Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11-04-2024 16:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-11_8aaee44445876f855a35c09b67b55101_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-11_8aaee44445876f855a35c09b67b55101_mafia.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-04-11_8aaee44445876f855a35c09b67b55101_mafia.exe
-
Size
488KB
-
MD5
8aaee44445876f855a35c09b67b55101
-
SHA1
5ef36cb006821c6134f13c5e7849bf329ce371ca
-
SHA256
b0792f65b8490484206ce11b4b3d7e5d5b577e468c7b22186b6f5ced09d376f1
-
SHA512
6077b0dd083f400bed749d34a26aae14bb34474adb173e8f3dc5448255f4ca21fe56907b028e732aa6bebce5ab5a02fd0f9680e8494aec83dd51a3cfc7a6ee1b
-
SSDEEP
12288:/U5rCOTeiD6+p3/zCVgMfoULiUYxVTlNZ:/UQOJDJPAgMoUY5N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2664 74C3.tmp 2504 75CC.tmp 2596 7723.tmp 2548 780D.tmp 2644 78F7.tmp 2636 79E1.tmp 2700 7AFA.tmp 2508 7B96.tmp 2440 7C61.tmp 2448 7D1C.tmp 2380 7E06.tmp 584 7EE0.tmp 1208 7F4D.tmp 932 8009.tmp 2688 80E3.tmp 2828 817F.tmp 2060 81FC.tmp 1624 82F5.tmp 1960 83DF.tmp 1104 846C.tmp 1968 8565.tmp 1784 87D5.tmp 1096 88A0.tmp 1408 892D.tmp 1424 899A.tmp 1396 8A17.tmp 2056 8A84.tmp 1056 8B01.tmp 2152 8B7D.tmp 2756 8BFA.tmp 2116 8C87.tmp 3052 8D03.tmp 2944 8D71.tmp 608 8DBF.tmp 2940 8E2C.tmp 780 8EB8.tmp 1528 8F25.tmp 700 8FA2.tmp 1460 901F.tmp 2140 909C.tmp 1928 9109.tmp 1820 9195.tmp 2900 9203.tmp 1640 9270.tmp 636 92CD.tmp 708 933B.tmp 1720 93A8.tmp 2860 9425.tmp 2120 94A1.tmp 692 950F.tmp 2800 958B.tmp 1896 95F9.tmp 2952 9647.tmp 2276 96A4.tmp 1688 9721.tmp 2812 978E.tmp 2488 980B.tmp 2604 9888.tmp 2616 98F5.tmp 2584 9962.tmp 1136 99B0.tmp 1700 9A1D.tmp 2612 9A8B.tmp 2528 9AF8.tmp -
Loads dropped DLL 64 IoCs
pid Process 2012 2024-04-11_8aaee44445876f855a35c09b67b55101_mafia.exe 2664 74C3.tmp 2504 75CC.tmp 2596 7723.tmp 2548 780D.tmp 2644 78F7.tmp 2636 79E1.tmp 2700 7AFA.tmp 2508 7B96.tmp 2440 7C61.tmp 2448 7D1C.tmp 2380 7E06.tmp 584 7EE0.tmp 1208 7F4D.tmp 932 8009.tmp 2688 80E3.tmp 2828 817F.tmp 2060 81FC.tmp 1624 82F5.tmp 1960 83DF.tmp 1104 846C.tmp 1968 8565.tmp 1784 87D5.tmp 1096 88A0.tmp 1408 892D.tmp 1424 899A.tmp 1396 8A17.tmp 2056 8A84.tmp 1056 8B01.tmp 2152 8B7D.tmp 2756 8BFA.tmp 2116 8C87.tmp 3052 8D03.tmp 2944 8D71.tmp 608 8DBF.tmp 2940 8E2C.tmp 780 8EB8.tmp 1528 8F25.tmp 700 8FA2.tmp 1460 901F.tmp 2140 909C.tmp 1928 9109.tmp 1820 9195.tmp 2900 9203.tmp 1640 9270.tmp 636 92CD.tmp 708 933B.tmp 1720 93A8.tmp 2860 9425.tmp 2120 94A1.tmp 692 950F.tmp 2800 958B.tmp 1896 95F9.tmp 2952 9647.tmp 2276 96A4.tmp 1688 9721.tmp 2812 978E.tmp 2488 980B.tmp 2604 9888.tmp 2616 98F5.tmp 2584 9962.tmp 1136 99B0.tmp 1700 9A1D.tmp 2612 9A8B.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2012 wrote to memory of 2664 2012 2024-04-11_8aaee44445876f855a35c09b67b55101_mafia.exe 28 PID 2012 wrote to memory of 2664 2012 2024-04-11_8aaee44445876f855a35c09b67b55101_mafia.exe 28 PID 2012 wrote to memory of 2664 2012 2024-04-11_8aaee44445876f855a35c09b67b55101_mafia.exe 28 PID 2012 wrote to memory of 2664 2012 2024-04-11_8aaee44445876f855a35c09b67b55101_mafia.exe 28 PID 2664 wrote to memory of 2504 2664 74C3.tmp 29 PID 2664 wrote to memory of 2504 2664 74C3.tmp 29 PID 2664 wrote to memory of 2504 2664 74C3.tmp 29 PID 2664 wrote to memory of 2504 2664 74C3.tmp 29 PID 2504 wrote to memory of 2596 2504 75CC.tmp 30 PID 2504 wrote to memory of 2596 2504 75CC.tmp 30 PID 2504 wrote to memory of 2596 2504 75CC.tmp 30 PID 2504 wrote to memory of 2596 2504 75CC.tmp 30 PID 2596 wrote to memory of 2548 2596 7723.tmp 31 PID 2596 wrote to memory of 2548 2596 7723.tmp 31 PID 2596 wrote to memory of 2548 2596 7723.tmp 31 PID 2596 wrote to memory of 2548 2596 7723.tmp 31 PID 2548 wrote to memory of 2644 2548 780D.tmp 32 PID 2548 wrote to memory of 2644 2548 780D.tmp 32 PID 2548 wrote to memory of 2644 2548 780D.tmp 32 PID 2548 wrote to memory of 2644 2548 780D.tmp 32 PID 2644 wrote to memory of 2636 2644 78F7.tmp 33 PID 2644 wrote to memory of 2636 2644 78F7.tmp 33 PID 2644 wrote to memory of 2636 2644 78F7.tmp 33 PID 2644 wrote to memory of 2636 2644 78F7.tmp 33 PID 2636 wrote to memory of 2700 2636 79E1.tmp 34 PID 2636 wrote to memory of 2700 2636 79E1.tmp 34 PID 2636 wrote to memory of 2700 2636 79E1.tmp 34 PID 2636 wrote to memory of 2700 2636 79E1.tmp 34 PID 2700 wrote to memory of 2508 2700 7AFA.tmp 35 PID 2700 wrote to memory of 2508 2700 7AFA.tmp 35 PID 2700 wrote to memory of 2508 2700 7AFA.tmp 35 PID 2700 wrote to memory of 2508 2700 7AFA.tmp 35 PID 2508 wrote to memory of 2440 2508 7B96.tmp 36 PID 2508 wrote to memory of 2440 2508 7B96.tmp 36 PID 2508 wrote to memory of 2440 2508 7B96.tmp 36 PID 2508 wrote to memory of 2440 2508 7B96.tmp 36 PID 2440 wrote to memory of 2448 2440 7C61.tmp 37 PID 2440 wrote to memory of 2448 2440 7C61.tmp 37 PID 2440 wrote to memory of 2448 2440 7C61.tmp 37 PID 2440 wrote to memory of 2448 2440 7C61.tmp 37 PID 2448 wrote to memory of 2380 2448 7D1C.tmp 38 PID 2448 wrote to memory of 2380 2448 7D1C.tmp 38 PID 2448 wrote to memory of 2380 2448 7D1C.tmp 38 PID 2448 wrote to memory of 2380 2448 7D1C.tmp 38 PID 2380 wrote to memory of 584 2380 7E06.tmp 39 PID 2380 wrote to memory of 584 2380 7E06.tmp 39 PID 2380 wrote to memory of 584 2380 7E06.tmp 39 PID 2380 wrote to memory of 584 2380 7E06.tmp 39 PID 584 wrote to memory of 1208 584 7EE0.tmp 40 PID 584 wrote to memory of 1208 584 7EE0.tmp 40 PID 584 wrote to memory of 1208 584 7EE0.tmp 40 PID 584 wrote to memory of 1208 584 7EE0.tmp 40 PID 1208 wrote to memory of 932 1208 7F4D.tmp 41 PID 1208 wrote to memory of 932 1208 7F4D.tmp 41 PID 1208 wrote to memory of 932 1208 7F4D.tmp 41 PID 1208 wrote to memory of 932 1208 7F4D.tmp 41 PID 932 wrote to memory of 2688 932 8009.tmp 42 PID 932 wrote to memory of 2688 932 8009.tmp 42 PID 932 wrote to memory of 2688 932 8009.tmp 42 PID 932 wrote to memory of 2688 932 8009.tmp 42 PID 2688 wrote to memory of 2828 2688 80E3.tmp 43 PID 2688 wrote to memory of 2828 2688 80E3.tmp 43 PID 2688 wrote to memory of 2828 2688 80E3.tmp 43 PID 2688 wrote to memory of 2828 2688 80E3.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-11_8aaee44445876f855a35c09b67b55101_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-11_8aaee44445876f855a35c09b67b55101_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\74C3.tmp"C:\Users\Admin\AppData\Local\Temp\74C3.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\75CC.tmp"C:\Users\Admin\AppData\Local\Temp\75CC.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\7723.tmp"C:\Users\Admin\AppData\Local\Temp\7723.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\780D.tmp"C:\Users\Admin\AppData\Local\Temp\780D.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\78F7.tmp"C:\Users\Admin\AppData\Local\Temp\78F7.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\79E1.tmp"C:\Users\Admin\AppData\Local\Temp\79E1.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\7AFA.tmp"C:\Users\Admin\AppData\Local\Temp\7AFA.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\7B96.tmp"C:\Users\Admin\AppData\Local\Temp\7B96.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\7C61.tmp"C:\Users\Admin\AppData\Local\Temp\7C61.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\7D1C.tmp"C:\Users\Admin\AppData\Local\Temp\7D1C.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\7E06.tmp"C:\Users\Admin\AppData\Local\Temp\7E06.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\7EE0.tmp"C:\Users\Admin\AppData\Local\Temp\7EE0.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:584 -
C:\Users\Admin\AppData\Local\Temp\7F4D.tmp"C:\Users\Admin\AppData\Local\Temp\7F4D.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\8009.tmp"C:\Users\Admin\AppData\Local\Temp\8009.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Users\Admin\AppData\Local\Temp\80E3.tmp"C:\Users\Admin\AppData\Local\Temp\80E3.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\817F.tmp"C:\Users\Admin\AppData\Local\Temp\817F.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\81FC.tmp"C:\Users\Admin\AppData\Local\Temp\81FC.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\82F5.tmp"C:\Users\Admin\AppData\Local\Temp\82F5.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\83DF.tmp"C:\Users\Admin\AppData\Local\Temp\83DF.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\846C.tmp"C:\Users\Admin\AppData\Local\Temp\846C.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\8565.tmp"C:\Users\Admin\AppData\Local\Temp\8565.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\87D5.tmp"C:\Users\Admin\AppData\Local\Temp\87D5.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\88A0.tmp"C:\Users\Admin\AppData\Local\Temp\88A0.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\892D.tmp"C:\Users\Admin\AppData\Local\Temp\892D.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\899A.tmp"C:\Users\Admin\AppData\Local\Temp\899A.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\8A17.tmp"C:\Users\Admin\AppData\Local\Temp\8A17.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\8A84.tmp"C:\Users\Admin\AppData\Local\Temp\8A84.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\8B01.tmp"C:\Users\Admin\AppData\Local\Temp\8B01.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\8C87.tmp"C:\Users\Admin\AppData\Local\Temp\8C87.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\8D03.tmp"C:\Users\Admin\AppData\Local\Temp\8D03.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\8D71.tmp"C:\Users\Admin\AppData\Local\Temp\8D71.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\8DBF.tmp"C:\Users\Admin\AppData\Local\Temp\8DBF.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:608 -
C:\Users\Admin\AppData\Local\Temp\8E2C.tmp"C:\Users\Admin\AppData\Local\Temp\8E2C.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\8EB8.tmp"C:\Users\Admin\AppData\Local\Temp\8EB8.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:780 -
C:\Users\Admin\AppData\Local\Temp\8F25.tmp"C:\Users\Admin\AppData\Local\Temp\8F25.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\8FA2.tmp"C:\Users\Admin\AppData\Local\Temp\8FA2.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:700 -
C:\Users\Admin\AppData\Local\Temp\901F.tmp"C:\Users\Admin\AppData\Local\Temp\901F.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\909C.tmp"C:\Users\Admin\AppData\Local\Temp\909C.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\9109.tmp"C:\Users\Admin\AppData\Local\Temp\9109.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\9195.tmp"C:\Users\Admin\AppData\Local\Temp\9195.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\9203.tmp"C:\Users\Admin\AppData\Local\Temp\9203.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\9270.tmp"C:\Users\Admin\AppData\Local\Temp\9270.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\92CD.tmp"C:\Users\Admin\AppData\Local\Temp\92CD.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:636 -
C:\Users\Admin\AppData\Local\Temp\933B.tmp"C:\Users\Admin\AppData\Local\Temp\933B.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:708 -
C:\Users\Admin\AppData\Local\Temp\93A8.tmp"C:\Users\Admin\AppData\Local\Temp\93A8.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\9425.tmp"C:\Users\Admin\AppData\Local\Temp\9425.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\94A1.tmp"C:\Users\Admin\AppData\Local\Temp\94A1.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\950F.tmp"C:\Users\Admin\AppData\Local\Temp\950F.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:692 -
C:\Users\Admin\AppData\Local\Temp\958B.tmp"C:\Users\Admin\AppData\Local\Temp\958B.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\95F9.tmp"C:\Users\Admin\AppData\Local\Temp\95F9.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\9647.tmp"C:\Users\Admin\AppData\Local\Temp\9647.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\96A4.tmp"C:\Users\Admin\AppData\Local\Temp\96A4.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\9721.tmp"C:\Users\Admin\AppData\Local\Temp\9721.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\978E.tmp"C:\Users\Admin\AppData\Local\Temp\978E.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\980B.tmp"C:\Users\Admin\AppData\Local\Temp\980B.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\9888.tmp"C:\Users\Admin\AppData\Local\Temp\9888.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\98F5.tmp"C:\Users\Admin\AppData\Local\Temp\98F5.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\9962.tmp"C:\Users\Admin\AppData\Local\Temp\9962.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\99B0.tmp"C:\Users\Admin\AppData\Local\Temp\99B0.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\9A8B.tmp"C:\Users\Admin\AppData\Local\Temp\9A8B.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"65⤵
- Executes dropped EXE
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\9B65.tmp"C:\Users\Admin\AppData\Local\Temp\9B65.tmp"66⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\9C9D.tmp"C:\Users\Admin\AppData\Local\Temp\9C9D.tmp"67⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\9D97.tmp"C:\Users\Admin\AppData\Local\Temp\9D97.tmp"68⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\9E04.tmp"C:\Users\Admin\AppData\Local\Temp\9E04.tmp"69⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\9E71.tmp"C:\Users\Admin\AppData\Local\Temp\9E71.tmp"70⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\9EDE.tmp"C:\Users\Admin\AppData\Local\Temp\9EDE.tmp"71⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\9F4B.tmp"C:\Users\Admin\AppData\Local\Temp\9F4B.tmp"72⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\9FB9.tmp"C:\Users\Admin\AppData\Local\Temp\9FB9.tmp"73⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\A026.tmp"C:\Users\Admin\AppData\Local\Temp\A026.tmp"74⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\A0B2.tmp"C:\Users\Admin\AppData\Local\Temp\A0B2.tmp"75⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\A110.tmp"C:\Users\Admin\AppData\Local\Temp\A110.tmp"76⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\A19C.tmp"C:\Users\Admin\AppData\Local\Temp\A19C.tmp"77⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\A209.tmp"C:\Users\Admin\AppData\Local\Temp\A209.tmp"78⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\A296.tmp"C:\Users\Admin\AppData\Local\Temp\A296.tmp"79⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\A303.tmp"C:\Users\Admin\AppData\Local\Temp\A303.tmp"80⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\A370.tmp"C:\Users\Admin\AppData\Local\Temp\A370.tmp"81⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\A3DD.tmp"C:\Users\Admin\AppData\Local\Temp\A3DD.tmp"82⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\A45A.tmp"C:\Users\Admin\AppData\Local\Temp\A45A.tmp"83⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\A4D7.tmp"C:\Users\Admin\AppData\Local\Temp\A4D7.tmp"84⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\A544.tmp"C:\Users\Admin\AppData\Local\Temp\A544.tmp"85⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\A5B1.tmp"C:\Users\Admin\AppData\Local\Temp\A5B1.tmp"86⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\A60F.tmp"C:\Users\Admin\AppData\Local\Temp\A60F.tmp"87⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\A68C.tmp"C:\Users\Admin\AppData\Local\Temp\A68C.tmp"88⤵PID:296
-
C:\Users\Admin\AppData\Local\Temp\A718.tmp"C:\Users\Admin\AppData\Local\Temp\A718.tmp"89⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\A776.tmp"C:\Users\Admin\AppData\Local\Temp\A776.tmp"90⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\A7E3.tmp"C:\Users\Admin\AppData\Local\Temp\A7E3.tmp"91⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\A860.tmp"C:\Users\Admin\AppData\Local\Temp\A860.tmp"92⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\A8DD.tmp"C:\Users\Admin\AppData\Local\Temp\A8DD.tmp"93⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\A959.tmp"C:\Users\Admin\AppData\Local\Temp\A959.tmp"94⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\A9D6.tmp"C:\Users\Admin\AppData\Local\Temp\A9D6.tmp"95⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\AA43.tmp"C:\Users\Admin\AppData\Local\Temp\AA43.tmp"96⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\AAB1.tmp"C:\Users\Admin\AppData\Local\Temp\AAB1.tmp"97⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\AB1E.tmp"C:\Users\Admin\AppData\Local\Temp\AB1E.tmp"98⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\AB8B.tmp"C:\Users\Admin\AppData\Local\Temp\AB8B.tmp"99⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\ABF8.tmp"C:\Users\Admin\AppData\Local\Temp\ABF8.tmp"100⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\AC56.tmp"C:\Users\Admin\AppData\Local\Temp\AC56.tmp"101⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\ACC3.tmp"C:\Users\Admin\AppData\Local\Temp\ACC3.tmp"102⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\AD40.tmp"C:\Users\Admin\AppData\Local\Temp\AD40.tmp"103⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\ADAD.tmp"C:\Users\Admin\AppData\Local\Temp\ADAD.tmp"104⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\AE2A.tmp"C:\Users\Admin\AppData\Local\Temp\AE2A.tmp"105⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\AE97.tmp"C:\Users\Admin\AppData\Local\Temp\AE97.tmp"106⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\AF14.tmp"C:\Users\Admin\AppData\Local\Temp\AF14.tmp"107⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\AF81.tmp"C:\Users\Admin\AppData\Local\Temp\AF81.tmp"108⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\AFDF.tmp"C:\Users\Admin\AppData\Local\Temp\AFDF.tmp"109⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\B02D.tmp"C:\Users\Admin\AppData\Local\Temp\B02D.tmp"110⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\B08A.tmp"C:\Users\Admin\AppData\Local\Temp\B08A.tmp"111⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\B0E8.tmp"C:\Users\Admin\AppData\Local\Temp\B0E8.tmp"112⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\B1C2.tmp"C:\Users\Admin\AppData\Local\Temp\B1C2.tmp"113⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\B220.tmp"C:\Users\Admin\AppData\Local\Temp\B220.tmp"114⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\B29D.tmp"C:\Users\Admin\AppData\Local\Temp\B29D.tmp"115⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\B30A.tmp"C:\Users\Admin\AppData\Local\Temp\B30A.tmp"116⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\B387.tmp"C:\Users\Admin\AppData\Local\Temp\B387.tmp"117⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\B403.tmp"C:\Users\Admin\AppData\Local\Temp\B403.tmp"118⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\B461.tmp"C:\Users\Admin\AppData\Local\Temp\B461.tmp"119⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\B4CE.tmp"C:\Users\Admin\AppData\Local\Temp\B4CE.tmp"120⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\B52C.tmp"C:\Users\Admin\AppData\Local\Temp\B52C.tmp"121⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\B589.tmp"C:\Users\Admin\AppData\Local\Temp\B589.tmp"122⤵PID:1012
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-