Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25/05/2024, 00:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-25_0fbeadb3d35d4128c14718bb0da13905_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-25_0fbeadb3d35d4128c14718bb0da13905_mafia.exe
Resource
win10v2004-20240426-en
2 signatures
150 seconds
General
-
Target
2024-05-25_0fbeadb3d35d4128c14718bb0da13905_mafia.exe
-
Size
529KB
-
MD5
0fbeadb3d35d4128c14718bb0da13905
-
SHA1
c100703641712f8411b98027cfdccbe39fb11a84
-
SHA256
edf8b1fa22b6dd32ebbbbd0e31c1ea94de9cab2cbc2adfe9113059ce68c3e126
-
SHA512
d010e7cd68eef8143be35cde7b122fe88ca7e8a9af994c674471b4f4b0b7514ad4eeb3324b9fdc1c4e96afe34cb1c274e7079a961b548ce7dd1b17f00a692547
-
SSDEEP
12288:NU5rCOTeij3kMB9NgbpTGvc+bIEAiATZwlH4Hp:NUQOJj3PB9NapGNbIEATSlH4Hp
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1996 1FB1.tmp 2164 203D.tmp 3040 20E9.tmp 2588 2185.tmp 2676 2221.tmp 2572 22AD.tmp 2716 233A.tmp 2472 23D6.tmp 2492 2462.tmp 2456 24FE.tmp 1656 258A.tmp 2620 2626.tmp 1648 26C2.tmp 2928 273F.tmp 2984 27DB.tmp 2752 2877.tmp 300 2913.tmp 1424 29AF.tmp 2772 2A4B.tmp 1928 2AD8.tmp 2768 2B74.tmp 1840 2C10.tmp 1412 2C8C.tmp 1292 2CDA.tmp 800 2D28.tmp 2104 2D76.tmp 2056 2DC4.tmp 2088 2E12.tmp 1252 2E70.tmp 2876 2EAE.tmp 2864 2EFC.tmp 336 2F4A.tmp 632 2F98.tmp 1736 2FE6.tmp 2132 3034.tmp 2988 3082.tmp 1532 30C1.tmp 452 310F.tmp 2412 315D.tmp 2276 319B.tmp 1284 31E9.tmp 1336 3237.tmp 1828 32A4.tmp 604 32E3.tmp 1792 3331.tmp 2872 338E.tmp 656 33DC.tmp 692 341B.tmp 1856 3469.tmp 352 34A7.tmp 1300 34F5.tmp 1788 3534.tmp 876 3582.tmp 1680 35D0.tmp 2232 361E.tmp 1576 365C.tmp 2096 369A.tmp 2136 36E8.tmp 2180 3727.tmp 2172 3765.tmp 2128 37B3.tmp 2656 3801.tmp 2592 384F.tmp 2720 388E.tmp -
Loads dropped DLL 64 IoCs
pid Process 1652 2024-05-25_0fbeadb3d35d4128c14718bb0da13905_mafia.exe 1996 1FB1.tmp 2164 203D.tmp 3040 20E9.tmp 2588 2185.tmp 2676 2221.tmp 2572 22AD.tmp 2716 233A.tmp 2472 23D6.tmp 2492 2462.tmp 2456 24FE.tmp 1656 258A.tmp 2620 2626.tmp 1648 26C2.tmp 2928 273F.tmp 2984 27DB.tmp 2752 2877.tmp 300 2913.tmp 1424 29AF.tmp 2772 2A4B.tmp 1928 2AD8.tmp 2768 2B74.tmp 1840 2C10.tmp 1412 2C8C.tmp 1292 2CDA.tmp 800 2D28.tmp 2104 2D76.tmp 2056 2DC4.tmp 2088 2E12.tmp 1252 2E70.tmp 2876 2EAE.tmp 2864 2EFC.tmp 336 2F4A.tmp 632 2F98.tmp 1736 2FE6.tmp 2132 3034.tmp 2988 3082.tmp 1532 30C1.tmp 452 310F.tmp 2412 315D.tmp 2276 319B.tmp 1284 31E9.tmp 1336 3237.tmp 1828 32A4.tmp 604 32E3.tmp 1792 3331.tmp 2872 338E.tmp 656 33DC.tmp 692 341B.tmp 1856 3469.tmp 352 34A7.tmp 1300 34F5.tmp 1788 3534.tmp 876 3582.tmp 1680 35D0.tmp 2232 361E.tmp 1576 365C.tmp 2096 369A.tmp 2136 36E8.tmp 2180 3727.tmp 2172 3765.tmp 2128 37B3.tmp 2656 3801.tmp 2592 384F.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1652 wrote to memory of 1996 1652 2024-05-25_0fbeadb3d35d4128c14718bb0da13905_mafia.exe 28 PID 1652 wrote to memory of 1996 1652 2024-05-25_0fbeadb3d35d4128c14718bb0da13905_mafia.exe 28 PID 1652 wrote to memory of 1996 1652 2024-05-25_0fbeadb3d35d4128c14718bb0da13905_mafia.exe 28 PID 1652 wrote to memory of 1996 1652 2024-05-25_0fbeadb3d35d4128c14718bb0da13905_mafia.exe 28 PID 1996 wrote to memory of 2164 1996 1FB1.tmp 29 PID 1996 wrote to memory of 2164 1996 1FB1.tmp 29 PID 1996 wrote to memory of 2164 1996 1FB1.tmp 29 PID 1996 wrote to memory of 2164 1996 1FB1.tmp 29 PID 2164 wrote to memory of 3040 2164 203D.tmp 30 PID 2164 wrote to memory of 3040 2164 203D.tmp 30 PID 2164 wrote to memory of 3040 2164 203D.tmp 30 PID 2164 wrote to memory of 3040 2164 203D.tmp 30 PID 3040 wrote to memory of 2588 3040 20E9.tmp 31 PID 3040 wrote to memory of 2588 3040 20E9.tmp 31 PID 3040 wrote to memory of 2588 3040 20E9.tmp 31 PID 3040 wrote to memory of 2588 3040 20E9.tmp 31 PID 2588 wrote to memory of 2676 2588 2185.tmp 32 PID 2588 wrote to memory of 2676 2588 2185.tmp 32 PID 2588 wrote to memory of 2676 2588 2185.tmp 32 PID 2588 wrote to memory of 2676 2588 2185.tmp 32 PID 2676 wrote to memory of 2572 2676 2221.tmp 33 PID 2676 wrote to memory of 2572 2676 2221.tmp 33 PID 2676 wrote to memory of 2572 2676 2221.tmp 33 PID 2676 wrote to memory of 2572 2676 2221.tmp 33 PID 2572 wrote to memory of 2716 2572 22AD.tmp 34 PID 2572 wrote to memory of 2716 2572 22AD.tmp 34 PID 2572 wrote to memory of 2716 2572 22AD.tmp 34 PID 2572 wrote to memory of 2716 2572 22AD.tmp 34 PID 2716 wrote to memory of 2472 2716 233A.tmp 35 PID 2716 wrote to memory of 2472 2716 233A.tmp 35 PID 2716 wrote to memory of 2472 2716 233A.tmp 35 PID 2716 wrote to memory of 2472 2716 233A.tmp 35 PID 2472 wrote to memory of 2492 2472 23D6.tmp 36 PID 2472 wrote to memory of 2492 2472 23D6.tmp 36 PID 2472 wrote to memory of 2492 2472 23D6.tmp 36 PID 2472 wrote to memory of 2492 2472 23D6.tmp 36 PID 2492 wrote to memory of 2456 2492 2462.tmp 37 PID 2492 wrote to memory of 2456 2492 2462.tmp 37 PID 2492 wrote to memory of 2456 2492 2462.tmp 37 PID 2492 wrote to memory of 2456 2492 2462.tmp 37 PID 2456 wrote to memory of 1656 2456 24FE.tmp 38 PID 2456 wrote to memory of 1656 2456 24FE.tmp 38 PID 2456 wrote to memory of 1656 2456 24FE.tmp 38 PID 2456 wrote to memory of 1656 2456 24FE.tmp 38 PID 1656 wrote to memory of 2620 1656 258A.tmp 39 PID 1656 wrote to memory of 2620 1656 258A.tmp 39 PID 1656 wrote to memory of 2620 1656 258A.tmp 39 PID 1656 wrote to memory of 2620 1656 258A.tmp 39 PID 2620 wrote to memory of 1648 2620 2626.tmp 40 PID 2620 wrote to memory of 1648 2620 2626.tmp 40 PID 2620 wrote to memory of 1648 2620 2626.tmp 40 PID 2620 wrote to memory of 1648 2620 2626.tmp 40 PID 1648 wrote to memory of 2928 1648 26C2.tmp 41 PID 1648 wrote to memory of 2928 1648 26C2.tmp 41 PID 1648 wrote to memory of 2928 1648 26C2.tmp 41 PID 1648 wrote to memory of 2928 1648 26C2.tmp 41 PID 2928 wrote to memory of 2984 2928 273F.tmp 42 PID 2928 wrote to memory of 2984 2928 273F.tmp 42 PID 2928 wrote to memory of 2984 2928 273F.tmp 42 PID 2928 wrote to memory of 2984 2928 273F.tmp 42 PID 2984 wrote to memory of 2752 2984 27DB.tmp 43 PID 2984 wrote to memory of 2752 2984 27DB.tmp 43 PID 2984 wrote to memory of 2752 2984 27DB.tmp 43 PID 2984 wrote to memory of 2752 2984 27DB.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_0fbeadb3d35d4128c14718bb0da13905_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-25_0fbeadb3d35d4128c14718bb0da13905_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\203D.tmp"C:\Users\Admin\AppData\Local\Temp\203D.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\20E9.tmp"C:\Users\Admin\AppData\Local\Temp\20E9.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\2185.tmp"C:\Users\Admin\AppData\Local\Temp\2185.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\2221.tmp"C:\Users\Admin\AppData\Local\Temp\2221.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\22AD.tmp"C:\Users\Admin\AppData\Local\Temp\22AD.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\233A.tmp"C:\Users\Admin\AppData\Local\Temp\233A.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\23D6.tmp"C:\Users\Admin\AppData\Local\Temp\23D6.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\24FE.tmp"C:\Users\Admin\AppData\Local\Temp\24FE.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\258A.tmp"C:\Users\Admin\AppData\Local\Temp\258A.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\2626.tmp"C:\Users\Admin\AppData\Local\Temp\2626.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\26C2.tmp"C:\Users\Admin\AppData\Local\Temp\26C2.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\273F.tmp"C:\Users\Admin\AppData\Local\Temp\273F.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\27DB.tmp"C:\Users\Admin\AppData\Local\Temp\27DB.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\2877.tmp"C:\Users\Admin\AppData\Local\Temp\2877.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\2913.tmp"C:\Users\Admin\AppData\Local\Temp\2913.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:300 -
C:\Users\Admin\AppData\Local\Temp\29AF.tmp"C:\Users\Admin\AppData\Local\Temp\29AF.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\2B74.tmp"C:\Users\Admin\AppData\Local\Temp\2B74.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\2C10.tmp"C:\Users\Admin\AppData\Local\Temp\2C10.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\2D28.tmp"C:\Users\Admin\AppData\Local\Temp\2D28.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:800 -
C:\Users\Admin\AppData\Local\Temp\2D76.tmp"C:\Users\Admin\AppData\Local\Temp\2D76.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\2E12.tmp"C:\Users\Admin\AppData\Local\Temp\2E12.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\2E70.tmp"C:\Users\Admin\AppData\Local\Temp\2E70.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:336 -
C:\Users\Admin\AppData\Local\Temp\2F98.tmp"C:\Users\Admin\AppData\Local\Temp\2F98.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:632 -
C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\3034.tmp"C:\Users\Admin\AppData\Local\Temp\3034.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\3082.tmp"C:\Users\Admin\AppData\Local\Temp\3082.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\30C1.tmp"C:\Users\Admin\AppData\Local\Temp\30C1.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\310F.tmp"C:\Users\Admin\AppData\Local\Temp\310F.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:452 -
C:\Users\Admin\AppData\Local\Temp\315D.tmp"C:\Users\Admin\AppData\Local\Temp\315D.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\319B.tmp"C:\Users\Admin\AppData\Local\Temp\319B.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\31E9.tmp"C:\Users\Admin\AppData\Local\Temp\31E9.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\3237.tmp"C:\Users\Admin\AppData\Local\Temp\3237.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\32A4.tmp"C:\Users\Admin\AppData\Local\Temp\32A4.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\32E3.tmp"C:\Users\Admin\AppData\Local\Temp\32E3.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:604 -
C:\Users\Admin\AppData\Local\Temp\3331.tmp"C:\Users\Admin\AppData\Local\Temp\3331.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\338E.tmp"C:\Users\Admin\AppData\Local\Temp\338E.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\33DC.tmp"C:\Users\Admin\AppData\Local\Temp\33DC.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:656 -
C:\Users\Admin\AppData\Local\Temp\341B.tmp"C:\Users\Admin\AppData\Local\Temp\341B.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:692 -
C:\Users\Admin\AppData\Local\Temp\3469.tmp"C:\Users\Admin\AppData\Local\Temp\3469.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\34A7.tmp"C:\Users\Admin\AppData\Local\Temp\34A7.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:352 -
C:\Users\Admin\AppData\Local\Temp\34F5.tmp"C:\Users\Admin\AppData\Local\Temp\34F5.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\3534.tmp"C:\Users\Admin\AppData\Local\Temp\3534.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\3582.tmp"C:\Users\Admin\AppData\Local\Temp\3582.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:876 -
C:\Users\Admin\AppData\Local\Temp\35D0.tmp"C:\Users\Admin\AppData\Local\Temp\35D0.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\361E.tmp"C:\Users\Admin\AppData\Local\Temp\361E.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\365C.tmp"C:\Users\Admin\AppData\Local\Temp\365C.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\369A.tmp"C:\Users\Admin\AppData\Local\Temp\369A.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\36E8.tmp"C:\Users\Admin\AppData\Local\Temp\36E8.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\3727.tmp"C:\Users\Admin\AppData\Local\Temp\3727.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\3765.tmp"C:\Users\Admin\AppData\Local\Temp\3765.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\37B3.tmp"C:\Users\Admin\AppData\Local\Temp\37B3.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\3801.tmp"C:\Users\Admin\AppData\Local\Temp\3801.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\384F.tmp"C:\Users\Admin\AppData\Local\Temp\384F.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\388E.tmp"C:\Users\Admin\AppData\Local\Temp\388E.tmp"65⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\38DC.tmp"C:\Users\Admin\AppData\Local\Temp\38DC.tmp"66⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\391A.tmp"C:\Users\Admin\AppData\Local\Temp\391A.tmp"67⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\3958.tmp"C:\Users\Admin\AppData\Local\Temp\3958.tmp"68⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\3997.tmp"C:\Users\Admin\AppData\Local\Temp\3997.tmp"69⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\39E5.tmp"C:\Users\Admin\AppData\Local\Temp\39E5.tmp"70⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\3A33.tmp"C:\Users\Admin\AppData\Local\Temp\3A33.tmp"71⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\3A81.tmp"C:\Users\Admin\AppData\Local\Temp\3A81.tmp"72⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\3ABF.tmp"C:\Users\Admin\AppData\Local\Temp\3ABF.tmp"73⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\3B0D.tmp"C:\Users\Admin\AppData\Local\Temp\3B0D.tmp"74⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\3B4C.tmp"C:\Users\Admin\AppData\Local\Temp\3B4C.tmp"75⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\3B9A.tmp"C:\Users\Admin\AppData\Local\Temp\3B9A.tmp"76⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\3BE8.tmp"C:\Users\Admin\AppData\Local\Temp\3BE8.tmp"77⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\3C36.tmp"C:\Users\Admin\AppData\Local\Temp\3C36.tmp"78⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\3C74.tmp"C:\Users\Admin\AppData\Local\Temp\3C74.tmp"79⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\3CB2.tmp"C:\Users\Admin\AppData\Local\Temp\3CB2.tmp"80⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\3CF1.tmp"C:\Users\Admin\AppData\Local\Temp\3CF1.tmp"81⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\3D3F.tmp"C:\Users\Admin\AppData\Local\Temp\3D3F.tmp"82⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\3D7D.tmp"C:\Users\Admin\AppData\Local\Temp\3D7D.tmp"83⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\3DBC.tmp"C:\Users\Admin\AppData\Local\Temp\3DBC.tmp"84⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\3DFA.tmp"C:\Users\Admin\AppData\Local\Temp\3DFA.tmp"85⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\3E38.tmp"C:\Users\Admin\AppData\Local\Temp\3E38.tmp"86⤵PID:356
-
C:\Users\Admin\AppData\Local\Temp\3E77.tmp"C:\Users\Admin\AppData\Local\Temp\3E77.tmp"87⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\3EC5.tmp"C:\Users\Admin\AppData\Local\Temp\3EC5.tmp"88⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\3F13.tmp"C:\Users\Admin\AppData\Local\Temp\3F13.tmp"89⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\3F61.tmp"C:\Users\Admin\AppData\Local\Temp\3F61.tmp"90⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\3F9F.tmp"C:\Users\Admin\AppData\Local\Temp\3F9F.tmp"91⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\3FED.tmp"C:\Users\Admin\AppData\Local\Temp\3FED.tmp"92⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\402C.tmp"C:\Users\Admin\AppData\Local\Temp\402C.tmp"93⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\407A.tmp"C:\Users\Admin\AppData\Local\Temp\407A.tmp"94⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\40C8.tmp"C:\Users\Admin\AppData\Local\Temp\40C8.tmp"95⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\4116.tmp"C:\Users\Admin\AppData\Local\Temp\4116.tmp"96⤵PID:472
-
C:\Users\Admin\AppData\Local\Temp\4154.tmp"C:\Users\Admin\AppData\Local\Temp\4154.tmp"97⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\41A2.tmp"C:\Users\Admin\AppData\Local\Temp\41A2.tmp"98⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\41E0.tmp"C:\Users\Admin\AppData\Local\Temp\41E0.tmp"99⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\422E.tmp"C:\Users\Admin\AppData\Local\Temp\422E.tmp"100⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\426D.tmp"C:\Users\Admin\AppData\Local\Temp\426D.tmp"101⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\42BB.tmp"C:\Users\Admin\AppData\Local\Temp\42BB.tmp"102⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\42F9.tmp"C:\Users\Admin\AppData\Local\Temp\42F9.tmp"103⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\4338.tmp"C:\Users\Admin\AppData\Local\Temp\4338.tmp"104⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\4386.tmp"C:\Users\Admin\AppData\Local\Temp\4386.tmp"105⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\43D4.tmp"C:\Users\Admin\AppData\Local\Temp\43D4.tmp"106⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\4412.tmp"C:\Users\Admin\AppData\Local\Temp\4412.tmp"107⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\4450.tmp"C:\Users\Admin\AppData\Local\Temp\4450.tmp"108⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\448F.tmp"C:\Users\Admin\AppData\Local\Temp\448F.tmp"109⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\44DD.tmp"C:\Users\Admin\AppData\Local\Temp\44DD.tmp"110⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\451B.tmp"C:\Users\Admin\AppData\Local\Temp\451B.tmp"111⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\455A.tmp"C:\Users\Admin\AppData\Local\Temp\455A.tmp"112⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\4598.tmp"C:\Users\Admin\AppData\Local\Temp\4598.tmp"113⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\45D6.tmp"C:\Users\Admin\AppData\Local\Temp\45D6.tmp"114⤵PID:604
-
C:\Users\Admin\AppData\Local\Temp\4615.tmp"C:\Users\Admin\AppData\Local\Temp\4615.tmp"115⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\4672.tmp"C:\Users\Admin\AppData\Local\Temp\4672.tmp"116⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\46B1.tmp"C:\Users\Admin\AppData\Local\Temp\46B1.tmp"117⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\46FF.tmp"C:\Users\Admin\AppData\Local\Temp\46FF.tmp"118⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\474D.tmp"C:\Users\Admin\AppData\Local\Temp\474D.tmp"119⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\479B.tmp"C:\Users\Admin\AppData\Local\Temp\479B.tmp"120⤵PID:352
-
C:\Users\Admin\AppData\Local\Temp\47E9.tmp"C:\Users\Admin\AppData\Local\Temp\47E9.tmp"121⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\4837.tmp"C:\Users\Admin\AppData\Local\Temp\4837.tmp"122⤵PID:1788
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-