Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
23-01-2024 12:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-01-23_d059b967cbea6a44fc24477f99980dd6_mafia.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-01-23_d059b967cbea6a44fc24477f99980dd6_mafia.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-01-23_d059b967cbea6a44fc24477f99980dd6_mafia.exe
-
Size
486KB
-
MD5
d059b967cbea6a44fc24477f99980dd6
-
SHA1
15972c7a7fe486795af0d2b6881fb3f167a3f97e
-
SHA256
bb739226a5bd440bd5620d3f3db8cbf1e25a97b5656c026ed6bd95412550d72a
-
SHA512
7122100fe85d630ed0a56371ecc18273579c60bb35f10885bb5d72f539ecf4ff5fe36dc897fa91fcdc0650b398a17d8546187cddab901f7d87b0f2552bd9d9a6
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7kFD8zjgBXqfdsc6hR6Hfq6MsQrjetwQHsH3j:/U5rCOTeiDkizjgBXqVsxk/qzswZNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2968 3B9A.tmp 2648 3C55.tmp 2800 3D3F.tmp 2992 3DDB.tmp 2980 3EA6.tmp 2976 3F32.tmp 2932 3FDE.tmp 2728 4099.tmp 2552 4164.tmp 2080 420F.tmp 2404 42F9.tmp 2024 4395.tmp 2920 448F.tmp 2960 4569.tmp 2376 4624.tmp 2748 46FF.tmp 2044 47D9.tmp 1632 48A4.tmp 1748 497E.tmp 1052 4A0B.tmp 692 4B04.tmp 1484 4BDF.tmp 2896 4C8A.tmp 1468 4D74.tmp 1692 4E01.tmp 1704 4E8D.tmp 1580 4F0A.tmp 1088 4F77.tmp 2468 4FE4.tmp 1168 5052.tmp 2096 50BF.tmp 2312 513C.tmp 2476 5199.tmp 840 5206.tmp 1932 5283.tmp 1080 5300.tmp 400 536D.tmp 2460 53DA.tmp 1716 5438.tmp 792 54B5.tmp 1548 5532.tmp 1904 55AE.tmp 788 560C.tmp 1816 5679.tmp 2144 56F6.tmp 112 5773.tmp 2220 57E0.tmp 2196 585D.tmp 1952 58CA.tmp 2504 5937.tmp 2396 59A4.tmp 996 5A21.tmp 2112 5A7F.tmp 2516 5ADC.tmp 2172 5B59.tmp 1600 5C05.tmp 1404 5C72.tmp 3052 5CDF.tmp 2812 5D5C.tmp 2852 5DC9.tmp 2832 5E46.tmp 2848 5EA4.tmp 2664 5F01.tmp 2980 5F7E.tmp -
Loads dropped DLL 64 IoCs
pid Process 2212 2024-01-23_d059b967cbea6a44fc24477f99980dd6_mafia.exe 2968 3B9A.tmp 2648 3C55.tmp 2800 3D3F.tmp 2992 3DDB.tmp 2980 3EA6.tmp 2976 3F32.tmp 2932 3FDE.tmp 2728 4099.tmp 2552 4164.tmp 2080 420F.tmp 2404 42F9.tmp 2024 4395.tmp 2920 448F.tmp 2960 4569.tmp 2376 4624.tmp 2748 46FF.tmp 2044 47D9.tmp 1632 48A4.tmp 1748 497E.tmp 1052 4A0B.tmp 692 4B04.tmp 1484 4BDF.tmp 2896 4C8A.tmp 1468 4D74.tmp 1692 4E01.tmp 1704 4E8D.tmp 1580 4F0A.tmp 1088 4F77.tmp 2468 4FE4.tmp 1168 5052.tmp 2096 50BF.tmp 2312 513C.tmp 2476 5199.tmp 840 5206.tmp 1932 5283.tmp 1080 5300.tmp 400 536D.tmp 2460 53DA.tmp 1716 5438.tmp 792 54B5.tmp 1548 5532.tmp 1904 55AE.tmp 788 560C.tmp 1816 5679.tmp 2144 56F6.tmp 112 5773.tmp 2220 57E0.tmp 2196 585D.tmp 1952 58CA.tmp 2504 5937.tmp 2396 59A4.tmp 996 5A21.tmp 2112 5A7F.tmp 2516 5ADC.tmp 2172 5B59.tmp 1600 5C05.tmp 1404 5C72.tmp 3052 5CDF.tmp 2812 5D5C.tmp 2852 5DC9.tmp 2832 5E46.tmp 2848 5EA4.tmp 2664 5F01.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2212 wrote to memory of 2968 2212 2024-01-23_d059b967cbea6a44fc24477f99980dd6_mafia.exe 28 PID 2212 wrote to memory of 2968 2212 2024-01-23_d059b967cbea6a44fc24477f99980dd6_mafia.exe 28 PID 2212 wrote to memory of 2968 2212 2024-01-23_d059b967cbea6a44fc24477f99980dd6_mafia.exe 28 PID 2212 wrote to memory of 2968 2212 2024-01-23_d059b967cbea6a44fc24477f99980dd6_mafia.exe 28 PID 2968 wrote to memory of 2648 2968 3B9A.tmp 29 PID 2968 wrote to memory of 2648 2968 3B9A.tmp 29 PID 2968 wrote to memory of 2648 2968 3B9A.tmp 29 PID 2968 wrote to memory of 2648 2968 3B9A.tmp 29 PID 2648 wrote to memory of 2800 2648 3C55.tmp 30 PID 2648 wrote to memory of 2800 2648 3C55.tmp 30 PID 2648 wrote to memory of 2800 2648 3C55.tmp 30 PID 2648 wrote to memory of 2800 2648 3C55.tmp 30 PID 2800 wrote to memory of 2992 2800 3D3F.tmp 31 PID 2800 wrote to memory of 2992 2800 3D3F.tmp 31 PID 2800 wrote to memory of 2992 2800 3D3F.tmp 31 PID 2800 wrote to memory of 2992 2800 3D3F.tmp 31 PID 2992 wrote to memory of 2980 2992 3DDB.tmp 32 PID 2992 wrote to memory of 2980 2992 3DDB.tmp 32 PID 2992 wrote to memory of 2980 2992 3DDB.tmp 32 PID 2992 wrote to memory of 2980 2992 3DDB.tmp 32 PID 2980 wrote to memory of 2976 2980 3EA6.tmp 33 PID 2980 wrote to memory of 2976 2980 3EA6.tmp 33 PID 2980 wrote to memory of 2976 2980 3EA6.tmp 33 PID 2980 wrote to memory of 2976 2980 3EA6.tmp 33 PID 2976 wrote to memory of 2932 2976 3F32.tmp 34 PID 2976 wrote to memory of 2932 2976 3F32.tmp 34 PID 2976 wrote to memory of 2932 2976 3F32.tmp 34 PID 2976 wrote to memory of 2932 2976 3F32.tmp 34 PID 2932 wrote to memory of 2728 2932 3FDE.tmp 35 PID 2932 wrote to memory of 2728 2932 3FDE.tmp 35 PID 2932 wrote to memory of 2728 2932 3FDE.tmp 35 PID 2932 wrote to memory of 2728 2932 3FDE.tmp 35 PID 2728 wrote to memory of 2552 2728 4099.tmp 36 PID 2728 wrote to memory of 2552 2728 4099.tmp 36 PID 2728 wrote to memory of 2552 2728 4099.tmp 36 PID 2728 wrote to memory of 2552 2728 4099.tmp 36 PID 2552 wrote to memory of 2080 2552 4164.tmp 37 PID 2552 wrote to memory of 2080 2552 4164.tmp 37 PID 2552 wrote to memory of 2080 2552 4164.tmp 37 PID 2552 wrote to memory of 2080 2552 4164.tmp 37 PID 2080 wrote to memory of 2404 2080 420F.tmp 38 PID 2080 wrote to memory of 2404 2080 420F.tmp 38 PID 2080 wrote to memory of 2404 2080 420F.tmp 38 PID 2080 wrote to memory of 2404 2080 420F.tmp 38 PID 2404 wrote to memory of 2024 2404 42F9.tmp 39 PID 2404 wrote to memory of 2024 2404 42F9.tmp 39 PID 2404 wrote to memory of 2024 2404 42F9.tmp 39 PID 2404 wrote to memory of 2024 2404 42F9.tmp 39 PID 2024 wrote to memory of 2920 2024 4395.tmp 40 PID 2024 wrote to memory of 2920 2024 4395.tmp 40 PID 2024 wrote to memory of 2920 2024 4395.tmp 40 PID 2024 wrote to memory of 2920 2024 4395.tmp 40 PID 2920 wrote to memory of 2960 2920 448F.tmp 41 PID 2920 wrote to memory of 2960 2920 448F.tmp 41 PID 2920 wrote to memory of 2960 2920 448F.tmp 41 PID 2920 wrote to memory of 2960 2920 448F.tmp 41 PID 2960 wrote to memory of 2376 2960 4569.tmp 42 PID 2960 wrote to memory of 2376 2960 4569.tmp 42 PID 2960 wrote to memory of 2376 2960 4569.tmp 42 PID 2960 wrote to memory of 2376 2960 4569.tmp 42 PID 2376 wrote to memory of 2748 2376 4624.tmp 43 PID 2376 wrote to memory of 2748 2376 4624.tmp 43 PID 2376 wrote to memory of 2748 2376 4624.tmp 43 PID 2376 wrote to memory of 2748 2376 4624.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-23_d059b967cbea6a44fc24477f99980dd6_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-23_d059b967cbea6a44fc24477f99980dd6_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\3B9A.tmp"C:\Users\Admin\AppData\Local\Temp\3B9A.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\3C55.tmp"C:\Users\Admin\AppData\Local\Temp\3C55.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\3D3F.tmp"C:\Users\Admin\AppData\Local\Temp\3D3F.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\3DDB.tmp"C:\Users\Admin\AppData\Local\Temp\3DDB.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\3EA6.tmp"C:\Users\Admin\AppData\Local\Temp\3EA6.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\3F32.tmp"C:\Users\Admin\AppData\Local\Temp\3F32.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\3FDE.tmp"C:\Users\Admin\AppData\Local\Temp\3FDE.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\4099.tmp"C:\Users\Admin\AppData\Local\Temp\4099.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\4164.tmp"C:\Users\Admin\AppData\Local\Temp\4164.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\420F.tmp"C:\Users\Admin\AppData\Local\Temp\420F.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\42F9.tmp"C:\Users\Admin\AppData\Local\Temp\42F9.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\4395.tmp"C:\Users\Admin\AppData\Local\Temp\4395.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\448F.tmp"C:\Users\Admin\AppData\Local\Temp\448F.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\4569.tmp"C:\Users\Admin\AppData\Local\Temp\4569.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\4624.tmp"C:\Users\Admin\AppData\Local\Temp\4624.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\46FF.tmp"C:\Users\Admin\AppData\Local\Temp\46FF.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\47D9.tmp"C:\Users\Admin\AppData\Local\Temp\47D9.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\48A4.tmp"C:\Users\Admin\AppData\Local\Temp\48A4.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\497E.tmp"C:\Users\Admin\AppData\Local\Temp\497E.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\4A0B.tmp"C:\Users\Admin\AppData\Local\Temp\4A0B.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\4B04.tmp"C:\Users\Admin\AppData\Local\Temp\4B04.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:692 -
C:\Users\Admin\AppData\Local\Temp\4BDF.tmp"C:\Users\Admin\AppData\Local\Temp\4BDF.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\4F77.tmp"C:\Users\Admin\AppData\Local\Temp\4F77.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\4FE4.tmp"C:\Users\Admin\AppData\Local\Temp\4FE4.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\50BF.tmp"C:\Users\Admin\AppData\Local\Temp\50BF.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\513C.tmp"C:\Users\Admin\AppData\Local\Temp\513C.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\5199.tmp"C:\Users\Admin\AppData\Local\Temp\5199.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\5206.tmp"C:\Users\Admin\AppData\Local\Temp\5206.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:840 -
C:\Users\Admin\AppData\Local\Temp\5283.tmp"C:\Users\Admin\AppData\Local\Temp\5283.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\5300.tmp"C:\Users\Admin\AppData\Local\Temp\5300.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\536D.tmp"C:\Users\Admin\AppData\Local\Temp\536D.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:400 -
C:\Users\Admin\AppData\Local\Temp\53DA.tmp"C:\Users\Admin\AppData\Local\Temp\53DA.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\5438.tmp"C:\Users\Admin\AppData\Local\Temp\5438.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\54B5.tmp"C:\Users\Admin\AppData\Local\Temp\54B5.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:792 -
C:\Users\Admin\AppData\Local\Temp\5532.tmp"C:\Users\Admin\AppData\Local\Temp\5532.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\55AE.tmp"C:\Users\Admin\AppData\Local\Temp\55AE.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\560C.tmp"C:\Users\Admin\AppData\Local\Temp\560C.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:788 -
C:\Users\Admin\AppData\Local\Temp\5679.tmp"C:\Users\Admin\AppData\Local\Temp\5679.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\56F6.tmp"C:\Users\Admin\AppData\Local\Temp\56F6.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\5773.tmp"C:\Users\Admin\AppData\Local\Temp\5773.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:112 -
C:\Users\Admin\AppData\Local\Temp\57E0.tmp"C:\Users\Admin\AppData\Local\Temp\57E0.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\585D.tmp"C:\Users\Admin\AppData\Local\Temp\585D.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\58CA.tmp"C:\Users\Admin\AppData\Local\Temp\58CA.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\5937.tmp"C:\Users\Admin\AppData\Local\Temp\5937.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\59A4.tmp"C:\Users\Admin\AppData\Local\Temp\59A4.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\5A21.tmp"C:\Users\Admin\AppData\Local\Temp\5A21.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:996 -
C:\Users\Admin\AppData\Local\Temp\5A7F.tmp"C:\Users\Admin\AppData\Local\Temp\5A7F.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\5ADC.tmp"C:\Users\Admin\AppData\Local\Temp\5ADC.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\5B59.tmp"C:\Users\Admin\AppData\Local\Temp\5B59.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\5C05.tmp"C:\Users\Admin\AppData\Local\Temp\5C05.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\5C72.tmp"C:\Users\Admin\AppData\Local\Temp\5C72.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\5CDF.tmp"C:\Users\Admin\AppData\Local\Temp\5CDF.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\5D5C.tmp"C:\Users\Admin\AppData\Local\Temp\5D5C.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\5DC9.tmp"C:\Users\Admin\AppData\Local\Temp\5DC9.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\5E46.tmp"C:\Users\Admin\AppData\Local\Temp\5E46.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\5EA4.tmp"C:\Users\Admin\AppData\Local\Temp\5EA4.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\5F01.tmp"C:\Users\Admin\AppData\Local\Temp\5F01.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\5F7E.tmp"C:\Users\Admin\AppData\Local\Temp\5F7E.tmp"65⤵
- Executes dropped EXE
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\5FDC.tmp"C:\Users\Admin\AppData\Local\Temp\5FDC.tmp"66⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\6049.tmp"C:\Users\Admin\AppData\Local\Temp\6049.tmp"67⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\60C6.tmp"C:\Users\Admin\AppData\Local\Temp\60C6.tmp"68⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\6123.tmp"C:\Users\Admin\AppData\Local\Temp\6123.tmp"69⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\6190.tmp"C:\Users\Admin\AppData\Local\Temp\6190.tmp"70⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\629A.tmp"C:\Users\Admin\AppData\Local\Temp\629A.tmp"71⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\6307.tmp"C:\Users\Admin\AppData\Local\Temp\6307.tmp"72⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\6355.tmp"C:\Users\Admin\AppData\Local\Temp\6355.tmp"73⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\63B3.tmp"C:\Users\Admin\AppData\Local\Temp\63B3.tmp"74⤵PID:240
-
C:\Users\Admin\AppData\Local\Temp\643F.tmp"C:\Users\Admin\AppData\Local\Temp\643F.tmp"75⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\649D.tmp"C:\Users\Admin\AppData\Local\Temp\649D.tmp"76⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\64FA.tmp"C:\Users\Admin\AppData\Local\Temp\64FA.tmp"77⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\6567.tmp"C:\Users\Admin\AppData\Local\Temp\6567.tmp"78⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\65E4.tmp"C:\Users\Admin\AppData\Local\Temp\65E4.tmp"79⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\6651.tmp"C:\Users\Admin\AppData\Local\Temp\6651.tmp"80⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\66AF.tmp"C:\Users\Admin\AppData\Local\Temp\66AF.tmp"81⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\671C.tmp"C:\Users\Admin\AppData\Local\Temp\671C.tmp"82⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\67A9.tmp"C:\Users\Admin\AppData\Local\Temp\67A9.tmp"83⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\6806.tmp"C:\Users\Admin\AppData\Local\Temp\6806.tmp"84⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\6873.tmp"C:\Users\Admin\AppData\Local\Temp\6873.tmp"85⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\68D1.tmp"C:\Users\Admin\AppData\Local\Temp\68D1.tmp"86⤵PID:520
-
C:\Users\Admin\AppData\Local\Temp\694E.tmp"C:\Users\Admin\AppData\Local\Temp\694E.tmp"87⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\69AB.tmp"C:\Users\Admin\AppData\Local\Temp\69AB.tmp"88⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\6A19.tmp"C:\Users\Admin\AppData\Local\Temp\6A19.tmp"89⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\6A86.tmp"C:\Users\Admin\AppData\Local\Temp\6A86.tmp"90⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\6AF3.tmp"C:\Users\Admin\AppData\Local\Temp\6AF3.tmp"91⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\6B60.tmp"C:\Users\Admin\AppData\Local\Temp\6B60.tmp"92⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\6BCD.tmp"C:\Users\Admin\AppData\Local\Temp\6BCD.tmp"93⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\6C3B.tmp"C:\Users\Admin\AppData\Local\Temp\6C3B.tmp"94⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\6CA8.tmp"C:\Users\Admin\AppData\Local\Temp\6CA8.tmp"95⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\6D25.tmp"C:\Users\Admin\AppData\Local\Temp\6D25.tmp"96⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\6DA1.tmp"C:\Users\Admin\AppData\Local\Temp\6DA1.tmp"97⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\6E0F.tmp"C:\Users\Admin\AppData\Local\Temp\6E0F.tmp"98⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\6E7C.tmp"C:\Users\Admin\AppData\Local\Temp\6E7C.tmp"99⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\6EE9.tmp"C:\Users\Admin\AppData\Local\Temp\6EE9.tmp"100⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\6F47.tmp"C:\Users\Admin\AppData\Local\Temp\6F47.tmp"101⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\6FC3.tmp"C:\Users\Admin\AppData\Local\Temp\6FC3.tmp"102⤵PID:328
-
C:\Users\Admin\AppData\Local\Temp\7031.tmp"C:\Users\Admin\AppData\Local\Temp\7031.tmp"103⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\709E.tmp"C:\Users\Admin\AppData\Local\Temp\709E.tmp"104⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\710B.tmp"C:\Users\Admin\AppData\Local\Temp\710B.tmp"105⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\7169.tmp"C:\Users\Admin\AppData\Local\Temp\7169.tmp"106⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\71F5.tmp"C:\Users\Admin\AppData\Local\Temp\71F5.tmp"107⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\7262.tmp"C:\Users\Admin\AppData\Local\Temp\7262.tmp"108⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\72CF.tmp"C:\Users\Admin\AppData\Local\Temp\72CF.tmp"109⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\734C.tmp"C:\Users\Admin\AppData\Local\Temp\734C.tmp"110⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\73C9.tmp"C:\Users\Admin\AppData\Local\Temp\73C9.tmp"111⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\7436.tmp"C:\Users\Admin\AppData\Local\Temp\7436.tmp"112⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\7494.tmp"C:\Users\Admin\AppData\Local\Temp\7494.tmp"113⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"114⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\758D.tmp"C:\Users\Admin\AppData\Local\Temp\758D.tmp"115⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\75FB.tmp"C:\Users\Admin\AppData\Local\Temp\75FB.tmp"116⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\7668.tmp"C:\Users\Admin\AppData\Local\Temp\7668.tmp"117⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\76D5.tmp"C:\Users\Admin\AppData\Local\Temp\76D5.tmp"118⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\7761.tmp"C:\Users\Admin\AppData\Local\Temp\7761.tmp"119⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\77CF.tmp"C:\Users\Admin\AppData\Local\Temp\77CF.tmp"120⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\783C.tmp"C:\Users\Admin\AppData\Local\Temp\783C.tmp"121⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\78A9.tmp"C:\Users\Admin\AppData\Local\Temp\78A9.tmp"122⤵PID:1864
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-