Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
11/04/2024, 11:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-11_4f85b9d117e9cda504ade61af990da9a_mafia.exe
Resource
win7-20240215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-11_4f85b9d117e9cda504ade61af990da9a_mafia.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
2024-04-11_4f85b9d117e9cda504ade61af990da9a_mafia.exe
-
Size
486KB
-
MD5
4f85b9d117e9cda504ade61af990da9a
-
SHA1
4b1c46734816d27544142f0331e4d1a1fecb8230
-
SHA256
66e899ab65b9e18bd7bee994d8f9ee7c8463f91f32de7a0aff8896215b012096
-
SHA512
a3d2cb8fd6137329401f9b6fbcba119b1032e1c65259ff6cd30bbefa00eea86f2aa7e6eaabaf6509560f3175b2832265dcc074f20fbc8d0a719a5207ef4712a0
-
SSDEEP
12288:/U5rCOTeiDaTOq/4dQRmds4XiZw7bUY8NZ:/UQOJDapwdQRm+4XiZw7oLN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2220 11AD.tmp 2000 11FB.tmp 2364 1249.tmp 2172 12A6.tmp 2544 1304.tmp 2656 1362.tmp 2608 13BF.tmp 2916 142C.tmp 2112 148A.tmp 2868 14D8.tmp 2156 1536.tmp 2464 1584.tmp 292 15F1.tmp 2620 164E.tmp 2792 16BC.tmp 2872 1729.tmp 2804 1786.tmp 2840 17D4.tmp 2692 1822.tmp 2772 1880.tmp 2988 18CE.tmp 300 193B.tmp 1628 1999.tmp 2248 19D7.tmp 1044 1A16.tmp 1792 1A54.tmp 1432 1A92.tmp 2356 1AD1.tmp 2200 1B0F.tmp 2412 1B4E.tmp 684 1B9C.tmp 924 1BDA.tmp 1496 1C18.tmp 1756 1C66.tmp 564 1CA5.tmp 1868 1CE3.tmp 648 1D22.tmp 452 1D60.tmp 1708 1D9E.tmp 2636 1DDD.tmp 1784 1E1B.tmp 1548 1E69.tmp 1624 1EA8.tmp 944 1EE6.tmp 1652 1F24.tmp 1676 1F63.tmp 968 1FA1.tmp 2088 1FE0.tmp 2532 201E.tmp 1256 205C.tmp 2932 209B.tmp 1312 20E9.tmp 1516 2127.tmp 2252 2166.tmp 1616 21A4.tmp 1604 21E2.tmp 1780 2221.tmp 1944 226F.tmp 1836 22AD.tmp 2016 22EC.tmp 2032 232A.tmp 2136 2378.tmp 2328 23C6.tmp 2644 2404.tmp -
Loads dropped DLL 64 IoCs
pid Process 1304 2024-04-11_4f85b9d117e9cda504ade61af990da9a_mafia.exe 2220 11AD.tmp 2000 11FB.tmp 2364 1249.tmp 2172 12A6.tmp 2544 1304.tmp 2656 1362.tmp 2608 13BF.tmp 2916 142C.tmp 2112 148A.tmp 2868 14D8.tmp 2156 1536.tmp 2464 1584.tmp 292 15F1.tmp 2620 164E.tmp 2792 16BC.tmp 2872 1729.tmp 2804 1786.tmp 2840 17D4.tmp 2692 1822.tmp 2772 1880.tmp 2988 18CE.tmp 300 193B.tmp 1628 1999.tmp 2248 19D7.tmp 1044 1A16.tmp 1792 1A54.tmp 1432 1A92.tmp 2356 1AD1.tmp 2200 1B0F.tmp 2412 1B4E.tmp 684 1B9C.tmp 924 1BDA.tmp 1496 1C18.tmp 1756 1C66.tmp 564 1CA5.tmp 1868 1CE3.tmp 648 1D22.tmp 452 1D60.tmp 1708 1D9E.tmp 2636 1DDD.tmp 1784 1E1B.tmp 1548 1E69.tmp 1624 1EA8.tmp 944 1EE6.tmp 1652 1F24.tmp 1676 1F63.tmp 968 1FA1.tmp 2088 1FE0.tmp 2532 201E.tmp 1256 205C.tmp 2932 209B.tmp 1312 20E9.tmp 1516 2127.tmp 2252 2166.tmp 1616 21A4.tmp 1604 21E2.tmp 1780 2221.tmp 1944 226F.tmp 1836 22AD.tmp 2016 22EC.tmp 2032 232A.tmp 2136 2378.tmp 2328 23C6.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1304 wrote to memory of 2220 1304 2024-04-11_4f85b9d117e9cda504ade61af990da9a_mafia.exe 28 PID 1304 wrote to memory of 2220 1304 2024-04-11_4f85b9d117e9cda504ade61af990da9a_mafia.exe 28 PID 1304 wrote to memory of 2220 1304 2024-04-11_4f85b9d117e9cda504ade61af990da9a_mafia.exe 28 PID 1304 wrote to memory of 2220 1304 2024-04-11_4f85b9d117e9cda504ade61af990da9a_mafia.exe 28 PID 2220 wrote to memory of 2000 2220 11AD.tmp 29 PID 2220 wrote to memory of 2000 2220 11AD.tmp 29 PID 2220 wrote to memory of 2000 2220 11AD.tmp 29 PID 2220 wrote to memory of 2000 2220 11AD.tmp 29 PID 2000 wrote to memory of 2364 2000 11FB.tmp 30 PID 2000 wrote to memory of 2364 2000 11FB.tmp 30 PID 2000 wrote to memory of 2364 2000 11FB.tmp 30 PID 2000 wrote to memory of 2364 2000 11FB.tmp 30 PID 2364 wrote to memory of 2172 2364 1249.tmp 31 PID 2364 wrote to memory of 2172 2364 1249.tmp 31 PID 2364 wrote to memory of 2172 2364 1249.tmp 31 PID 2364 wrote to memory of 2172 2364 1249.tmp 31 PID 2172 wrote to memory of 2544 2172 12A6.tmp 32 PID 2172 wrote to memory of 2544 2172 12A6.tmp 32 PID 2172 wrote to memory of 2544 2172 12A6.tmp 32 PID 2172 wrote to memory of 2544 2172 12A6.tmp 32 PID 2544 wrote to memory of 2656 2544 1304.tmp 33 PID 2544 wrote to memory of 2656 2544 1304.tmp 33 PID 2544 wrote to memory of 2656 2544 1304.tmp 33 PID 2544 wrote to memory of 2656 2544 1304.tmp 33 PID 2656 wrote to memory of 2608 2656 1362.tmp 34 PID 2656 wrote to memory of 2608 2656 1362.tmp 34 PID 2656 wrote to memory of 2608 2656 1362.tmp 34 PID 2656 wrote to memory of 2608 2656 1362.tmp 34 PID 2608 wrote to memory of 2916 2608 13BF.tmp 35 PID 2608 wrote to memory of 2916 2608 13BF.tmp 35 PID 2608 wrote to memory of 2916 2608 13BF.tmp 35 PID 2608 wrote to memory of 2916 2608 13BF.tmp 35 PID 2916 wrote to memory of 2112 2916 142C.tmp 36 PID 2916 wrote to memory of 2112 2916 142C.tmp 36 PID 2916 wrote to memory of 2112 2916 142C.tmp 36 PID 2916 wrote to memory of 2112 2916 142C.tmp 36 PID 2112 wrote to memory of 2868 2112 148A.tmp 37 PID 2112 wrote to memory of 2868 2112 148A.tmp 37 PID 2112 wrote to memory of 2868 2112 148A.tmp 37 PID 2112 wrote to memory of 2868 2112 148A.tmp 37 PID 2868 wrote to memory of 2156 2868 14D8.tmp 38 PID 2868 wrote to memory of 2156 2868 14D8.tmp 38 PID 2868 wrote to memory of 2156 2868 14D8.tmp 38 PID 2868 wrote to memory of 2156 2868 14D8.tmp 38 PID 2156 wrote to memory of 2464 2156 1536.tmp 39 PID 2156 wrote to memory of 2464 2156 1536.tmp 39 PID 2156 wrote to memory of 2464 2156 1536.tmp 39 PID 2156 wrote to memory of 2464 2156 1536.tmp 39 PID 2464 wrote to memory of 292 2464 1584.tmp 40 PID 2464 wrote to memory of 292 2464 1584.tmp 40 PID 2464 wrote to memory of 292 2464 1584.tmp 40 PID 2464 wrote to memory of 292 2464 1584.tmp 40 PID 292 wrote to memory of 2620 292 15F1.tmp 41 PID 292 wrote to memory of 2620 292 15F1.tmp 41 PID 292 wrote to memory of 2620 292 15F1.tmp 41 PID 292 wrote to memory of 2620 292 15F1.tmp 41 PID 2620 wrote to memory of 2792 2620 164E.tmp 42 PID 2620 wrote to memory of 2792 2620 164E.tmp 42 PID 2620 wrote to memory of 2792 2620 164E.tmp 42 PID 2620 wrote to memory of 2792 2620 164E.tmp 42 PID 2792 wrote to memory of 2872 2792 16BC.tmp 43 PID 2792 wrote to memory of 2872 2792 16BC.tmp 43 PID 2792 wrote to memory of 2872 2792 16BC.tmp 43 PID 2792 wrote to memory of 2872 2792 16BC.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-11_4f85b9d117e9cda504ade61af990da9a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-11_4f85b9d117e9cda504ade61af990da9a_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\11AD.tmp"C:\Users\Admin\AppData\Local\Temp\11AD.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\11FB.tmp"C:\Users\Admin\AppData\Local\Temp\11FB.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\1249.tmp"C:\Users\Admin\AppData\Local\Temp\1249.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\12A6.tmp"C:\Users\Admin\AppData\Local\Temp\12A6.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\1304.tmp"C:\Users\Admin\AppData\Local\Temp\1304.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\1362.tmp"C:\Users\Admin\AppData\Local\Temp\1362.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\13BF.tmp"C:\Users\Admin\AppData\Local\Temp\13BF.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\142C.tmp"C:\Users\Admin\AppData\Local\Temp\142C.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\148A.tmp"C:\Users\Admin\AppData\Local\Temp\148A.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\14D8.tmp"C:\Users\Admin\AppData\Local\Temp\14D8.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\1536.tmp"C:\Users\Admin\AppData\Local\Temp\1536.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\1584.tmp"C:\Users\Admin\AppData\Local\Temp\1584.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\15F1.tmp"C:\Users\Admin\AppData\Local\Temp\15F1.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:292 -
C:\Users\Admin\AppData\Local\Temp\164E.tmp"C:\Users\Admin\AppData\Local\Temp\164E.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\16BC.tmp"C:\Users\Admin\AppData\Local\Temp\16BC.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\1729.tmp"C:\Users\Admin\AppData\Local\Temp\1729.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\1786.tmp"C:\Users\Admin\AppData\Local\Temp\1786.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\17D4.tmp"C:\Users\Admin\AppData\Local\Temp\17D4.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\1822.tmp"C:\Users\Admin\AppData\Local\Temp\1822.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\1880.tmp"C:\Users\Admin\AppData\Local\Temp\1880.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\18CE.tmp"C:\Users\Admin\AppData\Local\Temp\18CE.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\193B.tmp"C:\Users\Admin\AppData\Local\Temp\193B.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:300 -
C:\Users\Admin\AppData\Local\Temp\1999.tmp"C:\Users\Admin\AppData\Local\Temp\1999.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\19D7.tmp"C:\Users\Admin\AppData\Local\Temp\19D7.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\1A16.tmp"C:\Users\Admin\AppData\Local\Temp\1A16.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\1A54.tmp"C:\Users\Admin\AppData\Local\Temp\1A54.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\1A92.tmp"C:\Users\Admin\AppData\Local\Temp\1A92.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\1B0F.tmp"C:\Users\Admin\AppData\Local\Temp\1B0F.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:684 -
C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:924 -
C:\Users\Admin\AppData\Local\Temp\1C18.tmp"C:\Users\Admin\AppData\Local\Temp\1C18.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\1C66.tmp"C:\Users\Admin\AppData\Local\Temp\1C66.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:564 -
C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\1D22.tmp"C:\Users\Admin\AppData\Local\Temp\1D22.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:648 -
C:\Users\Admin\AppData\Local\Temp\1D60.tmp"C:\Users\Admin\AppData\Local\Temp\1D60.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:452 -
C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\1E69.tmp"C:\Users\Admin\AppData\Local\Temp\1E69.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\1EE6.tmp"C:\Users\Admin\AppData\Local\Temp\1EE6.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:944 -
C:\Users\Admin\AppData\Local\Temp\1F24.tmp"C:\Users\Admin\AppData\Local\Temp\1F24.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\1F63.tmp"C:\Users\Admin\AppData\Local\Temp\1F63.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\1FA1.tmp"C:\Users\Admin\AppData\Local\Temp\1FA1.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:968 -
C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\201E.tmp"C:\Users\Admin\AppData\Local\Temp\201E.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\205C.tmp"C:\Users\Admin\AppData\Local\Temp\205C.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\209B.tmp"C:\Users\Admin\AppData\Local\Temp\209B.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\20E9.tmp"C:\Users\Admin\AppData\Local\Temp\20E9.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\2127.tmp"C:\Users\Admin\AppData\Local\Temp\2127.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\2166.tmp"C:\Users\Admin\AppData\Local\Temp\2166.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\21A4.tmp"C:\Users\Admin\AppData\Local\Temp\21A4.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\21E2.tmp"C:\Users\Admin\AppData\Local\Temp\21E2.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\2221.tmp"C:\Users\Admin\AppData\Local\Temp\2221.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\226F.tmp"C:\Users\Admin\AppData\Local\Temp\226F.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\22AD.tmp"C:\Users\Admin\AppData\Local\Temp\22AD.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\22EC.tmp"C:\Users\Admin\AppData\Local\Temp\22EC.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\232A.tmp"C:\Users\Admin\AppData\Local\Temp\232A.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\2378.tmp"C:\Users\Admin\AppData\Local\Temp\2378.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\23C6.tmp"C:\Users\Admin\AppData\Local\Temp\23C6.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\2404.tmp"C:\Users\Admin\AppData\Local\Temp\2404.tmp"65⤵
- Executes dropped EXE
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\2443.tmp"C:\Users\Admin\AppData\Local\Temp\2443.tmp"66⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\2481.tmp"C:\Users\Admin\AppData\Local\Temp\2481.tmp"67⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\24C0.tmp"C:\Users\Admin\AppData\Local\Temp\24C0.tmp"68⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\24FE.tmp"C:\Users\Admin\AppData\Local\Temp\24FE.tmp"69⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\253C.tmp"C:\Users\Admin\AppData\Local\Temp\253C.tmp"70⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\257B.tmp"C:\Users\Admin\AppData\Local\Temp\257B.tmp"71⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\25B9.tmp"C:\Users\Admin\AppData\Local\Temp\25B9.tmp"72⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\25F8.tmp"C:\Users\Admin\AppData\Local\Temp\25F8.tmp"73⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\2636.tmp"C:\Users\Admin\AppData\Local\Temp\2636.tmp"74⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\2684.tmp"C:\Users\Admin\AppData\Local\Temp\2684.tmp"75⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\26D2.tmp"C:\Users\Admin\AppData\Local\Temp\26D2.tmp"76⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\2710.tmp"C:\Users\Admin\AppData\Local\Temp\2710.tmp"77⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\274F.tmp"C:\Users\Admin\AppData\Local\Temp\274F.tmp"78⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\278D.tmp"C:\Users\Admin\AppData\Local\Temp\278D.tmp"79⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\27CC.tmp"C:\Users\Admin\AppData\Local\Temp\27CC.tmp"80⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"81⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\2848.tmp"C:\Users\Admin\AppData\Local\Temp\2848.tmp"82⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\2896.tmp"C:\Users\Admin\AppData\Local\Temp\2896.tmp"83⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\28D5.tmp"C:\Users\Admin\AppData\Local\Temp\28D5.tmp"84⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\2923.tmp"C:\Users\Admin\AppData\Local\Temp\2923.tmp"85⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\2961.tmp"C:\Users\Admin\AppData\Local\Temp\2961.tmp"86⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\29A0.tmp"C:\Users\Admin\AppData\Local\Temp\29A0.tmp"87⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\29DE.tmp"C:\Users\Admin\AppData\Local\Temp\29DE.tmp"88⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"89⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"90⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\2A99.tmp"C:\Users\Admin\AppData\Local\Temp\2A99.tmp"91⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"92⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\2B16.tmp"C:\Users\Admin\AppData\Local\Temp\2B16.tmp"93⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\2B54.tmp"C:\Users\Admin\AppData\Local\Temp\2B54.tmp"94⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\2B93.tmp"C:\Users\Admin\AppData\Local\Temp\2B93.tmp"95⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"96⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\2C10.tmp"C:\Users\Admin\AppData\Local\Temp\2C10.tmp"97⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"98⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"99⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"100⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\2D09.tmp"C:\Users\Admin\AppData\Local\Temp\2D09.tmp"101⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\2D48.tmp"C:\Users\Admin\AppData\Local\Temp\2D48.tmp"102⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\2D86.tmp"C:\Users\Admin\AppData\Local\Temp\2D86.tmp"103⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"104⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\2E03.tmp"C:\Users\Admin\AppData\Local\Temp\2E03.tmp"105⤵PID:648
-
C:\Users\Admin\AppData\Local\Temp\2E41.tmp"C:\Users\Admin\AppData\Local\Temp\2E41.tmp"106⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\2E80.tmp"C:\Users\Admin\AppData\Local\Temp\2E80.tmp"107⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"108⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"109⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\2F3B.tmp"C:\Users\Admin\AppData\Local\Temp\2F3B.tmp"110⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\2F79.tmp"C:\Users\Admin\AppData\Local\Temp\2F79.tmp"111⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"112⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"113⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\3034.tmp"C:\Users\Admin\AppData\Local\Temp\3034.tmp"114⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\3073.tmp"C:\Users\Admin\AppData\Local\Temp\3073.tmp"115⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\30B1.tmp"C:\Users\Admin\AppData\Local\Temp\30B1.tmp"116⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\30F0.tmp"C:\Users\Admin\AppData\Local\Temp\30F0.tmp"117⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\312E.tmp"C:\Users\Admin\AppData\Local\Temp\312E.tmp"118⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\316C.tmp"C:\Users\Admin\AppData\Local\Temp\316C.tmp"119⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\31AB.tmp"C:\Users\Admin\AppData\Local\Temp\31AB.tmp"120⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\31E9.tmp"C:\Users\Admin\AppData\Local\Temp\31E9.tmp"121⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\3228.tmp"C:\Users\Admin\AppData\Local\Temp\3228.tmp"122⤵PID:2252
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-