Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08-06-2024 06:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-08_43068e0a6f0c1a8190817ded12c100b9_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-08_43068e0a6f0c1a8190817ded12c100b9_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-06-08_43068e0a6f0c1a8190817ded12c100b9_mafia.exe
-
Size
536KB
-
MD5
43068e0a6f0c1a8190817ded12c100b9
-
SHA1
6c85f8f93a3a63a15f5abd06d504bfdeade7abf3
-
SHA256
12386c5aef17f215928357fef54fb53fb33991e1a9d26e96ce1c774d03100001
-
SHA512
a787c29608d6fbe0d2536c4e645e702e4680ab237678f9cb758ef1d59c61fc03963d65c10f91cc55013cdf41aecd41ede26c28b22472e9fbd3af138caf0f7023
-
SSDEEP
12288:wU5rCOTeiU30X0zSsjmoFBqAZlEWOFIZxVJ0ZT9:wUQOJUkXRsSoFwOKFIRJ0ZT9
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1920 10C3.tmp 1612 1140.tmp 2572 11DC.tmp 2608 1268.tmp 2712 12D5.tmp 2436 1371.tmp 2668 13FE.tmp 2488 14A9.tmp 2000 1507.tmp 2516 15A3.tmp 2956 1600.tmp 2752 169C.tmp 1860 16FA.tmp 2128 1777.tmp 2504 1803.tmp 2776 1890.tmp 1256 18FD.tmp 864 1989.tmp 2204 19E7.tmp 2016 1A73.tmp 1984 1B00.tmp 480 1B9C.tmp 1068 1C09.tmp 1616 1C57.tmp 2380 1CA5.tmp 2112 1CF3.tmp 1116 1D60.tmp 2108 1DAE.tmp 1476 1E1B.tmp 1280 1E69.tmp 332 1EA8.tmp 1684 1F05.tmp 664 1F72.tmp 1908 1FD0.tmp 2852 200E.tmp 1144 205C.tmp 992 20AA.tmp 2132 20E9.tmp 1916 2137.tmp 1520 2185.tmp 1508 21D3.tmp 2984 2221.tmp 2524 225F.tmp 2544 22AD.tmp 2604 22FB.tmp 2420 233A.tmp 2708 2388.tmp 112 23E5.tmp 2416 2452.tmp 2432 2491.tmp 1784 24DF.tmp 2980 252D.tmp 2652 256B.tmp 2832 25B9.tmp 2932 2607.tmp 3000 2655.tmp 2780 26A3.tmp 2744 26F1.tmp 2296 2730.tmp 1440 277E.tmp 2748 27BC.tmp 2504 280A.tmp 804 2848.tmp 640 2896.tmp -
Loads dropped DLL 64 IoCs
pid Process 2328 2024-06-08_43068e0a6f0c1a8190817ded12c100b9_mafia.exe 1920 10C3.tmp 1612 1140.tmp 2572 11DC.tmp 2608 1268.tmp 2712 12D5.tmp 2436 1371.tmp 2668 13FE.tmp 2488 14A9.tmp 2000 1507.tmp 2516 15A3.tmp 2956 1600.tmp 2752 169C.tmp 1860 16FA.tmp 2128 1777.tmp 2504 1803.tmp 2776 1890.tmp 1256 18FD.tmp 864 1989.tmp 2204 19E7.tmp 2016 1A73.tmp 1984 1B00.tmp 480 1B9C.tmp 1068 1C09.tmp 1616 1C57.tmp 2380 1CA5.tmp 2112 1CF3.tmp 1116 1D60.tmp 2108 1DAE.tmp 1476 1E1B.tmp 1280 1E69.tmp 332 1EA8.tmp 1684 1F05.tmp 664 1F72.tmp 1908 1FD0.tmp 2852 200E.tmp 1144 205C.tmp 992 20AA.tmp 2132 20E9.tmp 1916 2137.tmp 1520 2185.tmp 1508 21D3.tmp 2984 2221.tmp 2524 225F.tmp 2544 22AD.tmp 2604 22FB.tmp 2420 233A.tmp 2708 2388.tmp 112 23E5.tmp 2416 2452.tmp 2432 2491.tmp 1784 24DF.tmp 2980 252D.tmp 2652 256B.tmp 2832 25B9.tmp 2932 2607.tmp 3000 2655.tmp 2780 26A3.tmp 2744 26F1.tmp 2296 2730.tmp 1440 277E.tmp 2748 27BC.tmp 2504 280A.tmp 804 2848.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2328 wrote to memory of 1920 2328 2024-06-08_43068e0a6f0c1a8190817ded12c100b9_mafia.exe 28 PID 2328 wrote to memory of 1920 2328 2024-06-08_43068e0a6f0c1a8190817ded12c100b9_mafia.exe 28 PID 2328 wrote to memory of 1920 2328 2024-06-08_43068e0a6f0c1a8190817ded12c100b9_mafia.exe 28 PID 2328 wrote to memory of 1920 2328 2024-06-08_43068e0a6f0c1a8190817ded12c100b9_mafia.exe 28 PID 1920 wrote to memory of 1612 1920 10C3.tmp 29 PID 1920 wrote to memory of 1612 1920 10C3.tmp 29 PID 1920 wrote to memory of 1612 1920 10C3.tmp 29 PID 1920 wrote to memory of 1612 1920 10C3.tmp 29 PID 1612 wrote to memory of 2572 1612 1140.tmp 30 PID 1612 wrote to memory of 2572 1612 1140.tmp 30 PID 1612 wrote to memory of 2572 1612 1140.tmp 30 PID 1612 wrote to memory of 2572 1612 1140.tmp 30 PID 2572 wrote to memory of 2608 2572 11DC.tmp 31 PID 2572 wrote to memory of 2608 2572 11DC.tmp 31 PID 2572 wrote to memory of 2608 2572 11DC.tmp 31 PID 2572 wrote to memory of 2608 2572 11DC.tmp 31 PID 2608 wrote to memory of 2712 2608 1268.tmp 32 PID 2608 wrote to memory of 2712 2608 1268.tmp 32 PID 2608 wrote to memory of 2712 2608 1268.tmp 32 PID 2608 wrote to memory of 2712 2608 1268.tmp 32 PID 2712 wrote to memory of 2436 2712 12D5.tmp 33 PID 2712 wrote to memory of 2436 2712 12D5.tmp 33 PID 2712 wrote to memory of 2436 2712 12D5.tmp 33 PID 2712 wrote to memory of 2436 2712 12D5.tmp 33 PID 2436 wrote to memory of 2668 2436 1371.tmp 34 PID 2436 wrote to memory of 2668 2436 1371.tmp 34 PID 2436 wrote to memory of 2668 2436 1371.tmp 34 PID 2436 wrote to memory of 2668 2436 1371.tmp 34 PID 2668 wrote to memory of 2488 2668 13FE.tmp 35 PID 2668 wrote to memory of 2488 2668 13FE.tmp 35 PID 2668 wrote to memory of 2488 2668 13FE.tmp 35 PID 2668 wrote to memory of 2488 2668 13FE.tmp 35 PID 2488 wrote to memory of 2000 2488 14A9.tmp 36 PID 2488 wrote to memory of 2000 2488 14A9.tmp 36 PID 2488 wrote to memory of 2000 2488 14A9.tmp 36 PID 2488 wrote to memory of 2000 2488 14A9.tmp 36 PID 2000 wrote to memory of 2516 2000 1507.tmp 37 PID 2000 wrote to memory of 2516 2000 1507.tmp 37 PID 2000 wrote to memory of 2516 2000 1507.tmp 37 PID 2000 wrote to memory of 2516 2000 1507.tmp 37 PID 2516 wrote to memory of 2956 2516 15A3.tmp 38 PID 2516 wrote to memory of 2956 2516 15A3.tmp 38 PID 2516 wrote to memory of 2956 2516 15A3.tmp 38 PID 2516 wrote to memory of 2956 2516 15A3.tmp 38 PID 2956 wrote to memory of 2752 2956 1600.tmp 39 PID 2956 wrote to memory of 2752 2956 1600.tmp 39 PID 2956 wrote to memory of 2752 2956 1600.tmp 39 PID 2956 wrote to memory of 2752 2956 1600.tmp 39 PID 2752 wrote to memory of 1860 2752 169C.tmp 40 PID 2752 wrote to memory of 1860 2752 169C.tmp 40 PID 2752 wrote to memory of 1860 2752 169C.tmp 40 PID 2752 wrote to memory of 1860 2752 169C.tmp 40 PID 1860 wrote to memory of 2128 1860 16FA.tmp 41 PID 1860 wrote to memory of 2128 1860 16FA.tmp 41 PID 1860 wrote to memory of 2128 1860 16FA.tmp 41 PID 1860 wrote to memory of 2128 1860 16FA.tmp 41 PID 2128 wrote to memory of 2504 2128 1777.tmp 42 PID 2128 wrote to memory of 2504 2128 1777.tmp 42 PID 2128 wrote to memory of 2504 2128 1777.tmp 42 PID 2128 wrote to memory of 2504 2128 1777.tmp 42 PID 2504 wrote to memory of 2776 2504 1803.tmp 43 PID 2504 wrote to memory of 2776 2504 1803.tmp 43 PID 2504 wrote to memory of 2776 2504 1803.tmp 43 PID 2504 wrote to memory of 2776 2504 1803.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-08_43068e0a6f0c1a8190817ded12c100b9_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-08_43068e0a6f0c1a8190817ded12c100b9_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\10C3.tmp"C:\Users\Admin\AppData\Local\Temp\10C3.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\1140.tmp"C:\Users\Admin\AppData\Local\Temp\1140.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\11DC.tmp"C:\Users\Admin\AppData\Local\Temp\11DC.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\1268.tmp"C:\Users\Admin\AppData\Local\Temp\1268.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\12D5.tmp"C:\Users\Admin\AppData\Local\Temp\12D5.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\1371.tmp"C:\Users\Admin\AppData\Local\Temp\1371.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\13FE.tmp"C:\Users\Admin\AppData\Local\Temp\13FE.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\14A9.tmp"C:\Users\Admin\AppData\Local\Temp\14A9.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\1507.tmp"C:\Users\Admin\AppData\Local\Temp\1507.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\15A3.tmp"C:\Users\Admin\AppData\Local\Temp\15A3.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\1600.tmp"C:\Users\Admin\AppData\Local\Temp\1600.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\169C.tmp"C:\Users\Admin\AppData\Local\Temp\169C.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\16FA.tmp"C:\Users\Admin\AppData\Local\Temp\16FA.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\1777.tmp"C:\Users\Admin\AppData\Local\Temp\1777.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\1803.tmp"C:\Users\Admin\AppData\Local\Temp\1803.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\1890.tmp"C:\Users\Admin\AppData\Local\Temp\1890.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\18FD.tmp"C:\Users\Admin\AppData\Local\Temp\18FD.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\1989.tmp"C:\Users\Admin\AppData\Local\Temp\1989.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:864 -
C:\Users\Admin\AppData\Local\Temp\19E7.tmp"C:\Users\Admin\AppData\Local\Temp\19E7.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\1A73.tmp"C:\Users\Admin\AppData\Local\Temp\1A73.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\1B00.tmp"C:\Users\Admin\AppData\Local\Temp\1B00.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:480 -
C:\Users\Admin\AppData\Local\Temp\1C09.tmp"C:\Users\Admin\AppData\Local\Temp\1C09.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\1C57.tmp"C:\Users\Admin\AppData\Local\Temp\1C57.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\1D60.tmp"C:\Users\Admin\AppData\Local\Temp\1D60.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\1E69.tmp"C:\Users\Admin\AppData\Local\Temp\1E69.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:332 -
C:\Users\Admin\AppData\Local\Temp\1F05.tmp"C:\Users\Admin\AppData\Local\Temp\1F05.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\1F72.tmp"C:\Users\Admin\AppData\Local\Temp\1F72.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:664 -
C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\200E.tmp"C:\Users\Admin\AppData\Local\Temp\200E.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\205C.tmp"C:\Users\Admin\AppData\Local\Temp\205C.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\20AA.tmp"C:\Users\Admin\AppData\Local\Temp\20AA.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:992 -
C:\Users\Admin\AppData\Local\Temp\20E9.tmp"C:\Users\Admin\AppData\Local\Temp\20E9.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\2137.tmp"C:\Users\Admin\AppData\Local\Temp\2137.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\2185.tmp"C:\Users\Admin\AppData\Local\Temp\2185.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\21D3.tmp"C:\Users\Admin\AppData\Local\Temp\21D3.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\2221.tmp"C:\Users\Admin\AppData\Local\Temp\2221.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\225F.tmp"C:\Users\Admin\AppData\Local\Temp\225F.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\22AD.tmp"C:\Users\Admin\AppData\Local\Temp\22AD.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\22FB.tmp"C:\Users\Admin\AppData\Local\Temp\22FB.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\233A.tmp"C:\Users\Admin\AppData\Local\Temp\233A.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\2388.tmp"C:\Users\Admin\AppData\Local\Temp\2388.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:112 -
C:\Users\Admin\AppData\Local\Temp\2452.tmp"C:\Users\Admin\AppData\Local\Temp\2452.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\2491.tmp"C:\Users\Admin\AppData\Local\Temp\2491.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\24DF.tmp"C:\Users\Admin\AppData\Local\Temp\24DF.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\252D.tmp"C:\Users\Admin\AppData\Local\Temp\252D.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\256B.tmp"C:\Users\Admin\AppData\Local\Temp\256B.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\25B9.tmp"C:\Users\Admin\AppData\Local\Temp\25B9.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\2607.tmp"C:\Users\Admin\AppData\Local\Temp\2607.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\2655.tmp"C:\Users\Admin\AppData\Local\Temp\2655.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\26A3.tmp"C:\Users\Admin\AppData\Local\Temp\26A3.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\26F1.tmp"C:\Users\Admin\AppData\Local\Temp\26F1.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\2730.tmp"C:\Users\Admin\AppData\Local\Temp\2730.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\277E.tmp"C:\Users\Admin\AppData\Local\Temp\277E.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\27BC.tmp"C:\Users\Admin\AppData\Local\Temp\27BC.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\2848.tmp"C:\Users\Admin\AppData\Local\Temp\2848.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:804 -
C:\Users\Admin\AppData\Local\Temp\2896.tmp"C:\Users\Admin\AppData\Local\Temp\2896.tmp"65⤵
- Executes dropped EXE
PID:640 -
C:\Users\Admin\AppData\Local\Temp\28D5.tmp"C:\Users\Admin\AppData\Local\Temp\28D5.tmp"66⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\2923.tmp"C:\Users\Admin\AppData\Local\Temp\2923.tmp"67⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\2961.tmp"C:\Users\Admin\AppData\Local\Temp\2961.tmp"68⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\29A0.tmp"C:\Users\Admin\AppData\Local\Temp\29A0.tmp"69⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\29EE.tmp"C:\Users\Admin\AppData\Local\Temp\29EE.tmp"70⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"71⤵PID:604
-
C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"72⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"73⤵PID:480
-
C:\Users\Admin\AppData\Local\Temp\2B06.tmp"C:\Users\Admin\AppData\Local\Temp\2B06.tmp"74⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\2B45.tmp"C:\Users\Admin\AppData\Local\Temp\2B45.tmp"75⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\2B83.tmp"C:\Users\Admin\AppData\Local\Temp\2B83.tmp"76⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"77⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\2C1F.tmp"C:\Users\Admin\AppData\Local\Temp\2C1F.tmp"78⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"79⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"80⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\2D09.tmp"C:\Users\Admin\AppData\Local\Temp\2D09.tmp"81⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\2D48.tmp"C:\Users\Admin\AppData\Local\Temp\2D48.tmp"82⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\2D96.tmp"C:\Users\Admin\AppData\Local\Temp\2D96.tmp"83⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"84⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\2E32.tmp"C:\Users\Admin\AppData\Local\Temp\2E32.tmp"85⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\2E70.tmp"C:\Users\Admin\AppData\Local\Temp\2E70.tmp"86⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"87⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\2EED.tmp"C:\Users\Admin\AppData\Local\Temp\2EED.tmp"88⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\2F3B.tmp"C:\Users\Admin\AppData\Local\Temp\2F3B.tmp"89⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\2F79.tmp"C:\Users\Admin\AppData\Local\Temp\2F79.tmp"90⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"91⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\3015.tmp"C:\Users\Admin\AppData\Local\Temp\3015.tmp"92⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\3063.tmp"C:\Users\Admin\AppData\Local\Temp\3063.tmp"93⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\30A2.tmp"C:\Users\Admin\AppData\Local\Temp\30A2.tmp"94⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\30F0.tmp"C:\Users\Admin\AppData\Local\Temp\30F0.tmp"95⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\313E.tmp"C:\Users\Admin\AppData\Local\Temp\313E.tmp"96⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\317C.tmp"C:\Users\Admin\AppData\Local\Temp\317C.tmp"97⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\31CA.tmp"C:\Users\Admin\AppData\Local\Temp\31CA.tmp"98⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\3218.tmp"C:\Users\Admin\AppData\Local\Temp\3218.tmp"99⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"100⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\32A4.tmp"C:\Users\Admin\AppData\Local\Temp\32A4.tmp"101⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\32F2.tmp"C:\Users\Admin\AppData\Local\Temp\32F2.tmp"102⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\3340.tmp"C:\Users\Admin\AppData\Local\Temp\3340.tmp"103⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\338E.tmp"C:\Users\Admin\AppData\Local\Temp\338E.tmp"104⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\33CD.tmp"C:\Users\Admin\AppData\Local\Temp\33CD.tmp"105⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\340B.tmp"C:\Users\Admin\AppData\Local\Temp\340B.tmp"106⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\3459.tmp"C:\Users\Admin\AppData\Local\Temp\3459.tmp"107⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\3498.tmp"C:\Users\Admin\AppData\Local\Temp\3498.tmp"108⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\34E6.tmp"C:\Users\Admin\AppData\Local\Temp\34E6.tmp"109⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\3534.tmp"C:\Users\Admin\AppData\Local\Temp\3534.tmp"110⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\3572.tmp"C:\Users\Admin\AppData\Local\Temp\3572.tmp"111⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\35B0.tmp"C:\Users\Admin\AppData\Local\Temp\35B0.tmp"112⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\35FE.tmp"C:\Users\Admin\AppData\Local\Temp\35FE.tmp"113⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\364C.tmp"C:\Users\Admin\AppData\Local\Temp\364C.tmp"114⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\368B.tmp"C:\Users\Admin\AppData\Local\Temp\368B.tmp"115⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\36D9.tmp"C:\Users\Admin\AppData\Local\Temp\36D9.tmp"116⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\3727.tmp"C:\Users\Admin\AppData\Local\Temp\3727.tmp"117⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\3784.tmp"C:\Users\Admin\AppData\Local\Temp\3784.tmp"118⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\37C3.tmp"C:\Users\Admin\AppData\Local\Temp\37C3.tmp"119⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\3801.tmp"C:\Users\Admin\AppData\Local\Temp\3801.tmp"120⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\3840.tmp"C:\Users\Admin\AppData\Local\Temp\3840.tmp"121⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\387E.tmp"C:\Users\Admin\AppData\Local\Temp\387E.tmp"122⤵PID:1364
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-