Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12-06-2024 17:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-12_9f35217194023cddac7c09f6b40daa81_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-12_9f35217194023cddac7c09f6b40daa81_mafia.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-06-12_9f35217194023cddac7c09f6b40daa81_mafia.exe
-
Size
529KB
-
MD5
9f35217194023cddac7c09f6b40daa81
-
SHA1
a4a99a9f24915188e88b1314bbc0b5b3d3eb8e98
-
SHA256
8be9de73f152212cb189cdd4d2a2819abe18bfe1b77dcec1c780ff8b851a0ff9
-
SHA512
912bb7b88d6ba078196051bd8725dfdd1f15ffef4dcbf6c2da0a0ff52e26164a10a3ee0ee9b9c27536d93667160f44be15d09d694b82ea694d9b5f0287b66ee8
-
SSDEEP
12288:NU5rCOTeijTFD7kxoM//Dr2rz4kTZwlH4Hp:NUQOJjTF8z/4TSlH4Hp
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 880 1A92.tmp 2212 1B1F.tmp 2224 1BDA.tmp 2612 1C66.tmp 1976 1D02.tmp 2640 1D7F.tmp 2592 1DCD.tmp 2704 1E5A.tmp 2596 1EF6.tmp 2608 1F92.tmp 2664 201E.tmp 2460 209B.tmp 2944 2137.tmp 2476 21A4.tmp 2536 21E2.tmp 1448 227E.tmp 1476 22CC.tmp 1288 233A.tmp 1964 23C6.tmp 2928 2443.tmp 2752 24CF.tmp 2948 253C.tmp 2932 25B9.tmp 1188 25F8.tmp 2120 2646.tmp 2000 2694.tmp 2264 26E2.tmp 1948 2730.tmp 1820 276E.tmp 2092 27BC.tmp 540 280A.tmp 576 2858.tmp 1380 28A6.tmp 1740 28E4.tmp 1816 2923.tmp 788 2971.tmp 656 29AF.tmp 2380 29FD.tmp 3052 2A3C.tmp 2272 2A7A.tmp 1344 2AC8.tmp 1532 2B16.tmp 1340 2B64.tmp 948 2BA2.tmp 1984 2BF0.tmp 772 2C2F.tmp 1916 2C6D.tmp 1776 2CAC.tmp 2884 2CFA.tmp 844 2D38.tmp 548 2D86.tmp 3048 2DE4.tmp 1756 2E32.tmp 2284 2E70.tmp 2880 2EAE.tmp 1584 2EED.tmp 1668 2F3B.tmp 2180 2F89.tmp 1028 2FC7.tmp 1648 3025.tmp 1692 3073.tmp 2288 30B1.tmp 1044 30F0.tmp 2644 313E.tmp -
Loads dropped DLL 64 IoCs
pid Process 2512 2024-06-12_9f35217194023cddac7c09f6b40daa81_mafia.exe 880 1A92.tmp 2212 1B1F.tmp 2224 1BDA.tmp 2612 1C66.tmp 1976 1D02.tmp 2640 1D7F.tmp 2592 1DCD.tmp 2704 1E5A.tmp 2596 1EF6.tmp 2608 1F92.tmp 2664 201E.tmp 2460 209B.tmp 2944 2137.tmp 2476 21A4.tmp 2536 21E2.tmp 1448 227E.tmp 1476 22CC.tmp 1288 233A.tmp 1964 23C6.tmp 2928 2443.tmp 2752 24CF.tmp 2948 253C.tmp 2932 25B9.tmp 1188 25F8.tmp 2120 2646.tmp 2000 2694.tmp 2264 26E2.tmp 1948 2730.tmp 1820 276E.tmp 2092 27BC.tmp 540 280A.tmp 576 2858.tmp 1380 28A6.tmp 1740 28E4.tmp 1816 2923.tmp 788 2971.tmp 656 29AF.tmp 2380 29FD.tmp 3052 2A3C.tmp 2272 2A7A.tmp 1344 2AC8.tmp 1532 2B16.tmp 1340 2B64.tmp 948 2BA2.tmp 1984 2BF0.tmp 772 2C2F.tmp 1916 2C6D.tmp 1776 2CAC.tmp 2884 2CFA.tmp 844 2D38.tmp 548 2D86.tmp 3048 2DE4.tmp 1756 2E32.tmp 2284 2E70.tmp 2880 2EAE.tmp 1584 2EED.tmp 1668 2F3B.tmp 2180 2F89.tmp 1028 2FC7.tmp 1648 3025.tmp 1692 3073.tmp 2288 30B1.tmp 1044 30F0.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2512 wrote to memory of 880 2512 2024-06-12_9f35217194023cddac7c09f6b40daa81_mafia.exe 28 PID 2512 wrote to memory of 880 2512 2024-06-12_9f35217194023cddac7c09f6b40daa81_mafia.exe 28 PID 2512 wrote to memory of 880 2512 2024-06-12_9f35217194023cddac7c09f6b40daa81_mafia.exe 28 PID 2512 wrote to memory of 880 2512 2024-06-12_9f35217194023cddac7c09f6b40daa81_mafia.exe 28 PID 880 wrote to memory of 2212 880 1A92.tmp 29 PID 880 wrote to memory of 2212 880 1A92.tmp 29 PID 880 wrote to memory of 2212 880 1A92.tmp 29 PID 880 wrote to memory of 2212 880 1A92.tmp 29 PID 2212 wrote to memory of 2224 2212 1B1F.tmp 30 PID 2212 wrote to memory of 2224 2212 1B1F.tmp 30 PID 2212 wrote to memory of 2224 2212 1B1F.tmp 30 PID 2212 wrote to memory of 2224 2212 1B1F.tmp 30 PID 2224 wrote to memory of 2612 2224 1BDA.tmp 31 PID 2224 wrote to memory of 2612 2224 1BDA.tmp 31 PID 2224 wrote to memory of 2612 2224 1BDA.tmp 31 PID 2224 wrote to memory of 2612 2224 1BDA.tmp 31 PID 2612 wrote to memory of 1976 2612 1C66.tmp 32 PID 2612 wrote to memory of 1976 2612 1C66.tmp 32 PID 2612 wrote to memory of 1976 2612 1C66.tmp 32 PID 2612 wrote to memory of 1976 2612 1C66.tmp 32 PID 1976 wrote to memory of 2640 1976 1D02.tmp 33 PID 1976 wrote to memory of 2640 1976 1D02.tmp 33 PID 1976 wrote to memory of 2640 1976 1D02.tmp 33 PID 1976 wrote to memory of 2640 1976 1D02.tmp 33 PID 2640 wrote to memory of 2592 2640 1D7F.tmp 34 PID 2640 wrote to memory of 2592 2640 1D7F.tmp 34 PID 2640 wrote to memory of 2592 2640 1D7F.tmp 34 PID 2640 wrote to memory of 2592 2640 1D7F.tmp 34 PID 2592 wrote to memory of 2704 2592 1DCD.tmp 35 PID 2592 wrote to memory of 2704 2592 1DCD.tmp 35 PID 2592 wrote to memory of 2704 2592 1DCD.tmp 35 PID 2592 wrote to memory of 2704 2592 1DCD.tmp 35 PID 2704 wrote to memory of 2596 2704 1E5A.tmp 36 PID 2704 wrote to memory of 2596 2704 1E5A.tmp 36 PID 2704 wrote to memory of 2596 2704 1E5A.tmp 36 PID 2704 wrote to memory of 2596 2704 1E5A.tmp 36 PID 2596 wrote to memory of 2608 2596 1EF6.tmp 37 PID 2596 wrote to memory of 2608 2596 1EF6.tmp 37 PID 2596 wrote to memory of 2608 2596 1EF6.tmp 37 PID 2596 wrote to memory of 2608 2596 1EF6.tmp 37 PID 2608 wrote to memory of 2664 2608 1F92.tmp 38 PID 2608 wrote to memory of 2664 2608 1F92.tmp 38 PID 2608 wrote to memory of 2664 2608 1F92.tmp 38 PID 2608 wrote to memory of 2664 2608 1F92.tmp 38 PID 2664 wrote to memory of 2460 2664 201E.tmp 39 PID 2664 wrote to memory of 2460 2664 201E.tmp 39 PID 2664 wrote to memory of 2460 2664 201E.tmp 39 PID 2664 wrote to memory of 2460 2664 201E.tmp 39 PID 2460 wrote to memory of 2944 2460 209B.tmp 40 PID 2460 wrote to memory of 2944 2460 209B.tmp 40 PID 2460 wrote to memory of 2944 2460 209B.tmp 40 PID 2460 wrote to memory of 2944 2460 209B.tmp 40 PID 2944 wrote to memory of 2476 2944 2137.tmp 41 PID 2944 wrote to memory of 2476 2944 2137.tmp 41 PID 2944 wrote to memory of 2476 2944 2137.tmp 41 PID 2944 wrote to memory of 2476 2944 2137.tmp 41 PID 2476 wrote to memory of 2536 2476 21A4.tmp 42 PID 2476 wrote to memory of 2536 2476 21A4.tmp 42 PID 2476 wrote to memory of 2536 2476 21A4.tmp 42 PID 2476 wrote to memory of 2536 2476 21A4.tmp 42 PID 2536 wrote to memory of 1448 2536 21E2.tmp 43 PID 2536 wrote to memory of 1448 2536 21E2.tmp 43 PID 2536 wrote to memory of 1448 2536 21E2.tmp 43 PID 2536 wrote to memory of 1448 2536 21E2.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-12_9f35217194023cddac7c09f6b40daa81_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-12_9f35217194023cddac7c09f6b40daa81_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\1A92.tmp"C:\Users\Admin\AppData\Local\Temp\1A92.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\1C66.tmp"C:\Users\Admin\AppData\Local\Temp\1C66.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\1D02.tmp"C:\Users\Admin\AppData\Local\Temp\1D02.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\1DCD.tmp"C:\Users\Admin\AppData\Local\Temp\1DCD.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\1F92.tmp"C:\Users\Admin\AppData\Local\Temp\1F92.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\201E.tmp"C:\Users\Admin\AppData\Local\Temp\201E.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\209B.tmp"C:\Users\Admin\AppData\Local\Temp\209B.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\2137.tmp"C:\Users\Admin\AppData\Local\Temp\2137.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\21A4.tmp"C:\Users\Admin\AppData\Local\Temp\21A4.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\21E2.tmp"C:\Users\Admin\AppData\Local\Temp\21E2.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\227E.tmp"C:\Users\Admin\AppData\Local\Temp\227E.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\22CC.tmp"C:\Users\Admin\AppData\Local\Temp\22CC.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\233A.tmp"C:\Users\Admin\AppData\Local\Temp\233A.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\23C6.tmp"C:\Users\Admin\AppData\Local\Temp\23C6.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\2443.tmp"C:\Users\Admin\AppData\Local\Temp\2443.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\24CF.tmp"C:\Users\Admin\AppData\Local\Temp\24CF.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\253C.tmp"C:\Users\Admin\AppData\Local\Temp\253C.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\25B9.tmp"C:\Users\Admin\AppData\Local\Temp\25B9.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\25F8.tmp"C:\Users\Admin\AppData\Local\Temp\25F8.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\2646.tmp"C:\Users\Admin\AppData\Local\Temp\2646.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\2694.tmp"C:\Users\Admin\AppData\Local\Temp\2694.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\26E2.tmp"C:\Users\Admin\AppData\Local\Temp\26E2.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\2730.tmp"C:\Users\Admin\AppData\Local\Temp\2730.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\276E.tmp"C:\Users\Admin\AppData\Local\Temp\276E.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\27BC.tmp"C:\Users\Admin\AppData\Local\Temp\27BC.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:540 -
C:\Users\Admin\AppData\Local\Temp\2858.tmp"C:\Users\Admin\AppData\Local\Temp\2858.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:576 -
C:\Users\Admin\AppData\Local\Temp\28A6.tmp"C:\Users\Admin\AppData\Local\Temp\28A6.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\28E4.tmp"C:\Users\Admin\AppData\Local\Temp\28E4.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\2923.tmp"C:\Users\Admin\AppData\Local\Temp\2923.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\2971.tmp"C:\Users\Admin\AppData\Local\Temp\2971.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:788 -
C:\Users\Admin\AppData\Local\Temp\29AF.tmp"C:\Users\Admin\AppData\Local\Temp\29AF.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:656 -
C:\Users\Admin\AppData\Local\Temp\29FD.tmp"C:\Users\Admin\AppData\Local\Temp\29FD.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\2B16.tmp"C:\Users\Admin\AppData\Local\Temp\2B16.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\2B64.tmp"C:\Users\Admin\AppData\Local\Temp\2B64.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:948 -
C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:772 -
C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\2D38.tmp"C:\Users\Admin\AppData\Local\Temp\2D38.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:844 -
C:\Users\Admin\AppData\Local\Temp\2D86.tmp"C:\Users\Admin\AppData\Local\Temp\2D86.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:548 -
C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\2E32.tmp"C:\Users\Admin\AppData\Local\Temp\2E32.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\2E70.tmp"C:\Users\Admin\AppData\Local\Temp\2E70.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\2EED.tmp"C:\Users\Admin\AppData\Local\Temp\2EED.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\2F3B.tmp"C:\Users\Admin\AppData\Local\Temp\2F3B.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\2F89.tmp"C:\Users\Admin\AppData\Local\Temp\2F89.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\3025.tmp"C:\Users\Admin\AppData\Local\Temp\3025.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\3073.tmp"C:\Users\Admin\AppData\Local\Temp\3073.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\30B1.tmp"C:\Users\Admin\AppData\Local\Temp\30B1.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\30F0.tmp"C:\Users\Admin\AppData\Local\Temp\30F0.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\313E.tmp"C:\Users\Admin\AppData\Local\Temp\313E.tmp"65⤵
- Executes dropped EXE
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\318C.tmp"C:\Users\Admin\AppData\Local\Temp\318C.tmp"66⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\31CA.tmp"C:\Users\Admin\AppData\Local\Temp\31CA.tmp"67⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\3218.tmp"C:\Users\Admin\AppData\Local\Temp\3218.tmp"68⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"69⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\32A4.tmp"C:\Users\Admin\AppData\Local\Temp\32A4.tmp"70⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\32E3.tmp"C:\Users\Admin\AppData\Local\Temp\32E3.tmp"71⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\3321.tmp"C:\Users\Admin\AppData\Local\Temp\3321.tmp"72⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\336F.tmp"C:\Users\Admin\AppData\Local\Temp\336F.tmp"73⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\33BD.tmp"C:\Users\Admin\AppData\Local\Temp\33BD.tmp"74⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\33FC.tmp"C:\Users\Admin\AppData\Local\Temp\33FC.tmp"75⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\343A.tmp"C:\Users\Admin\AppData\Local\Temp\343A.tmp"76⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\3478.tmp"C:\Users\Admin\AppData\Local\Temp\3478.tmp"77⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\34B7.tmp"C:\Users\Admin\AppData\Local\Temp\34B7.tmp"78⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\3505.tmp"C:\Users\Admin\AppData\Local\Temp\3505.tmp"79⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\3553.tmp"C:\Users\Admin\AppData\Local\Temp\3553.tmp"80⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\3591.tmp"C:\Users\Admin\AppData\Local\Temp\3591.tmp"81⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\35DF.tmp"C:\Users\Admin\AppData\Local\Temp\35DF.tmp"82⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\362D.tmp"C:\Users\Admin\AppData\Local\Temp\362D.tmp"83⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\367B.tmp"C:\Users\Admin\AppData\Local\Temp\367B.tmp"84⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\36BA.tmp"C:\Users\Admin\AppData\Local\Temp\36BA.tmp"85⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\3708.tmp"C:\Users\Admin\AppData\Local\Temp\3708.tmp"86⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\3746.tmp"C:\Users\Admin\AppData\Local\Temp\3746.tmp"87⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\3784.tmp"C:\Users\Admin\AppData\Local\Temp\3784.tmp"88⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\37C3.tmp"C:\Users\Admin\AppData\Local\Temp\37C3.tmp"89⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\3811.tmp"C:\Users\Admin\AppData\Local\Temp\3811.tmp"90⤵PID:308
-
C:\Users\Admin\AppData\Local\Temp\385F.tmp"C:\Users\Admin\AppData\Local\Temp\385F.tmp"91⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\38AD.tmp"C:\Users\Admin\AppData\Local\Temp\38AD.tmp"92⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\38FB.tmp"C:\Users\Admin\AppData\Local\Temp\38FB.tmp"93⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\3939.tmp"C:\Users\Admin\AppData\Local\Temp\3939.tmp"94⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\3978.tmp"C:\Users\Admin\AppData\Local\Temp\3978.tmp"95⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\39C6.tmp"C:\Users\Admin\AppData\Local\Temp\39C6.tmp"96⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\3A04.tmp"C:\Users\Admin\AppData\Local\Temp\3A04.tmp"97⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\3A52.tmp"C:\Users\Admin\AppData\Local\Temp\3A52.tmp"98⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\3A90.tmp"C:\Users\Admin\AppData\Local\Temp\3A90.tmp"99⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\3ACF.tmp"C:\Users\Admin\AppData\Local\Temp\3ACF.tmp"100⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\3B0D.tmp"C:\Users\Admin\AppData\Local\Temp\3B0D.tmp"101⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\3B5B.tmp"C:\Users\Admin\AppData\Local\Temp\3B5B.tmp"102⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\3B9A.tmp"C:\Users\Admin\AppData\Local\Temp\3B9A.tmp"103⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\3BE8.tmp"C:\Users\Admin\AppData\Local\Temp\3BE8.tmp"104⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\3C36.tmp"C:\Users\Admin\AppData\Local\Temp\3C36.tmp"105⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\3C84.tmp"C:\Users\Admin\AppData\Local\Temp\3C84.tmp"106⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\3CC2.tmp"C:\Users\Admin\AppData\Local\Temp\3CC2.tmp"107⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\3D10.tmp"C:\Users\Admin\AppData\Local\Temp\3D10.tmp"108⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\3D4E.tmp"C:\Users\Admin\AppData\Local\Temp\3D4E.tmp"109⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"110⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\3DDB.tmp"C:\Users\Admin\AppData\Local\Temp\3DDB.tmp"111⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\3E29.tmp"C:\Users\Admin\AppData\Local\Temp\3E29.tmp"112⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\3E67.tmp"C:\Users\Admin\AppData\Local\Temp\3E67.tmp"113⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\3EA6.tmp"C:\Users\Admin\AppData\Local\Temp\3EA6.tmp"114⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"115⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\3F32.tmp"C:\Users\Admin\AppData\Local\Temp\3F32.tmp"116⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\3F70.tmp"C:\Users\Admin\AppData\Local\Temp\3F70.tmp"117⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\3FAF.tmp"C:\Users\Admin\AppData\Local\Temp\3FAF.tmp"118⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\3FFD.tmp"C:\Users\Admin\AppData\Local\Temp\3FFD.tmp"119⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\404B.tmp"C:\Users\Admin\AppData\Local\Temp\404B.tmp"120⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\4089.tmp"C:\Users\Admin\AppData\Local\Temp\4089.tmp"121⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\40C8.tmp"C:\Users\Admin\AppData\Local\Temp\40C8.tmp"122⤵PID:3024
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-