Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
27/05/2024, 13:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-27_7f9d584699969c423db58e4d4d78ebca_mafia.exe
Resource
win7-20240419-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-27_7f9d584699969c423db58e4d4d78ebca_mafia.exe
Resource
win10v2004-20240426-en
2 signatures
150 seconds
General
-
Target
2024-05-27_7f9d584699969c423db58e4d4d78ebca_mafia.exe
-
Size
530KB
-
MD5
7f9d584699969c423db58e4d4d78ebca
-
SHA1
2b58e4b9816ae6b2d94a910a4dd3e0e001c7aa7b
-
SHA256
8a60aea73a7c91224545a851f2dd1920f0f46f1fb73ccf1c3f5f88d34b1447e0
-
SHA512
8239d69f9e104d725b26ba4e7d97ce3a8a9591afcd9d43189413dfbd7dd60c06be5911ebadc8a526de031d4c664572fb4ca4b9bd75eab005a67961bc8798b2e5
-
SSDEEP
12288:AU5rCOTeiot1MVNJf+8Vy4qhbi4NZulFVg0M1:AUQOJot61fzs04NclFV/M1
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1788 165E.tmp 2600 16CB.tmp 2900 1767.tmp 2180 17D4.tmp 2340 1842.tmp 3020 189F.tmp 2736 190C.tmp 2648 1989.tmp 2680 19F6.tmp 2704 1A73.tmp 2656 1AF0.tmp 2576 1B7C.tmp 2564 1C09.tmp 2972 1C76.tmp 2484 1CE3.tmp 1836 1D50.tmp 1640 1DCD.tmp 1952 1E3A.tmp 1508 1EA8.tmp 2196 1F34.tmp 1932 1FC0.tmp 1964 202E.tmp 1820 208B.tmp 376 20CA.tmp 2608 2118.tmp 2796 2156.tmp 2808 2194.tmp 2464 21D3.tmp 3028 2221.tmp 2288 226F.tmp 2276 22BD.tmp 676 22FB.tmp 348 2349.tmp 1620 2388.tmp 496 23C6.tmp 1812 2404.tmp 1924 2443.tmp 1080 2481.tmp 2876 24C0.tmp 1744 24FE.tmp 976 253C.tmp 1340 257B.tmp 2036 25B9.tmp 612 25F8.tmp 2024 2646.tmp 1784 2684.tmp 836 26C2.tmp 3016 2701.tmp 1660 274F.tmp 3040 279D.tmp 900 27EB.tmp 1516 2829.tmp 3032 2868.tmp 880 28A6.tmp 2360 28E4.tmp 1580 2942.tmp 1684 2990.tmp 1664 29CE.tmp 760 2A0D.tmp 2912 2A4B.tmp 2952 2A8A.tmp 2964 2AC8.tmp 2928 2B06.tmp 1808 2B45.tmp -
Loads dropped DLL 64 IoCs
pid Process 2068 2024-05-27_7f9d584699969c423db58e4d4d78ebca_mafia.exe 1788 165E.tmp 2600 16CB.tmp 2900 1767.tmp 2180 17D4.tmp 2340 1842.tmp 3020 189F.tmp 2736 190C.tmp 2648 1989.tmp 2680 19F6.tmp 2704 1A73.tmp 2656 1AF0.tmp 2576 1B7C.tmp 2564 1C09.tmp 2972 1C76.tmp 2484 1CE3.tmp 1836 1D50.tmp 1640 1DCD.tmp 1952 1E3A.tmp 1508 1EA8.tmp 2196 1F34.tmp 1932 1FC0.tmp 1964 202E.tmp 1820 208B.tmp 376 20CA.tmp 2608 2118.tmp 2796 2156.tmp 2808 2194.tmp 2464 21D3.tmp 3028 2221.tmp 2288 226F.tmp 2276 22BD.tmp 676 22FB.tmp 348 2349.tmp 1620 2388.tmp 496 23C6.tmp 1812 2404.tmp 1924 2443.tmp 1080 2481.tmp 2876 24C0.tmp 1744 24FE.tmp 976 253C.tmp 1340 257B.tmp 2036 25B9.tmp 612 25F8.tmp 2024 2646.tmp 1784 2684.tmp 836 26C2.tmp 3016 2701.tmp 1660 274F.tmp 3040 279D.tmp 900 27EB.tmp 1516 2829.tmp 3032 2868.tmp 880 28A6.tmp 2360 28E4.tmp 1580 2942.tmp 1684 2990.tmp 1664 29CE.tmp 760 2A0D.tmp 2912 2A4B.tmp 2952 2A8A.tmp 2964 2AC8.tmp 2928 2B06.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2068 wrote to memory of 1788 2068 2024-05-27_7f9d584699969c423db58e4d4d78ebca_mafia.exe 28 PID 2068 wrote to memory of 1788 2068 2024-05-27_7f9d584699969c423db58e4d4d78ebca_mafia.exe 28 PID 2068 wrote to memory of 1788 2068 2024-05-27_7f9d584699969c423db58e4d4d78ebca_mafia.exe 28 PID 2068 wrote to memory of 1788 2068 2024-05-27_7f9d584699969c423db58e4d4d78ebca_mafia.exe 28 PID 1788 wrote to memory of 2600 1788 165E.tmp 29 PID 1788 wrote to memory of 2600 1788 165E.tmp 29 PID 1788 wrote to memory of 2600 1788 165E.tmp 29 PID 1788 wrote to memory of 2600 1788 165E.tmp 29 PID 2600 wrote to memory of 2900 2600 16CB.tmp 30 PID 2600 wrote to memory of 2900 2600 16CB.tmp 30 PID 2600 wrote to memory of 2900 2600 16CB.tmp 30 PID 2600 wrote to memory of 2900 2600 16CB.tmp 30 PID 2900 wrote to memory of 2180 2900 1767.tmp 31 PID 2900 wrote to memory of 2180 2900 1767.tmp 31 PID 2900 wrote to memory of 2180 2900 1767.tmp 31 PID 2900 wrote to memory of 2180 2900 1767.tmp 31 PID 2180 wrote to memory of 2340 2180 17D4.tmp 32 PID 2180 wrote to memory of 2340 2180 17D4.tmp 32 PID 2180 wrote to memory of 2340 2180 17D4.tmp 32 PID 2180 wrote to memory of 2340 2180 17D4.tmp 32 PID 2340 wrote to memory of 3020 2340 1842.tmp 33 PID 2340 wrote to memory of 3020 2340 1842.tmp 33 PID 2340 wrote to memory of 3020 2340 1842.tmp 33 PID 2340 wrote to memory of 3020 2340 1842.tmp 33 PID 3020 wrote to memory of 2736 3020 189F.tmp 34 PID 3020 wrote to memory of 2736 3020 189F.tmp 34 PID 3020 wrote to memory of 2736 3020 189F.tmp 34 PID 3020 wrote to memory of 2736 3020 189F.tmp 34 PID 2736 wrote to memory of 2648 2736 190C.tmp 35 PID 2736 wrote to memory of 2648 2736 190C.tmp 35 PID 2736 wrote to memory of 2648 2736 190C.tmp 35 PID 2736 wrote to memory of 2648 2736 190C.tmp 35 PID 2648 wrote to memory of 2680 2648 1989.tmp 36 PID 2648 wrote to memory of 2680 2648 1989.tmp 36 PID 2648 wrote to memory of 2680 2648 1989.tmp 36 PID 2648 wrote to memory of 2680 2648 1989.tmp 36 PID 2680 wrote to memory of 2704 2680 19F6.tmp 37 PID 2680 wrote to memory of 2704 2680 19F6.tmp 37 PID 2680 wrote to memory of 2704 2680 19F6.tmp 37 PID 2680 wrote to memory of 2704 2680 19F6.tmp 37 PID 2704 wrote to memory of 2656 2704 1A73.tmp 38 PID 2704 wrote to memory of 2656 2704 1A73.tmp 38 PID 2704 wrote to memory of 2656 2704 1A73.tmp 38 PID 2704 wrote to memory of 2656 2704 1A73.tmp 38 PID 2656 wrote to memory of 2576 2656 1AF0.tmp 39 PID 2656 wrote to memory of 2576 2656 1AF0.tmp 39 PID 2656 wrote to memory of 2576 2656 1AF0.tmp 39 PID 2656 wrote to memory of 2576 2656 1AF0.tmp 39 PID 2576 wrote to memory of 2564 2576 1B7C.tmp 40 PID 2576 wrote to memory of 2564 2576 1B7C.tmp 40 PID 2576 wrote to memory of 2564 2576 1B7C.tmp 40 PID 2576 wrote to memory of 2564 2576 1B7C.tmp 40 PID 2564 wrote to memory of 2972 2564 1C09.tmp 41 PID 2564 wrote to memory of 2972 2564 1C09.tmp 41 PID 2564 wrote to memory of 2972 2564 1C09.tmp 41 PID 2564 wrote to memory of 2972 2564 1C09.tmp 41 PID 2972 wrote to memory of 2484 2972 1C76.tmp 42 PID 2972 wrote to memory of 2484 2972 1C76.tmp 42 PID 2972 wrote to memory of 2484 2972 1C76.tmp 42 PID 2972 wrote to memory of 2484 2972 1C76.tmp 42 PID 2484 wrote to memory of 1836 2484 1CE3.tmp 43 PID 2484 wrote to memory of 1836 2484 1CE3.tmp 43 PID 2484 wrote to memory of 1836 2484 1CE3.tmp 43 PID 2484 wrote to memory of 1836 2484 1CE3.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-27_7f9d584699969c423db58e4d4d78ebca_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-27_7f9d584699969c423db58e4d4d78ebca_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\165E.tmp"C:\Users\Admin\AppData\Local\Temp\165E.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\16CB.tmp"C:\Users\Admin\AppData\Local\Temp\16CB.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\1767.tmp"C:\Users\Admin\AppData\Local\Temp\1767.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\17D4.tmp"C:\Users\Admin\AppData\Local\Temp\17D4.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\1842.tmp"C:\Users\Admin\AppData\Local\Temp\1842.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\189F.tmp"C:\Users\Admin\AppData\Local\Temp\189F.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\190C.tmp"C:\Users\Admin\AppData\Local\Temp\190C.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\1989.tmp"C:\Users\Admin\AppData\Local\Temp\1989.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\19F6.tmp"C:\Users\Admin\AppData\Local\Temp\19F6.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\1A73.tmp"C:\Users\Admin\AppData\Local\Temp\1A73.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\1C09.tmp"C:\Users\Admin\AppData\Local\Temp\1C09.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\1C76.tmp"C:\Users\Admin\AppData\Local\Temp\1C76.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\1D50.tmp"C:\Users\Admin\AppData\Local\Temp\1D50.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\1DCD.tmp"C:\Users\Admin\AppData\Local\Temp\1DCD.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\1F34.tmp"C:\Users\Admin\AppData\Local\Temp\1F34.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\202E.tmp"C:\Users\Admin\AppData\Local\Temp\202E.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\208B.tmp"C:\Users\Admin\AppData\Local\Temp\208B.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\20CA.tmp"C:\Users\Admin\AppData\Local\Temp\20CA.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:376 -
C:\Users\Admin\AppData\Local\Temp\2118.tmp"C:\Users\Admin\AppData\Local\Temp\2118.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\2156.tmp"C:\Users\Admin\AppData\Local\Temp\2156.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\2194.tmp"C:\Users\Admin\AppData\Local\Temp\2194.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\21D3.tmp"C:\Users\Admin\AppData\Local\Temp\21D3.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\2221.tmp"C:\Users\Admin\AppData\Local\Temp\2221.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\226F.tmp"C:\Users\Admin\AppData\Local\Temp\226F.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\22BD.tmp"C:\Users\Admin\AppData\Local\Temp\22BD.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\22FB.tmp"C:\Users\Admin\AppData\Local\Temp\22FB.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:676 -
C:\Users\Admin\AppData\Local\Temp\2349.tmp"C:\Users\Admin\AppData\Local\Temp\2349.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:348 -
C:\Users\Admin\AppData\Local\Temp\2388.tmp"C:\Users\Admin\AppData\Local\Temp\2388.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\23C6.tmp"C:\Users\Admin\AppData\Local\Temp\23C6.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:496 -
C:\Users\Admin\AppData\Local\Temp\2404.tmp"C:\Users\Admin\AppData\Local\Temp\2404.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\2443.tmp"C:\Users\Admin\AppData\Local\Temp\2443.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\2481.tmp"C:\Users\Admin\AppData\Local\Temp\2481.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\24C0.tmp"C:\Users\Admin\AppData\Local\Temp\24C0.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\24FE.tmp"C:\Users\Admin\AppData\Local\Temp\24FE.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\253C.tmp"C:\Users\Admin\AppData\Local\Temp\253C.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:976 -
C:\Users\Admin\AppData\Local\Temp\257B.tmp"C:\Users\Admin\AppData\Local\Temp\257B.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\25B9.tmp"C:\Users\Admin\AppData\Local\Temp\25B9.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\25F8.tmp"C:\Users\Admin\AppData\Local\Temp\25F8.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:612 -
C:\Users\Admin\AppData\Local\Temp\2646.tmp"C:\Users\Admin\AppData\Local\Temp\2646.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\2684.tmp"C:\Users\Admin\AppData\Local\Temp\2684.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\26C2.tmp"C:\Users\Admin\AppData\Local\Temp\26C2.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:836 -
C:\Users\Admin\AppData\Local\Temp\2701.tmp"C:\Users\Admin\AppData\Local\Temp\2701.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\274F.tmp"C:\Users\Admin\AppData\Local\Temp\274F.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\279D.tmp"C:\Users\Admin\AppData\Local\Temp\279D.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\27EB.tmp"C:\Users\Admin\AppData\Local\Temp\27EB.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:900 -
C:\Users\Admin\AppData\Local\Temp\2829.tmp"C:\Users\Admin\AppData\Local\Temp\2829.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\2868.tmp"C:\Users\Admin\AppData\Local\Temp\2868.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\28A6.tmp"C:\Users\Admin\AppData\Local\Temp\28A6.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:880 -
C:\Users\Admin\AppData\Local\Temp\28E4.tmp"C:\Users\Admin\AppData\Local\Temp\28E4.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\2942.tmp"C:\Users\Admin\AppData\Local\Temp\2942.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\2990.tmp"C:\Users\Admin\AppData\Local\Temp\2990.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\29CE.tmp"C:\Users\Admin\AppData\Local\Temp\29CE.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:760 -
C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\2B06.tmp"C:\Users\Admin\AppData\Local\Temp\2B06.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\2B45.tmp"C:\Users\Admin\AppData\Local\Temp\2B45.tmp"65⤵
- Executes dropped EXE
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\2B83.tmp"C:\Users\Admin\AppData\Local\Temp\2B83.tmp"66⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"67⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\2C00.tmp"C:\Users\Admin\AppData\Local\Temp\2C00.tmp"68⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"69⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"70⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"71⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"72⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\2D38.tmp"C:\Users\Admin\AppData\Local\Temp\2D38.tmp"73⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\2D76.tmp"C:\Users\Admin\AppData\Local\Temp\2D76.tmp"74⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"75⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"76⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\2E32.tmp"C:\Users\Admin\AppData\Local\Temp\2E32.tmp"77⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\2E70.tmp"C:\Users\Admin\AppData\Local\Temp\2E70.tmp"78⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"79⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\2EED.tmp"C:\Users\Admin\AppData\Local\Temp\2EED.tmp"80⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"81⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\2F6A.tmp"C:\Users\Admin\AppData\Local\Temp\2F6A.tmp"82⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"83⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"84⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\3025.tmp"C:\Users\Admin\AppData\Local\Temp\3025.tmp"85⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\3063.tmp"C:\Users\Admin\AppData\Local\Temp\3063.tmp"86⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\30A2.tmp"C:\Users\Admin\AppData\Local\Temp\30A2.tmp"87⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\30E0.tmp"C:\Users\Admin\AppData\Local\Temp\30E0.tmp"88⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\311E.tmp"C:\Users\Admin\AppData\Local\Temp\311E.tmp"89⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\315D.tmp"C:\Users\Admin\AppData\Local\Temp\315D.tmp"90⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\319B.tmp"C:\Users\Admin\AppData\Local\Temp\319B.tmp"91⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\31DA.tmp"C:\Users\Admin\AppData\Local\Temp\31DA.tmp"92⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\3218.tmp"C:\Users\Admin\AppData\Local\Temp\3218.tmp"93⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"94⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\3295.tmp"C:\Users\Admin\AppData\Local\Temp\3295.tmp"95⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\32D3.tmp"C:\Users\Admin\AppData\Local\Temp\32D3.tmp"96⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\3312.tmp"C:\Users\Admin\AppData\Local\Temp\3312.tmp"97⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\3350.tmp"C:\Users\Admin\AppData\Local\Temp\3350.tmp"98⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\338E.tmp"C:\Users\Admin\AppData\Local\Temp\338E.tmp"99⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\33CD.tmp"C:\Users\Admin\AppData\Local\Temp\33CD.tmp"100⤵PID:596
-
C:\Users\Admin\AppData\Local\Temp\340B.tmp"C:\Users\Admin\AppData\Local\Temp\340B.tmp"101⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\344A.tmp"C:\Users\Admin\AppData\Local\Temp\344A.tmp"102⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"103⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\34C6.tmp"C:\Users\Admin\AppData\Local\Temp\34C6.tmp"104⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\3505.tmp"C:\Users\Admin\AppData\Local\Temp\3505.tmp"105⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\3543.tmp"C:\Users\Admin\AppData\Local\Temp\3543.tmp"106⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\3582.tmp"C:\Users\Admin\AppData\Local\Temp\3582.tmp"107⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\35C0.tmp"C:\Users\Admin\AppData\Local\Temp\35C0.tmp"108⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\35FE.tmp"C:\Users\Admin\AppData\Local\Temp\35FE.tmp"109⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\363D.tmp"C:\Users\Admin\AppData\Local\Temp\363D.tmp"110⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\367B.tmp"C:\Users\Admin\AppData\Local\Temp\367B.tmp"111⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\36BA.tmp"C:\Users\Admin\AppData\Local\Temp\36BA.tmp"112⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\36F8.tmp"C:\Users\Admin\AppData\Local\Temp\36F8.tmp"113⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\3736.tmp"C:\Users\Admin\AppData\Local\Temp\3736.tmp"114⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\3775.tmp"C:\Users\Admin\AppData\Local\Temp\3775.tmp"115⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\37B3.tmp"C:\Users\Admin\AppData\Local\Temp\37B3.tmp"116⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\37F2.tmp"C:\Users\Admin\AppData\Local\Temp\37F2.tmp"117⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\3830.tmp"C:\Users\Admin\AppData\Local\Temp\3830.tmp"118⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\387E.tmp"C:\Users\Admin\AppData\Local\Temp\387E.tmp"119⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\38BC.tmp"C:\Users\Admin\AppData\Local\Temp\38BC.tmp"120⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\38FB.tmp"C:\Users\Admin\AppData\Local\Temp\38FB.tmp"121⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\3939.tmp"C:\Users\Admin\AppData\Local\Temp\3939.tmp"122⤵PID:2120
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-