Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05/07/2024, 13:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-07-05_ef40f98f9a410d302aeab31200dd96e9_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-05_ef40f98f9a410d302aeab31200dd96e9_mafia.exe
Resource
win10v2004-20240704-en
2 signatures
150 seconds
General
-
Target
2024-07-05_ef40f98f9a410d302aeab31200dd96e9_mafia.exe
-
Size
529KB
-
MD5
ef40f98f9a410d302aeab31200dd96e9
-
SHA1
558f97ec16e71f92c19c00ef3a817ff03eab50dd
-
SHA256
8ef304a4bfc01c178b8c4e9ef2606465cadcd54f5aec4ba436f8fb3be0b56ca4
-
SHA512
4809b47020f3e266f19e448ea8cb33194f9ac6bc11afd64ca155eae9ca5ecbff548786f0562fb10b0b851688904a291c439a57ee6f217c94fd5f32c1a1a93806
-
SSDEEP
12288:NU5rCOTeijv+HhXjOyquLjh8sWFNmTZwlH4Hp:NUQOJj6TOuomTSlH4Hp
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3064 1F92.tmp 2536 201E.tmp 2640 20CA.tmp 2532 2175.tmp 2856 21B4.tmp 2620 225F.tmp 1884 229E.tmp 2420 230B.tmp 2968 23C6.tmp 2080 2481.tmp 2392 24EE.tmp 2792 25AA.tmp 2976 2646.tmp 1800 26E2.tmp 1540 2720.tmp 1436 27CC.tmp 1368 2858.tmp 2668 2913.tmp 2772 29BF.tmp 864 2A3C.tmp 1260 2AD8.tmp 2216 2B83.tmp 2268 2C00.tmp 2376 2C5E.tmp 1888 2CAC.tmp 2796 2D09.tmp 1716 2D57.tmp 596 2D96.tmp 336 2DE4.tmp 1008 2E22.tmp 1420 2E70.tmp 2236 2EBE.tmp 832 2F0C.tmp 1120 2F5A.tmp 108 2FA8.tmp 2264 2FF6.tmp 2364 3044.tmp 1916 30A2.tmp 1224 30FF.tmp 1720 315D.tmp 1480 319B.tmp 1304 31F9.tmp 1232 3276.tmp 1448 32F2.tmp 932 3340.tmp 928 337F.tmp 2368 33BD.tmp 2328 340B.tmp 1936 3469.tmp 816 34B7.tmp 2072 3505.tmp 1672 3553.tmp 272 35A1.tmp 1576 35FE.tmp 1376 364C.tmp 1636 36AA.tmp 1044 36F8.tmp 2596 3746.tmp 2696 3794.tmp 2536 37E2.tmp 2584 3840.tmp 2724 388E.tmp 2628 38DC.tmp 2580 392A.tmp -
Loads dropped DLL 64 IoCs
pid Process 2588 2024-07-05_ef40f98f9a410d302aeab31200dd96e9_mafia.exe 3064 1F92.tmp 2536 201E.tmp 2640 20CA.tmp 2532 2175.tmp 2856 21B4.tmp 2620 225F.tmp 1884 229E.tmp 2420 230B.tmp 2968 23C6.tmp 2080 2481.tmp 2392 24EE.tmp 2792 25AA.tmp 2976 2646.tmp 1800 26E2.tmp 1540 2720.tmp 1436 27CC.tmp 1368 2858.tmp 2668 2913.tmp 2772 29BF.tmp 864 2A3C.tmp 1260 2AD8.tmp 2216 2B83.tmp 2268 2C00.tmp 2376 2C5E.tmp 1888 2CAC.tmp 2796 2D09.tmp 1716 2D57.tmp 596 2D96.tmp 336 2DE4.tmp 1008 2E22.tmp 1420 2E70.tmp 2236 2EBE.tmp 832 2F0C.tmp 1120 2F5A.tmp 108 2FA8.tmp 2264 2FF6.tmp 2364 3044.tmp 1916 30A2.tmp 1224 30FF.tmp 1720 315D.tmp 1480 319B.tmp 1304 31F9.tmp 1232 3276.tmp 1448 32F2.tmp 932 3340.tmp 928 337F.tmp 2368 33BD.tmp 2328 340B.tmp 1936 3469.tmp 816 34B7.tmp 2072 3505.tmp 1672 3553.tmp 272 35A1.tmp 1576 35FE.tmp 1376 364C.tmp 1636 36AA.tmp 1044 36F8.tmp 2596 3746.tmp 2696 3794.tmp 2536 37E2.tmp 2584 3840.tmp 2724 388E.tmp 2628 38DC.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2588 wrote to memory of 3064 2588 2024-07-05_ef40f98f9a410d302aeab31200dd96e9_mafia.exe 28 PID 2588 wrote to memory of 3064 2588 2024-07-05_ef40f98f9a410d302aeab31200dd96e9_mafia.exe 28 PID 2588 wrote to memory of 3064 2588 2024-07-05_ef40f98f9a410d302aeab31200dd96e9_mafia.exe 28 PID 2588 wrote to memory of 3064 2588 2024-07-05_ef40f98f9a410d302aeab31200dd96e9_mafia.exe 28 PID 3064 wrote to memory of 2536 3064 1F92.tmp 29 PID 3064 wrote to memory of 2536 3064 1F92.tmp 29 PID 3064 wrote to memory of 2536 3064 1F92.tmp 29 PID 3064 wrote to memory of 2536 3064 1F92.tmp 29 PID 2536 wrote to memory of 2640 2536 201E.tmp 30 PID 2536 wrote to memory of 2640 2536 201E.tmp 30 PID 2536 wrote to memory of 2640 2536 201E.tmp 30 PID 2536 wrote to memory of 2640 2536 201E.tmp 30 PID 2640 wrote to memory of 2532 2640 20CA.tmp 31 PID 2640 wrote to memory of 2532 2640 20CA.tmp 31 PID 2640 wrote to memory of 2532 2640 20CA.tmp 31 PID 2640 wrote to memory of 2532 2640 20CA.tmp 31 PID 2532 wrote to memory of 2856 2532 2175.tmp 32 PID 2532 wrote to memory of 2856 2532 2175.tmp 32 PID 2532 wrote to memory of 2856 2532 2175.tmp 32 PID 2532 wrote to memory of 2856 2532 2175.tmp 32 PID 2856 wrote to memory of 2620 2856 21B4.tmp 33 PID 2856 wrote to memory of 2620 2856 21B4.tmp 33 PID 2856 wrote to memory of 2620 2856 21B4.tmp 33 PID 2856 wrote to memory of 2620 2856 21B4.tmp 33 PID 2620 wrote to memory of 1884 2620 225F.tmp 34 PID 2620 wrote to memory of 1884 2620 225F.tmp 34 PID 2620 wrote to memory of 1884 2620 225F.tmp 34 PID 2620 wrote to memory of 1884 2620 225F.tmp 34 PID 1884 wrote to memory of 2420 1884 229E.tmp 35 PID 1884 wrote to memory of 2420 1884 229E.tmp 35 PID 1884 wrote to memory of 2420 1884 229E.tmp 35 PID 1884 wrote to memory of 2420 1884 229E.tmp 35 PID 2420 wrote to memory of 2968 2420 230B.tmp 36 PID 2420 wrote to memory of 2968 2420 230B.tmp 36 PID 2420 wrote to memory of 2968 2420 230B.tmp 36 PID 2420 wrote to memory of 2968 2420 230B.tmp 36 PID 2968 wrote to memory of 2080 2968 23C6.tmp 37 PID 2968 wrote to memory of 2080 2968 23C6.tmp 37 PID 2968 wrote to memory of 2080 2968 23C6.tmp 37 PID 2968 wrote to memory of 2080 2968 23C6.tmp 37 PID 2080 wrote to memory of 2392 2080 2481.tmp 38 PID 2080 wrote to memory of 2392 2080 2481.tmp 38 PID 2080 wrote to memory of 2392 2080 2481.tmp 38 PID 2080 wrote to memory of 2392 2080 2481.tmp 38 PID 2392 wrote to memory of 2792 2392 24EE.tmp 39 PID 2392 wrote to memory of 2792 2392 24EE.tmp 39 PID 2392 wrote to memory of 2792 2392 24EE.tmp 39 PID 2392 wrote to memory of 2792 2392 24EE.tmp 39 PID 2792 wrote to memory of 2976 2792 25AA.tmp 40 PID 2792 wrote to memory of 2976 2792 25AA.tmp 40 PID 2792 wrote to memory of 2976 2792 25AA.tmp 40 PID 2792 wrote to memory of 2976 2792 25AA.tmp 40 PID 2976 wrote to memory of 1800 2976 2646.tmp 41 PID 2976 wrote to memory of 1800 2976 2646.tmp 41 PID 2976 wrote to memory of 1800 2976 2646.tmp 41 PID 2976 wrote to memory of 1800 2976 2646.tmp 41 PID 1800 wrote to memory of 1540 1800 26E2.tmp 42 PID 1800 wrote to memory of 1540 1800 26E2.tmp 42 PID 1800 wrote to memory of 1540 1800 26E2.tmp 42 PID 1800 wrote to memory of 1540 1800 26E2.tmp 42 PID 1540 wrote to memory of 1436 1540 2720.tmp 43 PID 1540 wrote to memory of 1436 1540 2720.tmp 43 PID 1540 wrote to memory of 1436 1540 2720.tmp 43 PID 1540 wrote to memory of 1436 1540 2720.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-05_ef40f98f9a410d302aeab31200dd96e9_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-05_ef40f98f9a410d302aeab31200dd96e9_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\1F92.tmp"C:\Users\Admin\AppData\Local\Temp\1F92.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\201E.tmp"C:\Users\Admin\AppData\Local\Temp\201E.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\20CA.tmp"C:\Users\Admin\AppData\Local\Temp\20CA.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\2175.tmp"C:\Users\Admin\AppData\Local\Temp\2175.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\21B4.tmp"C:\Users\Admin\AppData\Local\Temp\21B4.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\225F.tmp"C:\Users\Admin\AppData\Local\Temp\225F.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\229E.tmp"C:\Users\Admin\AppData\Local\Temp\229E.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\230B.tmp"C:\Users\Admin\AppData\Local\Temp\230B.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\23C6.tmp"C:\Users\Admin\AppData\Local\Temp\23C6.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\2481.tmp"C:\Users\Admin\AppData\Local\Temp\2481.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\24EE.tmp"C:\Users\Admin\AppData\Local\Temp\24EE.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\25AA.tmp"C:\Users\Admin\AppData\Local\Temp\25AA.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\2646.tmp"C:\Users\Admin\AppData\Local\Temp\2646.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\26E2.tmp"C:\Users\Admin\AppData\Local\Temp\26E2.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\2720.tmp"C:\Users\Admin\AppData\Local\Temp\2720.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\27CC.tmp"C:\Users\Admin\AppData\Local\Temp\27CC.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\2858.tmp"C:\Users\Admin\AppData\Local\Temp\2858.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\2913.tmp"C:\Users\Admin\AppData\Local\Temp\2913.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\29BF.tmp"C:\Users\Admin\AppData\Local\Temp\29BF.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:864 -
C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\2B83.tmp"C:\Users\Admin\AppData\Local\Temp\2B83.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\2C00.tmp"C:\Users\Admin\AppData\Local\Temp\2C00.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\2D09.tmp"C:\Users\Admin\AppData\Local\Temp\2D09.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\2D57.tmp"C:\Users\Admin\AppData\Local\Temp\2D57.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\2D96.tmp"C:\Users\Admin\AppData\Local\Temp\2D96.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:596 -
C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:336 -
C:\Users\Admin\AppData\Local\Temp\2E22.tmp"C:\Users\Admin\AppData\Local\Temp\2E22.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\2E70.tmp"C:\Users\Admin\AppData\Local\Temp\2E70.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:832 -
C:\Users\Admin\AppData\Local\Temp\2F5A.tmp"C:\Users\Admin\AppData\Local\Temp\2F5A.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:108 -
C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\3044.tmp"C:\Users\Admin\AppData\Local\Temp\3044.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\30A2.tmp"C:\Users\Admin\AppData\Local\Temp\30A2.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\30FF.tmp"C:\Users\Admin\AppData\Local\Temp\30FF.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\315D.tmp"C:\Users\Admin\AppData\Local\Temp\315D.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\319B.tmp"C:\Users\Admin\AppData\Local\Temp\319B.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\31F9.tmp"C:\Users\Admin\AppData\Local\Temp\31F9.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\3276.tmp"C:\Users\Admin\AppData\Local\Temp\3276.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\32F2.tmp"C:\Users\Admin\AppData\Local\Temp\32F2.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\3340.tmp"C:\Users\Admin\AppData\Local\Temp\3340.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:932 -
C:\Users\Admin\AppData\Local\Temp\337F.tmp"C:\Users\Admin\AppData\Local\Temp\337F.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:928 -
C:\Users\Admin\AppData\Local\Temp\33BD.tmp"C:\Users\Admin\AppData\Local\Temp\33BD.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\340B.tmp"C:\Users\Admin\AppData\Local\Temp\340B.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\3469.tmp"C:\Users\Admin\AppData\Local\Temp\3469.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\34B7.tmp"C:\Users\Admin\AppData\Local\Temp\34B7.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:816 -
C:\Users\Admin\AppData\Local\Temp\3505.tmp"C:\Users\Admin\AppData\Local\Temp\3505.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\3553.tmp"C:\Users\Admin\AppData\Local\Temp\3553.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\35A1.tmp"C:\Users\Admin\AppData\Local\Temp\35A1.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:272 -
C:\Users\Admin\AppData\Local\Temp\35FE.tmp"C:\Users\Admin\AppData\Local\Temp\35FE.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\364C.tmp"C:\Users\Admin\AppData\Local\Temp\364C.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\36AA.tmp"C:\Users\Admin\AppData\Local\Temp\36AA.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\36F8.tmp"C:\Users\Admin\AppData\Local\Temp\36F8.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\3746.tmp"C:\Users\Admin\AppData\Local\Temp\3746.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\3794.tmp"C:\Users\Admin\AppData\Local\Temp\3794.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\37E2.tmp"C:\Users\Admin\AppData\Local\Temp\37E2.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\3840.tmp"C:\Users\Admin\AppData\Local\Temp\3840.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\388E.tmp"C:\Users\Admin\AppData\Local\Temp\388E.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\38DC.tmp"C:\Users\Admin\AppData\Local\Temp\38DC.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\392A.tmp"C:\Users\Admin\AppData\Local\Temp\392A.tmp"65⤵
- Executes dropped EXE
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\3978.tmp"C:\Users\Admin\AppData\Local\Temp\3978.tmp"66⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\39C6.tmp"C:\Users\Admin\AppData\Local\Temp\39C6.tmp"67⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\3A14.tmp"C:\Users\Admin\AppData\Local\Temp\3A14.tmp"68⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\3A62.tmp"C:\Users\Admin\AppData\Local\Temp\3A62.tmp"69⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\3AB0.tmp"C:\Users\Admin\AppData\Local\Temp\3AB0.tmp"70⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\3AEE.tmp"C:\Users\Admin\AppData\Local\Temp\3AEE.tmp"71⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\3B3C.tmp"C:\Users\Admin\AppData\Local\Temp\3B3C.tmp"72⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\3BA9.tmp"C:\Users\Admin\AppData\Local\Temp\3BA9.tmp"73⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\3BF7.tmp"C:\Users\Admin\AppData\Local\Temp\3BF7.tmp"74⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\3C45.tmp"C:\Users\Admin\AppData\Local\Temp\3C45.tmp"75⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\3CA3.tmp"C:\Users\Admin\AppData\Local\Temp\3CA3.tmp"76⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\3CE1.tmp"C:\Users\Admin\AppData\Local\Temp\3CE1.tmp"77⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\3D2F.tmp"C:\Users\Admin\AppData\Local\Temp\3D2F.tmp"78⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\3D7D.tmp"C:\Users\Admin\AppData\Local\Temp\3D7D.tmp"79⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\3DCB.tmp"C:\Users\Admin\AppData\Local\Temp\3DCB.tmp"80⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\3E19.tmp"C:\Users\Admin\AppData\Local\Temp\3E19.tmp"81⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\3E67.tmp"C:\Users\Admin\AppData\Local\Temp\3E67.tmp"82⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\3EB5.tmp"C:\Users\Admin\AppData\Local\Temp\3EB5.tmp"83⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\3F03.tmp"C:\Users\Admin\AppData\Local\Temp\3F03.tmp"84⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\3F42.tmp"C:\Users\Admin\AppData\Local\Temp\3F42.tmp"85⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\3F80.tmp"C:\Users\Admin\AppData\Local\Temp\3F80.tmp"86⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\3FBE.tmp"C:\Users\Admin\AppData\Local\Temp\3FBE.tmp"87⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\400C.tmp"C:\Users\Admin\AppData\Local\Temp\400C.tmp"88⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\405A.tmp"C:\Users\Admin\AppData\Local\Temp\405A.tmp"89⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\40A8.tmp"C:\Users\Admin\AppData\Local\Temp\40A8.tmp"90⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\4106.tmp"C:\Users\Admin\AppData\Local\Temp\4106.tmp"91⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\4144.tmp"C:\Users\Admin\AppData\Local\Temp\4144.tmp"92⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\4192.tmp"C:\Users\Admin\AppData\Local\Temp\4192.tmp"93⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\41E0.tmp"C:\Users\Admin\AppData\Local\Temp\41E0.tmp"94⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\422E.tmp"C:\Users\Admin\AppData\Local\Temp\422E.tmp"95⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\427C.tmp"C:\Users\Admin\AppData\Local\Temp\427C.tmp"96⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\42BB.tmp"C:\Users\Admin\AppData\Local\Temp\42BB.tmp"97⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\42F9.tmp"C:\Users\Admin\AppData\Local\Temp\42F9.tmp"98⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\4347.tmp"C:\Users\Admin\AppData\Local\Temp\4347.tmp"99⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\4395.tmp"C:\Users\Admin\AppData\Local\Temp\4395.tmp"100⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\43D4.tmp"C:\Users\Admin\AppData\Local\Temp\43D4.tmp"101⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\4412.tmp"C:\Users\Admin\AppData\Local\Temp\4412.tmp"102⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\4450.tmp"C:\Users\Admin\AppData\Local\Temp\4450.tmp"103⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\44AE.tmp"C:\Users\Admin\AppData\Local\Temp\44AE.tmp"104⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\44EC.tmp"C:\Users\Admin\AppData\Local\Temp\44EC.tmp"105⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\454A.tmp"C:\Users\Admin\AppData\Local\Temp\454A.tmp"106⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\4588.tmp"C:\Users\Admin\AppData\Local\Temp\4588.tmp"107⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\45C7.tmp"C:\Users\Admin\AppData\Local\Temp\45C7.tmp"108⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\4615.tmp"C:\Users\Admin\AppData\Local\Temp\4615.tmp"109⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\4672.tmp"C:\Users\Admin\AppData\Local\Temp\4672.tmp"110⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\46C0.tmp"C:\Users\Admin\AppData\Local\Temp\46C0.tmp"111⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\470E.tmp"C:\Users\Admin\AppData\Local\Temp\470E.tmp"112⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\474D.tmp"C:\Users\Admin\AppData\Local\Temp\474D.tmp"113⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\479B.tmp"C:\Users\Admin\AppData\Local\Temp\479B.tmp"114⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\47D9.tmp"C:\Users\Admin\AppData\Local\Temp\47D9.tmp"115⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\4827.tmp"C:\Users\Admin\AppData\Local\Temp\4827.tmp"116⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\4866.tmp"C:\Users\Admin\AppData\Local\Temp\4866.tmp"117⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\48B4.tmp"C:\Users\Admin\AppData\Local\Temp\48B4.tmp"118⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\4902.tmp"C:\Users\Admin\AppData\Local\Temp\4902.tmp"119⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\4940.tmp"C:\Users\Admin\AppData\Local\Temp\4940.tmp"120⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\498E.tmp"C:\Users\Admin\AppData\Local\Temp\498E.tmp"121⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\49CC.tmp"C:\Users\Admin\AppData\Local\Temp\49CC.tmp"122⤵PID:2484
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-