3e024010295b201ea6e1343e1d3d07d5e7466fea1db2bb610fb264d089a0672bc9074c01a4f95acfc787976b97c8f83f96d3a1c123f30d
-
SSDEEP
12288:/U5rCOTeiD7c3ErppfLg26FLru1IPPPaBN1GNZ:/UQOJDYUrbfLr6Fyu3SN1GN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2936 3DEA.tmp 2260 3E86.tmp 2768 3F61.tmp 2952 405A.tmp 1184 4135.tmp 2604 4200.tmp 2272 42EA.tmp 1644 43A5.tmp 2612 4470.tmp 2088 454A.tmp 2740 4624.tmp 1740 46FF.tmp 2812 476C.tmp 3004 4846.tmp 2148 4921.tmp 1612 4A0B.tmp 1976 4B04.tmp 1584 4BB0.tmp 1696 4C5C.tmp 380 4D07.tmp 440 4DE2.tmp 1504 4EDB.tmp 2884 512C.tmp 2872 51C8.tmp 2372 5254.tmp 1380 52C2.tmp 1356 531F.tmp 2084 538C.tmp 1984 5409.tmp 2376 5496.tmp 2960 5512.tmp 2300 558F.tmp 2256 561C.tmp 1908 5679.tmp 788 56D7.tmp 2464 5744.tmp 1604 57B1.tmp 2060 580F.tmp 2456 587C.tmp 1576 5918.tmp 1792 5985.tmp 1212 5A21.tmp 944 5A9E.tmp 1116 5B1B.tmp 2452 5B88.tmp 2236 5C14.tmp 2004 5C82.tmp 2208 5CFE.tmp 344 5D6C.tmp 1936 5DD9.tmp 2152 5E36.tmp 876 5EB3.tmp 2212 5F20.tmp 1980 5F8E.tmp 1624 5FDC.tmp 3020 6039.tmp 2664 6097.tmp 2328 60E5.tmp 2260 6133.tmp 2820 61A0.tmp 1648 620D.tmp 2704 626B.tmp 1968 62C8.tmp 2596 6326.tmp -
Loads dropped DLL 64 IoCs
pid Process 1988 2024-01-27_a7f00ebda44caf18706b11432e34ac19_mafia.exe 2936 3DEA.tmp 2260 3E86.tmp 2768 3F61.tmp 2952 405A.tmp 1184 4135.tmp 2604 4200.tmp 2272 42EA.tmp 1644 43A5.tmp 2612 4470.tmp 2088 454A.tmp 2740 4624.tmp 1740 46FF.tmp 2812 476C.tmp 3004 4846.tmp 2148 4921.tmp 1612 4A0B.tmp 1976 4B04.tmp 1584 4BB0.tmp 1696 4C5C.tmp 380 4D07.tmp 440 4DE2.tmp 1504 4EDB.tmp 2884 512C.tmp 2872 51C8.tmp 2372 5254.tmp 1380 52C2.tmp 1356 531F.tmp 2084 538C.tmp 1984 5409.tmp 2376 5496.tmp 2960 5512.tmp 2300 558F.tmp 2256 561C.tmp 1908 5679.tmp 788 56D7.tmp 2464 5744.tmp 1604 57B1.tmp 2060 580F.tmp 2456 587C.tmp 1576 5918.tmp 1792 5985.tmp 1212 5A21.tmp 944 5A9E.tmp 1116 5B1B.tmp 2452 5B88.tmp 2236 5C14.tmp 2004 5C82.tmp 2208 5CFE.tmp 344 5D6C.tmp 1936 5DD9.tmp 2152 5E36.tmp 876 5EB3.tmp 2212 5F20.tmp 1980 5F8E.tmp 1624 5FDC.tmp 3020 6039.tmp 2664 6097.tmp 2328 60E5.tmp 2260 6133.tmp 2820 61A0.tmp 1648 620D.tmp 2704 626B.tmp 1968 62C8.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1988 wrote to memory of 2936 1988 2024-01-27_a7f00ebda44caf18706b11432e34ac19_mafia.exe 28 PID 1988 wrote to memory of 2936 1988 2024-01-27_a7f00ebda44caf18706b11432e34ac19_mafia.exe 28 PID 1988 wrote to memory of 2936 1988 2024-01-27_a7f00ebda44caf18706b11432e34ac19_mafia.exe 28 PID 1988 wrote to memory of 2936 1988 2024-01-27_a7f00ebda44caf18706b11432e34ac19_mafia.exe 28 PID 2936 wrote to memory of 2260 2936 3DEA.tmp 29 PID 2936 wrote to memory of 2260 2936 3DEA.tmp 29 PID 2936 wrote to memory of 2260 2936 3DEA.tmp 29 PID 2936 wrote to memory of 2260 2936 3DEA.tmp 29 PID 2260 wrote to memory of 2768 2260 3E86.tmp 30 PID 2260 wrote to memory of 2768 2260 3E86.tmp 30 PID 2260 wrote to memory of 2768 2260 3E86.tmp 30 PID 2260 wrote to memory of 2768 2260 3E86.tmp 30 PID 2768 wrote to memory of 2952 2768 3F61.tmp 31 PID 2768 wrote to memory of 2952 2768 3F61.tmp 31 PID 2768 wrote to memory of 2952 2768 3F61.tmp 31 PID 2768 wrote to memory of 2952 2768 3F61.tmp 31 PID 2952 wrote to memory of 1184 2952 405A.tmp 32 PID 2952 wrote to memory of 1184 2952 405A.tmp 32 PID 2952 wrote to memory of 1184 2952 405A.tmp 32 PID 2952 wrote to memory of 1184 2952 405A.tmp 32 PID 1184 wrote to memory of 2604 1184 4135.tmp 33 PID 1184 wrote to memory of 2604 1184 4135.tmp 33 PID 1184 wrote to memory of 2604 1184 4135.tmp 33 PID 1184 wrote to memory of 2604 1184 4135.tmp 33 PID 2604 wrote to memory of 2272 2604 4200.tmp 34 PID 2604 wrote to memory of 2272 2604 4200.tmp 34 PID 2604 wrote to memory of 2272 2604 4200.tmp 34 PID 2604 wrote to memory of 2272 2604 4200.tmp 34 PID 2272 wrote to memory of 1644 2272 42EA.tmp 35 PID 2272 wrote to memory of 1644 2272 42EA.tmp 35 PID 2272 wrote to memory of 1644 2272 42EA.tmp 35 PID 2272 wrote to memory of 1644 2272 42EA.tmp 35 PID 1644 wrote to memory of 2612 1644 43A5.tmp 36 PID 1644 wrote to memory of 2612 1644 43A5.tmp 36 PID 1644 wrote to memory of 2612 1644 43A5.tmp 36 PID 1644 wrote to memory of 2612 1644 43A5.tmp 36 PID 2612 wrote to memory of 2088 2612 4470.tmp 37 PID 2612 wrote to memory of 2088 2612 4470.tmp 37 PID 2612 wrote to memory of 2088 2612 4470.tmp 37 PID 2612 wrote to memory of 2088 2612 4470.tmp 37 PID 2088 wrote to memory of 2740 2088 454A.tmp 38 PID 2088 wrote to memory of 2740 2088 454A.tmp 38 PID 2088 wrote to memory of 2740 2088 454A.tmp 38 PID 2088 wrote to memory of 2740 2088 454A.tmp 38 PID 2740 wrote to memory of 1740 2740 4624.tmp 39 PID 2740 wrote to memory of 1740 2740 4624.tmp 39 PID 2740 wrote to memory of 1740 2740 4624.tmp 39 PID 2740 wrote to memory of 1740 2740 4624.tmp 39 PID 1740 wrote to memory of 2812 1740 46FF.tmp 40 PID 1740 wrote to memory of 2812 1740 46FF.tmp 40 PID 1740 wrote to memory of 2812 1740 46FF.tmp 40 PID 1740 wrote to memory of 2812 1740 46FF.tmp 40 PID 2812 wrote to memory of 3004 2812 476C.tmp 41 PID 2812 wrote to memory of 3004 2812 476C.tmp 41 PID 2812 wrote to memory of 3004 2812 476C.tmp 41 PID 2812 wrote to memory of 3004 2812 476C.tmp 41 PID 3004 wrote to memory of 2148 3004 4846.tmp 42 PID 3004 wrote to memory of 2148 3004 4846.tmp 42 PID 3004 wrote to memory of 2148 3004 4846.tmp 42 PID 3004 wrote to memory of 2148 3004 4846.tmp 42 PID 2148 wrote to memory of 1612 2148 4921.tmp 43 PID 2148 wrote to memory of 1612 2148 4921.tmp 43 PID 2148 wrote to memory of 1612 2148 4921.tmp 43 PID 2148 wrote to memory of 1612 2148 4921.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-27_a7f00ebda44caf18706b11432e34ac19_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-27_a7f00ebda44caf18706b11432e34ac19_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\3DEA.tmp"C:\Users\Admin\AppData\Local\Temp\3DEA.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\3E86.tmp"C:\Users\Admin\AppData\Local\Temp\3E86.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\3F61.tmp"C:\Users\Admin\AppData\Local\Temp\3F61.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\405A.tmp"C:\Users\Admin\AppData\Local\Temp\405A.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\4135.tmp"C:\Users\Admin\AppData\Local\Temp\4135.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\4200.tmp"C:\Users\Admin\AppData\Local\Temp\4200.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\42EA.tmp"C:\Users\Admin\AppData\Local\Temp\42EA.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\43A5.tmp"C:\Users\Admin\AppData\Local\Temp\43A5.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\4470.tmp"C:\Users\Admin\AppData\Local\Temp\4470.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\454A.tmp"C:\Users\Admin\AppData\Local\Temp\454A.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\4624.tmp"C:\Users\Admin\AppData\Local\Temp\4624.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\46FF.tmp"C:\Users\Admin\AppData\Local\Temp\46FF.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\476C.tmp"C:\Users\Admin\AppData\Local\Temp\476C.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\4846.tmp"C:\Users\Admin\AppData\Local\Temp\4846.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\4921.tmp"C:\Users\Admin\AppData\Local\Temp\4921.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\4A0B.tmp"C:\Users\Admin\AppData\Local\Temp\4A0B.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\4B04.tmp"C:\Users\Admin\AppData\Local\Temp\4B04.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\4BB0.tmp"C:\Users\Admin\AppData\Local\Temp\4BB0.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\4C5C.tmp"C:\Users\Admin\AppData\Local\Temp\4C5C.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:380 -
C:\Users\Admin\AppData\Local\Temp\4DE2.tmp"C:\Users\Admin\AppData\Local\Temp\4DE2.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:440 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\512C.tmp"C:\Users\Admin\AppData\Local\Temp\512C.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\51C8.tmp"C:\Users\Admin\AppData\Local\Temp\51C8.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\5254.tmp"C:\Users\Admin\AppData\Local\Temp\5254.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\52C2.tmp"C:\Users\Admin\AppData\Local\Temp\52C2.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\531F.tmp"C:\Users\Admin\AppData\Local\Temp\531F.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\538C.tmp"C:\Users\Admin\AppData\Local\Temp\538C.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\5409.tmp"C:\Users\Admin\AppData\Local\Temp\5409.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\5496.tmp"C:\Users\Admin\AppData\Local\Temp\5496.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\5512.tmp"C:\Users\Admin\AppData\Local\Temp\5512.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\558F.tmp"C:\Users\Admin\AppData\Local\Temp\558F.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\561C.tmp"C:\Users\Admin\AppData\Local\Temp\561C.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\5679.tmp"C:\Users\Admin\AppData\Local\Temp\5679.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\56D7.tmp"C:\Users\Admin\AppData\Local\Temp\56D7.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:788 -
C:\Users\Admin\AppData\Local\Temp\5744.tmp"C:\Users\Admin\AppData\Local\Temp\5744.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\57B1.tmp"C:\Users\Admin\AppData\Local\Temp\57B1.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\580F.tmp"C:\Users\Admin\AppData\Local\Temp\580F.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\587C.tmp"C:\Users\Admin\AppData\Local\Temp\587C.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\5918.tmp"C:\Users\Admin\AppData\Local\Temp\5918.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\5985.tmp"C:\Users\Admin\AppData\Local\Temp\5985.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\5A21.tmp"C:\Users\Admin\AppData\Local\Temp\5A21.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:944 -
C:\Users\Admin\AppData\Local\Temp\5B1B.tmp"C:\Users\Admin\AppData\Local\Temp\5B1B.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\5B88.tmp"C:\Users\Admin\AppData\Local\Temp\5B88.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\5C14.tmp"C:\Users\Admin\AppData\Local\Temp\5C14.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\5C82.tmp"C:\Users\Admin\AppData\Local\Temp\5C82.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\5CFE.tmp"C:\Users\Admin\AppData\Local\Temp\5CFE.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\5D6C.tmp"C:\Users\Admin\AppData\Local\Temp\5D6C.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:344 -
C:\Users\Admin\AppData\Local\Temp\5DD9.tmp"C:\Users\Admin\AppData\Local\Temp\5DD9.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\5E36.tmp"C:\Users\Admin\AppData\Local\Temp\5E36.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\5EB3.tmp"C:\Users\Admin\AppData\Local\Temp\5EB3.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:876 -
C:\Users\Admin\AppData\Local\Temp\5F20.tmp"C:\Users\Admin\AppData\Local\Temp\5F20.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\5F8E.tmp"C:\Users\Admin\AppData\Local\Temp\5F8E.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\5FDC.tmp"C:\Users\Admin\AppData\Local\Temp\5FDC.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\6039.tmp"C:\Users\Admin\AppData\Local\Temp\6039.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\6097.tmp"C:\Users\Admin\AppData\Local\Temp\6097.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\60E5.tmp"C:\Users\Admin\AppData\Local\Temp\60E5.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\6133.tmp"C:\Users\Admin\AppData\Local\Temp\6133.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\61A0.tmp"C:\Users\Admin\AppData\Local\Temp\61A0.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\620D.tmp"C:\Users\Admin\AppData\Local\Temp\620D.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\626B.tmp"C:\Users\Admin\AppData\Local\Temp\626B.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\62C8.tmp"C:\Users\Admin\AppData\Local\Temp\62C8.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\6326.tmp"C:\Users\Admin\AppData\Local\Temp\6326.tmp"65⤵
- Executes dropped EXE
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\6384.tmp"C:\Users\Admin\AppData\Local\Temp\6384.tmp"66⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\63F1.tmp"C:\Users\Admin\AppData\Local\Temp\63F1.tmp"67⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\645E.tmp"C:\Users\Admin\AppData\Local\Temp\645E.tmp"68⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\64DB.tmp"C:\Users\Admin\AppData\Local\Temp\64DB.tmp"69⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\66AF.tmp"C:\Users\Admin\AppData\Local\Temp\66AF.tmp"70⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\673B.tmp"C:\Users\Admin\AppData\Local\Temp\673B.tmp"71⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\67B8.tmp"C:\Users\Admin\AppData\Local\Temp\67B8.tmp"72⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\6806.tmp"C:\Users\Admin\AppData\Local\Temp\6806.tmp"73⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\6854.tmp"C:\Users\Admin\AppData\Local\Temp\6854.tmp"74⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\68B2.tmp"C:\Users\Admin\AppData\Local\Temp\68B2.tmp"75⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\690F.tmp"C:\Users\Admin\AppData\Local\Temp\690F.tmp"76⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\697D.tmp"C:\Users\Admin\AppData\Local\Temp\697D.tmp"77⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\69EA.tmp"C:\Users\Admin\AppData\Local\Temp\69EA.tmp"78⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\6A47.tmp"C:\Users\Admin\AppData\Local\Temp\6A47.tmp"79⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\6AB5.tmp"C:\Users\Admin\AppData\Local\Temp\6AB5.tmp"80⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\6B03.tmp"C:\Users\Admin\AppData\Local\Temp\6B03.tmp"81⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\6B60.tmp"C:\Users\Admin\AppData\Local\Temp\6B60.tmp"82⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\6BCD.tmp"C:\Users\Admin\AppData\Local\Temp\6BCD.tmp"83⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\6C3B.tmp"C:\Users\Admin\AppData\Local\Temp\6C3B.tmp"84⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\6C89.tmp"C:\Users\Admin\AppData\Local\Temp\6C89.tmp"85⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\6CD7.tmp"C:\Users\Admin\AppData\Local\Temp\6CD7.tmp"86⤵PID:476
-
C:\Users\Admin\AppData\Local\Temp\6D44.tmp"C:\Users\Admin\AppData\Local\Temp\6D44.tmp"87⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\6D92.tmp"C:\Users\Admin\AppData\Local\Temp\6D92.tmp"88⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\6DEF.tmp"C:\Users\Admin\AppData\Local\Temp\6DEF.tmp"89⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\6E7C.tmp"C:\Users\Admin\AppData\Local\Temp\6E7C.tmp"90⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\6EE9.tmp"C:\Users\Admin\AppData\Local\Temp\6EE9.tmp"91⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\6F66.tmp"C:\Users\Admin\AppData\Local\Temp\6F66.tmp"92⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\6FD3.tmp"C:\Users\Admin\AppData\Local\Temp\6FD3.tmp"93⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\7050.tmp"C:\Users\Admin\AppData\Local\Temp\7050.tmp"94⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\70AD.tmp"C:\Users\Admin\AppData\Local\Temp\70AD.tmp"95⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\710B.tmp"C:\Users\Admin\AppData\Local\Temp\710B.tmp"96⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\7188.tmp"C:\Users\Admin\AppData\Local\Temp\7188.tmp"97⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\71F5.tmp"C:\Users\Admin\AppData\Local\Temp\71F5.tmp"98⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\7272.tmp"C:\Users\Admin\AppData\Local\Temp\7272.tmp"99⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\72DF.tmp"C:\Users\Admin\AppData\Local\Temp\72DF.tmp"100⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\735C.tmp"C:\Users\Admin\AppData\Local\Temp\735C.tmp"101⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\73D9.tmp"C:\Users\Admin\AppData\Local\Temp\73D9.tmp"102⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"103⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\74C3.tmp"C:\Users\Admin\AppData\Local\Temp\74C3.tmp"104⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"105⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\757E.tmp"C:\Users\Admin\AppData\Local\Temp\757E.tmp"106⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\75DB.tmp"C:\Users\Admin\AppData\Local\Temp\75DB.tmp"107⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\7649.tmp"C:\Users\Admin\AppData\Local\Temp\7649.tmp"108⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\76A6.tmp"C:\Users\Admin\AppData\Local\Temp\76A6.tmp"109⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\7713.tmp"C:\Users\Admin\AppData\Local\Temp\7713.tmp"110⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\7790.tmp"C:\Users\Admin\AppData\Local\Temp\7790.tmp"111⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\77FD.tmp"C:\Users\Admin\AppData\Local\Temp\77FD.tmp"112⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\787A.tmp"C:\Users\Admin\AppData\Local\Temp\787A.tmp"113⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\78E7.tmp"C:\Users\Admin\AppData\Local\Temp\78E7.tmp"114⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\7955.tmp"C:\Users\Admin\AppData\Local\Temp\7955.tmp"115⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\79C2.tmp"C:\Users\Admin\AppData\Local\Temp\79C2.tmp"116⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\7A5E.tmp"C:\Users\Admin\AppData\Local\Temp\7A5E.tmp"117⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\7ACB.tmp"C:\Users\Admin\AppData\Local\Temp\7ACB.tmp"118⤵PID:344
-
C:\Users\Admin\AppData\Local\Temp\7B86.tmp"C:\Users\Admin\AppData\Local\Temp\7B86.tmp"119⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\7C03.tmp"C:\Users\Admin\AppData\Local\Temp\7C03.tmp"120⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\7C61.tmp"C:\Users\Admin\AppData\Local\Temp\7C61.tmp"121⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\7CCE.tmp"C:\Users\Admin\AppData\Local\Temp\7CCE.tmp"122⤵PID:1988
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-