Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
21/04/2024, 11:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-21_59828092eeae366356ccd399bd15c1af_mafia.exe
Resource
win7-20240215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-21_59828092eeae366356ccd399bd15c1af_mafia.exe
Resource
win10v2004-20240412-en
2 signatures
150 seconds
General
-
Target
2024-04-21_59828092eeae366356ccd399bd15c1af_mafia.exe
-
Size
486KB
-
MD5
59828092eeae366356ccd399bd15c1af
-
SHA1
2a6c1b3d86bcc35fcf3b0691add2840ee14fc77d
-
SHA256
c5fc53c41b4d23fc5f41a080fdf1203ef745164c18bf073c56c4e0319035e927
-
SHA512
5f11971a7d3bf4b1cf387e944db3cba14a7bfe724f3e89ca99315dc5fa0059fae4baaec97d493c11e7cf2068fe88c608e70d566d2e3e94021bbee4fb0827476f
-
SSDEEP
12288:/U5rCOTeiDaMrLzOfQWHBBA7tWZZbqzuyY:/UQOJD5LzOfzHjAIZbZd
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3032 F4C.tmp 2640 F9A.tmp 2596 1008.tmp 2652 1065.tmp 3008 10C3.tmp 2708 1101.tmp 2572 115F.tmp 2480 11BC.tmp 1044 122A.tmp 2472 1278.tmp 2576 12D5.tmp 2924 1323.tmp 2776 1362.tmp 2632 13B0.tmp 2936 13FE.tmp 1112 144C.tmp 2004 14A9.tmp 1068 1516.tmp 824 1584.tmp 1072 15F1.tmp 2696 164E.tmp 2260 16AC.tmp 1604 16FA.tmp 2284 1748.tmp 1580 1786.tmp 2308 17D4.tmp 2852 1813.tmp 2216 1851.tmp 2636 189F.tmp 2040 18DE.tmp 608 191C.tmp 564 196A.tmp 1056 19A8.tmp 976 19E7.tmp 1824 1A25.tmp 1348 1A64.tmp 1368 1AB2.tmp 452 1AF0.tmp 2296 1B2E.tmp 1664 1B6D.tmp 1796 1BAB.tmp 2176 1BEA.tmp 1424 1C28.tmp 1048 1C76.tmp 1688 1CB4.tmp 1036 1D02.tmp 2224 1D41.tmp 2884 1D7F.tmp 1312 1DBE.tmp 2896 1DFC.tmp 2820 1E3A.tmp 1720 1E79.tmp 912 1EB7.tmp 2536 1EF6.tmp 1624 1F44.tmp 1732 1F82.tmp 3000 1FC0.tmp 2096 1FFF.tmp 2992 203D.tmp 2084 207C.tmp 2564 20CA.tmp 2680 2108.tmp 2580 2156.tmp 3008 2194.tmp -
Loads dropped DLL 64 IoCs
pid Process 3000 2024-04-21_59828092eeae366356ccd399bd15c1af_mafia.exe 3032 F4C.tmp 2640 F9A.tmp 2596 1008.tmp 2652 1065.tmp 3008 10C3.tmp 2708 1101.tmp 2572 115F.tmp 2480 11BC.tmp 1044 122A.tmp 2472 1278.tmp 2576 12D5.tmp 2924 1323.tmp 2776 1362.tmp 2632 13B0.tmp 2936 13FE.tmp 1112 144C.tmp 2004 14A9.tmp 1068 1516.tmp 824 1584.tmp 1072 15F1.tmp 2696 164E.tmp 2260 16AC.tmp 1604 16FA.tmp 2284 1748.tmp 1580 1786.tmp 2308 17D4.tmp 2852 1813.tmp 2216 1851.tmp 2636 189F.tmp 2040 18DE.tmp 608 191C.tmp 564 196A.tmp 1056 19A8.tmp 976 19E7.tmp 1824 1A25.tmp 1348 1A64.tmp 1368 1AB2.tmp 452 1AF0.tmp 2296 1B2E.tmp 1664 1B6D.tmp 1796 1BAB.tmp 2176 1BEA.tmp 1424 1C28.tmp 1048 1C76.tmp 1688 1CB4.tmp 1036 1D02.tmp 2224 1D41.tmp 2884 1D7F.tmp 1312 1DBE.tmp 2896 1DFC.tmp 2820 1E3A.tmp 1720 1E79.tmp 912 1EB7.tmp 2536 1EF6.tmp 1624 1F44.tmp 1732 1F82.tmp 3000 1FC0.tmp 2096 1FFF.tmp 2992 203D.tmp 2084 207C.tmp 2564 20CA.tmp 2680 2108.tmp 2580 2156.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3000 wrote to memory of 3032 3000 2024-04-21_59828092eeae366356ccd399bd15c1af_mafia.exe 28 PID 3000 wrote to memory of 3032 3000 2024-04-21_59828092eeae366356ccd399bd15c1af_mafia.exe 28 PID 3000 wrote to memory of 3032 3000 2024-04-21_59828092eeae366356ccd399bd15c1af_mafia.exe 28 PID 3000 wrote to memory of 3032 3000 2024-04-21_59828092eeae366356ccd399bd15c1af_mafia.exe 28 PID 3032 wrote to memory of 2640 3032 F4C.tmp 29 PID 3032 wrote to memory of 2640 3032 F4C.tmp 29 PID 3032 wrote to memory of 2640 3032 F4C.tmp 29 PID 3032 wrote to memory of 2640 3032 F4C.tmp 29 PID 2640 wrote to memory of 2596 2640 F9A.tmp 30 PID 2640 wrote to memory of 2596 2640 F9A.tmp 30 PID 2640 wrote to memory of 2596 2640 F9A.tmp 30 PID 2640 wrote to memory of 2596 2640 F9A.tmp 30 PID 2596 wrote to memory of 2652 2596 1008.tmp 31 PID 2596 wrote to memory of 2652 2596 1008.tmp 31 PID 2596 wrote to memory of 2652 2596 1008.tmp 31 PID 2596 wrote to memory of 2652 2596 1008.tmp 31 PID 2652 wrote to memory of 3008 2652 1065.tmp 32 PID 2652 wrote to memory of 3008 2652 1065.tmp 32 PID 2652 wrote to memory of 3008 2652 1065.tmp 32 PID 2652 wrote to memory of 3008 2652 1065.tmp 32 PID 3008 wrote to memory of 2708 3008 10C3.tmp 33 PID 3008 wrote to memory of 2708 3008 10C3.tmp 33 PID 3008 wrote to memory of 2708 3008 10C3.tmp 33 PID 3008 wrote to memory of 2708 3008 10C3.tmp 33 PID 2708 wrote to memory of 2572 2708 1101.tmp 34 PID 2708 wrote to memory of 2572 2708 1101.tmp 34 PID 2708 wrote to memory of 2572 2708 1101.tmp 34 PID 2708 wrote to memory of 2572 2708 1101.tmp 34 PID 2572 wrote to memory of 2480 2572 115F.tmp 35 PID 2572 wrote to memory of 2480 2572 115F.tmp 35 PID 2572 wrote to memory of 2480 2572 115F.tmp 35 PID 2572 wrote to memory of 2480 2572 115F.tmp 35 PID 2480 wrote to memory of 1044 2480 11BC.tmp 36 PID 2480 wrote to memory of 1044 2480 11BC.tmp 36 PID 2480 wrote to memory of 1044 2480 11BC.tmp 36 PID 2480 wrote to memory of 1044 2480 11BC.tmp 36 PID 1044 wrote to memory of 2472 1044 122A.tmp 37 PID 1044 wrote to memory of 2472 1044 122A.tmp 37 PID 1044 wrote to memory of 2472 1044 122A.tmp 37 PID 1044 wrote to memory of 2472 1044 122A.tmp 37 PID 2472 wrote to memory of 2576 2472 1278.tmp 38 PID 2472 wrote to memory of 2576 2472 1278.tmp 38 PID 2472 wrote to memory of 2576 2472 1278.tmp 38 PID 2472 wrote to memory of 2576 2472 1278.tmp 38 PID 2576 wrote to memory of 2924 2576 12D5.tmp 39 PID 2576 wrote to memory of 2924 2576 12D5.tmp 39 PID 2576 wrote to memory of 2924 2576 12D5.tmp 39 PID 2576 wrote to memory of 2924 2576 12D5.tmp 39 PID 2924 wrote to memory of 2776 2924 1323.tmp 40 PID 2924 wrote to memory of 2776 2924 1323.tmp 40 PID 2924 wrote to memory of 2776 2924 1323.tmp 40 PID 2924 wrote to memory of 2776 2924 1323.tmp 40 PID 2776 wrote to memory of 2632 2776 1362.tmp 41 PID 2776 wrote to memory of 2632 2776 1362.tmp 41 PID 2776 wrote to memory of 2632 2776 1362.tmp 41 PID 2776 wrote to memory of 2632 2776 1362.tmp 41 PID 2632 wrote to memory of 2936 2632 13B0.tmp 42 PID 2632 wrote to memory of 2936 2632 13B0.tmp 42 PID 2632 wrote to memory of 2936 2632 13B0.tmp 42 PID 2632 wrote to memory of 2936 2632 13B0.tmp 42 PID 2936 wrote to memory of 1112 2936 13FE.tmp 43 PID 2936 wrote to memory of 1112 2936 13FE.tmp 43 PID 2936 wrote to memory of 1112 2936 13FE.tmp 43 PID 2936 wrote to memory of 1112 2936 13FE.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-21_59828092eeae366356ccd399bd15c1af_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-21_59828092eeae366356ccd399bd15c1af_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\F4C.tmp"C:\Users\Admin\AppData\Local\Temp\F4C.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\F9A.tmp"C:\Users\Admin\AppData\Local\Temp\F9A.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\1008.tmp"C:\Users\Admin\AppData\Local\Temp\1008.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\1065.tmp"C:\Users\Admin\AppData\Local\Temp\1065.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\10C3.tmp"C:\Users\Admin\AppData\Local\Temp\10C3.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\1101.tmp"C:\Users\Admin\AppData\Local\Temp\1101.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\115F.tmp"C:\Users\Admin\AppData\Local\Temp\115F.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\11BC.tmp"C:\Users\Admin\AppData\Local\Temp\11BC.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\122A.tmp"C:\Users\Admin\AppData\Local\Temp\122A.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\1278.tmp"C:\Users\Admin\AppData\Local\Temp\1278.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\12D5.tmp"C:\Users\Admin\AppData\Local\Temp\12D5.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\1323.tmp"C:\Users\Admin\AppData\Local\Temp\1323.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\1362.tmp"C:\Users\Admin\AppData\Local\Temp\1362.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\13B0.tmp"C:\Users\Admin\AppData\Local\Temp\13B0.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\13FE.tmp"C:\Users\Admin\AppData\Local\Temp\13FE.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\144C.tmp"C:\Users\Admin\AppData\Local\Temp\144C.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\14A9.tmp"C:\Users\Admin\AppData\Local\Temp\14A9.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\1516.tmp"C:\Users\Admin\AppData\Local\Temp\1516.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\1584.tmp"C:\Users\Admin\AppData\Local\Temp\1584.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:824 -
C:\Users\Admin\AppData\Local\Temp\15F1.tmp"C:\Users\Admin\AppData\Local\Temp\15F1.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\164E.tmp"C:\Users\Admin\AppData\Local\Temp\164E.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\16AC.tmp"C:\Users\Admin\AppData\Local\Temp\16AC.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\16FA.tmp"C:\Users\Admin\AppData\Local\Temp\16FA.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\1748.tmp"C:\Users\Admin\AppData\Local\Temp\1748.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\1786.tmp"C:\Users\Admin\AppData\Local\Temp\1786.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\17D4.tmp"C:\Users\Admin\AppData\Local\Temp\17D4.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\1813.tmp"C:\Users\Admin\AppData\Local\Temp\1813.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\1851.tmp"C:\Users\Admin\AppData\Local\Temp\1851.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\189F.tmp"C:\Users\Admin\AppData\Local\Temp\189F.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\18DE.tmp"C:\Users\Admin\AppData\Local\Temp\18DE.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\191C.tmp"C:\Users\Admin\AppData\Local\Temp\191C.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:608 -
C:\Users\Admin\AppData\Local\Temp\196A.tmp"C:\Users\Admin\AppData\Local\Temp\196A.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:564 -
C:\Users\Admin\AppData\Local\Temp\19A8.tmp"C:\Users\Admin\AppData\Local\Temp\19A8.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\19E7.tmp"C:\Users\Admin\AppData\Local\Temp\19E7.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:976 -
C:\Users\Admin\AppData\Local\Temp\1A25.tmp"C:\Users\Admin\AppData\Local\Temp\1A25.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\1A64.tmp"C:\Users\Admin\AppData\Local\Temp\1A64.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:452 -
C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\1B6D.tmp"C:\Users\Admin\AppData\Local\Temp\1B6D.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\1BEA.tmp"C:\Users\Admin\AppData\Local\Temp\1BEA.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\1C28.tmp"C:\Users\Admin\AppData\Local\Temp\1C28.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\1C76.tmp"C:\Users\Admin\AppData\Local\Temp\1C76.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\1CB4.tmp"C:\Users\Admin\AppData\Local\Temp\1CB4.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\1D02.tmp"C:\Users\Admin\AppData\Local\Temp\1D02.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\1D41.tmp"C:\Users\Admin\AppData\Local\Temp\1D41.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\1E79.tmp"C:\Users\Admin\AppData\Local\Temp\1E79.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:912 -
C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\1F44.tmp"C:\Users\Admin\AppData\Local\Temp\1F44.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\1F82.tmp"C:\Users\Admin\AppData\Local\Temp\1F82.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\203D.tmp"C:\Users\Admin\AppData\Local\Temp\203D.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\207C.tmp"C:\Users\Admin\AppData\Local\Temp\207C.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\20CA.tmp"C:\Users\Admin\AppData\Local\Temp\20CA.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\2108.tmp"C:\Users\Admin\AppData\Local\Temp\2108.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\2156.tmp"C:\Users\Admin\AppData\Local\Temp\2156.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\2194.tmp"C:\Users\Admin\AppData\Local\Temp\2194.tmp"65⤵
- Executes dropped EXE
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\21D3.tmp"C:\Users\Admin\AppData\Local\Temp\21D3.tmp"66⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\2211.tmp"C:\Users\Admin\AppData\Local\Temp\2211.tmp"67⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\226F.tmp"C:\Users\Admin\AppData\Local\Temp\226F.tmp"68⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\22CC.tmp"C:\Users\Admin\AppData\Local\Temp\22CC.tmp"69⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\230B.tmp"C:\Users\Admin\AppData\Local\Temp\230B.tmp"70⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\2349.tmp"C:\Users\Admin\AppData\Local\Temp\2349.tmp"71⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\2388.tmp"C:\Users\Admin\AppData\Local\Temp\2388.tmp"72⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\23C6.tmp"C:\Users\Admin\AppData\Local\Temp\23C6.tmp"73⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\2404.tmp"C:\Users\Admin\AppData\Local\Temp\2404.tmp"74⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\2443.tmp"C:\Users\Admin\AppData\Local\Temp\2443.tmp"75⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\2481.tmp"C:\Users\Admin\AppData\Local\Temp\2481.tmp"76⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\24C0.tmp"C:\Users\Admin\AppData\Local\Temp\24C0.tmp"77⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\24FE.tmp"C:\Users\Admin\AppData\Local\Temp\24FE.tmp"78⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\253C.tmp"C:\Users\Admin\AppData\Local\Temp\253C.tmp"79⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\257B.tmp"C:\Users\Admin\AppData\Local\Temp\257B.tmp"80⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\25B9.tmp"C:\Users\Admin\AppData\Local\Temp\25B9.tmp"81⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\25F8.tmp"C:\Users\Admin\AppData\Local\Temp\25F8.tmp"82⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\2636.tmp"C:\Users\Admin\AppData\Local\Temp\2636.tmp"83⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\2674.tmp"C:\Users\Admin\AppData\Local\Temp\2674.tmp"84⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\26B3.tmp"C:\Users\Admin\AppData\Local\Temp\26B3.tmp"85⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\26F1.tmp"C:\Users\Admin\AppData\Local\Temp\26F1.tmp"86⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\273F.tmp"C:\Users\Admin\AppData\Local\Temp\273F.tmp"87⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\278D.tmp"C:\Users\Admin\AppData\Local\Temp\278D.tmp"88⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\27CC.tmp"C:\Users\Admin\AppData\Local\Temp\27CC.tmp"89⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"90⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\2848.tmp"C:\Users\Admin\AppData\Local\Temp\2848.tmp"91⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\2887.tmp"C:\Users\Admin\AppData\Local\Temp\2887.tmp"92⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\28C5.tmp"C:\Users\Admin\AppData\Local\Temp\28C5.tmp"93⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\2904.tmp"C:\Users\Admin\AppData\Local\Temp\2904.tmp"94⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\2942.tmp"C:\Users\Admin\AppData\Local\Temp\2942.tmp"95⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\2980.tmp"C:\Users\Admin\AppData\Local\Temp\2980.tmp"96⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\29BF.tmp"C:\Users\Admin\AppData\Local\Temp\29BF.tmp"97⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\29FD.tmp"C:\Users\Admin\AppData\Local\Temp\29FD.tmp"98⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"99⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"100⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"101⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"102⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\2B35.tmp"C:\Users\Admin\AppData\Local\Temp\2B35.tmp"103⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\2B74.tmp"C:\Users\Admin\AppData\Local\Temp\2B74.tmp"104⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"105⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"106⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"107⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"108⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"109⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"110⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\2D38.tmp"C:\Users\Admin\AppData\Local\Temp\2D38.tmp"111⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\2D76.tmp"C:\Users\Admin\AppData\Local\Temp\2D76.tmp"112⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"113⤵PID:284
-
C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"114⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\2E32.tmp"C:\Users\Admin\AppData\Local\Temp\2E32.tmp"115⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\2E70.tmp"C:\Users\Admin\AppData\Local\Temp\2E70.tmp"116⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"117⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"118⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\2F3B.tmp"C:\Users\Admin\AppData\Local\Temp\2F3B.tmp"119⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\2F79.tmp"C:\Users\Admin\AppData\Local\Temp\2F79.tmp"120⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"121⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"122⤵PID:2740
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-