Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
04-07-2024 20:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-07-04_f6d57aa9245f70ead74a7e41aded56f0_mafia.exe
Resource
win7-20240220-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-04_f6d57aa9245f70ead74a7e41aded56f0_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-07-04_f6d57aa9245f70ead74a7e41aded56f0_mafia.exe
-
Size
486KB
-
MD5
f6d57aa9245f70ead74a7e41aded56f0
-
SHA1
b518423cd21adcdbc2efc7b994e30eb883939bc3
-
SHA256
c98cf94a072ebfca032af89c5b178dcd1bbe081552fd436e5391ec92cf36e678
-
SHA512
0964b35d0a24ecd2addc0c965c325ba491c9bda0bd684eda6163f7a436e440a959324e16714b9502547d0b25d5f35b11778dc55858056cb05fa8514ca2b3a52b
-
SSDEEP
12288:UU5rCOTeiDMjjTNNh4A7Rh+0Cd8Qqn5zS4NZ:UUQOJDMXTfaURh+Jdon5u4N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2704 2684.tmp 1976 26F1.tmp 2632 276E.tmp 2812 27CC.tmp 2524 2839.tmp 2560 2896.tmp 2920 2904.tmp 2452 2961.tmp 2416 29BF.tmp 2924 2A1C.tmp 2888 2A7A.tmp 1856 2AC8.tmp 2668 2B26.tmp 2736 2B93.tmp 852 2C00.tmp 344 2C6D.tmp 2216 2CCB.tmp 1516 2D38.tmp 2296 2D96.tmp 1276 2DF3.tmp 488 2E32.tmp 2180 2E9F.tmp 2000 2EED.tmp 2040 2F2B.tmp 2256 2F6A.tmp 2860 2FB8.tmp 1908 3006.tmp 1372 3054.tmp 2384 30A2.tmp 2240 30E0.tmp 1648 312E.tmp 2832 316C.tmp 384 31AB.tmp 1764 31F9.tmp 2360 3237.tmp 3040 3276.tmp 2816 32C4.tmp 692 3312.tmp 2100 3360.tmp 1708 343A.tmp 1864 3488.tmp 972 34C6.tmp 2916 3514.tmp 888 3572.tmp 912 35C0.tmp 744 360E.tmp 3064 365C.tmp 2340 36AA.tmp 1760 36F8.tmp 568 3746.tmp 2900 3784.tmp 1884 37C3.tmp 884 3801.tmp 2096 384F.tmp 2848 388E.tmp 2700 391A.tmp 3012 3987.tmp 2544 3A33.tmp 2508 3A71.tmp 2808 3ACF.tmp 2552 3B0D.tmp 2812 3B4C.tmp 2284 3B8A.tmp 2772 3BC8.tmp -
Loads dropped DLL 64 IoCs
pid Process 3028 2024-07-04_f6d57aa9245f70ead74a7e41aded56f0_mafia.exe 2704 2684.tmp 1976 26F1.tmp 2632 276E.tmp 2812 27CC.tmp 2524 2839.tmp 2560 2896.tmp 2920 2904.tmp 2452 2961.tmp 2416 29BF.tmp 2924 2A1C.tmp 2888 2A7A.tmp 1856 2AC8.tmp 2668 2B26.tmp 2736 2B93.tmp 852 2C00.tmp 344 2C6D.tmp 2216 2CCB.tmp 1516 2D38.tmp 2296 2D96.tmp 1276 2DF3.tmp 488 2E32.tmp 2180 2E9F.tmp 2000 2EED.tmp 2040 2F2B.tmp 2256 2F6A.tmp 2860 2FB8.tmp 1908 3006.tmp 1372 3054.tmp 2384 30A2.tmp 2240 30E0.tmp 1648 312E.tmp 2832 316C.tmp 384 31AB.tmp 1764 31F9.tmp 2360 3237.tmp 3040 3276.tmp 2816 32C4.tmp 692 3312.tmp 2100 3360.tmp 1708 343A.tmp 1864 3488.tmp 972 34C6.tmp 2916 3514.tmp 888 3572.tmp 912 35C0.tmp 744 360E.tmp 3064 365C.tmp 2340 36AA.tmp 1760 36F8.tmp 568 3746.tmp 2900 3784.tmp 1884 37C3.tmp 884 3801.tmp 2096 384F.tmp 1376 38DC.tmp 2700 391A.tmp 3012 3987.tmp 2544 3A33.tmp 2508 3A71.tmp 2808 3ACF.tmp 2552 3B0D.tmp 2812 3B4C.tmp 2284 3B8A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3028 wrote to memory of 2704 3028 2024-07-04_f6d57aa9245f70ead74a7e41aded56f0_mafia.exe 28 PID 3028 wrote to memory of 2704 3028 2024-07-04_f6d57aa9245f70ead74a7e41aded56f0_mafia.exe 28 PID 3028 wrote to memory of 2704 3028 2024-07-04_f6d57aa9245f70ead74a7e41aded56f0_mafia.exe 28 PID 3028 wrote to memory of 2704 3028 2024-07-04_f6d57aa9245f70ead74a7e41aded56f0_mafia.exe 28 PID 2704 wrote to memory of 1976 2704 2684.tmp 29 PID 2704 wrote to memory of 1976 2704 2684.tmp 29 PID 2704 wrote to memory of 1976 2704 2684.tmp 29 PID 2704 wrote to memory of 1976 2704 2684.tmp 29 PID 1976 wrote to memory of 2632 1976 26F1.tmp 30 PID 1976 wrote to memory of 2632 1976 26F1.tmp 30 PID 1976 wrote to memory of 2632 1976 26F1.tmp 30 PID 1976 wrote to memory of 2632 1976 26F1.tmp 30 PID 2632 wrote to memory of 2812 2632 276E.tmp 31 PID 2632 wrote to memory of 2812 2632 276E.tmp 31 PID 2632 wrote to memory of 2812 2632 276E.tmp 31 PID 2632 wrote to memory of 2812 2632 276E.tmp 31 PID 2812 wrote to memory of 2524 2812 27CC.tmp 32 PID 2812 wrote to memory of 2524 2812 27CC.tmp 32 PID 2812 wrote to memory of 2524 2812 27CC.tmp 32 PID 2812 wrote to memory of 2524 2812 27CC.tmp 32 PID 2524 wrote to memory of 2560 2524 2839.tmp 33 PID 2524 wrote to memory of 2560 2524 2839.tmp 33 PID 2524 wrote to memory of 2560 2524 2839.tmp 33 PID 2524 wrote to memory of 2560 2524 2839.tmp 33 PID 2560 wrote to memory of 2920 2560 2896.tmp 34 PID 2560 wrote to memory of 2920 2560 2896.tmp 34 PID 2560 wrote to memory of 2920 2560 2896.tmp 34 PID 2560 wrote to memory of 2920 2560 2896.tmp 34 PID 2920 wrote to memory of 2452 2920 2904.tmp 35 PID 2920 wrote to memory of 2452 2920 2904.tmp 35 PID 2920 wrote to memory of 2452 2920 2904.tmp 35 PID 2920 wrote to memory of 2452 2920 2904.tmp 35 PID 2452 wrote to memory of 2416 2452 2961.tmp 36 PID 2452 wrote to memory of 2416 2452 2961.tmp 36 PID 2452 wrote to memory of 2416 2452 2961.tmp 36 PID 2452 wrote to memory of 2416 2452 2961.tmp 36 PID 2416 wrote to memory of 2924 2416 29BF.tmp 37 PID 2416 wrote to memory of 2924 2416 29BF.tmp 37 PID 2416 wrote to memory of 2924 2416 29BF.tmp 37 PID 2416 wrote to memory of 2924 2416 29BF.tmp 37 PID 2924 wrote to memory of 2888 2924 2A1C.tmp 38 PID 2924 wrote to memory of 2888 2924 2A1C.tmp 38 PID 2924 wrote to memory of 2888 2924 2A1C.tmp 38 PID 2924 wrote to memory of 2888 2924 2A1C.tmp 38 PID 2888 wrote to memory of 1856 2888 2A7A.tmp 39 PID 2888 wrote to memory of 1856 2888 2A7A.tmp 39 PID 2888 wrote to memory of 1856 2888 2A7A.tmp 39 PID 2888 wrote to memory of 1856 2888 2A7A.tmp 39 PID 1856 wrote to memory of 2668 1856 2AC8.tmp 40 PID 1856 wrote to memory of 2668 1856 2AC8.tmp 40 PID 1856 wrote to memory of 2668 1856 2AC8.tmp 40 PID 1856 wrote to memory of 2668 1856 2AC8.tmp 40 PID 2668 wrote to memory of 2736 2668 2B26.tmp 41 PID 2668 wrote to memory of 2736 2668 2B26.tmp 41 PID 2668 wrote to memory of 2736 2668 2B26.tmp 41 PID 2668 wrote to memory of 2736 2668 2B26.tmp 41 PID 2736 wrote to memory of 852 2736 2B93.tmp 42 PID 2736 wrote to memory of 852 2736 2B93.tmp 42 PID 2736 wrote to memory of 852 2736 2B93.tmp 42 PID 2736 wrote to memory of 852 2736 2B93.tmp 42 PID 852 wrote to memory of 344 852 2C00.tmp 43 PID 852 wrote to memory of 344 852 2C00.tmp 43 PID 852 wrote to memory of 344 852 2C00.tmp 43 PID 852 wrote to memory of 344 852 2C00.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-04_f6d57aa9245f70ead74a7e41aded56f0_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-04_f6d57aa9245f70ead74a7e41aded56f0_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\2684.tmp"C:\Users\Admin\AppData\Local\Temp\2684.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\26F1.tmp"C:\Users\Admin\AppData\Local\Temp\26F1.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\276E.tmp"C:\Users\Admin\AppData\Local\Temp\276E.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\27CC.tmp"C:\Users\Admin\AppData\Local\Temp\27CC.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\2839.tmp"C:\Users\Admin\AppData\Local\Temp\2839.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\2896.tmp"C:\Users\Admin\AppData\Local\Temp\2896.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\2904.tmp"C:\Users\Admin\AppData\Local\Temp\2904.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\2961.tmp"C:\Users\Admin\AppData\Local\Temp\2961.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\29BF.tmp"C:\Users\Admin\AppData\Local\Temp\29BF.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\2B26.tmp"C:\Users\Admin\AppData\Local\Temp\2B26.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\2B93.tmp"C:\Users\Admin\AppData\Local\Temp\2B93.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\2C00.tmp"C:\Users\Admin\AppData\Local\Temp\2C00.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:344 -
C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\2D38.tmp"C:\Users\Admin\AppData\Local\Temp\2D38.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\2D96.tmp"C:\Users\Admin\AppData\Local\Temp\2D96.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\2E32.tmp"C:\Users\Admin\AppData\Local\Temp\2E32.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:488 -
C:\Users\Admin\AppData\Local\Temp\2E9F.tmp"C:\Users\Admin\AppData\Local\Temp\2E9F.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\2EED.tmp"C:\Users\Admin\AppData\Local\Temp\2EED.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\2F6A.tmp"C:\Users\Admin\AppData\Local\Temp\2F6A.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\3006.tmp"C:\Users\Admin\AppData\Local\Temp\3006.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\3054.tmp"C:\Users\Admin\AppData\Local\Temp\3054.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\30A2.tmp"C:\Users\Admin\AppData\Local\Temp\30A2.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\30E0.tmp"C:\Users\Admin\AppData\Local\Temp\30E0.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\312E.tmp"C:\Users\Admin\AppData\Local\Temp\312E.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\316C.tmp"C:\Users\Admin\AppData\Local\Temp\316C.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\31AB.tmp"C:\Users\Admin\AppData\Local\Temp\31AB.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:384 -
C:\Users\Admin\AppData\Local\Temp\31F9.tmp"C:\Users\Admin\AppData\Local\Temp\31F9.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\3237.tmp"C:\Users\Admin\AppData\Local\Temp\3237.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\3276.tmp"C:\Users\Admin\AppData\Local\Temp\3276.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\32C4.tmp"C:\Users\Admin\AppData\Local\Temp\32C4.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\3312.tmp"C:\Users\Admin\AppData\Local\Temp\3312.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:692 -
C:\Users\Admin\AppData\Local\Temp\3360.tmp"C:\Users\Admin\AppData\Local\Temp\3360.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\343A.tmp"C:\Users\Admin\AppData\Local\Temp\343A.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\34C6.tmp"C:\Users\Admin\AppData\Local\Temp\34C6.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:972 -
C:\Users\Admin\AppData\Local\Temp\3514.tmp"C:\Users\Admin\AppData\Local\Temp\3514.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\3572.tmp"C:\Users\Admin\AppData\Local\Temp\3572.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:888 -
C:\Users\Admin\AppData\Local\Temp\35C0.tmp"C:\Users\Admin\AppData\Local\Temp\35C0.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:912 -
C:\Users\Admin\AppData\Local\Temp\360E.tmp"C:\Users\Admin\AppData\Local\Temp\360E.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:744 -
C:\Users\Admin\AppData\Local\Temp\365C.tmp"C:\Users\Admin\AppData\Local\Temp\365C.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\36AA.tmp"C:\Users\Admin\AppData\Local\Temp\36AA.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\36F8.tmp"C:\Users\Admin\AppData\Local\Temp\36F8.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\3746.tmp"C:\Users\Admin\AppData\Local\Temp\3746.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:568 -
C:\Users\Admin\AppData\Local\Temp\3784.tmp"C:\Users\Admin\AppData\Local\Temp\3784.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\37C3.tmp"C:\Users\Admin\AppData\Local\Temp\37C3.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\3801.tmp"C:\Users\Admin\AppData\Local\Temp\3801.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:884 -
C:\Users\Admin\AppData\Local\Temp\384F.tmp"C:\Users\Admin\AppData\Local\Temp\384F.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\388E.tmp"C:\Users\Admin\AppData\Local\Temp\388E.tmp"56⤵
- Executes dropped EXE
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\38DC.tmp"C:\Users\Admin\AppData\Local\Temp\38DC.tmp"57⤵
- Loads dropped DLL
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\391A.tmp"C:\Users\Admin\AppData\Local\Temp\391A.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\3987.tmp"C:\Users\Admin\AppData\Local\Temp\3987.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\3A33.tmp"C:\Users\Admin\AppData\Local\Temp\3A33.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\3A71.tmp"C:\Users\Admin\AppData\Local\Temp\3A71.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\3ACF.tmp"C:\Users\Admin\AppData\Local\Temp\3ACF.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\3B0D.tmp"C:\Users\Admin\AppData\Local\Temp\3B0D.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\3B4C.tmp"C:\Users\Admin\AppData\Local\Temp\3B4C.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\3B8A.tmp"C:\Users\Admin\AppData\Local\Temp\3B8A.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\3BC8.tmp"C:\Users\Admin\AppData\Local\Temp\3BC8.tmp"66⤵
- Executes dropped EXE
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\3C07.tmp"C:\Users\Admin\AppData\Local\Temp\3C07.tmp"67⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\3C45.tmp"C:\Users\Admin\AppData\Local\Temp\3C45.tmp"68⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\3C84.tmp"C:\Users\Admin\AppData\Local\Temp\3C84.tmp"69⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\3CC2.tmp"C:\Users\Admin\AppData\Local\Temp\3CC2.tmp"70⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\3D00.tmp"C:\Users\Admin\AppData\Local\Temp\3D00.tmp"71⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\3D3F.tmp"C:\Users\Admin\AppData\Local\Temp\3D3F.tmp"72⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\3D7D.tmp"C:\Users\Admin\AppData\Local\Temp\3D7D.tmp"73⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\3DCB.tmp"C:\Users\Admin\AppData\Local\Temp\3DCB.tmp"74⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\3E0A.tmp"C:\Users\Admin\AppData\Local\Temp\3E0A.tmp"75⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\3E48.tmp"C:\Users\Admin\AppData\Local\Temp\3E48.tmp"76⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\3E86.tmp"C:\Users\Admin\AppData\Local\Temp\3E86.tmp"77⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"78⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\3F22.tmp"C:\Users\Admin\AppData\Local\Temp\3F22.tmp"79⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\3F61.tmp"C:\Users\Admin\AppData\Local\Temp\3F61.tmp"80⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\3FAF.tmp"C:\Users\Admin\AppData\Local\Temp\3FAF.tmp"81⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\3FED.tmp"C:\Users\Admin\AppData\Local\Temp\3FED.tmp"82⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\402C.tmp"C:\Users\Admin\AppData\Local\Temp\402C.tmp"83⤵PID:276
-
C:\Users\Admin\AppData\Local\Temp\406A.tmp"C:\Users\Admin\AppData\Local\Temp\406A.tmp"84⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\40A8.tmp"C:\Users\Admin\AppData\Local\Temp\40A8.tmp"85⤵PID:352
-
C:\Users\Admin\AppData\Local\Temp\40F6.tmp"C:\Users\Admin\AppData\Local\Temp\40F6.tmp"86⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\4135.tmp"C:\Users\Admin\AppData\Local\Temp\4135.tmp"87⤵PID:596
-
C:\Users\Admin\AppData\Local\Temp\4173.tmp"C:\Users\Admin\AppData\Local\Temp\4173.tmp"88⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\41B2.tmp"C:\Users\Admin\AppData\Local\Temp\41B2.tmp"89⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\4200.tmp"C:\Users\Admin\AppData\Local\Temp\4200.tmp"90⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\423E.tmp"C:\Users\Admin\AppData\Local\Temp\423E.tmp"91⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\428C.tmp"C:\Users\Admin\AppData\Local\Temp\428C.tmp"92⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\42CA.tmp"C:\Users\Admin\AppData\Local\Temp\42CA.tmp"93⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\4318.tmp"C:\Users\Admin\AppData\Local\Temp\4318.tmp"94⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\4357.tmp"C:\Users\Admin\AppData\Local\Temp\4357.tmp"95⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\4395.tmp"C:\Users\Admin\AppData\Local\Temp\4395.tmp"96⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\43D4.tmp"C:\Users\Admin\AppData\Local\Temp\43D4.tmp"97⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\4412.tmp"C:\Users\Admin\AppData\Local\Temp\4412.tmp"98⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\4450.tmp"C:\Users\Admin\AppData\Local\Temp\4450.tmp"99⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\448F.tmp"C:\Users\Admin\AppData\Local\Temp\448F.tmp"100⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\44CD.tmp"C:\Users\Admin\AppData\Local\Temp\44CD.tmp"101⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\450C.tmp"C:\Users\Admin\AppData\Local\Temp\450C.tmp"102⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\454A.tmp"C:\Users\Admin\AppData\Local\Temp\454A.tmp"103⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\4598.tmp"C:\Users\Admin\AppData\Local\Temp\4598.tmp"104⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\45D6.tmp"C:\Users\Admin\AppData\Local\Temp\45D6.tmp"105⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\4624.tmp"C:\Users\Admin\AppData\Local\Temp\4624.tmp"106⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\4672.tmp"C:\Users\Admin\AppData\Local\Temp\4672.tmp"107⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\46B1.tmp"C:\Users\Admin\AppData\Local\Temp\46B1.tmp"108⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\46EF.tmp"C:\Users\Admin\AppData\Local\Temp\46EF.tmp"109⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\473D.tmp"C:\Users\Admin\AppData\Local\Temp\473D.tmp"110⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\477C.tmp"C:\Users\Admin\AppData\Local\Temp\477C.tmp"111⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\47BA.tmp"C:\Users\Admin\AppData\Local\Temp\47BA.tmp"112⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\4808.tmp"C:\Users\Admin\AppData\Local\Temp\4808.tmp"113⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\4856.tmp"C:\Users\Admin\AppData\Local\Temp\4856.tmp"114⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\4894.tmp"C:\Users\Admin\AppData\Local\Temp\4894.tmp"115⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\48E2.tmp"C:\Users\Admin\AppData\Local\Temp\48E2.tmp"116⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\4921.tmp"C:\Users\Admin\AppData\Local\Temp\4921.tmp"117⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\496F.tmp"C:\Users\Admin\AppData\Local\Temp\496F.tmp"118⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\49AD.tmp"C:\Users\Admin\AppData\Local\Temp\49AD.tmp"119⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\49FB.tmp"C:\Users\Admin\AppData\Local\Temp\49FB.tmp"120⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\4A3A.tmp"C:\Users\Admin\AppData\Local\Temp\4A3A.tmp"121⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\4A88.tmp"C:\Users\Admin\AppData\Local\Temp\4A88.tmp"122⤵PID:1528
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-