Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
13/02/2024, 15:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-13_97632237bba8dcb443914e9332b666b2_mafia.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-13_97632237bba8dcb443914e9332b666b2_mafia.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
2024-02-13_97632237bba8dcb443914e9332b666b2_mafia.exe
-
Size
486KB
-
MD5
97632237bba8dcb443914e9332b666b2
-
SHA1
ab04d6e341baad036c0085289126c4ca6278fe75
-
SHA256
bed567898f24151d7b5c5ea075af06902e2f12263e47fc4d0aaa882b05105b26
-
SHA512
6744bda6088db295865470fb618b8e2cee33558427f972f1a4f8e3568486e5534ca3593d7bd27c4eaf4cdd116add007aa79677e27a262d21ecc096f90bb4ff44
-
SSDEEP
12288:/U5rCOTeiD2Nk/oH87ic7dYPRA1wP55NZ:/UQOJDL/oc7iaYPRHDN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2192 3B8A.tmp 2356 3C55.tmp 2808 3D2F.tmp 2804 3E19.tmp 2688 3EF4.tmp 2672 3FBE.tmp 2584 40A8.tmp 2724 4183.tmp 2576 424E.tmp 548 4328.tmp 2532 43F3.tmp 2016 44BE.tmp 2760 4588.tmp 3036 4672.tmp 2652 472E.tmp 828 47F8.tmp 2148 4875.tmp 2464 4950.tmp 280 4A78.tmp 268 4B62.tmp 336 4C3C.tmp 1104 4DA3.tmp 2756 4E8D.tmp 576 4F39.tmp 1660 4FB6.tmp 1648 5061.tmp 1368 50CE.tmp 1328 513C.tmp 2228 51A9.tmp 2824 5216.tmp 2940 5274.tmp 2176 52E1.tmp 1372 535E.tmp 2276 53CB.tmp 1900 5438.tmp 1652 54C4.tmp 776 5532.tmp 1324 558F.tmp 2456 55FC.tmp 1744 566A.tmp 1520 56E6.tmp 1988 5744.tmp 1156 57A2.tmp 1892 580F.tmp 1912 587C.tmp 2988 58E9.tmp 704 5947.tmp 1488 59C4.tmp 2488 5A40.tmp 1612 5A9E.tmp 296 5B1B.tmp 1980 5B88.tmp 1984 5BD6.tmp 2516 5C43.tmp 1568 5CC0.tmp 1592 5D2D.tmp 1996 5D9A.tmp 2192 5E08.tmp 2800 5E75.tmp 2828 5EE2.tmp 2816 5F6E.tmp 2980 5FCC.tmp 2848 6039.tmp 2836 60B6.tmp -
Loads dropped DLL 64 IoCs
pid Process 1996 2024-02-13_97632237bba8dcb443914e9332b666b2_mafia.exe 2192 3B8A.tmp 2356 3C55.tmp 2808 3D2F.tmp 2804 3E19.tmp 2688 3EF4.tmp 2672 3FBE.tmp 2584 40A8.tmp 2724 4183.tmp 2576 424E.tmp 548 4328.tmp 2532 43F3.tmp 2016 44BE.tmp 2760 4588.tmp 3036 4672.tmp 2652 472E.tmp 828 47F8.tmp 2148 4875.tmp 2464 4950.tmp 280 4A78.tmp 268 4B62.tmp 336 4C3C.tmp 1104 4DA3.tmp 2756 4E8D.tmp 576 4F39.tmp 1660 4FB6.tmp 1648 5061.tmp 1368 50CE.tmp 1328 513C.tmp 2228 51A9.tmp 2824 5216.tmp 2940 5274.tmp 2176 52E1.tmp 1372 535E.tmp 2276 53CB.tmp 1900 5438.tmp 1652 54C4.tmp 776 5532.tmp 1324 558F.tmp 2456 55FC.tmp 1744 566A.tmp 1520 56E6.tmp 1988 5744.tmp 1156 57A2.tmp 1892 580F.tmp 1912 587C.tmp 2988 58E9.tmp 704 5947.tmp 1488 59C4.tmp 2488 5A40.tmp 1612 5A9E.tmp 296 5B1B.tmp 1980 5B88.tmp 1984 5BD6.tmp 2516 5C43.tmp 1568 5CC0.tmp 1592 5D2D.tmp 1996 5D9A.tmp 2192 5E08.tmp 2800 5E75.tmp 2828 5EE2.tmp 2816 5F6E.tmp 2980 5FCC.tmp 2848 6039.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1996 wrote to memory of 2192 1996 2024-02-13_97632237bba8dcb443914e9332b666b2_mafia.exe 28 PID 1996 wrote to memory of 2192 1996 2024-02-13_97632237bba8dcb443914e9332b666b2_mafia.exe 28 PID 1996 wrote to memory of 2192 1996 2024-02-13_97632237bba8dcb443914e9332b666b2_mafia.exe 28 PID 1996 wrote to memory of 2192 1996 2024-02-13_97632237bba8dcb443914e9332b666b2_mafia.exe 28 PID 2192 wrote to memory of 2356 2192 3B8A.tmp 29 PID 2192 wrote to memory of 2356 2192 3B8A.tmp 29 PID 2192 wrote to memory of 2356 2192 3B8A.tmp 29 PID 2192 wrote to memory of 2356 2192 3B8A.tmp 29 PID 2356 wrote to memory of 2808 2356 3C55.tmp 30 PID 2356 wrote to memory of 2808 2356 3C55.tmp 30 PID 2356 wrote to memory of 2808 2356 3C55.tmp 30 PID 2356 wrote to memory of 2808 2356 3C55.tmp 30 PID 2808 wrote to memory of 2804 2808 3D2F.tmp 31 PID 2808 wrote to memory of 2804 2808 3D2F.tmp 31 PID 2808 wrote to memory of 2804 2808 3D2F.tmp 31 PID 2808 wrote to memory of 2804 2808 3D2F.tmp 31 PID 2804 wrote to memory of 2688 2804 3E19.tmp 32 PID 2804 wrote to memory of 2688 2804 3E19.tmp 32 PID 2804 wrote to memory of 2688 2804 3E19.tmp 32 PID 2804 wrote to memory of 2688 2804 3E19.tmp 32 PID 2688 wrote to memory of 2672 2688 3EF4.tmp 33 PID 2688 wrote to memory of 2672 2688 3EF4.tmp 33 PID 2688 wrote to memory of 2672 2688 3EF4.tmp 33 PID 2688 wrote to memory of 2672 2688 3EF4.tmp 33 PID 2672 wrote to memory of 2584 2672 3FBE.tmp 34 PID 2672 wrote to memory of 2584 2672 3FBE.tmp 34 PID 2672 wrote to memory of 2584 2672 3FBE.tmp 34 PID 2672 wrote to memory of 2584 2672 3FBE.tmp 34 PID 2584 wrote to memory of 2724 2584 40A8.tmp 35 PID 2584 wrote to memory of 2724 2584 40A8.tmp 35 PID 2584 wrote to memory of 2724 2584 40A8.tmp 35 PID 2584 wrote to memory of 2724 2584 40A8.tmp 35 PID 2724 wrote to memory of 2576 2724 4183.tmp 36 PID 2724 wrote to memory of 2576 2724 4183.tmp 36 PID 2724 wrote to memory of 2576 2724 4183.tmp 36 PID 2724 wrote to memory of 2576 2724 4183.tmp 36 PID 2576 wrote to memory of 548 2576 424E.tmp 37 PID 2576 wrote to memory of 548 2576 424E.tmp 37 PID 2576 wrote to memory of 548 2576 424E.tmp 37 PID 2576 wrote to memory of 548 2576 424E.tmp 37 PID 548 wrote to memory of 2532 548 4328.tmp 38 PID 548 wrote to memory of 2532 548 4328.tmp 38 PID 548 wrote to memory of 2532 548 4328.tmp 38 PID 548 wrote to memory of 2532 548 4328.tmp 38 PID 2532 wrote to memory of 2016 2532 43F3.tmp 39 PID 2532 wrote to memory of 2016 2532 43F3.tmp 39 PID 2532 wrote to memory of 2016 2532 43F3.tmp 39 PID 2532 wrote to memory of 2016 2532 43F3.tmp 39 PID 2016 wrote to memory of 2760 2016 44BE.tmp 40 PID 2016 wrote to memory of 2760 2016 44BE.tmp 40 PID 2016 wrote to memory of 2760 2016 44BE.tmp 40 PID 2016 wrote to memory of 2760 2016 44BE.tmp 40 PID 2760 wrote to memory of 3036 2760 4588.tmp 41 PID 2760 wrote to memory of 3036 2760 4588.tmp 41 PID 2760 wrote to memory of 3036 2760 4588.tmp 41 PID 2760 wrote to memory of 3036 2760 4588.tmp 41 PID 3036 wrote to memory of 2652 3036 4672.tmp 42 PID 3036 wrote to memory of 2652 3036 4672.tmp 42 PID 3036 wrote to memory of 2652 3036 4672.tmp 42 PID 3036 wrote to memory of 2652 3036 4672.tmp 42 PID 2652 wrote to memory of 828 2652 472E.tmp 43 PID 2652 wrote to memory of 828 2652 472E.tmp 43 PID 2652 wrote to memory of 828 2652 472E.tmp 43 PID 2652 wrote to memory of 828 2652 472E.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-13_97632237bba8dcb443914e9332b666b2_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-13_97632237bba8dcb443914e9332b666b2_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\3B8A.tmp"C:\Users\Admin\AppData\Local\Temp\3B8A.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\3C55.tmp"C:\Users\Admin\AppData\Local\Temp\3C55.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\3D2F.tmp"C:\Users\Admin\AppData\Local\Temp\3D2F.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\3E19.tmp"C:\Users\Admin\AppData\Local\Temp\3E19.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\3EF4.tmp"C:\Users\Admin\AppData\Local\Temp\3EF4.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\3FBE.tmp"C:\Users\Admin\AppData\Local\Temp\3FBE.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\40A8.tmp"C:\Users\Admin\AppData\Local\Temp\40A8.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\4183.tmp"C:\Users\Admin\AppData\Local\Temp\4183.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\424E.tmp"C:\Users\Admin\AppData\Local\Temp\424E.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\4328.tmp"C:\Users\Admin\AppData\Local\Temp\4328.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\43F3.tmp"C:\Users\Admin\AppData\Local\Temp\43F3.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\44BE.tmp"C:\Users\Admin\AppData\Local\Temp\44BE.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\4588.tmp"C:\Users\Admin\AppData\Local\Temp\4588.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\4672.tmp"C:\Users\Admin\AppData\Local\Temp\4672.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\472E.tmp"C:\Users\Admin\AppData\Local\Temp\472E.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\47F8.tmp"C:\Users\Admin\AppData\Local\Temp\47F8.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:828 -
C:\Users\Admin\AppData\Local\Temp\4875.tmp"C:\Users\Admin\AppData\Local\Temp\4875.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\4950.tmp"C:\Users\Admin\AppData\Local\Temp\4950.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\4A78.tmp"C:\Users\Admin\AppData\Local\Temp\4A78.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:280 -
C:\Users\Admin\AppData\Local\Temp\4B62.tmp"C:\Users\Admin\AppData\Local\Temp\4B62.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:268 -
C:\Users\Admin\AppData\Local\Temp\4C3C.tmp"C:\Users\Admin\AppData\Local\Temp\4C3C.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:336 -
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:576 -
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\5061.tmp"C:\Users\Admin\AppData\Local\Temp\5061.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\50CE.tmp"C:\Users\Admin\AppData\Local\Temp\50CE.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\513C.tmp"C:\Users\Admin\AppData\Local\Temp\513C.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\51A9.tmp"C:\Users\Admin\AppData\Local\Temp\51A9.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\5216.tmp"C:\Users\Admin\AppData\Local\Temp\5216.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\5274.tmp"C:\Users\Admin\AppData\Local\Temp\5274.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\52E1.tmp"C:\Users\Admin\AppData\Local\Temp\52E1.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\535E.tmp"C:\Users\Admin\AppData\Local\Temp\535E.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\53CB.tmp"C:\Users\Admin\AppData\Local\Temp\53CB.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\5438.tmp"C:\Users\Admin\AppData\Local\Temp\5438.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\54C4.tmp"C:\Users\Admin\AppData\Local\Temp\54C4.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\5532.tmp"C:\Users\Admin\AppData\Local\Temp\5532.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:776 -
C:\Users\Admin\AppData\Local\Temp\558F.tmp"C:\Users\Admin\AppData\Local\Temp\558F.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\55FC.tmp"C:\Users\Admin\AppData\Local\Temp\55FC.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\566A.tmp"C:\Users\Admin\AppData\Local\Temp\566A.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\56E6.tmp"C:\Users\Admin\AppData\Local\Temp\56E6.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\5744.tmp"C:\Users\Admin\AppData\Local\Temp\5744.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\57A2.tmp"C:\Users\Admin\AppData\Local\Temp\57A2.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\580F.tmp"C:\Users\Admin\AppData\Local\Temp\580F.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\587C.tmp"C:\Users\Admin\AppData\Local\Temp\587C.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\58E9.tmp"C:\Users\Admin\AppData\Local\Temp\58E9.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\5947.tmp"C:\Users\Admin\AppData\Local\Temp\5947.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:704 -
C:\Users\Admin\AppData\Local\Temp\59C4.tmp"C:\Users\Admin\AppData\Local\Temp\59C4.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\5A40.tmp"C:\Users\Admin\AppData\Local\Temp\5A40.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\5B1B.tmp"C:\Users\Admin\AppData\Local\Temp\5B1B.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:296 -
C:\Users\Admin\AppData\Local\Temp\5B88.tmp"C:\Users\Admin\AppData\Local\Temp\5B88.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\5BD6.tmp"C:\Users\Admin\AppData\Local\Temp\5BD6.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\5C43.tmp"C:\Users\Admin\AppData\Local\Temp\5C43.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\5CC0.tmp"C:\Users\Admin\AppData\Local\Temp\5CC0.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\5D2D.tmp"C:\Users\Admin\AppData\Local\Temp\5D2D.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\5D9A.tmp"C:\Users\Admin\AppData\Local\Temp\5D9A.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\5E08.tmp"C:\Users\Admin\AppData\Local\Temp\5E08.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\5E75.tmp"C:\Users\Admin\AppData\Local\Temp\5E75.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\5EE2.tmp"C:\Users\Admin\AppData\Local\Temp\5EE2.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\5F6E.tmp"C:\Users\Admin\AppData\Local\Temp\5F6E.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\5FCC.tmp"C:\Users\Admin\AppData\Local\Temp\5FCC.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\6039.tmp"C:\Users\Admin\AppData\Local\Temp\6039.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\60B6.tmp"C:\Users\Admin\AppData\Local\Temp\60B6.tmp"65⤵
- Executes dropped EXE
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\6123.tmp"C:\Users\Admin\AppData\Local\Temp\6123.tmp"66⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\61A0.tmp"C:\Users\Admin\AppData\Local\Temp\61A0.tmp"67⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\62D8.tmp"C:\Users\Admin\AppData\Local\Temp\62D8.tmp"68⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\6345.tmp"C:\Users\Admin\AppData\Local\Temp\6345.tmp"69⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\63A3.tmp"C:\Users\Admin\AppData\Local\Temp\63A3.tmp"70⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\6401.tmp"C:\Users\Admin\AppData\Local\Temp\6401.tmp"71⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\646E.tmp"C:\Users\Admin\AppData\Local\Temp\646E.tmp"72⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\64FA.tmp"C:\Users\Admin\AppData\Local\Temp\64FA.tmp"73⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\6567.tmp"C:\Users\Admin\AppData\Local\Temp\6567.tmp"74⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\65D5.tmp"C:\Users\Admin\AppData\Local\Temp\65D5.tmp"75⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\6623.tmp"C:\Users\Admin\AppData\Local\Temp\6623.tmp"76⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\6680.tmp"C:\Users\Admin\AppData\Local\Temp\6680.tmp"77⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\66FD.tmp"C:\Users\Admin\AppData\Local\Temp\66FD.tmp"78⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\676A.tmp"C:\Users\Admin\AppData\Local\Temp\676A.tmp"79⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\67D7.tmp"C:\Users\Admin\AppData\Local\Temp\67D7.tmp"80⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\6835.tmp"C:\Users\Admin\AppData\Local\Temp\6835.tmp"81⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\68A2.tmp"C:\Users\Admin\AppData\Local\Temp\68A2.tmp"82⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\690F.tmp"C:\Users\Admin\AppData\Local\Temp\690F.tmp"83⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\696D.tmp"C:\Users\Admin\AppData\Local\Temp\696D.tmp"84⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\69CB.tmp"C:\Users\Admin\AppData\Local\Temp\69CB.tmp"85⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\6A28.tmp"C:\Users\Admin\AppData\Local\Temp\6A28.tmp"86⤵PID:596
-
C:\Users\Admin\AppData\Local\Temp\6A86.tmp"C:\Users\Admin\AppData\Local\Temp\6A86.tmp"87⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\6AF3.tmp"C:\Users\Admin\AppData\Local\Temp\6AF3.tmp"88⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\6B60.tmp"C:\Users\Admin\AppData\Local\Temp\6B60.tmp"89⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\6BCD.tmp"C:\Users\Admin\AppData\Local\Temp\6BCD.tmp"90⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\6C3B.tmp"C:\Users\Admin\AppData\Local\Temp\6C3B.tmp"91⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\6CA8.tmp"C:\Users\Admin\AppData\Local\Temp\6CA8.tmp"92⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\6D05.tmp"C:\Users\Admin\AppData\Local\Temp\6D05.tmp"93⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\6D82.tmp"C:\Users\Admin\AppData\Local\Temp\6D82.tmp"94⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\6DEF.tmp"C:\Users\Admin\AppData\Local\Temp\6DEF.tmp"95⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\6E6C.tmp"C:\Users\Admin\AppData\Local\Temp\6E6C.tmp"96⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\6ED9.tmp"C:\Users\Admin\AppData\Local\Temp\6ED9.tmp"97⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\6F56.tmp"C:\Users\Admin\AppData\Local\Temp\6F56.tmp"98⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\6FC3.tmp"C:\Users\Admin\AppData\Local\Temp\6FC3.tmp"99⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\7021.tmp"C:\Users\Admin\AppData\Local\Temp\7021.tmp"100⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\707F.tmp"C:\Users\Admin\AppData\Local\Temp\707F.tmp"101⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\70FB.tmp"C:\Users\Admin\AppData\Local\Temp\70FB.tmp"102⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\7178.tmp"C:\Users\Admin\AppData\Local\Temp\7178.tmp"103⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\71F5.tmp"C:\Users\Admin\AppData\Local\Temp\71F5.tmp"104⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\7253.tmp"C:\Users\Admin\AppData\Local\Temp\7253.tmp"105⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\72B0.tmp"C:\Users\Admin\AppData\Local\Temp\72B0.tmp"106⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\730E.tmp"C:\Users\Admin\AppData\Local\Temp\730E.tmp"107⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\736B.tmp"C:\Users\Admin\AppData\Local\Temp\736B.tmp"108⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\73C9.tmp"C:\Users\Admin\AppData\Local\Temp\73C9.tmp"109⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\7446.tmp"C:\Users\Admin\AppData\Local\Temp\7446.tmp"110⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\74A3.tmp"C:\Users\Admin\AppData\Local\Temp\74A3.tmp"111⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\7501.tmp"C:\Users\Admin\AppData\Local\Temp\7501.tmp"112⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\755F.tmp"C:\Users\Admin\AppData\Local\Temp\755F.tmp"113⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\75EB.tmp"C:\Users\Admin\AppData\Local\Temp\75EB.tmp"114⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\7649.tmp"C:\Users\Admin\AppData\Local\Temp\7649.tmp"115⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\76C5.tmp"C:\Users\Admin\AppData\Local\Temp\76C5.tmp"116⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\77A0.tmp"C:\Users\Admin\AppData\Local\Temp\77A0.tmp"117⤵PID:344
-
C:\Users\Admin\AppData\Local\Temp\781D.tmp"C:\Users\Admin\AppData\Local\Temp\781D.tmp"118⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\788A.tmp"C:\Users\Admin\AppData\Local\Temp\788A.tmp"119⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\78F7.tmp"C:\Users\Admin\AppData\Local\Temp\78F7.tmp"120⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\7955.tmp"C:\Users\Admin\AppData\Local\Temp\7955.tmp"121⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\79C2.tmp"C:\Users\Admin\AppData\Local\Temp\79C2.tmp"122⤵PID:2204
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-