Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
11-06-2024 02:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-11_6cd693e754feca1bad449db92ae0bbdf_mafia.exe
Resource
win7-20240508-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-11_6cd693e754feca1bad449db92ae0bbdf_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-06-11_6cd693e754feca1bad449db92ae0bbdf_mafia.exe
-
Size
529KB
-
MD5
6cd693e754feca1bad449db92ae0bbdf
-
SHA1
8c5f033511ff02a8a13ba483c184fe29571501ad
-
SHA256
ffdbafd04838dd46041352e14bb6f14e59475d50aba3774e82056e7534a2a20f
-
SHA512
8a1dc9a60f4cbc3aaa39662d4f14533bb9480193f571cd7b6de2b8d9007eed9751af6891e52ce0e36a1cc617001e2a892e36a189232a353b72ca57b4ab0e8676
-
SSDEEP
12288:NU5rCOTeij/14Fmij9aaWrOD6pZcKqbyTZwlH4Hp:NUQOJjiFh+pLVTSlH4Hp
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2192 114F.tmp 356 11CC.tmp 2084 1278.tmp 2716 12D5.tmp 2748 1362.tmp 2800 13DE.tmp 2796 145B.tmp 2852 14B9.tmp 2692 1574.tmp 2536 15F1.tmp 1884 166E.tmp 3036 16DB.tmp 2828 1748.tmp 2892 17B5.tmp 2880 1832.tmp 2928 189F.tmp 1972 18FD.tmp 2500 196A.tmp 2324 19D7.tmp 888 1A44.tmp 2512 1AC1.tmp 1812 1B2E.tmp 1668 1B8C.tmp 1540 1BCA.tmp 1796 1C18.tmp 2104 1C57.tmp 2976 1C95.tmp 2292 1CD4.tmp 1148 1D22.tmp 1872 1D60.tmp 264 1DAE.tmp 984 1DEC.tmp 1476 1E2B.tmp 1728 1E69.tmp 692 1EB7.tmp 1236 1EF6.tmp 904 1F44.tmp 684 1F82.tmp 1132 1FD0.tmp 2400 200E.tmp 1368 205C.tmp 1592 209B.tmp 688 20D9.tmp 604 2118.tmp 2040 2166.tmp 1648 21B4.tmp 956 2202.tmp 2416 2240.tmp 1780 227E.tmp 632 22BD.tmp 2204 22FB.tmp 2956 2349.tmp 868 2397.tmp 1092 23D6.tmp 2200 2424.tmp 3060 2462.tmp 3056 24A0.tmp 2604 24DF.tmp 2616 251D.tmp 1552 255C.tmp 2084 259A.tmp 2756 25D8.tmp 2672 2617.tmp 2748 2655.tmp -
Loads dropped DLL 64 IoCs
pid Process 3016 2024-06-11_6cd693e754feca1bad449db92ae0bbdf_mafia.exe 2192 114F.tmp 356 11CC.tmp 2084 1278.tmp 2716 12D5.tmp 2748 1362.tmp 2800 13DE.tmp 2796 145B.tmp 2852 14B9.tmp 2692 1574.tmp 2536 15F1.tmp 1884 166E.tmp 3036 16DB.tmp 2828 1748.tmp 2892 17B5.tmp 2880 1832.tmp 2928 189F.tmp 1972 18FD.tmp 2500 196A.tmp 2324 19D7.tmp 888 1A44.tmp 2512 1AC1.tmp 1812 1B2E.tmp 1668 1B8C.tmp 1540 1BCA.tmp 1796 1C18.tmp 2104 1C57.tmp 2976 1C95.tmp 2292 1CD4.tmp 1148 1D22.tmp 1872 1D60.tmp 264 1DAE.tmp 984 1DEC.tmp 1476 1E2B.tmp 1728 1E69.tmp 692 1EB7.tmp 1236 1EF6.tmp 904 1F44.tmp 684 1F82.tmp 1132 1FD0.tmp 2400 200E.tmp 1368 205C.tmp 1592 209B.tmp 688 20D9.tmp 604 2118.tmp 2040 2166.tmp 1648 21B4.tmp 956 2202.tmp 2416 2240.tmp 1780 227E.tmp 632 22BD.tmp 2204 22FB.tmp 2956 2349.tmp 868 2397.tmp 1092 23D6.tmp 2200 2424.tmp 3060 2462.tmp 3056 24A0.tmp 2604 24DF.tmp 2616 251D.tmp 1552 255C.tmp 2084 259A.tmp 2756 25D8.tmp 2672 2617.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3016 wrote to memory of 2192 3016 2024-06-11_6cd693e754feca1bad449db92ae0bbdf_mafia.exe 28 PID 3016 wrote to memory of 2192 3016 2024-06-11_6cd693e754feca1bad449db92ae0bbdf_mafia.exe 28 PID 3016 wrote to memory of 2192 3016 2024-06-11_6cd693e754feca1bad449db92ae0bbdf_mafia.exe 28 PID 3016 wrote to memory of 2192 3016 2024-06-11_6cd693e754feca1bad449db92ae0bbdf_mafia.exe 28 PID 2192 wrote to memory of 356 2192 114F.tmp 29 PID 2192 wrote to memory of 356 2192 114F.tmp 29 PID 2192 wrote to memory of 356 2192 114F.tmp 29 PID 2192 wrote to memory of 356 2192 114F.tmp 29 PID 356 wrote to memory of 2084 356 11CC.tmp 30 PID 356 wrote to memory of 2084 356 11CC.tmp 30 PID 356 wrote to memory of 2084 356 11CC.tmp 30 PID 356 wrote to memory of 2084 356 11CC.tmp 30 PID 2084 wrote to memory of 2716 2084 1278.tmp 31 PID 2084 wrote to memory of 2716 2084 1278.tmp 31 PID 2084 wrote to memory of 2716 2084 1278.tmp 31 PID 2084 wrote to memory of 2716 2084 1278.tmp 31 PID 2716 wrote to memory of 2748 2716 12D5.tmp 32 PID 2716 wrote to memory of 2748 2716 12D5.tmp 32 PID 2716 wrote to memory of 2748 2716 12D5.tmp 32 PID 2716 wrote to memory of 2748 2716 12D5.tmp 32 PID 2748 wrote to memory of 2800 2748 1362.tmp 33 PID 2748 wrote to memory of 2800 2748 1362.tmp 33 PID 2748 wrote to memory of 2800 2748 1362.tmp 33 PID 2748 wrote to memory of 2800 2748 1362.tmp 33 PID 2800 wrote to memory of 2796 2800 13DE.tmp 34 PID 2800 wrote to memory of 2796 2800 13DE.tmp 34 PID 2800 wrote to memory of 2796 2800 13DE.tmp 34 PID 2800 wrote to memory of 2796 2800 13DE.tmp 34 PID 2796 wrote to memory of 2852 2796 145B.tmp 35 PID 2796 wrote to memory of 2852 2796 145B.tmp 35 PID 2796 wrote to memory of 2852 2796 145B.tmp 35 PID 2796 wrote to memory of 2852 2796 145B.tmp 35 PID 2852 wrote to memory of 2692 2852 14B9.tmp 36 PID 2852 wrote to memory of 2692 2852 14B9.tmp 36 PID 2852 wrote to memory of 2692 2852 14B9.tmp 36 PID 2852 wrote to memory of 2692 2852 14B9.tmp 36 PID 2692 wrote to memory of 2536 2692 1574.tmp 37 PID 2692 wrote to memory of 2536 2692 1574.tmp 37 PID 2692 wrote to memory of 2536 2692 1574.tmp 37 PID 2692 wrote to memory of 2536 2692 1574.tmp 37 PID 2536 wrote to memory of 1884 2536 15F1.tmp 38 PID 2536 wrote to memory of 1884 2536 15F1.tmp 38 PID 2536 wrote to memory of 1884 2536 15F1.tmp 38 PID 2536 wrote to memory of 1884 2536 15F1.tmp 38 PID 1884 wrote to memory of 3036 1884 166E.tmp 39 PID 1884 wrote to memory of 3036 1884 166E.tmp 39 PID 1884 wrote to memory of 3036 1884 166E.tmp 39 PID 1884 wrote to memory of 3036 1884 166E.tmp 39 PID 3036 wrote to memory of 2828 3036 16DB.tmp 40 PID 3036 wrote to memory of 2828 3036 16DB.tmp 40 PID 3036 wrote to memory of 2828 3036 16DB.tmp 40 PID 3036 wrote to memory of 2828 3036 16DB.tmp 40 PID 2828 wrote to memory of 2892 2828 1748.tmp 41 PID 2828 wrote to memory of 2892 2828 1748.tmp 41 PID 2828 wrote to memory of 2892 2828 1748.tmp 41 PID 2828 wrote to memory of 2892 2828 1748.tmp 41 PID 2892 wrote to memory of 2880 2892 17B5.tmp 42 PID 2892 wrote to memory of 2880 2892 17B5.tmp 42 PID 2892 wrote to memory of 2880 2892 17B5.tmp 42 PID 2892 wrote to memory of 2880 2892 17B5.tmp 42 PID 2880 wrote to memory of 2928 2880 1832.tmp 43 PID 2880 wrote to memory of 2928 2880 1832.tmp 43 PID 2880 wrote to memory of 2928 2880 1832.tmp 43 PID 2880 wrote to memory of 2928 2880 1832.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_6cd693e754feca1bad449db92ae0bbdf_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-11_6cd693e754feca1bad449db92ae0bbdf_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\114F.tmp"C:\Users\Admin\AppData\Local\Temp\114F.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\11CC.tmp"C:\Users\Admin\AppData\Local\Temp\11CC.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:356 -
C:\Users\Admin\AppData\Local\Temp\1278.tmp"C:\Users\Admin\AppData\Local\Temp\1278.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\12D5.tmp"C:\Users\Admin\AppData\Local\Temp\12D5.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\1362.tmp"C:\Users\Admin\AppData\Local\Temp\1362.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\13DE.tmp"C:\Users\Admin\AppData\Local\Temp\13DE.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\145B.tmp"C:\Users\Admin\AppData\Local\Temp\145B.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\14B9.tmp"C:\Users\Admin\AppData\Local\Temp\14B9.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\1574.tmp"C:\Users\Admin\AppData\Local\Temp\1574.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\15F1.tmp"C:\Users\Admin\AppData\Local\Temp\15F1.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\166E.tmp"C:\Users\Admin\AppData\Local\Temp\166E.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\16DB.tmp"C:\Users\Admin\AppData\Local\Temp\16DB.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\1748.tmp"C:\Users\Admin\AppData\Local\Temp\1748.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\17B5.tmp"C:\Users\Admin\AppData\Local\Temp\17B5.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\1832.tmp"C:\Users\Admin\AppData\Local\Temp\1832.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\189F.tmp"C:\Users\Admin\AppData\Local\Temp\189F.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\18FD.tmp"C:\Users\Admin\AppData\Local\Temp\18FD.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\196A.tmp"C:\Users\Admin\AppData\Local\Temp\196A.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\19D7.tmp"C:\Users\Admin\AppData\Local\Temp\19D7.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\1A44.tmp"C:\Users\Admin\AppData\Local\Temp\1A44.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:888 -
C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\1B8C.tmp"C:\Users\Admin\AppData\Local\Temp\1B8C.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\1C18.tmp"C:\Users\Admin\AppData\Local\Temp\1C18.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\1C57.tmp"C:\Users\Admin\AppData\Local\Temp\1C57.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\1C95.tmp"C:\Users\Admin\AppData\Local\Temp\1C95.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\1CD4.tmp"C:\Users\Admin\AppData\Local\Temp\1CD4.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\1D22.tmp"C:\Users\Admin\AppData\Local\Temp\1D22.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\1D60.tmp"C:\Users\Admin\AppData\Local\Temp\1D60.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:264 -
C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:984 -
C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\1E69.tmp"C:\Users\Admin\AppData\Local\Temp\1E69.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:692 -
C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\1F44.tmp"C:\Users\Admin\AppData\Local\Temp\1F44.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:904 -
C:\Users\Admin\AppData\Local\Temp\1F82.tmp"C:\Users\Admin\AppData\Local\Temp\1F82.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:684 -
C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\200E.tmp"C:\Users\Admin\AppData\Local\Temp\200E.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\205C.tmp"C:\Users\Admin\AppData\Local\Temp\205C.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\209B.tmp"C:\Users\Admin\AppData\Local\Temp\209B.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\20D9.tmp"C:\Users\Admin\AppData\Local\Temp\20D9.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:688 -
C:\Users\Admin\AppData\Local\Temp\2118.tmp"C:\Users\Admin\AppData\Local\Temp\2118.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:604 -
C:\Users\Admin\AppData\Local\Temp\2166.tmp"C:\Users\Admin\AppData\Local\Temp\2166.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\21B4.tmp"C:\Users\Admin\AppData\Local\Temp\21B4.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\2202.tmp"C:\Users\Admin\AppData\Local\Temp\2202.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:956 -
C:\Users\Admin\AppData\Local\Temp\2240.tmp"C:\Users\Admin\AppData\Local\Temp\2240.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\227E.tmp"C:\Users\Admin\AppData\Local\Temp\227E.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\22BD.tmp"C:\Users\Admin\AppData\Local\Temp\22BD.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:632 -
C:\Users\Admin\AppData\Local\Temp\22FB.tmp"C:\Users\Admin\AppData\Local\Temp\22FB.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\2349.tmp"C:\Users\Admin\AppData\Local\Temp\2349.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\2397.tmp"C:\Users\Admin\AppData\Local\Temp\2397.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:868 -
C:\Users\Admin\AppData\Local\Temp\23D6.tmp"C:\Users\Admin\AppData\Local\Temp\23D6.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\2424.tmp"C:\Users\Admin\AppData\Local\Temp\2424.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\24A0.tmp"C:\Users\Admin\AppData\Local\Temp\24A0.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\24DF.tmp"C:\Users\Admin\AppData\Local\Temp\24DF.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\251D.tmp"C:\Users\Admin\AppData\Local\Temp\251D.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\259A.tmp"C:\Users\Admin\AppData\Local\Temp\259A.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\25D8.tmp"C:\Users\Admin\AppData\Local\Temp\25D8.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\2655.tmp"C:\Users\Admin\AppData\Local\Temp\2655.tmp"65⤵
- Executes dropped EXE
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\2694.tmp"C:\Users\Admin\AppData\Local\Temp\2694.tmp"66⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\26D2.tmp"C:\Users\Admin\AppData\Local\Temp\26D2.tmp"67⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\2710.tmp"C:\Users\Admin\AppData\Local\Temp\2710.tmp"68⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\275E.tmp"C:\Users\Admin\AppData\Local\Temp\275E.tmp"69⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\279D.tmp"C:\Users\Admin\AppData\Local\Temp\279D.tmp"70⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\27DB.tmp"C:\Users\Admin\AppData\Local\Temp\27DB.tmp"71⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\281A.tmp"C:\Users\Admin\AppData\Local\Temp\281A.tmp"72⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\2858.tmp"C:\Users\Admin\AppData\Local\Temp\2858.tmp"73⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\2896.tmp"C:\Users\Admin\AppData\Local\Temp\2896.tmp"74⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\28D5.tmp"C:\Users\Admin\AppData\Local\Temp\28D5.tmp"75⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\2913.tmp"C:\Users\Admin\AppData\Local\Temp\2913.tmp"76⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\2952.tmp"C:\Users\Admin\AppData\Local\Temp\2952.tmp"77⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\2990.tmp"C:\Users\Admin\AppData\Local\Temp\2990.tmp"78⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\29CE.tmp"C:\Users\Admin\AppData\Local\Temp\29CE.tmp"79⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"80⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"81⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\2A99.tmp"C:\Users\Admin\AppData\Local\Temp\2A99.tmp"82⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"83⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\2B16.tmp"C:\Users\Admin\AppData\Local\Temp\2B16.tmp"84⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\2B54.tmp"C:\Users\Admin\AppData\Local\Temp\2B54.tmp"85⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\2B93.tmp"C:\Users\Admin\AppData\Local\Temp\2B93.tmp"86⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"87⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\2C10.tmp"C:\Users\Admin\AppData\Local\Temp\2C10.tmp"88⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"89⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"90⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"91⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\2D09.tmp"C:\Users\Admin\AppData\Local\Temp\2D09.tmp"92⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\2D48.tmp"C:\Users\Admin\AppData\Local\Temp\2D48.tmp"93⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\2D86.tmp"C:\Users\Admin\AppData\Local\Temp\2D86.tmp"94⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"95⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"96⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\2E32.tmp"C:\Users\Admin\AppData\Local\Temp\2E32.tmp"97⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\2E70.tmp"C:\Users\Admin\AppData\Local\Temp\2E70.tmp"98⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"99⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\2EED.tmp"C:\Users\Admin\AppData\Local\Temp\2EED.tmp"100⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"101⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\2F79.tmp"C:\Users\Admin\AppData\Local\Temp\2F79.tmp"102⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"103⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"104⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\3034.tmp"C:\Users\Admin\AppData\Local\Temp\3034.tmp"105⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\3073.tmp"C:\Users\Admin\AppData\Local\Temp\3073.tmp"106⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\30B1.tmp"C:\Users\Admin\AppData\Local\Temp\30B1.tmp"107⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\30F0.tmp"C:\Users\Admin\AppData\Local\Temp\30F0.tmp"108⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\312E.tmp"C:\Users\Admin\AppData\Local\Temp\312E.tmp"109⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\316C.tmp"C:\Users\Admin\AppData\Local\Temp\316C.tmp"110⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\31AB.tmp"C:\Users\Admin\AppData\Local\Temp\31AB.tmp"111⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\31E9.tmp"C:\Users\Admin\AppData\Local\Temp\31E9.tmp"112⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\3228.tmp"C:\Users\Admin\AppData\Local\Temp\3228.tmp"113⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\3266.tmp"C:\Users\Admin\AppData\Local\Temp\3266.tmp"114⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\32A4.tmp"C:\Users\Admin\AppData\Local\Temp\32A4.tmp"115⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\32E3.tmp"C:\Users\Admin\AppData\Local\Temp\32E3.tmp"116⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\3321.tmp"C:\Users\Admin\AppData\Local\Temp\3321.tmp"117⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\3360.tmp"C:\Users\Admin\AppData\Local\Temp\3360.tmp"118⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\339E.tmp"C:\Users\Admin\AppData\Local\Temp\339E.tmp"119⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\33DC.tmp"C:\Users\Admin\AppData\Local\Temp\33DC.tmp"120⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\341B.tmp"C:\Users\Admin\AppData\Local\Temp\341B.tmp"121⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\3459.tmp"C:\Users\Admin\AppData\Local\Temp\3459.tmp"122⤵PID:2452
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-