Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
17-05-2024 09:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-17_969fa81aabded50ed9d9a85e110938a4_mafia.exe
Resource
win7-20240215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-17_969fa81aabded50ed9d9a85e110938a4_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-17_969fa81aabded50ed9d9a85e110938a4_mafia.exe
-
Size
527KB
-
MD5
969fa81aabded50ed9d9a85e110938a4
-
SHA1
b691964ef0c25ac8d303b4737bee802a483bdf4c
-
SHA256
65d50064054ff47d76f4c7dffafdb664d617c8c7de547719e7c415f00f324bb0
-
SHA512
4c23e9b74bbaa807395c59c01ac1eb506aa196913064795e15f018f219100a061bdee142ff6160507f4bb0ffac6f313da2ed314340987c0d3857b0950a6f2e57
-
SSDEEP
12288:fU5rCOTeidy35Z4CgkEX67L7wYoifk9DZu:fUQOJdy2X67PwYw9Do
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2740 8D7.tmp 2580 934.tmp 2708 9B1.tmp 2560 A1E.tmp 2444 A9B.tmp 2472 B08.tmp 2184 B76.tmp 2436 BE3.tmp 2508 C50.tmp 3036 C9E.tmp 1804 CFC.tmp 2764 D59.tmp 2776 DC6.tmp 2816 E24.tmp 2924 E82.tmp 796 EDF.tmp 2016 F3D.tmp 1952 F8B.tmp 2424 FE8.tmp 624 1036.tmp 2928 1094.tmp 1696 10E2.tmp 2064 1140.tmp 1968 117E.tmp 1972 11CC.tmp 2856 120A.tmp 2012 1249.tmp 2864 1287.tmp 772 12C6.tmp 756 1304.tmp 1428 1342.tmp 1080 1390.tmp 1732 13CF.tmp 2004 140D.tmp 2404 144C.tmp 1904 149A.tmp 3012 14D8.tmp 1224 1516.tmp 2020 1555.tmp 672 1593.tmp 1612 15D2.tmp 1280 1610.tmp 3008 164E.tmp 328 168D.tmp 896 16CB.tmp 792 170A.tmp 1044 1748.tmp 2196 1786.tmp 2144 17C5.tmp 1896 1803.tmp 880 1842.tmp 2880 1880.tmp 888 18BE.tmp 1776 18FD.tmp 472 193B.tmp 1548 1989.tmp 3032 19C8.tmp 3040 1A06.tmp 2636 1A44.tmp 2648 1A83.tmp 2576 1AC1.tmp 2732 1B00.tmp 2560 1B3E.tmp 2552 1B7C.tmp -
Loads dropped DLL 64 IoCs
pid Process 2356 2024-05-17_969fa81aabded50ed9d9a85e110938a4_mafia.exe 2740 8D7.tmp 2580 934.tmp 2708 9B1.tmp 2560 A1E.tmp 2444 A9B.tmp 2472 B08.tmp 2184 B76.tmp 2436 BE3.tmp 2508 C50.tmp 3036 C9E.tmp 1804 CFC.tmp 2764 D59.tmp 2776 DC6.tmp 2816 E24.tmp 2924 E82.tmp 796 EDF.tmp 2016 F3D.tmp 1952 F8B.tmp 2424 FE8.tmp 624 1036.tmp 2928 1094.tmp 1696 10E2.tmp 2064 1140.tmp 1968 117E.tmp 1972 11CC.tmp 2856 120A.tmp 2012 1249.tmp 2864 1287.tmp 772 12C6.tmp 756 1304.tmp 1428 1342.tmp 1080 1390.tmp 1732 13CF.tmp 2004 140D.tmp 2404 144C.tmp 1904 149A.tmp 3012 14D8.tmp 1224 1516.tmp 2020 1555.tmp 672 1593.tmp 1612 15D2.tmp 1280 1610.tmp 3008 164E.tmp 328 168D.tmp 896 16CB.tmp 792 170A.tmp 1044 1748.tmp 2196 1786.tmp 2144 17C5.tmp 1896 1803.tmp 880 1842.tmp 2880 1880.tmp 888 18BE.tmp 1776 18FD.tmp 472 193B.tmp 1548 1989.tmp 3032 19C8.tmp 3040 1A06.tmp 2636 1A44.tmp 2648 1A83.tmp 2576 1AC1.tmp 2732 1B00.tmp 2560 1B3E.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2356 wrote to memory of 2740 2356 2024-05-17_969fa81aabded50ed9d9a85e110938a4_mafia.exe 28 PID 2356 wrote to memory of 2740 2356 2024-05-17_969fa81aabded50ed9d9a85e110938a4_mafia.exe 28 PID 2356 wrote to memory of 2740 2356 2024-05-17_969fa81aabded50ed9d9a85e110938a4_mafia.exe 28 PID 2356 wrote to memory of 2740 2356 2024-05-17_969fa81aabded50ed9d9a85e110938a4_mafia.exe 28 PID 2740 wrote to memory of 2580 2740 8D7.tmp 29 PID 2740 wrote to memory of 2580 2740 8D7.tmp 29 PID 2740 wrote to memory of 2580 2740 8D7.tmp 29 PID 2740 wrote to memory of 2580 2740 8D7.tmp 29 PID 2580 wrote to memory of 2708 2580 934.tmp 30 PID 2580 wrote to memory of 2708 2580 934.tmp 30 PID 2580 wrote to memory of 2708 2580 934.tmp 30 PID 2580 wrote to memory of 2708 2580 934.tmp 30 PID 2708 wrote to memory of 2560 2708 9B1.tmp 31 PID 2708 wrote to memory of 2560 2708 9B1.tmp 31 PID 2708 wrote to memory of 2560 2708 9B1.tmp 31 PID 2708 wrote to memory of 2560 2708 9B1.tmp 31 PID 2560 wrote to memory of 2444 2560 A1E.tmp 32 PID 2560 wrote to memory of 2444 2560 A1E.tmp 32 PID 2560 wrote to memory of 2444 2560 A1E.tmp 32 PID 2560 wrote to memory of 2444 2560 A1E.tmp 32 PID 2444 wrote to memory of 2472 2444 A9B.tmp 33 PID 2444 wrote to memory of 2472 2444 A9B.tmp 33 PID 2444 wrote to memory of 2472 2444 A9B.tmp 33 PID 2444 wrote to memory of 2472 2444 A9B.tmp 33 PID 2472 wrote to memory of 2184 2472 B08.tmp 34 PID 2472 wrote to memory of 2184 2472 B08.tmp 34 PID 2472 wrote to memory of 2184 2472 B08.tmp 34 PID 2472 wrote to memory of 2184 2472 B08.tmp 34 PID 2184 wrote to memory of 2436 2184 B76.tmp 35 PID 2184 wrote to memory of 2436 2184 B76.tmp 35 PID 2184 wrote to memory of 2436 2184 B76.tmp 35 PID 2184 wrote to memory of 2436 2184 B76.tmp 35 PID 2436 wrote to memory of 2508 2436 BE3.tmp 36 PID 2436 wrote to memory of 2508 2436 BE3.tmp 36 PID 2436 wrote to memory of 2508 2436 BE3.tmp 36 PID 2436 wrote to memory of 2508 2436 BE3.tmp 36 PID 2508 wrote to memory of 3036 2508 C50.tmp 37 PID 2508 wrote to memory of 3036 2508 C50.tmp 37 PID 2508 wrote to memory of 3036 2508 C50.tmp 37 PID 2508 wrote to memory of 3036 2508 C50.tmp 37 PID 3036 wrote to memory of 1804 3036 C9E.tmp 38 PID 3036 wrote to memory of 1804 3036 C9E.tmp 38 PID 3036 wrote to memory of 1804 3036 C9E.tmp 38 PID 3036 wrote to memory of 1804 3036 C9E.tmp 38 PID 1804 wrote to memory of 2764 1804 CFC.tmp 39 PID 1804 wrote to memory of 2764 1804 CFC.tmp 39 PID 1804 wrote to memory of 2764 1804 CFC.tmp 39 PID 1804 wrote to memory of 2764 1804 CFC.tmp 39 PID 2764 wrote to memory of 2776 2764 D59.tmp 40 PID 2764 wrote to memory of 2776 2764 D59.tmp 40 PID 2764 wrote to memory of 2776 2764 D59.tmp 40 PID 2764 wrote to memory of 2776 2764 D59.tmp 40 PID 2776 wrote to memory of 2816 2776 DC6.tmp 41 PID 2776 wrote to memory of 2816 2776 DC6.tmp 41 PID 2776 wrote to memory of 2816 2776 DC6.tmp 41 PID 2776 wrote to memory of 2816 2776 DC6.tmp 41 PID 2816 wrote to memory of 2924 2816 E24.tmp 42 PID 2816 wrote to memory of 2924 2816 E24.tmp 42 PID 2816 wrote to memory of 2924 2816 E24.tmp 42 PID 2816 wrote to memory of 2924 2816 E24.tmp 42 PID 2924 wrote to memory of 796 2924 E82.tmp 43 PID 2924 wrote to memory of 796 2924 E82.tmp 43 PID 2924 wrote to memory of 796 2924 E82.tmp 43 PID 2924 wrote to memory of 796 2924 E82.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-17_969fa81aabded50ed9d9a85e110938a4_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-17_969fa81aabded50ed9d9a85e110938a4_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\8D7.tmp"C:\Users\Admin\AppData\Local\Temp\8D7.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\934.tmp"C:\Users\Admin\AppData\Local\Temp\934.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\9B1.tmp"C:\Users\Admin\AppData\Local\Temp\9B1.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\A1E.tmp"C:\Users\Admin\AppData\Local\Temp\A1E.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\A9B.tmp"C:\Users\Admin\AppData\Local\Temp\A9B.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\B08.tmp"C:\Users\Admin\AppData\Local\Temp\B08.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\B76.tmp"C:\Users\Admin\AppData\Local\Temp\B76.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\BE3.tmp"C:\Users\Admin\AppData\Local\Temp\BE3.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\C50.tmp"C:\Users\Admin\AppData\Local\Temp\C50.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\C9E.tmp"C:\Users\Admin\AppData\Local\Temp\C9E.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\CFC.tmp"C:\Users\Admin\AppData\Local\Temp\CFC.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\D59.tmp"C:\Users\Admin\AppData\Local\Temp\D59.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\DC6.tmp"C:\Users\Admin\AppData\Local\Temp\DC6.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\E24.tmp"C:\Users\Admin\AppData\Local\Temp\E24.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\E82.tmp"C:\Users\Admin\AppData\Local\Temp\E82.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\EDF.tmp"C:\Users\Admin\AppData\Local\Temp\EDF.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:796 -
C:\Users\Admin\AppData\Local\Temp\F3D.tmp"C:\Users\Admin\AppData\Local\Temp\F3D.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\F8B.tmp"C:\Users\Admin\AppData\Local\Temp\F8B.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\FE8.tmp"C:\Users\Admin\AppData\Local\Temp\FE8.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\1036.tmp"C:\Users\Admin\AppData\Local\Temp\1036.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:624 -
C:\Users\Admin\AppData\Local\Temp\1094.tmp"C:\Users\Admin\AppData\Local\Temp\1094.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\10E2.tmp"C:\Users\Admin\AppData\Local\Temp\10E2.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\1140.tmp"C:\Users\Admin\AppData\Local\Temp\1140.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\117E.tmp"C:\Users\Admin\AppData\Local\Temp\117E.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\11CC.tmp"C:\Users\Admin\AppData\Local\Temp\11CC.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\120A.tmp"C:\Users\Admin\AppData\Local\Temp\120A.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\1249.tmp"C:\Users\Admin\AppData\Local\Temp\1249.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\1287.tmp"C:\Users\Admin\AppData\Local\Temp\1287.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\12C6.tmp"C:\Users\Admin\AppData\Local\Temp\12C6.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:772 -
C:\Users\Admin\AppData\Local\Temp\1304.tmp"C:\Users\Admin\AppData\Local\Temp\1304.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:756 -
C:\Users\Admin\AppData\Local\Temp\1342.tmp"C:\Users\Admin\AppData\Local\Temp\1342.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\1390.tmp"C:\Users\Admin\AppData\Local\Temp\1390.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\13CF.tmp"C:\Users\Admin\AppData\Local\Temp\13CF.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\140D.tmp"C:\Users\Admin\AppData\Local\Temp\140D.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\144C.tmp"C:\Users\Admin\AppData\Local\Temp\144C.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\149A.tmp"C:\Users\Admin\AppData\Local\Temp\149A.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\14D8.tmp"C:\Users\Admin\AppData\Local\Temp\14D8.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\1516.tmp"C:\Users\Admin\AppData\Local\Temp\1516.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\1555.tmp"C:\Users\Admin\AppData\Local\Temp\1555.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\1593.tmp"C:\Users\Admin\AppData\Local\Temp\1593.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:672 -
C:\Users\Admin\AppData\Local\Temp\15D2.tmp"C:\Users\Admin\AppData\Local\Temp\15D2.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\1610.tmp"C:\Users\Admin\AppData\Local\Temp\1610.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\164E.tmp"C:\Users\Admin\AppData\Local\Temp\164E.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\168D.tmp"C:\Users\Admin\AppData\Local\Temp\168D.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:328 -
C:\Users\Admin\AppData\Local\Temp\16CB.tmp"C:\Users\Admin\AppData\Local\Temp\16CB.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:896 -
C:\Users\Admin\AppData\Local\Temp\170A.tmp"C:\Users\Admin\AppData\Local\Temp\170A.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:792 -
C:\Users\Admin\AppData\Local\Temp\1748.tmp"C:\Users\Admin\AppData\Local\Temp\1748.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\1786.tmp"C:\Users\Admin\AppData\Local\Temp\1786.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\17C5.tmp"C:\Users\Admin\AppData\Local\Temp\17C5.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\1803.tmp"C:\Users\Admin\AppData\Local\Temp\1803.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\1842.tmp"C:\Users\Admin\AppData\Local\Temp\1842.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:880 -
C:\Users\Admin\AppData\Local\Temp\1880.tmp"C:\Users\Admin\AppData\Local\Temp\1880.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\18BE.tmp"C:\Users\Admin\AppData\Local\Temp\18BE.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:888 -
C:\Users\Admin\AppData\Local\Temp\18FD.tmp"C:\Users\Admin\AppData\Local\Temp\18FD.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\193B.tmp"C:\Users\Admin\AppData\Local\Temp\193B.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:472 -
C:\Users\Admin\AppData\Local\Temp\1989.tmp"C:\Users\Admin\AppData\Local\Temp\1989.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\19C8.tmp"C:\Users\Admin\AppData\Local\Temp\19C8.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\1A06.tmp"C:\Users\Admin\AppData\Local\Temp\1A06.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\1A44.tmp"C:\Users\Admin\AppData\Local\Temp\1A44.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\1A83.tmp"C:\Users\Admin\AppData\Local\Temp\1A83.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\1B00.tmp"C:\Users\Admin\AppData\Local\Temp\1B00.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"65⤵
- Executes dropped EXE
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"66⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\1C18.tmp"C:\Users\Admin\AppData\Local\Temp\1C18.tmp"67⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\1C57.tmp"C:\Users\Admin\AppData\Local\Temp\1C57.tmp"68⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\1C95.tmp"C:\Users\Admin\AppData\Local\Temp\1C95.tmp"69⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\1CD4.tmp"C:\Users\Admin\AppData\Local\Temp\1CD4.tmp"70⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\1D12.tmp"C:\Users\Admin\AppData\Local\Temp\1D12.tmp"71⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\1D50.tmp"C:\Users\Admin\AppData\Local\Temp\1D50.tmp"72⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\1D8F.tmp"C:\Users\Admin\AppData\Local\Temp\1D8F.tmp"73⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\1DCD.tmp"C:\Users\Admin\AppData\Local\Temp\1DCD.tmp"74⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"75⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\1E4A.tmp"C:\Users\Admin\AppData\Local\Temp\1E4A.tmp"76⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\1E88.tmp"C:\Users\Admin\AppData\Local\Temp\1E88.tmp"77⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"78⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\1F05.tmp"C:\Users\Admin\AppData\Local\Temp\1F05.tmp"79⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\1F44.tmp"C:\Users\Admin\AppData\Local\Temp\1F44.tmp"80⤵PID:276
-
C:\Users\Admin\AppData\Local\Temp\1F82.tmp"C:\Users\Admin\AppData\Local\Temp\1F82.tmp"81⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"82⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"83⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\203D.tmp"C:\Users\Admin\AppData\Local\Temp\203D.tmp"84⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\207C.tmp"C:\Users\Admin\AppData\Local\Temp\207C.tmp"85⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\20BA.tmp"C:\Users\Admin\AppData\Local\Temp\20BA.tmp"86⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\20F8.tmp"C:\Users\Admin\AppData\Local\Temp\20F8.tmp"87⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\2137.tmp"C:\Users\Admin\AppData\Local\Temp\2137.tmp"88⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\2175.tmp"C:\Users\Admin\AppData\Local\Temp\2175.tmp"89⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\21B4.tmp"C:\Users\Admin\AppData\Local\Temp\21B4.tmp"90⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\21F2.tmp"C:\Users\Admin\AppData\Local\Temp\21F2.tmp"91⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\2230.tmp"C:\Users\Admin\AppData\Local\Temp\2230.tmp"92⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\226F.tmp"C:\Users\Admin\AppData\Local\Temp\226F.tmp"93⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\22AD.tmp"C:\Users\Admin\AppData\Local\Temp\22AD.tmp"94⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\22EC.tmp"C:\Users\Admin\AppData\Local\Temp\22EC.tmp"95⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\232A.tmp"C:\Users\Admin\AppData\Local\Temp\232A.tmp"96⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\2368.tmp"C:\Users\Admin\AppData\Local\Temp\2368.tmp"97⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\23A7.tmp"C:\Users\Admin\AppData\Local\Temp\23A7.tmp"98⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"99⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\2424.tmp"C:\Users\Admin\AppData\Local\Temp\2424.tmp"100⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"101⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\24B0.tmp"C:\Users\Admin\AppData\Local\Temp\24B0.tmp"102⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\24EE.tmp"C:\Users\Admin\AppData\Local\Temp\24EE.tmp"103⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\252D.tmp"C:\Users\Admin\AppData\Local\Temp\252D.tmp"104⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\257B.tmp"C:\Users\Admin\AppData\Local\Temp\257B.tmp"105⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\25B9.tmp"C:\Users\Admin\AppData\Local\Temp\25B9.tmp"106⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\25F8.tmp"C:\Users\Admin\AppData\Local\Temp\25F8.tmp"107⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\2646.tmp"C:\Users\Admin\AppData\Local\Temp\2646.tmp"108⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\2684.tmp"C:\Users\Admin\AppData\Local\Temp\2684.tmp"109⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\26C2.tmp"C:\Users\Admin\AppData\Local\Temp\26C2.tmp"110⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\2701.tmp"C:\Users\Admin\AppData\Local\Temp\2701.tmp"111⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\273F.tmp"C:\Users\Admin\AppData\Local\Temp\273F.tmp"112⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\277E.tmp"C:\Users\Admin\AppData\Local\Temp\277E.tmp"113⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\27CC.tmp"C:\Users\Admin\AppData\Local\Temp\27CC.tmp"114⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"115⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\2848.tmp"C:\Users\Admin\AppData\Local\Temp\2848.tmp"116⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\2887.tmp"C:\Users\Admin\AppData\Local\Temp\2887.tmp"117⤵PID:352
-
C:\Users\Admin\AppData\Local\Temp\28C5.tmp"C:\Users\Admin\AppData\Local\Temp\28C5.tmp"118⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\2904.tmp"C:\Users\Admin\AppData\Local\Temp\2904.tmp"119⤵PID:344
-
C:\Users\Admin\AppData\Local\Temp\2952.tmp"C:\Users\Admin\AppData\Local\Temp\2952.tmp"120⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\29A0.tmp"C:\Users\Admin\AppData\Local\Temp\29A0.tmp"121⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\29DE.tmp"C:\Users\Admin\AppData\Local\Temp\29DE.tmp"122⤵PID:2520
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-