Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
20/06/2024, 06:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-20_a382fb30fe98f586353f235ddf576404_mafia.exe
Resource
win7-20240508-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-20_a382fb30fe98f586353f235ddf576404_mafia.exe
Resource
win10v2004-20240611-en
2 signatures
150 seconds
General
-
Target
2024-06-20_a382fb30fe98f586353f235ddf576404_mafia.exe
-
Size
487KB
-
MD5
a382fb30fe98f586353f235ddf576404
-
SHA1
0798d3b2c688474a7f668f4123a851463784f172
-
SHA256
3d1941a0c485f841c0659d1dcc0234b1e592840efebbd936a97c10c07b5b232b
-
SHA512
73cf8b529e145784364ccd884ce51d649a1e7749719d9c13b274cd6da6c2ce9fe078f75b46144d1ea2a9aabd3391b0fb6e1eab09db938ade74a46af6a55c16a3
-
SSDEEP
12288:HU5rCOTeiJfgyUz/Yg8S84gLMtaAHoMNZ:HUQOJJfgTr4p3xa1N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1276 13EE.tmp 1284 145B.tmp 2392 14E8.tmp 2648 1555.tmp 2740 15D2.tmp 2652 163F.tmp 1832 16BC.tmp 2544 1738.tmp 2688 17B5.tmp 2532 1822.tmp 916 189F.tmp 2364 190C.tmp 308 197A.tmp 2892 19E7.tmp 3008 1A54.tmp 808 1AC1.tmp 2000 1B00.tmp 2608 1B5D.tmp 1764 1BCA.tmp 2580 1C47.tmp 2872 1CC4.tmp 1672 1D31.tmp 1692 1D8F.tmp 1592 1DDD.tmp 2064 1E2B.tmp 2120 1E69.tmp 2112 1EA8.tmp 1972 1EF6.tmp 2940 1F44.tmp 2316 1F82.tmp 380 1FD0.tmp 676 200E.tmp 1144 205C.tmp 1488 20AA.tmp 948 20F8.tmp 556 2137.tmp 2360 2175.tmp 912 21B4.tmp 1528 2202.tmp 408 2250.tmp 1132 229E.tmp 1796 22EC.tmp 1888 233A.tmp 1636 2378.tmp 1440 23C6.tmp 2504 2404.tmp 932 2443.tmp 2356 2491.tmp 2464 24CF.tmp 1844 250E.tmp 1436 255C.tmp 1384 259A.tmp 1616 25D8.tmp 1728 2626.tmp 2448 2674.tmp 1608 26D2.tmp 2792 2720.tmp 2912 277E.tmp 2700 27EB.tmp 2152 2829.tmp 2660 2868.tmp 2624 28A6.tmp 2724 28F4.tmp 2928 2942.tmp -
Loads dropped DLL 64 IoCs
pid Process 2980 2024-06-20_a382fb30fe98f586353f235ddf576404_mafia.exe 1276 13EE.tmp 1284 145B.tmp 2392 14E8.tmp 2648 1555.tmp 2740 15D2.tmp 2652 163F.tmp 1832 16BC.tmp 2544 1738.tmp 2688 17B5.tmp 2532 1822.tmp 916 189F.tmp 2364 190C.tmp 308 197A.tmp 2892 19E7.tmp 3008 1A54.tmp 808 1AC1.tmp 2000 1B00.tmp 2608 1B5D.tmp 1764 1BCA.tmp 2580 1C47.tmp 2872 1CC4.tmp 1672 1D31.tmp 1692 1D8F.tmp 1592 1DDD.tmp 2064 1E2B.tmp 2120 1E69.tmp 2112 1EA8.tmp 1972 1EF6.tmp 2940 1F44.tmp 2316 1F82.tmp 380 1FD0.tmp 676 200E.tmp 1144 205C.tmp 1488 20AA.tmp 948 20F8.tmp 556 2137.tmp 2360 2175.tmp 912 21B4.tmp 1528 2202.tmp 408 2250.tmp 1132 229E.tmp 1796 22EC.tmp 1888 233A.tmp 1636 2378.tmp 1440 23C6.tmp 2504 2404.tmp 932 2443.tmp 2356 2491.tmp 2464 24CF.tmp 1844 250E.tmp 1436 255C.tmp 1384 259A.tmp 1616 25D8.tmp 1728 2626.tmp 2448 2674.tmp 1608 26D2.tmp 2792 2720.tmp 2912 277E.tmp 2700 27EB.tmp 2152 2829.tmp 2660 2868.tmp 2624 28A6.tmp 2724 28F4.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2980 wrote to memory of 1276 2980 2024-06-20_a382fb30fe98f586353f235ddf576404_mafia.exe 28 PID 2980 wrote to memory of 1276 2980 2024-06-20_a382fb30fe98f586353f235ddf576404_mafia.exe 28 PID 2980 wrote to memory of 1276 2980 2024-06-20_a382fb30fe98f586353f235ddf576404_mafia.exe 28 PID 2980 wrote to memory of 1276 2980 2024-06-20_a382fb30fe98f586353f235ddf576404_mafia.exe 28 PID 1276 wrote to memory of 1284 1276 13EE.tmp 29 PID 1276 wrote to memory of 1284 1276 13EE.tmp 29 PID 1276 wrote to memory of 1284 1276 13EE.tmp 29 PID 1276 wrote to memory of 1284 1276 13EE.tmp 29 PID 1284 wrote to memory of 2392 1284 145B.tmp 30 PID 1284 wrote to memory of 2392 1284 145B.tmp 30 PID 1284 wrote to memory of 2392 1284 145B.tmp 30 PID 1284 wrote to memory of 2392 1284 145B.tmp 30 PID 2392 wrote to memory of 2648 2392 14E8.tmp 31 PID 2392 wrote to memory of 2648 2392 14E8.tmp 31 PID 2392 wrote to memory of 2648 2392 14E8.tmp 31 PID 2392 wrote to memory of 2648 2392 14E8.tmp 31 PID 2648 wrote to memory of 2740 2648 1555.tmp 32 PID 2648 wrote to memory of 2740 2648 1555.tmp 32 PID 2648 wrote to memory of 2740 2648 1555.tmp 32 PID 2648 wrote to memory of 2740 2648 1555.tmp 32 PID 2740 wrote to memory of 2652 2740 15D2.tmp 33 PID 2740 wrote to memory of 2652 2740 15D2.tmp 33 PID 2740 wrote to memory of 2652 2740 15D2.tmp 33 PID 2740 wrote to memory of 2652 2740 15D2.tmp 33 PID 2652 wrote to memory of 1832 2652 163F.tmp 34 PID 2652 wrote to memory of 1832 2652 163F.tmp 34 PID 2652 wrote to memory of 1832 2652 163F.tmp 34 PID 2652 wrote to memory of 1832 2652 163F.tmp 34 PID 1832 wrote to memory of 2544 1832 16BC.tmp 35 PID 1832 wrote to memory of 2544 1832 16BC.tmp 35 PID 1832 wrote to memory of 2544 1832 16BC.tmp 35 PID 1832 wrote to memory of 2544 1832 16BC.tmp 35 PID 2544 wrote to memory of 2688 2544 1738.tmp 36 PID 2544 wrote to memory of 2688 2544 1738.tmp 36 PID 2544 wrote to memory of 2688 2544 1738.tmp 36 PID 2544 wrote to memory of 2688 2544 1738.tmp 36 PID 2688 wrote to memory of 2532 2688 17B5.tmp 37 PID 2688 wrote to memory of 2532 2688 17B5.tmp 37 PID 2688 wrote to memory of 2532 2688 17B5.tmp 37 PID 2688 wrote to memory of 2532 2688 17B5.tmp 37 PID 2532 wrote to memory of 916 2532 1822.tmp 38 PID 2532 wrote to memory of 916 2532 1822.tmp 38 PID 2532 wrote to memory of 916 2532 1822.tmp 38 PID 2532 wrote to memory of 916 2532 1822.tmp 38 PID 916 wrote to memory of 2364 916 189F.tmp 39 PID 916 wrote to memory of 2364 916 189F.tmp 39 PID 916 wrote to memory of 2364 916 189F.tmp 39 PID 916 wrote to memory of 2364 916 189F.tmp 39 PID 2364 wrote to memory of 308 2364 190C.tmp 40 PID 2364 wrote to memory of 308 2364 190C.tmp 40 PID 2364 wrote to memory of 308 2364 190C.tmp 40 PID 2364 wrote to memory of 308 2364 190C.tmp 40 PID 308 wrote to memory of 2892 308 197A.tmp 41 PID 308 wrote to memory of 2892 308 197A.tmp 41 PID 308 wrote to memory of 2892 308 197A.tmp 41 PID 308 wrote to memory of 2892 308 197A.tmp 41 PID 2892 wrote to memory of 3008 2892 19E7.tmp 42 PID 2892 wrote to memory of 3008 2892 19E7.tmp 42 PID 2892 wrote to memory of 3008 2892 19E7.tmp 42 PID 2892 wrote to memory of 3008 2892 19E7.tmp 42 PID 3008 wrote to memory of 808 3008 1A54.tmp 43 PID 3008 wrote to memory of 808 3008 1A54.tmp 43 PID 3008 wrote to memory of 808 3008 1A54.tmp 43 PID 3008 wrote to memory of 808 3008 1A54.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-20_a382fb30fe98f586353f235ddf576404_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-20_a382fb30fe98f586353f235ddf576404_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\13EE.tmp"C:\Users\Admin\AppData\Local\Temp\13EE.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\145B.tmp"C:\Users\Admin\AppData\Local\Temp\145B.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\14E8.tmp"C:\Users\Admin\AppData\Local\Temp\14E8.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\1555.tmp"C:\Users\Admin\AppData\Local\Temp\1555.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\15D2.tmp"C:\Users\Admin\AppData\Local\Temp\15D2.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\163F.tmp"C:\Users\Admin\AppData\Local\Temp\163F.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\16BC.tmp"C:\Users\Admin\AppData\Local\Temp\16BC.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\1738.tmp"C:\Users\Admin\AppData\Local\Temp\1738.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\17B5.tmp"C:\Users\Admin\AppData\Local\Temp\17B5.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\1822.tmp"C:\Users\Admin\AppData\Local\Temp\1822.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\189F.tmp"C:\Users\Admin\AppData\Local\Temp\189F.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\190C.tmp"C:\Users\Admin\AppData\Local\Temp\190C.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\197A.tmp"C:\Users\Admin\AppData\Local\Temp\197A.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:308 -
C:\Users\Admin\AppData\Local\Temp\19E7.tmp"C:\Users\Admin\AppData\Local\Temp\19E7.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\1A54.tmp"C:\Users\Admin\AppData\Local\Temp\1A54.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:808 -
C:\Users\Admin\AppData\Local\Temp\1B00.tmp"C:\Users\Admin\AppData\Local\Temp\1B00.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\1C47.tmp"C:\Users\Admin\AppData\Local\Temp\1C47.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\1D31.tmp"C:\Users\Admin\AppData\Local\Temp\1D31.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\1D8F.tmp"C:\Users\Admin\AppData\Local\Temp\1D8F.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\1E69.tmp"C:\Users\Admin\AppData\Local\Temp\1E69.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\1F44.tmp"C:\Users\Admin\AppData\Local\Temp\1F44.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\1F82.tmp"C:\Users\Admin\AppData\Local\Temp\1F82.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:380 -
C:\Users\Admin\AppData\Local\Temp\200E.tmp"C:\Users\Admin\AppData\Local\Temp\200E.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:676 -
C:\Users\Admin\AppData\Local\Temp\205C.tmp"C:\Users\Admin\AppData\Local\Temp\205C.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\20AA.tmp"C:\Users\Admin\AppData\Local\Temp\20AA.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\20F8.tmp"C:\Users\Admin\AppData\Local\Temp\20F8.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:948 -
C:\Users\Admin\AppData\Local\Temp\2137.tmp"C:\Users\Admin\AppData\Local\Temp\2137.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:556 -
C:\Users\Admin\AppData\Local\Temp\2175.tmp"C:\Users\Admin\AppData\Local\Temp\2175.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\21B4.tmp"C:\Users\Admin\AppData\Local\Temp\21B4.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:912 -
C:\Users\Admin\AppData\Local\Temp\2202.tmp"C:\Users\Admin\AppData\Local\Temp\2202.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\2250.tmp"C:\Users\Admin\AppData\Local\Temp\2250.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:408 -
C:\Users\Admin\AppData\Local\Temp\229E.tmp"C:\Users\Admin\AppData\Local\Temp\229E.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\22EC.tmp"C:\Users\Admin\AppData\Local\Temp\22EC.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\233A.tmp"C:\Users\Admin\AppData\Local\Temp\233A.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\2378.tmp"C:\Users\Admin\AppData\Local\Temp\2378.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\23C6.tmp"C:\Users\Admin\AppData\Local\Temp\23C6.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\2404.tmp"C:\Users\Admin\AppData\Local\Temp\2404.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\2443.tmp"C:\Users\Admin\AppData\Local\Temp\2443.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:932 -
C:\Users\Admin\AppData\Local\Temp\2491.tmp"C:\Users\Admin\AppData\Local\Temp\2491.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\24CF.tmp"C:\Users\Admin\AppData\Local\Temp\24CF.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\250E.tmp"C:\Users\Admin\AppData\Local\Temp\250E.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\259A.tmp"C:\Users\Admin\AppData\Local\Temp\259A.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\25D8.tmp"C:\Users\Admin\AppData\Local\Temp\25D8.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\2626.tmp"C:\Users\Admin\AppData\Local\Temp\2626.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\2674.tmp"C:\Users\Admin\AppData\Local\Temp\2674.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\26D2.tmp"C:\Users\Admin\AppData\Local\Temp\26D2.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\2720.tmp"C:\Users\Admin\AppData\Local\Temp\2720.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\277E.tmp"C:\Users\Admin\AppData\Local\Temp\277E.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\27EB.tmp"C:\Users\Admin\AppData\Local\Temp\27EB.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\2829.tmp"C:\Users\Admin\AppData\Local\Temp\2829.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\2868.tmp"C:\Users\Admin\AppData\Local\Temp\2868.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\28A6.tmp"C:\Users\Admin\AppData\Local\Temp\28A6.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\28F4.tmp"C:\Users\Admin\AppData\Local\Temp\28F4.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\2942.tmp"C:\Users\Admin\AppData\Local\Temp\2942.tmp"65⤵
- Executes dropped EXE
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\2990.tmp"C:\Users\Admin\AppData\Local\Temp\2990.tmp"66⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\29CE.tmp"C:\Users\Admin\AppData\Local\Temp\29CE.tmp"67⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"68⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"69⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"70⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"71⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\2B35.tmp"C:\Users\Admin\AppData\Local\Temp\2B35.tmp"72⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\2B74.tmp"C:\Users\Admin\AppData\Local\Temp\2B74.tmp"73⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"74⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\2C00.tmp"C:\Users\Admin\AppData\Local\Temp\2C00.tmp"75⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"76⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\2C9C.tmp"C:\Users\Admin\AppData\Local\Temp\2C9C.tmp"77⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"78⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\2D28.tmp"C:\Users\Admin\AppData\Local\Temp\2D28.tmp"79⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\2D76.tmp"C:\Users\Admin\AppData\Local\Temp\2D76.tmp"80⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"81⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\2E03.tmp"C:\Users\Admin\AppData\Local\Temp\2E03.tmp"82⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\2E51.tmp"C:\Users\Admin\AppData\Local\Temp\2E51.tmp"83⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\2E9F.tmp"C:\Users\Admin\AppData\Local\Temp\2E9F.tmp"84⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\2EED.tmp"C:\Users\Admin\AppData\Local\Temp\2EED.tmp"85⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"86⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\2F79.tmp"C:\Users\Admin\AppData\Local\Temp\2F79.tmp"87⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"88⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\3006.tmp"C:\Users\Admin\AppData\Local\Temp\3006.tmp"89⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\3044.tmp"C:\Users\Admin\AppData\Local\Temp\3044.tmp"90⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\3082.tmp"C:\Users\Admin\AppData\Local\Temp\3082.tmp"91⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\30C1.tmp"C:\Users\Admin\AppData\Local\Temp\30C1.tmp"92⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\30FF.tmp"C:\Users\Admin\AppData\Local\Temp\30FF.tmp"93⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\313E.tmp"C:\Users\Admin\AppData\Local\Temp\313E.tmp"94⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\317C.tmp"C:\Users\Admin\AppData\Local\Temp\317C.tmp"95⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\31BA.tmp"C:\Users\Admin\AppData\Local\Temp\31BA.tmp"96⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\3208.tmp"C:\Users\Admin\AppData\Local\Temp\3208.tmp"97⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"98⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\32C4.tmp"C:\Users\Admin\AppData\Local\Temp\32C4.tmp"99⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\336F.tmp"C:\Users\Admin\AppData\Local\Temp\336F.tmp"100⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\3543.tmp"C:\Users\Admin\AppData\Local\Temp\3543.tmp"101⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\3591.tmp"C:\Users\Admin\AppData\Local\Temp\3591.tmp"102⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\35DF.tmp"C:\Users\Admin\AppData\Local\Temp\35DF.tmp"103⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\362D.tmp"C:\Users\Admin\AppData\Local\Temp\362D.tmp"104⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\366C.tmp"C:\Users\Admin\AppData\Local\Temp\366C.tmp"105⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\36BA.tmp"C:\Users\Admin\AppData\Local\Temp\36BA.tmp"106⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\3708.tmp"C:\Users\Admin\AppData\Local\Temp\3708.tmp"107⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\3746.tmp"C:\Users\Admin\AppData\Local\Temp\3746.tmp"108⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\3794.tmp"C:\Users\Admin\AppData\Local\Temp\3794.tmp"109⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\37E2.tmp"C:\Users\Admin\AppData\Local\Temp\37E2.tmp"110⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\3820.tmp"C:\Users\Admin\AppData\Local\Temp\3820.tmp"111⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\386E.tmp"C:\Users\Admin\AppData\Local\Temp\386E.tmp"112⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\38AD.tmp"C:\Users\Admin\AppData\Local\Temp\38AD.tmp"113⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\38EB.tmp"C:\Users\Admin\AppData\Local\Temp\38EB.tmp"114⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\3939.tmp"C:\Users\Admin\AppData\Local\Temp\3939.tmp"115⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\3987.tmp"C:\Users\Admin\AppData\Local\Temp\3987.tmp"116⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\39C6.tmp"C:\Users\Admin\AppData\Local\Temp\39C6.tmp"117⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\3A14.tmp"C:\Users\Admin\AppData\Local\Temp\3A14.tmp"118⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\3A62.tmp"C:\Users\Admin\AppData\Local\Temp\3A62.tmp"119⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\3ABF.tmp"C:\Users\Admin\AppData\Local\Temp\3ABF.tmp"120⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\3AFE.tmp"C:\Users\Admin\AppData\Local\Temp\3AFE.tmp"121⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\3B3C.tmp"C:\Users\Admin\AppData\Local\Temp\3B3C.tmp"122⤵PID:2312
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-