Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 18:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-28_aee2fb6fe11a73a1678dea8486d1f43b_mafia.exe
Resource
win7-20240419-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-28_aee2fb6fe11a73a1678dea8486d1f43b_mafia.exe
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
2024-05-28_aee2fb6fe11a73a1678dea8486d1f43b_mafia.exe
-
Size
541KB
-
MD5
aee2fb6fe11a73a1678dea8486d1f43b
-
SHA1
c117c0f263a73f8eceee65e5145e77c2dd406606
-
SHA256
1198f4bc47789153725a0daffdbfdfe19175a4e14febce791a6fe18182045961
-
SHA512
54f85f5052c842c24c4cdacc9c70cdaf5ee3162ae0f4cc3f06acea94cacdfd1604f5bd555680a673964c13c41fbe573d7e49d200db0252aecbaf1b4e52f6090c
-
SSDEEP
12288:UU5rCOTeifVessIwqcvbomLvvSIjrZa73ctO:UUQOJf0snuzvLzrU73ctO
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2864 6A5.tmp 2548 712.tmp 2564 79F.tmp 2404 7FC.tmp 2876 879.tmp 2752 8C7.tmp 2544 944.tmp 2568 9B1.tmp 2464 A3E.tmp 2132 AAB.tmp 2300 AF9.tmp 1756 B56.tmp 2700 BD3.tmp 2756 C40.tmp 2676 CAE.tmp 1768 D2A.tmp 1780 DA7.tmp 1676 E34.tmp 1504 EC0.tmp 616 F2D.tmp 1172 FAA.tmp 1236 1017.tmp 2092 1084.tmp 2948 10D2.tmp 2180 1120.tmp 2032 115F.tmp 2852 11AD.tmp 1616 11EB.tmp 380 122A.tmp 804 1268.tmp 580 12A6.tmp 948 12E5.tmp 572 1323.tmp 2224 1362.tmp 2444 13A0.tmp 396 13DE.tmp 1912 141D.tmp 556 145B.tmp 604 149A.tmp 2188 14D8.tmp 1464 1516.tmp 316 1555.tmp 1820 1593.tmp 784 15D2.tmp 1672 1610.tmp 2296 164E.tmp 552 168D.tmp 2232 16CB.tmp 1680 170A.tmp 2260 1748.tmp 1320 1786.tmp 2056 17C5.tmp 880 1803.tmp 868 1842.tmp 2908 1880.tmp 1496 18BE.tmp 1528 18FD.tmp 2860 194B.tmp 2100 19A8.tmp 2656 19E7.tmp 2660 1A25.tmp 2652 1A64.tmp 2736 1AA2.tmp 2460 1AE0.tmp -
Loads dropped DLL 64 IoCs
pid Process 1860 2024-05-28_aee2fb6fe11a73a1678dea8486d1f43b_mafia.exe 2864 6A5.tmp 2548 712.tmp 2564 79F.tmp 2404 7FC.tmp 2876 879.tmp 2752 8C7.tmp 2544 944.tmp 2568 9B1.tmp 2464 A3E.tmp 2132 AAB.tmp 2300 AF9.tmp 1756 B56.tmp 2700 BD3.tmp 2756 C40.tmp 2676 CAE.tmp 1768 D2A.tmp 1780 DA7.tmp 1676 E34.tmp 1504 EC0.tmp 616 F2D.tmp 1172 FAA.tmp 1236 1017.tmp 2092 1084.tmp 2948 10D2.tmp 2180 1120.tmp 2032 115F.tmp 2852 11AD.tmp 1616 11EB.tmp 380 122A.tmp 804 1268.tmp 580 12A6.tmp 948 12E5.tmp 572 1323.tmp 2224 1362.tmp 2444 13A0.tmp 396 13DE.tmp 1912 141D.tmp 556 145B.tmp 604 149A.tmp 2188 14D8.tmp 1464 1516.tmp 316 1555.tmp 1820 1593.tmp 784 15D2.tmp 1672 1610.tmp 2296 164E.tmp 552 168D.tmp 2232 16CB.tmp 1680 170A.tmp 2260 1748.tmp 1320 1786.tmp 2056 17C5.tmp 880 1803.tmp 868 1842.tmp 2908 1880.tmp 1496 18BE.tmp 1528 18FD.tmp 2860 194B.tmp 2100 19A8.tmp 2656 19E7.tmp 2660 1A25.tmp 2652 1A64.tmp 2736 1AA2.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1860 wrote to memory of 2864 1860 2024-05-28_aee2fb6fe11a73a1678dea8486d1f43b_mafia.exe 28 PID 1860 wrote to memory of 2864 1860 2024-05-28_aee2fb6fe11a73a1678dea8486d1f43b_mafia.exe 28 PID 1860 wrote to memory of 2864 1860 2024-05-28_aee2fb6fe11a73a1678dea8486d1f43b_mafia.exe 28 PID 1860 wrote to memory of 2864 1860 2024-05-28_aee2fb6fe11a73a1678dea8486d1f43b_mafia.exe 28 PID 2864 wrote to memory of 2548 2864 6A5.tmp 29 PID 2864 wrote to memory of 2548 2864 6A5.tmp 29 PID 2864 wrote to memory of 2548 2864 6A5.tmp 29 PID 2864 wrote to memory of 2548 2864 6A5.tmp 29 PID 2548 wrote to memory of 2564 2548 712.tmp 30 PID 2548 wrote to memory of 2564 2548 712.tmp 30 PID 2548 wrote to memory of 2564 2548 712.tmp 30 PID 2548 wrote to memory of 2564 2548 712.tmp 30 PID 2564 wrote to memory of 2404 2564 79F.tmp 31 PID 2564 wrote to memory of 2404 2564 79F.tmp 31 PID 2564 wrote to memory of 2404 2564 79F.tmp 31 PID 2564 wrote to memory of 2404 2564 79F.tmp 31 PID 2404 wrote to memory of 2876 2404 7FC.tmp 32 PID 2404 wrote to memory of 2876 2404 7FC.tmp 32 PID 2404 wrote to memory of 2876 2404 7FC.tmp 32 PID 2404 wrote to memory of 2876 2404 7FC.tmp 32 PID 2876 wrote to memory of 2752 2876 879.tmp 33 PID 2876 wrote to memory of 2752 2876 879.tmp 33 PID 2876 wrote to memory of 2752 2876 879.tmp 33 PID 2876 wrote to memory of 2752 2876 879.tmp 33 PID 2752 wrote to memory of 2544 2752 8C7.tmp 34 PID 2752 wrote to memory of 2544 2752 8C7.tmp 34 PID 2752 wrote to memory of 2544 2752 8C7.tmp 34 PID 2752 wrote to memory of 2544 2752 8C7.tmp 34 PID 2544 wrote to memory of 2568 2544 944.tmp 35 PID 2544 wrote to memory of 2568 2544 944.tmp 35 PID 2544 wrote to memory of 2568 2544 944.tmp 35 PID 2544 wrote to memory of 2568 2544 944.tmp 35 PID 2568 wrote to memory of 2464 2568 9B1.tmp 36 PID 2568 wrote to memory of 2464 2568 9B1.tmp 36 PID 2568 wrote to memory of 2464 2568 9B1.tmp 36 PID 2568 wrote to memory of 2464 2568 9B1.tmp 36 PID 2464 wrote to memory of 2132 2464 A3E.tmp 37 PID 2464 wrote to memory of 2132 2464 A3E.tmp 37 PID 2464 wrote to memory of 2132 2464 A3E.tmp 37 PID 2464 wrote to memory of 2132 2464 A3E.tmp 37 PID 2132 wrote to memory of 2300 2132 AAB.tmp 38 PID 2132 wrote to memory of 2300 2132 AAB.tmp 38 PID 2132 wrote to memory of 2300 2132 AAB.tmp 38 PID 2132 wrote to memory of 2300 2132 AAB.tmp 38 PID 2300 wrote to memory of 1756 2300 AF9.tmp 39 PID 2300 wrote to memory of 1756 2300 AF9.tmp 39 PID 2300 wrote to memory of 1756 2300 AF9.tmp 39 PID 2300 wrote to memory of 1756 2300 AF9.tmp 39 PID 1756 wrote to memory of 2700 1756 B56.tmp 40 PID 1756 wrote to memory of 2700 1756 B56.tmp 40 PID 1756 wrote to memory of 2700 1756 B56.tmp 40 PID 1756 wrote to memory of 2700 1756 B56.tmp 40 PID 2700 wrote to memory of 2756 2700 BD3.tmp 41 PID 2700 wrote to memory of 2756 2700 BD3.tmp 41 PID 2700 wrote to memory of 2756 2700 BD3.tmp 41 PID 2700 wrote to memory of 2756 2700 BD3.tmp 41 PID 2756 wrote to memory of 2676 2756 C40.tmp 42 PID 2756 wrote to memory of 2676 2756 C40.tmp 42 PID 2756 wrote to memory of 2676 2756 C40.tmp 42 PID 2756 wrote to memory of 2676 2756 C40.tmp 42 PID 2676 wrote to memory of 1768 2676 CAE.tmp 43 PID 2676 wrote to memory of 1768 2676 CAE.tmp 43 PID 2676 wrote to memory of 1768 2676 CAE.tmp 43 PID 2676 wrote to memory of 1768 2676 CAE.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-28_aee2fb6fe11a73a1678dea8486d1f43b_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-28_aee2fb6fe11a73a1678dea8486d1f43b_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\6A5.tmp"C:\Users\Admin\AppData\Local\Temp\6A5.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\712.tmp"C:\Users\Admin\AppData\Local\Temp\712.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\79F.tmp"C:\Users\Admin\AppData\Local\Temp\79F.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\7FC.tmp"C:\Users\Admin\AppData\Local\Temp\7FC.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\879.tmp"C:\Users\Admin\AppData\Local\Temp\879.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\8C7.tmp"C:\Users\Admin\AppData\Local\Temp\8C7.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\944.tmp"C:\Users\Admin\AppData\Local\Temp\944.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\9B1.tmp"C:\Users\Admin\AppData\Local\Temp\9B1.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\A3E.tmp"C:\Users\Admin\AppData\Local\Temp\A3E.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\AAB.tmp"C:\Users\Admin\AppData\Local\Temp\AAB.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\AF9.tmp"C:\Users\Admin\AppData\Local\Temp\AF9.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\B56.tmp"C:\Users\Admin\AppData\Local\Temp\B56.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\BD3.tmp"C:\Users\Admin\AppData\Local\Temp\BD3.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\C40.tmp"C:\Users\Admin\AppData\Local\Temp\C40.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\CAE.tmp"C:\Users\Admin\AppData\Local\Temp\CAE.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\D2A.tmp"C:\Users\Admin\AppData\Local\Temp\D2A.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\DA7.tmp"C:\Users\Admin\AppData\Local\Temp\DA7.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\E34.tmp"C:\Users\Admin\AppData\Local\Temp\E34.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\EC0.tmp"C:\Users\Admin\AppData\Local\Temp\EC0.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\F2D.tmp"C:\Users\Admin\AppData\Local\Temp\F2D.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:616 -
C:\Users\Admin\AppData\Local\Temp\FAA.tmp"C:\Users\Admin\AppData\Local\Temp\FAA.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\1017.tmp"C:\Users\Admin\AppData\Local\Temp\1017.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\1084.tmp"C:\Users\Admin\AppData\Local\Temp\1084.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\10D2.tmp"C:\Users\Admin\AppData\Local\Temp\10D2.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\1120.tmp"C:\Users\Admin\AppData\Local\Temp\1120.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\115F.tmp"C:\Users\Admin\AppData\Local\Temp\115F.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\11AD.tmp"C:\Users\Admin\AppData\Local\Temp\11AD.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\11EB.tmp"C:\Users\Admin\AppData\Local\Temp\11EB.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\122A.tmp"C:\Users\Admin\AppData\Local\Temp\122A.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:380 -
C:\Users\Admin\AppData\Local\Temp\1268.tmp"C:\Users\Admin\AppData\Local\Temp\1268.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:804 -
C:\Users\Admin\AppData\Local\Temp\12A6.tmp"C:\Users\Admin\AppData\Local\Temp\12A6.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:580 -
C:\Users\Admin\AppData\Local\Temp\12E5.tmp"C:\Users\Admin\AppData\Local\Temp\12E5.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:948 -
C:\Users\Admin\AppData\Local\Temp\1323.tmp"C:\Users\Admin\AppData\Local\Temp\1323.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:572 -
C:\Users\Admin\AppData\Local\Temp\1362.tmp"C:\Users\Admin\AppData\Local\Temp\1362.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\13A0.tmp"C:\Users\Admin\AppData\Local\Temp\13A0.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\13DE.tmp"C:\Users\Admin\AppData\Local\Temp\13DE.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:396 -
C:\Users\Admin\AppData\Local\Temp\141D.tmp"C:\Users\Admin\AppData\Local\Temp\141D.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\145B.tmp"C:\Users\Admin\AppData\Local\Temp\145B.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:556 -
C:\Users\Admin\AppData\Local\Temp\149A.tmp"C:\Users\Admin\AppData\Local\Temp\149A.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:604 -
C:\Users\Admin\AppData\Local\Temp\14D8.tmp"C:\Users\Admin\AppData\Local\Temp\14D8.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\1516.tmp"C:\Users\Admin\AppData\Local\Temp\1516.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\1555.tmp"C:\Users\Admin\AppData\Local\Temp\1555.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:316 -
C:\Users\Admin\AppData\Local\Temp\1593.tmp"C:\Users\Admin\AppData\Local\Temp\1593.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\15D2.tmp"C:\Users\Admin\AppData\Local\Temp\15D2.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:784 -
C:\Users\Admin\AppData\Local\Temp\1610.tmp"C:\Users\Admin\AppData\Local\Temp\1610.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\164E.tmp"C:\Users\Admin\AppData\Local\Temp\164E.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\168D.tmp"C:\Users\Admin\AppData\Local\Temp\168D.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:552 -
C:\Users\Admin\AppData\Local\Temp\16CB.tmp"C:\Users\Admin\AppData\Local\Temp\16CB.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\170A.tmp"C:\Users\Admin\AppData\Local\Temp\170A.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\1748.tmp"C:\Users\Admin\AppData\Local\Temp\1748.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\1786.tmp"C:\Users\Admin\AppData\Local\Temp\1786.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\17C5.tmp"C:\Users\Admin\AppData\Local\Temp\17C5.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\1803.tmp"C:\Users\Admin\AppData\Local\Temp\1803.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:880 -
C:\Users\Admin\AppData\Local\Temp\1842.tmp"C:\Users\Admin\AppData\Local\Temp\1842.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:868 -
C:\Users\Admin\AppData\Local\Temp\1880.tmp"C:\Users\Admin\AppData\Local\Temp\1880.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\18BE.tmp"C:\Users\Admin\AppData\Local\Temp\18BE.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\18FD.tmp"C:\Users\Admin\AppData\Local\Temp\18FD.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\194B.tmp"C:\Users\Admin\AppData\Local\Temp\194B.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\19A8.tmp"C:\Users\Admin\AppData\Local\Temp\19A8.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\19E7.tmp"C:\Users\Admin\AppData\Local\Temp\19E7.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\1A25.tmp"C:\Users\Admin\AppData\Local\Temp\1A25.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\1A64.tmp"C:\Users\Admin\AppData\Local\Temp\1A64.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\1AE0.tmp"C:\Users\Admin\AppData\Local\Temp\1AE0.tmp"65⤵
- Executes dropped EXE
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"66⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"67⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"68⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"69⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\1C18.tmp"C:\Users\Admin\AppData\Local\Temp\1C18.tmp"70⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\1C57.tmp"C:\Users\Admin\AppData\Local\Temp\1C57.tmp"71⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\1C95.tmp"C:\Users\Admin\AppData\Local\Temp\1C95.tmp"72⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\1CD4.tmp"C:\Users\Admin\AppData\Local\Temp\1CD4.tmp"73⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\1D12.tmp"C:\Users\Admin\AppData\Local\Temp\1D12.tmp"74⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\1D60.tmp"C:\Users\Admin\AppData\Local\Temp\1D60.tmp"75⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"76⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"77⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"78⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"79⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\1E98.tmp"C:\Users\Admin\AppData\Local\Temp\1E98.tmp"80⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"81⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\1F15.tmp"C:\Users\Admin\AppData\Local\Temp\1F15.tmp"82⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\1F53.tmp"C:\Users\Admin\AppData\Local\Temp\1F53.tmp"83⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\1F92.tmp"C:\Users\Admin\AppData\Local\Temp\1F92.tmp"84⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"85⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\200E.tmp"C:\Users\Admin\AppData\Local\Temp\200E.tmp"86⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\204D.tmp"C:\Users\Admin\AppData\Local\Temp\204D.tmp"87⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\208B.tmp"C:\Users\Admin\AppData\Local\Temp\208B.tmp"88⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\20CA.tmp"C:\Users\Admin\AppData\Local\Temp\20CA.tmp"89⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\2108.tmp"C:\Users\Admin\AppData\Local\Temp\2108.tmp"90⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\2146.tmp"C:\Users\Admin\AppData\Local\Temp\2146.tmp"91⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\2185.tmp"C:\Users\Admin\AppData\Local\Temp\2185.tmp"92⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\21C3.tmp"C:\Users\Admin\AppData\Local\Temp\21C3.tmp"93⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\2202.tmp"C:\Users\Admin\AppData\Local\Temp\2202.tmp"94⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\2240.tmp"C:\Users\Admin\AppData\Local\Temp\2240.tmp"95⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\228E.tmp"C:\Users\Admin\AppData\Local\Temp\228E.tmp"96⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\22DC.tmp"C:\Users\Admin\AppData\Local\Temp\22DC.tmp"97⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\231A.tmp"C:\Users\Admin\AppData\Local\Temp\231A.tmp"98⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\2359.tmp"C:\Users\Admin\AppData\Local\Temp\2359.tmp"99⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\2397.tmp"C:\Users\Admin\AppData\Local\Temp\2397.tmp"100⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"101⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\2424.tmp"C:\Users\Admin\AppData\Local\Temp\2424.tmp"102⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"103⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\24A0.tmp"C:\Users\Admin\AppData\Local\Temp\24A0.tmp"104⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\24DF.tmp"C:\Users\Admin\AppData\Local\Temp\24DF.tmp"105⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\251D.tmp"C:\Users\Admin\AppData\Local\Temp\251D.tmp"106⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"107⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\259A.tmp"C:\Users\Admin\AppData\Local\Temp\259A.tmp"108⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\25D8.tmp"C:\Users\Admin\AppData\Local\Temp\25D8.tmp"109⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"110⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\2655.tmp"C:\Users\Admin\AppData\Local\Temp\2655.tmp"111⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\2694.tmp"C:\Users\Admin\AppData\Local\Temp\2694.tmp"112⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\26D2.tmp"C:\Users\Admin\AppData\Local\Temp\26D2.tmp"113⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\2710.tmp"C:\Users\Admin\AppData\Local\Temp\2710.tmp"114⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\274F.tmp"C:\Users\Admin\AppData\Local\Temp\274F.tmp"115⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\278D.tmp"C:\Users\Admin\AppData\Local\Temp\278D.tmp"116⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\27CC.tmp"C:\Users\Admin\AppData\Local\Temp\27CC.tmp"117⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"118⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\2848.tmp"C:\Users\Admin\AppData\Local\Temp\2848.tmp"119⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\2887.tmp"C:\Users\Admin\AppData\Local\Temp\2887.tmp"120⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\28C5.tmp"C:\Users\Admin\AppData\Local\Temp\28C5.tmp"121⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\2904.tmp"C:\Users\Admin\AppData\Local\Temp\2904.tmp"122⤵PID:880
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-