Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
30/04/2024, 11:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-30_5a7d6da9656724cf6204c4e683798363_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-30_5a7d6da9656724cf6204c4e683798363_mafia.exe
Resource
win10v2004-20240419-en
2 signatures
150 seconds
General
-
Target
2024-04-30_5a7d6da9656724cf6204c4e683798363_mafia.exe
-
Size
527KB
-
MD5
5a7d6da9656724cf6204c4e683798363
-
SHA1
a4cca797dc96127806316a340db3da414373b83e
-
SHA256
30f97375ec808903dd9d65d9126cc18c8eabe25e714110dcad7e0d76003939b1
-
SHA512
228e78723fd33839c960a136ca6d820283ae1e39fa8116af93b9dc5eeeb7eabcef8d807f4aa9cdc3566eb2ba772ebfd36790505e26fba0c9029dba86dac2c6fe
-
SSDEEP
12288:fU5rCOTeidadXm/v/ENqJJ+eTz5jQ35YJcV723YAAioDZu:fUQOJdtv/0Iw23DroDo
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2220 2D38.tmp 2928 2DB5.tmp 2004 2E60.tmp 2632 2EFC.tmp 2584 2F79.tmp 2840 3015.tmp 2452 3092.tmp 2724 311E.tmp 2640 318C.tmp 2484 3228.tmp 3020 3285.tmp 2992 3331.tmp 2604 33DC.tmp 2956 3469.tmp 2968 34B7.tmp 1932 3553.tmp 1724 35DF.tmp 1036 367B.tmp 1916 3717.tmp 2688 3794.tmp 488 3830.tmp 2756 38CC.tmp 840 3949.tmp 2248 3997.tmp 1364 39E5.tmp 1432 3A33.tmp 1764 3A81.tmp 2020 3ACF.tmp 2016 3B1D.tmp 1264 3B6B.tmp 2824 3BB9.tmp 2284 3C07.tmp 1200 3C55.tmp 3052 3C93.tmp 1732 3CE1.tmp 568 3D2F.tmp 968 3D7D.tmp 1136 3DBC.tmp 1296 3E0A.tmp 1748 3E48.tmp 1772 3E96.tmp 1720 3ED4.tmp 784 3F22.tmp 1320 3F61.tmp 2676 3FAF.tmp 924 3FED.tmp 2084 404B.tmp 2512 4089.tmp 3012 40D7.tmp 1980 4125.tmp 2508 4173.tmp 1508 41C1.tmp 1976 420F.tmp 2896 425D.tmp 1596 42AB.tmp 1752 42EA.tmp 2188 4338.tmp 2240 4386.tmp 2144 43D4.tmp 2536 4422.tmp 2644 4460.tmp 2856 449E.tmp 2844 44EC.tmp 2588 452B.tmp -
Loads dropped DLL 64 IoCs
pid Process 2188 2024-04-30_5a7d6da9656724cf6204c4e683798363_mafia.exe 2220 2D38.tmp 2928 2DB5.tmp 2004 2E60.tmp 2632 2EFC.tmp 2584 2F79.tmp 2840 3015.tmp 2452 3092.tmp 2724 311E.tmp 2640 318C.tmp 2484 3228.tmp 3020 3285.tmp 2992 3331.tmp 2604 33DC.tmp 2956 3469.tmp 2968 34B7.tmp 1932 3553.tmp 1724 35DF.tmp 1036 367B.tmp 1916 3717.tmp 2688 3794.tmp 488 3830.tmp 2756 38CC.tmp 840 3949.tmp 2248 3997.tmp 1364 39E5.tmp 1432 3A33.tmp 1764 3A81.tmp 2020 3ACF.tmp 2016 3B1D.tmp 1264 3B6B.tmp 2824 3BB9.tmp 2284 3C07.tmp 1200 3C55.tmp 3052 3C93.tmp 1732 3CE1.tmp 568 3D2F.tmp 968 3D7D.tmp 1136 3DBC.tmp 1296 3E0A.tmp 1748 3E48.tmp 1772 3E96.tmp 1720 3ED4.tmp 784 3F22.tmp 1320 3F61.tmp 2676 3FAF.tmp 924 3FED.tmp 2084 404B.tmp 2512 4089.tmp 3012 40D7.tmp 1980 4125.tmp 2508 4173.tmp 1508 41C1.tmp 1976 420F.tmp 2896 425D.tmp 1596 42AB.tmp 1752 42EA.tmp 2188 4338.tmp 2240 4386.tmp 2144 43D4.tmp 2536 4422.tmp 2644 4460.tmp 2856 449E.tmp 2844 44EC.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2188 wrote to memory of 2220 2188 2024-04-30_5a7d6da9656724cf6204c4e683798363_mafia.exe 28 PID 2188 wrote to memory of 2220 2188 2024-04-30_5a7d6da9656724cf6204c4e683798363_mafia.exe 28 PID 2188 wrote to memory of 2220 2188 2024-04-30_5a7d6da9656724cf6204c4e683798363_mafia.exe 28 PID 2188 wrote to memory of 2220 2188 2024-04-30_5a7d6da9656724cf6204c4e683798363_mafia.exe 28 PID 2220 wrote to memory of 2928 2220 2D38.tmp 29 PID 2220 wrote to memory of 2928 2220 2D38.tmp 29 PID 2220 wrote to memory of 2928 2220 2D38.tmp 29 PID 2220 wrote to memory of 2928 2220 2D38.tmp 29 PID 2928 wrote to memory of 2004 2928 2DB5.tmp 30 PID 2928 wrote to memory of 2004 2928 2DB5.tmp 30 PID 2928 wrote to memory of 2004 2928 2DB5.tmp 30 PID 2928 wrote to memory of 2004 2928 2DB5.tmp 30 PID 2004 wrote to memory of 2632 2004 2E60.tmp 31 PID 2004 wrote to memory of 2632 2004 2E60.tmp 31 PID 2004 wrote to memory of 2632 2004 2E60.tmp 31 PID 2004 wrote to memory of 2632 2004 2E60.tmp 31 PID 2632 wrote to memory of 2584 2632 2EFC.tmp 32 PID 2632 wrote to memory of 2584 2632 2EFC.tmp 32 PID 2632 wrote to memory of 2584 2632 2EFC.tmp 32 PID 2632 wrote to memory of 2584 2632 2EFC.tmp 32 PID 2584 wrote to memory of 2840 2584 2F79.tmp 33 PID 2584 wrote to memory of 2840 2584 2F79.tmp 33 PID 2584 wrote to memory of 2840 2584 2F79.tmp 33 PID 2584 wrote to memory of 2840 2584 2F79.tmp 33 PID 2840 wrote to memory of 2452 2840 3015.tmp 34 PID 2840 wrote to memory of 2452 2840 3015.tmp 34 PID 2840 wrote to memory of 2452 2840 3015.tmp 34 PID 2840 wrote to memory of 2452 2840 3015.tmp 34 PID 2452 wrote to memory of 2724 2452 3092.tmp 35 PID 2452 wrote to memory of 2724 2452 3092.tmp 35 PID 2452 wrote to memory of 2724 2452 3092.tmp 35 PID 2452 wrote to memory of 2724 2452 3092.tmp 35 PID 2724 wrote to memory of 2640 2724 311E.tmp 36 PID 2724 wrote to memory of 2640 2724 311E.tmp 36 PID 2724 wrote to memory of 2640 2724 311E.tmp 36 PID 2724 wrote to memory of 2640 2724 311E.tmp 36 PID 2640 wrote to memory of 2484 2640 318C.tmp 37 PID 2640 wrote to memory of 2484 2640 318C.tmp 37 PID 2640 wrote to memory of 2484 2640 318C.tmp 37 PID 2640 wrote to memory of 2484 2640 318C.tmp 37 PID 2484 wrote to memory of 3020 2484 3228.tmp 38 PID 2484 wrote to memory of 3020 2484 3228.tmp 38 PID 2484 wrote to memory of 3020 2484 3228.tmp 38 PID 2484 wrote to memory of 3020 2484 3228.tmp 38 PID 3020 wrote to memory of 2992 3020 3285.tmp 39 PID 3020 wrote to memory of 2992 3020 3285.tmp 39 PID 3020 wrote to memory of 2992 3020 3285.tmp 39 PID 3020 wrote to memory of 2992 3020 3285.tmp 39 PID 2992 wrote to memory of 2604 2992 3331.tmp 40 PID 2992 wrote to memory of 2604 2992 3331.tmp 40 PID 2992 wrote to memory of 2604 2992 3331.tmp 40 PID 2992 wrote to memory of 2604 2992 3331.tmp 40 PID 2604 wrote to memory of 2956 2604 33DC.tmp 41 PID 2604 wrote to memory of 2956 2604 33DC.tmp 41 PID 2604 wrote to memory of 2956 2604 33DC.tmp 41 PID 2604 wrote to memory of 2956 2604 33DC.tmp 41 PID 2956 wrote to memory of 2968 2956 3469.tmp 42 PID 2956 wrote to memory of 2968 2956 3469.tmp 42 PID 2956 wrote to memory of 2968 2956 3469.tmp 42 PID 2956 wrote to memory of 2968 2956 3469.tmp 42 PID 2968 wrote to memory of 1932 2968 34B7.tmp 43 PID 2968 wrote to memory of 1932 2968 34B7.tmp 43 PID 2968 wrote to memory of 1932 2968 34B7.tmp 43 PID 2968 wrote to memory of 1932 2968 34B7.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-30_5a7d6da9656724cf6204c4e683798363_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-30_5a7d6da9656724cf6204c4e683798363_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\2D38.tmp"C:\Users\Admin\AppData\Local\Temp\2D38.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\2E60.tmp"C:\Users\Admin\AppData\Local\Temp\2E60.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\2F79.tmp"C:\Users\Admin\AppData\Local\Temp\2F79.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\3015.tmp"C:\Users\Admin\AppData\Local\Temp\3015.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\3092.tmp"C:\Users\Admin\AppData\Local\Temp\3092.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\311E.tmp"C:\Users\Admin\AppData\Local\Temp\311E.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\318C.tmp"C:\Users\Admin\AppData\Local\Temp\318C.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\3228.tmp"C:\Users\Admin\AppData\Local\Temp\3228.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\3285.tmp"C:\Users\Admin\AppData\Local\Temp\3285.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\3331.tmp"C:\Users\Admin\AppData\Local\Temp\3331.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\33DC.tmp"C:\Users\Admin\AppData\Local\Temp\33DC.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\3469.tmp"C:\Users\Admin\AppData\Local\Temp\3469.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\34B7.tmp"C:\Users\Admin\AppData\Local\Temp\34B7.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\3553.tmp"C:\Users\Admin\AppData\Local\Temp\3553.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\35DF.tmp"C:\Users\Admin\AppData\Local\Temp\35DF.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\367B.tmp"C:\Users\Admin\AppData\Local\Temp\367B.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\3717.tmp"C:\Users\Admin\AppData\Local\Temp\3717.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\3794.tmp"C:\Users\Admin\AppData\Local\Temp\3794.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\3830.tmp"C:\Users\Admin\AppData\Local\Temp\3830.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:488 -
C:\Users\Admin\AppData\Local\Temp\38CC.tmp"C:\Users\Admin\AppData\Local\Temp\38CC.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\3949.tmp"C:\Users\Admin\AppData\Local\Temp\3949.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:840 -
C:\Users\Admin\AppData\Local\Temp\3997.tmp"C:\Users\Admin\AppData\Local\Temp\3997.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\39E5.tmp"C:\Users\Admin\AppData\Local\Temp\39E5.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\3A33.tmp"C:\Users\Admin\AppData\Local\Temp\3A33.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\3A81.tmp"C:\Users\Admin\AppData\Local\Temp\3A81.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\3ACF.tmp"C:\Users\Admin\AppData\Local\Temp\3ACF.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\3B1D.tmp"C:\Users\Admin\AppData\Local\Temp\3B1D.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\3B6B.tmp"C:\Users\Admin\AppData\Local\Temp\3B6B.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\3BB9.tmp"C:\Users\Admin\AppData\Local\Temp\3BB9.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\3C07.tmp"C:\Users\Admin\AppData\Local\Temp\3C07.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\3C55.tmp"C:\Users\Admin\AppData\Local\Temp\3C55.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\3C93.tmp"C:\Users\Admin\AppData\Local\Temp\3C93.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\3CE1.tmp"C:\Users\Admin\AppData\Local\Temp\3CE1.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\3D2F.tmp"C:\Users\Admin\AppData\Local\Temp\3D2F.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:568 -
C:\Users\Admin\AppData\Local\Temp\3D7D.tmp"C:\Users\Admin\AppData\Local\Temp\3D7D.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:968 -
C:\Users\Admin\AppData\Local\Temp\3DBC.tmp"C:\Users\Admin\AppData\Local\Temp\3DBC.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\3E0A.tmp"C:\Users\Admin\AppData\Local\Temp\3E0A.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\3E48.tmp"C:\Users\Admin\AppData\Local\Temp\3E48.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\3E96.tmp"C:\Users\Admin\AppData\Local\Temp\3E96.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\3ED4.tmp"C:\Users\Admin\AppData\Local\Temp\3ED4.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\3F22.tmp"C:\Users\Admin\AppData\Local\Temp\3F22.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:784 -
C:\Users\Admin\AppData\Local\Temp\3F61.tmp"C:\Users\Admin\AppData\Local\Temp\3F61.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\3FAF.tmp"C:\Users\Admin\AppData\Local\Temp\3FAF.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\3FED.tmp"C:\Users\Admin\AppData\Local\Temp\3FED.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:924 -
C:\Users\Admin\AppData\Local\Temp\404B.tmp"C:\Users\Admin\AppData\Local\Temp\404B.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\4089.tmp"C:\Users\Admin\AppData\Local\Temp\4089.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\40D7.tmp"C:\Users\Admin\AppData\Local\Temp\40D7.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\4125.tmp"C:\Users\Admin\AppData\Local\Temp\4125.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\4173.tmp"C:\Users\Admin\AppData\Local\Temp\4173.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\41C1.tmp"C:\Users\Admin\AppData\Local\Temp\41C1.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\420F.tmp"C:\Users\Admin\AppData\Local\Temp\420F.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\425D.tmp"C:\Users\Admin\AppData\Local\Temp\425D.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\42AB.tmp"C:\Users\Admin\AppData\Local\Temp\42AB.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\42EA.tmp"C:\Users\Admin\AppData\Local\Temp\42EA.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\4338.tmp"C:\Users\Admin\AppData\Local\Temp\4338.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\4386.tmp"C:\Users\Admin\AppData\Local\Temp\4386.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\43D4.tmp"C:\Users\Admin\AppData\Local\Temp\43D4.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\4422.tmp"C:\Users\Admin\AppData\Local\Temp\4422.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\4460.tmp"C:\Users\Admin\AppData\Local\Temp\4460.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\449E.tmp"C:\Users\Admin\AppData\Local\Temp\449E.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\44EC.tmp"C:\Users\Admin\AppData\Local\Temp\44EC.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\452B.tmp"C:\Users\Admin\AppData\Local\Temp\452B.tmp"65⤵
- Executes dropped EXE
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\4569.tmp"C:\Users\Admin\AppData\Local\Temp\4569.tmp"66⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\45B7.tmp"C:\Users\Admin\AppData\Local\Temp\45B7.tmp"67⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\45F6.tmp"C:\Users\Admin\AppData\Local\Temp\45F6.tmp"68⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\4634.tmp"C:\Users\Admin\AppData\Local\Temp\4634.tmp"69⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\4682.tmp"C:\Users\Admin\AppData\Local\Temp\4682.tmp"70⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\46C0.tmp"C:\Users\Admin\AppData\Local\Temp\46C0.tmp"71⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\470E.tmp"C:\Users\Admin\AppData\Local\Temp\470E.tmp"72⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\474D.tmp"C:\Users\Admin\AppData\Local\Temp\474D.tmp"73⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\478B.tmp"C:\Users\Admin\AppData\Local\Temp\478B.tmp"74⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\47CA.tmp"C:\Users\Admin\AppData\Local\Temp\47CA.tmp"75⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\4818.tmp"C:\Users\Admin\AppData\Local\Temp\4818.tmp"76⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\4856.tmp"C:\Users\Admin\AppData\Local\Temp\4856.tmp"77⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\4894.tmp"C:\Users\Admin\AppData\Local\Temp\4894.tmp"78⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\48E2.tmp"C:\Users\Admin\AppData\Local\Temp\48E2.tmp"79⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\4921.tmp"C:\Users\Admin\AppData\Local\Temp\4921.tmp"80⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\496F.tmp"C:\Users\Admin\AppData\Local\Temp\496F.tmp"81⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\49AD.tmp"C:\Users\Admin\AppData\Local\Temp\49AD.tmp"82⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\49EC.tmp"C:\Users\Admin\AppData\Local\Temp\49EC.tmp"83⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\4A3A.tmp"C:\Users\Admin\AppData\Local\Temp\4A3A.tmp"84⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\4A78.tmp"C:\Users\Admin\AppData\Local\Temp\4A78.tmp"85⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\4AB6.tmp"C:\Users\Admin\AppData\Local\Temp\4AB6.tmp"86⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\4AF5.tmp"C:\Users\Admin\AppData\Local\Temp\4AF5.tmp"87⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\4B43.tmp"C:\Users\Admin\AppData\Local\Temp\4B43.tmp"88⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\4B81.tmp"C:\Users\Admin\AppData\Local\Temp\4B81.tmp"89⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\4BC0.tmp"C:\Users\Admin\AppData\Local\Temp\4BC0.tmp"90⤵PID:596
-
C:\Users\Admin\AppData\Local\Temp\4BFE.tmp"C:\Users\Admin\AppData\Local\Temp\4BFE.tmp"91⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\4C4C.tmp"C:\Users\Admin\AppData\Local\Temp\4C4C.tmp"92⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"93⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"94⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"95⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\4D65.tmp"C:\Users\Admin\AppData\Local\Temp\4D65.tmp"96⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\4DB3.tmp"C:\Users\Admin\AppData\Local\Temp\4DB3.tmp"97⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"98⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"99⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"100⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"101⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"102⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"103⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"104⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\4FF4.tmp"C:\Users\Admin\AppData\Local\Temp\4FF4.tmp"105⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\5042.tmp"C:\Users\Admin\AppData\Local\Temp\5042.tmp"106⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\5080.tmp"C:\Users\Admin\AppData\Local\Temp\5080.tmp"107⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\50BF.tmp"C:\Users\Admin\AppData\Local\Temp\50BF.tmp"108⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\510D.tmp"C:\Users\Admin\AppData\Local\Temp\510D.tmp"109⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\515B.tmp"C:\Users\Admin\AppData\Local\Temp\515B.tmp"110⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\5199.tmp"C:\Users\Admin\AppData\Local\Temp\5199.tmp"111⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\51D8.tmp"C:\Users\Admin\AppData\Local\Temp\51D8.tmp"112⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\5216.tmp"C:\Users\Admin\AppData\Local\Temp\5216.tmp"113⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\5254.tmp"C:\Users\Admin\AppData\Local\Temp\5254.tmp"114⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\5293.tmp"C:\Users\Admin\AppData\Local\Temp\5293.tmp"115⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\52E1.tmp"C:\Users\Admin\AppData\Local\Temp\52E1.tmp"116⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\532F.tmp"C:\Users\Admin\AppData\Local\Temp\532F.tmp"117⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\537D.tmp"C:\Users\Admin\AppData\Local\Temp\537D.tmp"118⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\53BB.tmp"C:\Users\Admin\AppData\Local\Temp\53BB.tmp"119⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\5409.tmp"C:\Users\Admin\AppData\Local\Temp\5409.tmp"120⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\5448.tmp"C:\Users\Admin\AppData\Local\Temp\5448.tmp"121⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\5496.tmp"C:\Users\Admin\AppData\Local\Temp\5496.tmp"122⤵PID:2216
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-