Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
20/02/2024, 13:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-20_f0d989fd8fd34b57f5532f3e821b0d84_mafia.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-20_f0d989fd8fd34b57f5532f3e821b0d84_mafia.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
2024-02-20_f0d989fd8fd34b57f5532f3e821b0d84_mafia.exe
-
Size
541KB
-
MD5
f0d989fd8fd34b57f5532f3e821b0d84
-
SHA1
4556e22e8ff6cf4c43ccb2990b2f027e29386acf
-
SHA256
91be68dd27af750240f3314c510594bafcaf23e4aef21839d6dd9cbf6cba6f40
-
SHA512
e57eceb5d0aa47574342097f2011a872778c98809dafcdcf3cc90a01140523052bc999daabb78bac807adc7e738fdab792cf8f01145506dfa4dd7c0a59978319
-
SSDEEP
12288:UU5rCOTeifMoulc7WMUn4KDma8txb+43P9juvrZa73ctO:UUQOJfMoulcqMUntmr7b+4V6vrU73ctO
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2512 3D6E.tmp 2272 3DEA.tmp 2708 3F13.tmp 2852 402C.tmp 2676 4135.tmp 2264 423E.tmp 2884 4318.tmp 2800 4422.tmp 2568 452B.tmp 2628 4663.tmp 740 476C.tmp 1980 4837.tmp 2920 497E.tmp 2952 4A78.tmp 2984 4B81.tmp 3012 4C4C.tmp 2116 4D46.tmp 392 4E5E.tmp 1632 5004.tmp 672 511C.tmp 304 5216.tmp 2028 5310.tmp 2788 53CB.tmp 612 5448.tmp 1852 54D4.tmp 1380 5541.tmp 1716 55CE.tmp 1468 563B.tmp 1128 56C7.tmp 1472 5763.tmp 2392 57E0.tmp 2524 586C.tmp 1232 58DA.tmp 1884 5947.tmp 1044 59C4.tmp 744 5A40.tmp 1208 5ABD.tmp 676 5B3A.tmp 1544 5BD6.tmp 1672 5C43.tmp 1660 5CC0.tmp 1100 5D2D.tmp 1060 5DAA.tmp 3060 5E27.tmp 880 5E94.tmp 1504 5F20.tmp 3020 5F7E.tmp 2240 5FEB.tmp 2428 6058.tmp 2128 60C6.tmp 2316 6142.tmp 1868 61B0.tmp 1644 621D.tmp 2492 629A.tmp 2476 6316.tmp 1608 6393.tmp 1576 6410.tmp 2440 6558.tmp 2696 65D5.tmp 2712 6651.tmp 2820 66BF.tmp 2904 673B.tmp 2848 67A9.tmp 2728 6845.tmp -
Loads dropped DLL 64 IoCs
pid Process 2476 2024-02-20_f0d989fd8fd34b57f5532f3e821b0d84_mafia.exe 2512 3D6E.tmp 2272 3DEA.tmp 2708 3F13.tmp 2852 402C.tmp 2676 4135.tmp 2264 423E.tmp 2884 4318.tmp 2800 4422.tmp 2568 452B.tmp 2628 4663.tmp 740 476C.tmp 1980 4837.tmp 2920 497E.tmp 2952 4A78.tmp 2984 4B81.tmp 3012 4C4C.tmp 2116 4D46.tmp 392 4E5E.tmp 1632 5004.tmp 672 511C.tmp 304 5216.tmp 2028 5310.tmp 2788 53CB.tmp 612 5448.tmp 1852 54D4.tmp 1380 5541.tmp 1716 55CE.tmp 1468 563B.tmp 1128 56C7.tmp 1472 5763.tmp 2392 57E0.tmp 2524 586C.tmp 1232 58DA.tmp 1884 5947.tmp 1044 59C4.tmp 744 5A40.tmp 1208 5ABD.tmp 676 5B3A.tmp 1544 5BD6.tmp 1672 5C43.tmp 1660 5CC0.tmp 1100 5D2D.tmp 1060 5DAA.tmp 3060 5E27.tmp 880 5E94.tmp 1504 5F20.tmp 3020 5F7E.tmp 2240 5FEB.tmp 2428 6058.tmp 2128 60C6.tmp 2316 6142.tmp 1868 61B0.tmp 1644 621D.tmp 2492 629A.tmp 2476 6316.tmp 1608 6393.tmp 1576 6410.tmp 2440 6558.tmp 2696 65D5.tmp 2712 6651.tmp 2820 66BF.tmp 2904 673B.tmp 2848 67A9.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2476 wrote to memory of 2512 2476 2024-02-20_f0d989fd8fd34b57f5532f3e821b0d84_mafia.exe 28 PID 2476 wrote to memory of 2512 2476 2024-02-20_f0d989fd8fd34b57f5532f3e821b0d84_mafia.exe 28 PID 2476 wrote to memory of 2512 2476 2024-02-20_f0d989fd8fd34b57f5532f3e821b0d84_mafia.exe 28 PID 2476 wrote to memory of 2512 2476 2024-02-20_f0d989fd8fd34b57f5532f3e821b0d84_mafia.exe 28 PID 2512 wrote to memory of 2272 2512 3D6E.tmp 29 PID 2512 wrote to memory of 2272 2512 3D6E.tmp 29 PID 2512 wrote to memory of 2272 2512 3D6E.tmp 29 PID 2512 wrote to memory of 2272 2512 3D6E.tmp 29 PID 2272 wrote to memory of 2708 2272 3DEA.tmp 30 PID 2272 wrote to memory of 2708 2272 3DEA.tmp 30 PID 2272 wrote to memory of 2708 2272 3DEA.tmp 30 PID 2272 wrote to memory of 2708 2272 3DEA.tmp 30 PID 2708 wrote to memory of 2852 2708 3F13.tmp 31 PID 2708 wrote to memory of 2852 2708 3F13.tmp 31 PID 2708 wrote to memory of 2852 2708 3F13.tmp 31 PID 2708 wrote to memory of 2852 2708 3F13.tmp 31 PID 2852 wrote to memory of 2676 2852 402C.tmp 32 PID 2852 wrote to memory of 2676 2852 402C.tmp 32 PID 2852 wrote to memory of 2676 2852 402C.tmp 32 PID 2852 wrote to memory of 2676 2852 402C.tmp 32 PID 2676 wrote to memory of 2264 2676 4135.tmp 33 PID 2676 wrote to memory of 2264 2676 4135.tmp 33 PID 2676 wrote to memory of 2264 2676 4135.tmp 33 PID 2676 wrote to memory of 2264 2676 4135.tmp 33 PID 2264 wrote to memory of 2884 2264 423E.tmp 34 PID 2264 wrote to memory of 2884 2264 423E.tmp 34 PID 2264 wrote to memory of 2884 2264 423E.tmp 34 PID 2264 wrote to memory of 2884 2264 423E.tmp 34 PID 2884 wrote to memory of 2800 2884 4318.tmp 35 PID 2884 wrote to memory of 2800 2884 4318.tmp 35 PID 2884 wrote to memory of 2800 2884 4318.tmp 35 PID 2884 wrote to memory of 2800 2884 4318.tmp 35 PID 2800 wrote to memory of 2568 2800 4422.tmp 36 PID 2800 wrote to memory of 2568 2800 4422.tmp 36 PID 2800 wrote to memory of 2568 2800 4422.tmp 36 PID 2800 wrote to memory of 2568 2800 4422.tmp 36 PID 2568 wrote to memory of 2628 2568 452B.tmp 37 PID 2568 wrote to memory of 2628 2568 452B.tmp 37 PID 2568 wrote to memory of 2628 2568 452B.tmp 37 PID 2568 wrote to memory of 2628 2568 452B.tmp 37 PID 2628 wrote to memory of 740 2628 4663.tmp 38 PID 2628 wrote to memory of 740 2628 4663.tmp 38 PID 2628 wrote to memory of 740 2628 4663.tmp 38 PID 2628 wrote to memory of 740 2628 4663.tmp 38 PID 740 wrote to memory of 1980 740 476C.tmp 39 PID 740 wrote to memory of 1980 740 476C.tmp 39 PID 740 wrote to memory of 1980 740 476C.tmp 39 PID 740 wrote to memory of 1980 740 476C.tmp 39 PID 1980 wrote to memory of 2920 1980 4837.tmp 40 PID 1980 wrote to memory of 2920 1980 4837.tmp 40 PID 1980 wrote to memory of 2920 1980 4837.tmp 40 PID 1980 wrote to memory of 2920 1980 4837.tmp 40 PID 2920 wrote to memory of 2952 2920 497E.tmp 41 PID 2920 wrote to memory of 2952 2920 497E.tmp 41 PID 2920 wrote to memory of 2952 2920 497E.tmp 41 PID 2920 wrote to memory of 2952 2920 497E.tmp 41 PID 2952 wrote to memory of 2984 2952 4A78.tmp 42 PID 2952 wrote to memory of 2984 2952 4A78.tmp 42 PID 2952 wrote to memory of 2984 2952 4A78.tmp 42 PID 2952 wrote to memory of 2984 2952 4A78.tmp 42 PID 2984 wrote to memory of 3012 2984 4B81.tmp 43 PID 2984 wrote to memory of 3012 2984 4B81.tmp 43 PID 2984 wrote to memory of 3012 2984 4B81.tmp 43 PID 2984 wrote to memory of 3012 2984 4B81.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-20_f0d989fd8fd34b57f5532f3e821b0d84_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-20_f0d989fd8fd34b57f5532f3e821b0d84_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\3D6E.tmp"C:\Users\Admin\AppData\Local\Temp\3D6E.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\3DEA.tmp"C:\Users\Admin\AppData\Local\Temp\3DEA.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\3F13.tmp"C:\Users\Admin\AppData\Local\Temp\3F13.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\402C.tmp"C:\Users\Admin\AppData\Local\Temp\402C.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\4135.tmp"C:\Users\Admin\AppData\Local\Temp\4135.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\423E.tmp"C:\Users\Admin\AppData\Local\Temp\423E.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\4318.tmp"C:\Users\Admin\AppData\Local\Temp\4318.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\4422.tmp"C:\Users\Admin\AppData\Local\Temp\4422.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\452B.tmp"C:\Users\Admin\AppData\Local\Temp\452B.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\4663.tmp"C:\Users\Admin\AppData\Local\Temp\4663.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\476C.tmp"C:\Users\Admin\AppData\Local\Temp\476C.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Users\Admin\AppData\Local\Temp\4837.tmp"C:\Users\Admin\AppData\Local\Temp\4837.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\497E.tmp"C:\Users\Admin\AppData\Local\Temp\497E.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\4A78.tmp"C:\Users\Admin\AppData\Local\Temp\4A78.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\4B81.tmp"C:\Users\Admin\AppData\Local\Temp\4B81.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\4C4C.tmp"C:\Users\Admin\AppData\Local\Temp\4C4C.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\4D46.tmp"C:\Users\Admin\AppData\Local\Temp\4D46.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:392 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\511C.tmp"C:\Users\Admin\AppData\Local\Temp\511C.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:672 -
C:\Users\Admin\AppData\Local\Temp\5216.tmp"C:\Users\Admin\AppData\Local\Temp\5216.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:304 -
C:\Users\Admin\AppData\Local\Temp\5310.tmp"C:\Users\Admin\AppData\Local\Temp\5310.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\53CB.tmp"C:\Users\Admin\AppData\Local\Temp\53CB.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\5448.tmp"C:\Users\Admin\AppData\Local\Temp\5448.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:612 -
C:\Users\Admin\AppData\Local\Temp\54D4.tmp"C:\Users\Admin\AppData\Local\Temp\54D4.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\5541.tmp"C:\Users\Admin\AppData\Local\Temp\5541.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\55CE.tmp"C:\Users\Admin\AppData\Local\Temp\55CE.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\563B.tmp"C:\Users\Admin\AppData\Local\Temp\563B.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\56C7.tmp"C:\Users\Admin\AppData\Local\Temp\56C7.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\5763.tmp"C:\Users\Admin\AppData\Local\Temp\5763.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\57E0.tmp"C:\Users\Admin\AppData\Local\Temp\57E0.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\586C.tmp"C:\Users\Admin\AppData\Local\Temp\586C.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\58DA.tmp"C:\Users\Admin\AppData\Local\Temp\58DA.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\5947.tmp"C:\Users\Admin\AppData\Local\Temp\5947.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\59C4.tmp"C:\Users\Admin\AppData\Local\Temp\59C4.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\5A40.tmp"C:\Users\Admin\AppData\Local\Temp\5A40.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:744 -
C:\Users\Admin\AppData\Local\Temp\5ABD.tmp"C:\Users\Admin\AppData\Local\Temp\5ABD.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\5B3A.tmp"C:\Users\Admin\AppData\Local\Temp\5B3A.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:676 -
C:\Users\Admin\AppData\Local\Temp\5BD6.tmp"C:\Users\Admin\AppData\Local\Temp\5BD6.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\5C43.tmp"C:\Users\Admin\AppData\Local\Temp\5C43.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\5CC0.tmp"C:\Users\Admin\AppData\Local\Temp\5CC0.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\5D2D.tmp"C:\Users\Admin\AppData\Local\Temp\5D2D.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\5DAA.tmp"C:\Users\Admin\AppData\Local\Temp\5DAA.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\5E27.tmp"C:\Users\Admin\AppData\Local\Temp\5E27.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\5E94.tmp"C:\Users\Admin\AppData\Local\Temp\5E94.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:880 -
C:\Users\Admin\AppData\Local\Temp\5F20.tmp"C:\Users\Admin\AppData\Local\Temp\5F20.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\5F7E.tmp"C:\Users\Admin\AppData\Local\Temp\5F7E.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\5FEB.tmp"C:\Users\Admin\AppData\Local\Temp\5FEB.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\6058.tmp"C:\Users\Admin\AppData\Local\Temp\6058.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\60C6.tmp"C:\Users\Admin\AppData\Local\Temp\60C6.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\6142.tmp"C:\Users\Admin\AppData\Local\Temp\6142.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\61B0.tmp"C:\Users\Admin\AppData\Local\Temp\61B0.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\621D.tmp"C:\Users\Admin\AppData\Local\Temp\621D.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\629A.tmp"C:\Users\Admin\AppData\Local\Temp\629A.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\6316.tmp"C:\Users\Admin\AppData\Local\Temp\6316.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\6393.tmp"C:\Users\Admin\AppData\Local\Temp\6393.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\6410.tmp"C:\Users\Admin\AppData\Local\Temp\6410.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\6558.tmp"C:\Users\Admin\AppData\Local\Temp\6558.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\65D5.tmp"C:\Users\Admin\AppData\Local\Temp\65D5.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\6651.tmp"C:\Users\Admin\AppData\Local\Temp\6651.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\66BF.tmp"C:\Users\Admin\AppData\Local\Temp\66BF.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\673B.tmp"C:\Users\Admin\AppData\Local\Temp\673B.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\67A9.tmp"C:\Users\Admin\AppData\Local\Temp\67A9.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\6845.tmp"C:\Users\Admin\AppData\Local\Temp\6845.tmp"65⤵
- Executes dropped EXE
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\68B2.tmp"C:\Users\Admin\AppData\Local\Temp\68B2.tmp"66⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\691F.tmp"C:\Users\Admin\AppData\Local\Temp\691F.tmp"67⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\699C.tmp"C:\Users\Admin\AppData\Local\Temp\699C.tmp"68⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\6A47.tmp"C:\Users\Admin\AppData\Local\Temp\6A47.tmp"69⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\6AD4.tmp"C:\Users\Admin\AppData\Local\Temp\6AD4.tmp"70⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\6B41.tmp"C:\Users\Admin\AppData\Local\Temp\6B41.tmp"71⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\6BBE.tmp"C:\Users\Admin\AppData\Local\Temp\6BBE.tmp"72⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\6C3B.tmp"C:\Users\Admin\AppData\Local\Temp\6C3B.tmp"73⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\6CB7.tmp"C:\Users\Admin\AppData\Local\Temp\6CB7.tmp"74⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\6D25.tmp"C:\Users\Admin\AppData\Local\Temp\6D25.tmp"75⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\6DA1.tmp"C:\Users\Admin\AppData\Local\Temp\6DA1.tmp"76⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\6E1E.tmp"C:\Users\Admin\AppData\Local\Temp\6E1E.tmp"77⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\6EAB.tmp"C:\Users\Admin\AppData\Local\Temp\6EAB.tmp"78⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\6F27.tmp"C:\Users\Admin\AppData\Local\Temp\6F27.tmp"79⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\6F95.tmp"C:\Users\Admin\AppData\Local\Temp\6F95.tmp"80⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\7002.tmp"C:\Users\Admin\AppData\Local\Temp\7002.tmp"81⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\706F.tmp"C:\Users\Admin\AppData\Local\Temp\706F.tmp"82⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\70FB.tmp"C:\Users\Admin\AppData\Local\Temp\70FB.tmp"83⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\7169.tmp"C:\Users\Admin\AppData\Local\Temp\7169.tmp"84⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\71D6.tmp"C:\Users\Admin\AppData\Local\Temp\71D6.tmp"85⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\7253.tmp"C:\Users\Admin\AppData\Local\Temp\7253.tmp"86⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\72CF.tmp"C:\Users\Admin\AppData\Local\Temp\72CF.tmp"87⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\732D.tmp"C:\Users\Admin\AppData\Local\Temp\732D.tmp"88⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\739A.tmp"C:\Users\Admin\AppData\Local\Temp\739A.tmp"89⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\7427.tmp"C:\Users\Admin\AppData\Local\Temp\7427.tmp"90⤵PID:304
-
C:\Users\Admin\AppData\Local\Temp\74A3.tmp"C:\Users\Admin\AppData\Local\Temp\74A3.tmp"91⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\7530.tmp"C:\Users\Admin\AppData\Local\Temp\7530.tmp"92⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\759D.tmp"C:\Users\Admin\AppData\Local\Temp\759D.tmp"93⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"94⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\76B6.tmp"C:\Users\Admin\AppData\Local\Temp\76B6.tmp"95⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\7742.tmp"C:\Users\Admin\AppData\Local\Temp\7742.tmp"96⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\77BF.tmp"C:\Users\Admin\AppData\Local\Temp\77BF.tmp"97⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\784B.tmp"C:\Users\Admin\AppData\Local\Temp\784B.tmp"98⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\78B9.tmp"C:\Users\Admin\AppData\Local\Temp\78B9.tmp"99⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\7935.tmp"C:\Users\Admin\AppData\Local\Temp\7935.tmp"100⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\79E1.tmp"C:\Users\Admin\AppData\Local\Temp\79E1.tmp"101⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\7A5E.tmp"C:\Users\Admin\AppData\Local\Temp\7A5E.tmp"102⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\7ADB.tmp"C:\Users\Admin\AppData\Local\Temp\7ADB.tmp"103⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\7B57.tmp"C:\Users\Admin\AppData\Local\Temp\7B57.tmp"104⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\7BE4.tmp"C:\Users\Admin\AppData\Local\Temp\7BE4.tmp"105⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\7C70.tmp"C:\Users\Admin\AppData\Local\Temp\7C70.tmp"106⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\7CDD.tmp"C:\Users\Admin\AppData\Local\Temp\7CDD.tmp"107⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\7D4B.tmp"C:\Users\Admin\AppData\Local\Temp\7D4B.tmp"108⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\7DC7.tmp"C:\Users\Admin\AppData\Local\Temp\7DC7.tmp"109⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\7E44.tmp"C:\Users\Admin\AppData\Local\Temp\7E44.tmp"110⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\7EA2.tmp"C:\Users\Admin\AppData\Local\Temp\7EA2.tmp"111⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\7F0F.tmp"C:\Users\Admin\AppData\Local\Temp\7F0F.tmp"112⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\7F7C.tmp"C:\Users\Admin\AppData\Local\Temp\7F7C.tmp"113⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\7FF9.tmp"C:\Users\Admin\AppData\Local\Temp\7FF9.tmp"114⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\8066.tmp"C:\Users\Admin\AppData\Local\Temp\8066.tmp"115⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\80E3.tmp"C:\Users\Admin\AppData\Local\Temp\80E3.tmp"116⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\8141.tmp"C:\Users\Admin\AppData\Local\Temp\8141.tmp"117⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\81DD.tmp"C:\Users\Admin\AppData\Local\Temp\81DD.tmp"118⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\823A.tmp"C:\Users\Admin\AppData\Local\Temp\823A.tmp"119⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\82A7.tmp"C:\Users\Admin\AppData\Local\Temp\82A7.tmp"120⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\8315.tmp"C:\Users\Admin\AppData\Local\Temp\8315.tmp"121⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\8382.tmp"C:\Users\Admin\AppData\Local\Temp\8382.tmp"122⤵PID:2212
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-