Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 12:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-24_a5e61ed4068c6df2aac275d2b3f60e7b_mafia.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-24_a5e61ed4068c6df2aac275d2b3f60e7b_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-24_a5e61ed4068c6df2aac275d2b3f60e7b_mafia.exe
-
Size
530KB
-
MD5
a5e61ed4068c6df2aac275d2b3f60e7b
-
SHA1
a8325e365e9f3763007be932ecc40ef8d75f98a6
-
SHA256
d4b5d1e511657528b1afef59aa2acdfd01d3c1c6434d9f965ca59905afaef450
-
SHA512
074c8816b81e95f352c127ecc34f783d128eaba3543f8a184721e9d55f76d9ad7e80e745f8d10568f0208aab429be26e15ea9df0d1442c43a4f2a93da8fb2bbc
-
SSDEEP
12288:AU5rCOTeioGqmp/Rgb/PvzKOoSRN9+fdb+dNZulFVg0M1:AUQOJoGqEgjv+OomN9ohwNclFV/M1
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1664 30.tmp 2980 8D.tmp 2776 EB.tmp 2116 148.tmp 2644 1B6.tmp 2640 223.tmp 2708 280.tmp 2608 2DE.tmp 2476 32C.tmp 1996 399.tmp 2480 406.tmp 2744 445.tmp 2020 4B2.tmp 1980 51F.tmp 1904 58C.tmp 1948 5EA.tmp 1328 657.tmp 2624 6A5.tmp 2536 712.tmp 2788 780.tmp 1616 7DD.tmp 1892 84A.tmp 380 8A8.tmp 2264 8F6.tmp 2016 934.tmp 2236 973.tmp 1684 9C1.tmp 1872 9FF.tmp 2056 A3E.tmp 268 A7C.tmp 288 ABA.tmp 1644 AF9.tmp 560 B37.tmp 1816 B76.tmp 1728 BB4.tmp 412 BF2.tmp 1036 C31.tmp 3028 C6F.tmp 3004 CAE.tmp 1700 CEC.tmp 1560 D2A.tmp 980 D69.tmp 960 DA7.tmp 1144 DE6.tmp 1212 E24.tmp 1076 E62.tmp 2312 EB0.tmp 2220 EEF.tmp 564 F2D.tmp 2364 F6C.tmp 1136 FAA.tmp 1756 FE8.tmp 2368 1027.tmp 2200 1065.tmp 2372 10B3.tmp 936 10F2.tmp 2904 1130.tmp 2900 116E.tmp 2984 11AD.tmp 2836 11EB.tmp 2592 1239.tmp 2552 1278.tmp 2672 12B6.tmp 2588 12F4.tmp -
Loads dropped DLL 64 IoCs
pid Process 2372 2024-05-24_a5e61ed4068c6df2aac275d2b3f60e7b_mafia.exe 1664 30.tmp 2980 8D.tmp 2776 EB.tmp 2116 148.tmp 2644 1B6.tmp 2640 223.tmp 2708 280.tmp 2608 2DE.tmp 2476 32C.tmp 1996 399.tmp 2480 406.tmp 2744 445.tmp 2020 4B2.tmp 1980 51F.tmp 1904 58C.tmp 1948 5EA.tmp 1328 657.tmp 2624 6A5.tmp 2536 712.tmp 2788 780.tmp 1616 7DD.tmp 1892 84A.tmp 380 8A8.tmp 2264 8F6.tmp 2016 934.tmp 2236 973.tmp 1684 9C1.tmp 1872 9FF.tmp 2056 A3E.tmp 268 A7C.tmp 288 ABA.tmp 1644 AF9.tmp 560 B37.tmp 1816 B76.tmp 1728 BB4.tmp 412 BF2.tmp 1036 C31.tmp 3028 C6F.tmp 3004 CAE.tmp 1700 CEC.tmp 1560 D2A.tmp 980 D69.tmp 960 DA7.tmp 1144 DE6.tmp 1212 E24.tmp 1076 E62.tmp 2312 EB0.tmp 2220 EEF.tmp 564 F2D.tmp 2364 F6C.tmp 1136 FAA.tmp 1756 FE8.tmp 2368 1027.tmp 2200 1065.tmp 2372 10B3.tmp 936 10F2.tmp 2904 1130.tmp 2900 116E.tmp 2984 11AD.tmp 2836 11EB.tmp 2592 1239.tmp 2552 1278.tmp 2672 12B6.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2372 wrote to memory of 1664 2372 2024-05-24_a5e61ed4068c6df2aac275d2b3f60e7b_mafia.exe 28 PID 2372 wrote to memory of 1664 2372 2024-05-24_a5e61ed4068c6df2aac275d2b3f60e7b_mafia.exe 28 PID 2372 wrote to memory of 1664 2372 2024-05-24_a5e61ed4068c6df2aac275d2b3f60e7b_mafia.exe 28 PID 2372 wrote to memory of 1664 2372 2024-05-24_a5e61ed4068c6df2aac275d2b3f60e7b_mafia.exe 28 PID 1664 wrote to memory of 2980 1664 30.tmp 29 PID 1664 wrote to memory of 2980 1664 30.tmp 29 PID 1664 wrote to memory of 2980 1664 30.tmp 29 PID 1664 wrote to memory of 2980 1664 30.tmp 29 PID 2980 wrote to memory of 2776 2980 8D.tmp 30 PID 2980 wrote to memory of 2776 2980 8D.tmp 30 PID 2980 wrote to memory of 2776 2980 8D.tmp 30 PID 2980 wrote to memory of 2776 2980 8D.tmp 30 PID 2776 wrote to memory of 2116 2776 EB.tmp 31 PID 2776 wrote to memory of 2116 2776 EB.tmp 31 PID 2776 wrote to memory of 2116 2776 EB.tmp 31 PID 2776 wrote to memory of 2116 2776 EB.tmp 31 PID 2116 wrote to memory of 2644 2116 148.tmp 32 PID 2116 wrote to memory of 2644 2116 148.tmp 32 PID 2116 wrote to memory of 2644 2116 148.tmp 32 PID 2116 wrote to memory of 2644 2116 148.tmp 32 PID 2644 wrote to memory of 2640 2644 1B6.tmp 33 PID 2644 wrote to memory of 2640 2644 1B6.tmp 33 PID 2644 wrote to memory of 2640 2644 1B6.tmp 33 PID 2644 wrote to memory of 2640 2644 1B6.tmp 33 PID 2640 wrote to memory of 2708 2640 223.tmp 34 PID 2640 wrote to memory of 2708 2640 223.tmp 34 PID 2640 wrote to memory of 2708 2640 223.tmp 34 PID 2640 wrote to memory of 2708 2640 223.tmp 34 PID 2708 wrote to memory of 2608 2708 280.tmp 35 PID 2708 wrote to memory of 2608 2708 280.tmp 35 PID 2708 wrote to memory of 2608 2708 280.tmp 35 PID 2708 wrote to memory of 2608 2708 280.tmp 35 PID 2608 wrote to memory of 2476 2608 2DE.tmp 36 PID 2608 wrote to memory of 2476 2608 2DE.tmp 36 PID 2608 wrote to memory of 2476 2608 2DE.tmp 36 PID 2608 wrote to memory of 2476 2608 2DE.tmp 36 PID 2476 wrote to memory of 1996 2476 32C.tmp 37 PID 2476 wrote to memory of 1996 2476 32C.tmp 37 PID 2476 wrote to memory of 1996 2476 32C.tmp 37 PID 2476 wrote to memory of 1996 2476 32C.tmp 37 PID 1996 wrote to memory of 2480 1996 399.tmp 38 PID 1996 wrote to memory of 2480 1996 399.tmp 38 PID 1996 wrote to memory of 2480 1996 399.tmp 38 PID 1996 wrote to memory of 2480 1996 399.tmp 38 PID 2480 wrote to memory of 2744 2480 406.tmp 39 PID 2480 wrote to memory of 2744 2480 406.tmp 39 PID 2480 wrote to memory of 2744 2480 406.tmp 39 PID 2480 wrote to memory of 2744 2480 406.tmp 39 PID 2744 wrote to memory of 2020 2744 445.tmp 40 PID 2744 wrote to memory of 2020 2744 445.tmp 40 PID 2744 wrote to memory of 2020 2744 445.tmp 40 PID 2744 wrote to memory of 2020 2744 445.tmp 40 PID 2020 wrote to memory of 1980 2020 4B2.tmp 41 PID 2020 wrote to memory of 1980 2020 4B2.tmp 41 PID 2020 wrote to memory of 1980 2020 4B2.tmp 41 PID 2020 wrote to memory of 1980 2020 4B2.tmp 41 PID 1980 wrote to memory of 1904 1980 51F.tmp 42 PID 1980 wrote to memory of 1904 1980 51F.tmp 42 PID 1980 wrote to memory of 1904 1980 51F.tmp 42 PID 1980 wrote to memory of 1904 1980 51F.tmp 42 PID 1904 wrote to memory of 1948 1904 58C.tmp 43 PID 1904 wrote to memory of 1948 1904 58C.tmp 43 PID 1904 wrote to memory of 1948 1904 58C.tmp 43 PID 1904 wrote to memory of 1948 1904 58C.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_a5e61ed4068c6df2aac275d2b3f60e7b_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-24_a5e61ed4068c6df2aac275d2b3f60e7b_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\30.tmp"C:\Users\Admin\AppData\Local\Temp\30.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\8D.tmp"C:\Users\Admin\AppData\Local\Temp\8D.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\EB.tmp"C:\Users\Admin\AppData\Local\Temp\EB.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\148.tmp"C:\Users\Admin\AppData\Local\Temp\148.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\1B6.tmp"C:\Users\Admin\AppData\Local\Temp\1B6.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\223.tmp"C:\Users\Admin\AppData\Local\Temp\223.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\280.tmp"C:\Users\Admin\AppData\Local\Temp\280.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\2DE.tmp"C:\Users\Admin\AppData\Local\Temp\2DE.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\32C.tmp"C:\Users\Admin\AppData\Local\Temp\32C.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\399.tmp"C:\Users\Admin\AppData\Local\Temp\399.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\406.tmp"C:\Users\Admin\AppData\Local\Temp\406.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\445.tmp"C:\Users\Admin\AppData\Local\Temp\445.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\4B2.tmp"C:\Users\Admin\AppData\Local\Temp\4B2.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\51F.tmp"C:\Users\Admin\AppData\Local\Temp\51F.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\58C.tmp"C:\Users\Admin\AppData\Local\Temp\58C.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\5EA.tmp"C:\Users\Admin\AppData\Local\Temp\5EA.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\657.tmp"C:\Users\Admin\AppData\Local\Temp\657.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\6A5.tmp"C:\Users\Admin\AppData\Local\Temp\6A5.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\712.tmp"C:\Users\Admin\AppData\Local\Temp\712.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\780.tmp"C:\Users\Admin\AppData\Local\Temp\780.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\7DD.tmp"C:\Users\Admin\AppData\Local\Temp\7DD.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\84A.tmp"C:\Users\Admin\AppData\Local\Temp\84A.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\8A8.tmp"C:\Users\Admin\AppData\Local\Temp\8A8.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:380 -
C:\Users\Admin\AppData\Local\Temp\8F6.tmp"C:\Users\Admin\AppData\Local\Temp\8F6.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\934.tmp"C:\Users\Admin\AppData\Local\Temp\934.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\973.tmp"C:\Users\Admin\AppData\Local\Temp\973.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\9C1.tmp"C:\Users\Admin\AppData\Local\Temp\9C1.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\9FF.tmp"C:\Users\Admin\AppData\Local\Temp\9FF.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\A3E.tmp"C:\Users\Admin\AppData\Local\Temp\A3E.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\A7C.tmp"C:\Users\Admin\AppData\Local\Temp\A7C.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:268 -
C:\Users\Admin\AppData\Local\Temp\ABA.tmp"C:\Users\Admin\AppData\Local\Temp\ABA.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:288 -
C:\Users\Admin\AppData\Local\Temp\AF9.tmp"C:\Users\Admin\AppData\Local\Temp\AF9.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\B37.tmp"C:\Users\Admin\AppData\Local\Temp\B37.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:560 -
C:\Users\Admin\AppData\Local\Temp\B76.tmp"C:\Users\Admin\AppData\Local\Temp\B76.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\BB4.tmp"C:\Users\Admin\AppData\Local\Temp\BB4.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\BF2.tmp"C:\Users\Admin\AppData\Local\Temp\BF2.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:412 -
C:\Users\Admin\AppData\Local\Temp\C31.tmp"C:\Users\Admin\AppData\Local\Temp\C31.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\C6F.tmp"C:\Users\Admin\AppData\Local\Temp\C6F.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\CAE.tmp"C:\Users\Admin\AppData\Local\Temp\CAE.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\CEC.tmp"C:\Users\Admin\AppData\Local\Temp\CEC.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\D2A.tmp"C:\Users\Admin\AppData\Local\Temp\D2A.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\D69.tmp"C:\Users\Admin\AppData\Local\Temp\D69.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:980 -
C:\Users\Admin\AppData\Local\Temp\DA7.tmp"C:\Users\Admin\AppData\Local\Temp\DA7.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:960 -
C:\Users\Admin\AppData\Local\Temp\DE6.tmp"C:\Users\Admin\AppData\Local\Temp\DE6.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\E24.tmp"C:\Users\Admin\AppData\Local\Temp\E24.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\E62.tmp"C:\Users\Admin\AppData\Local\Temp\E62.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\EB0.tmp"C:\Users\Admin\AppData\Local\Temp\EB0.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\EEF.tmp"C:\Users\Admin\AppData\Local\Temp\EEF.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\F2D.tmp"C:\Users\Admin\AppData\Local\Temp\F2D.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:564 -
C:\Users\Admin\AppData\Local\Temp\F6C.tmp"C:\Users\Admin\AppData\Local\Temp\F6C.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\FAA.tmp"C:\Users\Admin\AppData\Local\Temp\FAA.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\FE8.tmp"C:\Users\Admin\AppData\Local\Temp\FE8.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\1027.tmp"C:\Users\Admin\AppData\Local\Temp\1027.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\1065.tmp"C:\Users\Admin\AppData\Local\Temp\1065.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\10B3.tmp"C:\Users\Admin\AppData\Local\Temp\10B3.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\10F2.tmp"C:\Users\Admin\AppData\Local\Temp\10F2.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:936 -
C:\Users\Admin\AppData\Local\Temp\1130.tmp"C:\Users\Admin\AppData\Local\Temp\1130.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\116E.tmp"C:\Users\Admin\AppData\Local\Temp\116E.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\11AD.tmp"C:\Users\Admin\AppData\Local\Temp\11AD.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\11EB.tmp"C:\Users\Admin\AppData\Local\Temp\11EB.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\1239.tmp"C:\Users\Admin\AppData\Local\Temp\1239.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\1278.tmp"C:\Users\Admin\AppData\Local\Temp\1278.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\12B6.tmp"C:\Users\Admin\AppData\Local\Temp\12B6.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\12F4.tmp"C:\Users\Admin\AppData\Local\Temp\12F4.tmp"65⤵
- Executes dropped EXE
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\1342.tmp"C:\Users\Admin\AppData\Local\Temp\1342.tmp"66⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\1381.tmp"C:\Users\Admin\AppData\Local\Temp\1381.tmp"67⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\13BF.tmp"C:\Users\Admin\AppData\Local\Temp\13BF.tmp"68⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\140D.tmp"C:\Users\Admin\AppData\Local\Temp\140D.tmp"69⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\144C.tmp"C:\Users\Admin\AppData\Local\Temp\144C.tmp"70⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\148A.tmp"C:\Users\Admin\AppData\Local\Temp\148A.tmp"71⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\14C8.tmp"C:\Users\Admin\AppData\Local\Temp\14C8.tmp"72⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\1516.tmp"C:\Users\Admin\AppData\Local\Temp\1516.tmp"73⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\1555.tmp"C:\Users\Admin\AppData\Local\Temp\1555.tmp"74⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\1593.tmp"C:\Users\Admin\AppData\Local\Temp\1593.tmp"75⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\15D2.tmp"C:\Users\Admin\AppData\Local\Temp\15D2.tmp"76⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\1610.tmp"C:\Users\Admin\AppData\Local\Temp\1610.tmp"77⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\164E.tmp"C:\Users\Admin\AppData\Local\Temp\164E.tmp"78⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\168D.tmp"C:\Users\Admin\AppData\Local\Temp\168D.tmp"79⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\16CB.tmp"C:\Users\Admin\AppData\Local\Temp\16CB.tmp"80⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\170A.tmp"C:\Users\Admin\AppData\Local\Temp\170A.tmp"81⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\1758.tmp"C:\Users\Admin\AppData\Local\Temp\1758.tmp"82⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\1796.tmp"C:\Users\Admin\AppData\Local\Temp\1796.tmp"83⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\17D4.tmp"C:\Users\Admin\AppData\Local\Temp\17D4.tmp"84⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\1813.tmp"C:\Users\Admin\AppData\Local\Temp\1813.tmp"85⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\1851.tmp"C:\Users\Admin\AppData\Local\Temp\1851.tmp"86⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\1890.tmp"C:\Users\Admin\AppData\Local\Temp\1890.tmp"87⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\18CE.tmp"C:\Users\Admin\AppData\Local\Temp\18CE.tmp"88⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\191C.tmp"C:\Users\Admin\AppData\Local\Temp\191C.tmp"89⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\195A.tmp"C:\Users\Admin\AppData\Local\Temp\195A.tmp"90⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\1999.tmp"C:\Users\Admin\AppData\Local\Temp\1999.tmp"91⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\19D7.tmp"C:\Users\Admin\AppData\Local\Temp\19D7.tmp"92⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\1A16.tmp"C:\Users\Admin\AppData\Local\Temp\1A16.tmp"93⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\1A54.tmp"C:\Users\Admin\AppData\Local\Temp\1A54.tmp"94⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\1A92.tmp"C:\Users\Admin\AppData\Local\Temp\1A92.tmp"95⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"96⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\1B0F.tmp"C:\Users\Admin\AppData\Local\Temp\1B0F.tmp"97⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"98⤵PID:268
-
C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"99⤵PID:288
-
C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"100⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\1C18.tmp"C:\Users\Admin\AppData\Local\Temp\1C18.tmp"101⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\1C57.tmp"C:\Users\Admin\AppData\Local\Temp\1C57.tmp"102⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\1C95.tmp"C:\Users\Admin\AppData\Local\Temp\1C95.tmp"103⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\1CD4.tmp"C:\Users\Admin\AppData\Local\Temp\1CD4.tmp"104⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\1D12.tmp"C:\Users\Admin\AppData\Local\Temp\1D12.tmp"105⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\1D50.tmp"C:\Users\Admin\AppData\Local\Temp\1D50.tmp"106⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\1D8F.tmp"C:\Users\Admin\AppData\Local\Temp\1D8F.tmp"107⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\1DCD.tmp"C:\Users\Admin\AppData\Local\Temp\1DCD.tmp"108⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"109⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\1E4A.tmp"C:\Users\Admin\AppData\Local\Temp\1E4A.tmp"110⤵PID:284
-
C:\Users\Admin\AppData\Local\Temp\1E98.tmp"C:\Users\Admin\AppData\Local\Temp\1E98.tmp"111⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"112⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\1F24.tmp"C:\Users\Admin\AppData\Local\Temp\1F24.tmp"113⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\1F63.tmp"C:\Users\Admin\AppData\Local\Temp\1F63.tmp"114⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\1FA1.tmp"C:\Users\Admin\AppData\Local\Temp\1FA1.tmp"115⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"116⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\201E.tmp"C:\Users\Admin\AppData\Local\Temp\201E.tmp"117⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\205C.tmp"C:\Users\Admin\AppData\Local\Temp\205C.tmp"118⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\209B.tmp"C:\Users\Admin\AppData\Local\Temp\209B.tmp"119⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\20D9.tmp"C:\Users\Admin\AppData\Local\Temp\20D9.tmp"120⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\2118.tmp"C:\Users\Admin\AppData\Local\Temp\2118.tmp"121⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\2156.tmp"C:\Users\Admin\AppData\Local\Temp\2156.tmp"122⤵PID:1692
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-