Analysis
-
max time kernel
151s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
28-08-2023 19:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cafa4c8a9b259565422ff661cd0f6262_mafia_JC.exe
Resource
win7-20230712-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
cafa4c8a9b259565422ff661cd0f6262_mafia_JC.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
cafa4c8a9b259565422ff661cd0f6262_mafia_JC.exe
-
Size
486KB
-
MD5
cafa4c8a9b259565422ff661cd0f6262
-
SHA1
deae5f53c74513c321c2cafde1aa2a90dcec2ac7
-
SHA256
d0e5743033533ccc1db36273d50ab3f433941ffeec00f9189c3544dcd48cba70
-
SHA512
254ddba5ae307987895366ed3283e9f6260640ad83830608b48340a7c54be08a5f5906535678ad333644a8b074aa0c98b8bb815a2125e1931d9980f5b00c8caa
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7ym8Nmsb7YGJchtXZih/zCNGUgRCOyvYuZQ3b:/U5rCOTeiDymts4GJcPIh/+GFCORPNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2796 781D.tmp 2832 788A.tmp 2996 7974.tmp 2388 7A7D.tmp 2924 7B48.tmp 2172 7C32.tmp 2868 7CAF.tmp 2704 7DB8.tmp 2768 7E54.tmp 1288 7F3E.tmp 564 8009.tmp 484 80F3.tmp 640 819E.tmp 1868 8269.tmp 2152 82E6.tmp 2300 8382.tmp 2272 846C.tmp 2108 8537.tmp 2804 8611.tmp 2956 871A.tmp 2208 8804.tmp 2976 8A07.tmp 1672 8AE1.tmp 1648 8B5E.tmp 1532 8BBC.tmp 1048 8C48.tmp 2028 8CD5.tmp 1628 8D51.tmp 1664 8DBF.tmp 1440 8E3B.tmp 1276 8EC8.tmp 2100 8F54.tmp 2488 8FB2.tmp 2256 901F.tmp 1920 908C.tmp 396 9109.tmp 2680 9176.tmp 1356 91E3.tmp 1996 9251.tmp 960 92DD.tmp 788 934A.tmp 1536 93C7.tmp 1456 9444.tmp 1520 94C1.tmp 1032 952E.tmp 2356 959B.tmp 1580 9608.tmp 1968 9675.tmp 2112 96F2.tmp 2248 975F.tmp 1896 97CD.tmp 1236 9849.tmp 1760 98B7.tmp 2368 9914.tmp 2480 9991.tmp 664 99FE.tmp 2004 9A7B.tmp 2932 9AE8.tmp 2988 9B65.tmp 2936 9BF1.tmp 2836 9C5F.tmp 2864 9CCC.tmp 2896 9D1A.tmp 2924 9D77.tmp -
Loads dropped DLL 64 IoCs
pid Process 1316 cafa4c8a9b259565422ff661cd0f6262_mafia_JC.exe 2796 781D.tmp 2832 788A.tmp 2996 7974.tmp 2388 7A7D.tmp 2924 7B48.tmp 2172 7C32.tmp 2868 7CAF.tmp 2704 7DB8.tmp 2768 7E54.tmp 1288 7F3E.tmp 564 8009.tmp 484 80F3.tmp 640 819E.tmp 1868 8269.tmp 2152 82E6.tmp 2300 8382.tmp 2272 846C.tmp 2108 8537.tmp 2804 8611.tmp 2956 871A.tmp 2208 8804.tmp 2976 8A07.tmp 1672 8AE1.tmp 1648 8B5E.tmp 1532 8BBC.tmp 1048 8C48.tmp 2028 8CD5.tmp 1628 8D51.tmp 1664 8DBF.tmp 1440 8E3B.tmp 1276 8EC8.tmp 2100 8F54.tmp 2488 8FB2.tmp 2256 901F.tmp 1920 908C.tmp 396 9109.tmp 2680 9176.tmp 1356 91E3.tmp 1996 9251.tmp 960 92DD.tmp 788 934A.tmp 1536 93C7.tmp 1456 9444.tmp 1520 94C1.tmp 1032 952E.tmp 2356 959B.tmp 1580 9608.tmp 1968 9675.tmp 2112 96F2.tmp 2248 975F.tmp 1896 97CD.tmp 1236 9849.tmp 1760 98B7.tmp 2368 9914.tmp 2480 9991.tmp 664 99FE.tmp 2004 9A7B.tmp 2932 9AE8.tmp 2988 9B65.tmp 2936 9BF1.tmp 2836 9C5F.tmp 2864 9CCC.tmp 2896 9D1A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1316 wrote to memory of 2796 1316 cafa4c8a9b259565422ff661cd0f6262_mafia_JC.exe 28 PID 1316 wrote to memory of 2796 1316 cafa4c8a9b259565422ff661cd0f6262_mafia_JC.exe 28 PID 1316 wrote to memory of 2796 1316 cafa4c8a9b259565422ff661cd0f6262_mafia_JC.exe 28 PID 1316 wrote to memory of 2796 1316 cafa4c8a9b259565422ff661cd0f6262_mafia_JC.exe 28 PID 2796 wrote to memory of 2832 2796 781D.tmp 29 PID 2796 wrote to memory of 2832 2796 781D.tmp 29 PID 2796 wrote to memory of 2832 2796 781D.tmp 29 PID 2796 wrote to memory of 2832 2796 781D.tmp 29 PID 2832 wrote to memory of 2996 2832 788A.tmp 30 PID 2832 wrote to memory of 2996 2832 788A.tmp 30 PID 2832 wrote to memory of 2996 2832 788A.tmp 30 PID 2832 wrote to memory of 2996 2832 788A.tmp 30 PID 2996 wrote to memory of 2388 2996 7974.tmp 31 PID 2996 wrote to memory of 2388 2996 7974.tmp 31 PID 2996 wrote to memory of 2388 2996 7974.tmp 31 PID 2996 wrote to memory of 2388 2996 7974.tmp 31 PID 2388 wrote to memory of 2924 2388 7A7D.tmp 32 PID 2388 wrote to memory of 2924 2388 7A7D.tmp 32 PID 2388 wrote to memory of 2924 2388 7A7D.tmp 32 PID 2388 wrote to memory of 2924 2388 7A7D.tmp 32 PID 2924 wrote to memory of 2172 2924 7B48.tmp 33 PID 2924 wrote to memory of 2172 2924 7B48.tmp 33 PID 2924 wrote to memory of 2172 2924 7B48.tmp 33 PID 2924 wrote to memory of 2172 2924 7B48.tmp 33 PID 2172 wrote to memory of 2868 2172 7C32.tmp 34 PID 2172 wrote to memory of 2868 2172 7C32.tmp 34 PID 2172 wrote to memory of 2868 2172 7C32.tmp 34 PID 2172 wrote to memory of 2868 2172 7C32.tmp 34 PID 2868 wrote to memory of 2704 2868 7CAF.tmp 35 PID 2868 wrote to memory of 2704 2868 7CAF.tmp 35 PID 2868 wrote to memory of 2704 2868 7CAF.tmp 35 PID 2868 wrote to memory of 2704 2868 7CAF.tmp 35 PID 2704 wrote to memory of 2768 2704 7DB8.tmp 36 PID 2704 wrote to memory of 2768 2704 7DB8.tmp 36 PID 2704 wrote to memory of 2768 2704 7DB8.tmp 36 PID 2704 wrote to memory of 2768 2704 7DB8.tmp 36 PID 2768 wrote to memory of 1288 2768 7E54.tmp 37 PID 2768 wrote to memory of 1288 2768 7E54.tmp 37 PID 2768 wrote to memory of 1288 2768 7E54.tmp 37 PID 2768 wrote to memory of 1288 2768 7E54.tmp 37 PID 1288 wrote to memory of 564 1288 7F3E.tmp 38 PID 1288 wrote to memory of 564 1288 7F3E.tmp 38 PID 1288 wrote to memory of 564 1288 7F3E.tmp 38 PID 1288 wrote to memory of 564 1288 7F3E.tmp 38 PID 564 wrote to memory of 484 564 8009.tmp 39 PID 564 wrote to memory of 484 564 8009.tmp 39 PID 564 wrote to memory of 484 564 8009.tmp 39 PID 564 wrote to memory of 484 564 8009.tmp 39 PID 484 wrote to memory of 640 484 80F3.tmp 40 PID 484 wrote to memory of 640 484 80F3.tmp 40 PID 484 wrote to memory of 640 484 80F3.tmp 40 PID 484 wrote to memory of 640 484 80F3.tmp 40 PID 640 wrote to memory of 1868 640 819E.tmp 41 PID 640 wrote to memory of 1868 640 819E.tmp 41 PID 640 wrote to memory of 1868 640 819E.tmp 41 PID 640 wrote to memory of 1868 640 819E.tmp 41 PID 1868 wrote to memory of 2152 1868 8269.tmp 42 PID 1868 wrote to memory of 2152 1868 8269.tmp 42 PID 1868 wrote to memory of 2152 1868 8269.tmp 42 PID 1868 wrote to memory of 2152 1868 8269.tmp 42 PID 2152 wrote to memory of 2300 2152 82E6.tmp 43 PID 2152 wrote to memory of 2300 2152 82E6.tmp 43 PID 2152 wrote to memory of 2300 2152 82E6.tmp 43 PID 2152 wrote to memory of 2300 2152 82E6.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\cafa4c8a9b259565422ff661cd0f6262_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\cafa4c8a9b259565422ff661cd0f6262_mafia_JC.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\781D.tmp"C:\Users\Admin\AppData\Local\Temp\781D.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\788A.tmp"C:\Users\Admin\AppData\Local\Temp\788A.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\7974.tmp"C:\Users\Admin\AppData\Local\Temp\7974.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\7A7D.tmp"C:\Users\Admin\AppData\Local\Temp\7A7D.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\7B48.tmp"C:\Users\Admin\AppData\Local\Temp\7B48.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\7C32.tmp"C:\Users\Admin\AppData\Local\Temp\7C32.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\7CAF.tmp"C:\Users\Admin\AppData\Local\Temp\7CAF.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\7DB8.tmp"C:\Users\Admin\AppData\Local\Temp\7DB8.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\7E54.tmp"C:\Users\Admin\AppData\Local\Temp\7E54.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\7F3E.tmp"C:\Users\Admin\AppData\Local\Temp\7F3E.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\8009.tmp"C:\Users\Admin\AppData\Local\Temp\8009.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Users\Admin\AppData\Local\Temp\80F3.tmp"C:\Users\Admin\AppData\Local\Temp\80F3.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:484 -
C:\Users\Admin\AppData\Local\Temp\819E.tmp"C:\Users\Admin\AppData\Local\Temp\819E.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Users\Admin\AppData\Local\Temp\8269.tmp"C:\Users\Admin\AppData\Local\Temp\8269.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\82E6.tmp"C:\Users\Admin\AppData\Local\Temp\82E6.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\8382.tmp"C:\Users\Admin\AppData\Local\Temp\8382.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\846C.tmp"C:\Users\Admin\AppData\Local\Temp\846C.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\8537.tmp"C:\Users\Admin\AppData\Local\Temp\8537.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\8611.tmp"C:\Users\Admin\AppData\Local\Temp\8611.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\871A.tmp"C:\Users\Admin\AppData\Local\Temp\871A.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\8804.tmp"C:\Users\Admin\AppData\Local\Temp\8804.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\8A07.tmp"C:\Users\Admin\AppData\Local\Temp\8A07.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\8AE1.tmp"C:\Users\Admin\AppData\Local\Temp\8AE1.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\8B5E.tmp"C:\Users\Admin\AppData\Local\Temp\8B5E.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\8BBC.tmp"C:\Users\Admin\AppData\Local\Temp\8BBC.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\8C48.tmp"C:\Users\Admin\AppData\Local\Temp\8C48.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\8CD5.tmp"C:\Users\Admin\AppData\Local\Temp\8CD5.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\8D51.tmp"C:\Users\Admin\AppData\Local\Temp\8D51.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\8DBF.tmp"C:\Users\Admin\AppData\Local\Temp\8DBF.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\8E3B.tmp"C:\Users\Admin\AppData\Local\Temp\8E3B.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\8EC8.tmp"C:\Users\Admin\AppData\Local\Temp\8EC8.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\8F54.tmp"C:\Users\Admin\AppData\Local\Temp\8F54.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\8FB2.tmp"C:\Users\Admin\AppData\Local\Temp\8FB2.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\901F.tmp"C:\Users\Admin\AppData\Local\Temp\901F.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\908C.tmp"C:\Users\Admin\AppData\Local\Temp\908C.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\9109.tmp"C:\Users\Admin\AppData\Local\Temp\9109.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:396 -
C:\Users\Admin\AppData\Local\Temp\9176.tmp"C:\Users\Admin\AppData\Local\Temp\9176.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\91E3.tmp"C:\Users\Admin\AppData\Local\Temp\91E3.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\9251.tmp"C:\Users\Admin\AppData\Local\Temp\9251.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\92DD.tmp"C:\Users\Admin\AppData\Local\Temp\92DD.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:960 -
C:\Users\Admin\AppData\Local\Temp\934A.tmp"C:\Users\Admin\AppData\Local\Temp\934A.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:788 -
C:\Users\Admin\AppData\Local\Temp\93C7.tmp"C:\Users\Admin\AppData\Local\Temp\93C7.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\9444.tmp"C:\Users\Admin\AppData\Local\Temp\9444.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\94C1.tmp"C:\Users\Admin\AppData\Local\Temp\94C1.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\952E.tmp"C:\Users\Admin\AppData\Local\Temp\952E.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\959B.tmp"C:\Users\Admin\AppData\Local\Temp\959B.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\9608.tmp"C:\Users\Admin\AppData\Local\Temp\9608.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\9675.tmp"C:\Users\Admin\AppData\Local\Temp\9675.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\96F2.tmp"C:\Users\Admin\AppData\Local\Temp\96F2.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\975F.tmp"C:\Users\Admin\AppData\Local\Temp\975F.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\97CD.tmp"C:\Users\Admin\AppData\Local\Temp\97CD.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\9849.tmp"C:\Users\Admin\AppData\Local\Temp\9849.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\98B7.tmp"C:\Users\Admin\AppData\Local\Temp\98B7.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\9914.tmp"C:\Users\Admin\AppData\Local\Temp\9914.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\9991.tmp"C:\Users\Admin\AppData\Local\Temp\9991.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\99FE.tmp"C:\Users\Admin\AppData\Local\Temp\99FE.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:664 -
C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\9B65.tmp"C:\Users\Admin\AppData\Local\Temp\9B65.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\9BF1.tmp"C:\Users\Admin\AppData\Local\Temp\9BF1.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\9D1A.tmp"C:\Users\Admin\AppData\Local\Temp\9D1A.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\9D77.tmp"C:\Users\Admin\AppData\Local\Temp\9D77.tmp"65⤵
- Executes dropped EXE
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\9DE5.tmp"C:\Users\Admin\AppData\Local\Temp\9DE5.tmp"66⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\A0C2.tmp"C:\Users\Admin\AppData\Local\Temp\A0C2.tmp"67⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\A14E.tmp"C:\Users\Admin\AppData\Local\Temp\A14E.tmp"68⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\A2A5.tmp"C:\Users\Admin\AppData\Local\Temp\A2A5.tmp"69⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\A313.tmp"C:\Users\Admin\AppData\Local\Temp\A313.tmp"70⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\A380.tmp"C:\Users\Admin\AppData\Local\Temp\A380.tmp"71⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\A3ED.tmp"C:\Users\Admin\AppData\Local\Temp\A3ED.tmp"72⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\A43B.tmp"C:\Users\Admin\AppData\Local\Temp\A43B.tmp"73⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\A4B8.tmp"C:\Users\Admin\AppData\Local\Temp\A4B8.tmp"74⤵PID:472
-
C:\Users\Admin\AppData\Local\Temp\A525.tmp"C:\Users\Admin\AppData\Local\Temp\A525.tmp"75⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\A5A2.tmp"C:\Users\Admin\AppData\Local\Temp\A5A2.tmp"76⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\A60F.tmp"C:\Users\Admin\AppData\Local\Temp\A60F.tmp"77⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\A67C.tmp"C:\Users\Admin\AppData\Local\Temp\A67C.tmp"78⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\A6E9.tmp"C:\Users\Admin\AppData\Local\Temp\A6E9.tmp"79⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\A757.tmp"C:\Users\Admin\AppData\Local\Temp\A757.tmp"80⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\A7C4.tmp"C:\Users\Admin\AppData\Local\Temp\A7C4.tmp"81⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\A841.tmp"C:\Users\Admin\AppData\Local\Temp\A841.tmp"82⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\A8AE.tmp"C:\Users\Admin\AppData\Local\Temp\A8AE.tmp"83⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\A91B.tmp"C:\Users\Admin\AppData\Local\Temp\A91B.tmp"84⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\A988.tmp"C:\Users\Admin\AppData\Local\Temp\A988.tmp"85⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\AA05.tmp"C:\Users\Admin\AppData\Local\Temp\AA05.tmp"86⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\AA82.tmp"C:\Users\Admin\AppData\Local\Temp\AA82.tmp"87⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\AAEF.tmp"C:\Users\Admin\AppData\Local\Temp\AAEF.tmp"88⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\AB6C.tmp"C:\Users\Admin\AppData\Local\Temp\AB6C.tmp"89⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\ABD9.tmp"C:\Users\Admin\AppData\Local\Temp\ABD9.tmp"90⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\AC46.tmp"C:\Users\Admin\AppData\Local\Temp\AC46.tmp"91⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\ACB3.tmp"C:\Users\Admin\AppData\Local\Temp\ACB3.tmp"92⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\AD11.tmp"C:\Users\Admin\AppData\Local\Temp\AD11.tmp"93⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\AD8E.tmp"C:\Users\Admin\AppData\Local\Temp\AD8E.tmp"94⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\ADFB.tmp"C:\Users\Admin\AppData\Local\Temp\ADFB.tmp"95⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\AE59.tmp"C:\Users\Admin\AppData\Local\Temp\AE59.tmp"96⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\AEE5.tmp"C:\Users\Admin\AppData\Local\Temp\AEE5.tmp"97⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\AF62.tmp"C:\Users\Admin\AppData\Local\Temp\AF62.tmp"98⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\AFCF.tmp"C:\Users\Admin\AppData\Local\Temp\AFCF.tmp"99⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\B02D.tmp"C:\Users\Admin\AppData\Local\Temp\B02D.tmp"100⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\B09A.tmp"C:\Users\Admin\AppData\Local\Temp\B09A.tmp"101⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\B107.tmp"C:\Users\Admin\AppData\Local\Temp\B107.tmp"102⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\B174.tmp"C:\Users\Admin\AppData\Local\Temp\B174.tmp"103⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\B1D2.tmp"C:\Users\Admin\AppData\Local\Temp\B1D2.tmp"104⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\B24F.tmp"C:\Users\Admin\AppData\Local\Temp\B24F.tmp"105⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\B2BC.tmp"C:\Users\Admin\AppData\Local\Temp\B2BC.tmp"106⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\B319.tmp"C:\Users\Admin\AppData\Local\Temp\B319.tmp"107⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\B367.tmp"C:\Users\Admin\AppData\Local\Temp\B367.tmp"108⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\B3B5.tmp"C:\Users\Admin\AppData\Local\Temp\B3B5.tmp"109⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\B413.tmp"C:\Users\Admin\AppData\Local\Temp\B413.tmp"110⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\B471.tmp"C:\Users\Admin\AppData\Local\Temp\B471.tmp"111⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\B4CE.tmp"C:\Users\Admin\AppData\Local\Temp\B4CE.tmp"112⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\B52C.tmp"C:\Users\Admin\AppData\Local\Temp\B52C.tmp"113⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\B589.tmp"C:\Users\Admin\AppData\Local\Temp\B589.tmp"114⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\B606.tmp"C:\Users\Admin\AppData\Local\Temp\B606.tmp"115⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\B7F9.tmp"C:\Users\Admin\AppData\Local\Temp\B7F9.tmp"116⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\B867.tmp"C:\Users\Admin\AppData\Local\Temp\B867.tmp"117⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\B8D4.tmp"C:\Users\Admin\AppData\Local\Temp\B8D4.tmp"118⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\B931.tmp"C:\Users\Admin\AppData\Local\Temp\B931.tmp"119⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\B99F.tmp"C:\Users\Admin\AppData\Local\Temp\B99F.tmp"120⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\BA1B.tmp"C:\Users\Admin\AppData\Local\Temp\BA1B.tmp"121⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\BA89.tmp"C:\Users\Admin\AppData\Local\Temp\BA89.tmp"122⤵PID:1236
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-