Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
09/03/2024, 15:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-03-09_3466df9051a58206a8a8216051c8b666_mafia.exe
Resource
win7-20240215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-09_3466df9051a58206a8a8216051c8b666_mafia.exe
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
2024-03-09_3466df9051a58206a8a8216051c8b666_mafia.exe
-
Size
486KB
-
MD5
3466df9051a58206a8a8216051c8b666
-
SHA1
6d0ece585b96693ba907a7700a78cda7077e2422
-
SHA256
2a3a9df8d5240dc39d6cc7eb54e6910a1fd4e8db2c8737cee35981296afb75fd
-
SHA512
be3ae40220d677bd98c40170851828a6376886e4413600f02aca7ce1655c783da14ccaa4100d8e0848de8bc85a40007121d38a008eb779346bddfdd06fc4ed36
-
SSDEEP
12288:/U5rCOTeiDJDB72tKqPGjyuXj54eECNZ:/UQOJDJV72hPyXNrDN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2872 FE4C.tmp 2904 FEB9.tmp 2620 FF36.tmp 2564 FF84.tmp 2104 FFF1.tmp 2656 4F.tmp 2628 BC.tmp 2464 129.tmp 2440 196.tmp 2836 204.tmp 2852 271.tmp 1276 2CE.tmp 2472 32C.tmp 2588 38A.tmp 676 3E7.tmp 768 454.tmp 404 4B2.tmp 2156 51F.tmp 2160 57D.tmp 1464 5DA.tmp 2320 628.tmp 2032 686.tmp 2124 6E4.tmp 2012 722.tmp 2372 770.tmp 2212 7AE.tmp 2704 7FC.tmp 1964 83B.tmp 2768 889.tmp 596 8D7.tmp 800 915.tmp 1068 954.tmp 916 9A2.tmp 1820 9F0.tmp 1196 A2E.tmp 1908 A7C.tmp 2924 ABA.tmp 2984 AF9.tmp 1496 B37.tmp 2992 B76.tmp 1228 BC4.tmp 772 C02.tmp 292 C40.tmp 2272 C8E.tmp 868 CCD.tmp 1988 D0B.tmp 1656 D4A.tmp 2300 D88.tmp 1620 DC6.tmp 1948 E05.tmp 2264 E53.tmp 2076 E91.tmp 1444 ED0.tmp 2260 F0E.tmp 2360 F5C.tmp 1548 FAA.tmp 2908 FE8.tmp 2848 1027.tmp 2220 1075.tmp 3020 10B3.tmp 2668 10F2.tmp 2560 1140.tmp 2528 117E.tmp 2680 11BC.tmp -
Loads dropped DLL 64 IoCs
pid Process 2876 2024-03-09_3466df9051a58206a8a8216051c8b666_mafia.exe 2872 FE4C.tmp 2904 FEB9.tmp 2620 FF36.tmp 2564 FF84.tmp 2104 FFF1.tmp 2656 4F.tmp 2628 BC.tmp 2464 129.tmp 2440 196.tmp 2836 204.tmp 2852 271.tmp 1276 2CE.tmp 2472 32C.tmp 2588 38A.tmp 676 3E7.tmp 768 454.tmp 404 4B2.tmp 2156 51F.tmp 2160 57D.tmp 1464 5DA.tmp 2320 628.tmp 2032 686.tmp 2124 6E4.tmp 2012 722.tmp 2372 770.tmp 2212 7AE.tmp 2704 7FC.tmp 1964 83B.tmp 2768 889.tmp 596 8D7.tmp 800 915.tmp 1068 954.tmp 916 9A2.tmp 1820 9F0.tmp 1196 A2E.tmp 1908 A7C.tmp 2924 ABA.tmp 2984 AF9.tmp 1496 B37.tmp 2992 B76.tmp 1228 BC4.tmp 772 C02.tmp 292 C40.tmp 2272 C8E.tmp 868 CCD.tmp 1988 D0B.tmp 1656 D4A.tmp 2300 D88.tmp 1620 DC6.tmp 1948 E05.tmp 2264 E53.tmp 2076 E91.tmp 1444 ED0.tmp 2260 F0E.tmp 2360 F5C.tmp 1548 FAA.tmp 2908 FE8.tmp 2848 1027.tmp 2220 1075.tmp 3020 10B3.tmp 2668 10F2.tmp 2560 1140.tmp 2528 117E.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2876 wrote to memory of 2872 2876 2024-03-09_3466df9051a58206a8a8216051c8b666_mafia.exe 28 PID 2876 wrote to memory of 2872 2876 2024-03-09_3466df9051a58206a8a8216051c8b666_mafia.exe 28 PID 2876 wrote to memory of 2872 2876 2024-03-09_3466df9051a58206a8a8216051c8b666_mafia.exe 28 PID 2876 wrote to memory of 2872 2876 2024-03-09_3466df9051a58206a8a8216051c8b666_mafia.exe 28 PID 2872 wrote to memory of 2904 2872 FE4C.tmp 29 PID 2872 wrote to memory of 2904 2872 FE4C.tmp 29 PID 2872 wrote to memory of 2904 2872 FE4C.tmp 29 PID 2872 wrote to memory of 2904 2872 FE4C.tmp 29 PID 2904 wrote to memory of 2620 2904 FEB9.tmp 30 PID 2904 wrote to memory of 2620 2904 FEB9.tmp 30 PID 2904 wrote to memory of 2620 2904 FEB9.tmp 30 PID 2904 wrote to memory of 2620 2904 FEB9.tmp 30 PID 2620 wrote to memory of 2564 2620 FF36.tmp 31 PID 2620 wrote to memory of 2564 2620 FF36.tmp 31 PID 2620 wrote to memory of 2564 2620 FF36.tmp 31 PID 2620 wrote to memory of 2564 2620 FF36.tmp 31 PID 2564 wrote to memory of 2104 2564 FF84.tmp 32 PID 2564 wrote to memory of 2104 2564 FF84.tmp 32 PID 2564 wrote to memory of 2104 2564 FF84.tmp 32 PID 2564 wrote to memory of 2104 2564 FF84.tmp 32 PID 2104 wrote to memory of 2656 2104 FFF1.tmp 33 PID 2104 wrote to memory of 2656 2104 FFF1.tmp 33 PID 2104 wrote to memory of 2656 2104 FFF1.tmp 33 PID 2104 wrote to memory of 2656 2104 FFF1.tmp 33 PID 2656 wrote to memory of 2628 2656 4F.tmp 34 PID 2656 wrote to memory of 2628 2656 4F.tmp 34 PID 2656 wrote to memory of 2628 2656 4F.tmp 34 PID 2656 wrote to memory of 2628 2656 4F.tmp 34 PID 2628 wrote to memory of 2464 2628 BC.tmp 35 PID 2628 wrote to memory of 2464 2628 BC.tmp 35 PID 2628 wrote to memory of 2464 2628 BC.tmp 35 PID 2628 wrote to memory of 2464 2628 BC.tmp 35 PID 2464 wrote to memory of 2440 2464 129.tmp 36 PID 2464 wrote to memory of 2440 2464 129.tmp 36 PID 2464 wrote to memory of 2440 2464 129.tmp 36 PID 2464 wrote to memory of 2440 2464 129.tmp 36 PID 2440 wrote to memory of 2836 2440 196.tmp 37 PID 2440 wrote to memory of 2836 2440 196.tmp 37 PID 2440 wrote to memory of 2836 2440 196.tmp 37 PID 2440 wrote to memory of 2836 2440 196.tmp 37 PID 2836 wrote to memory of 2852 2836 204.tmp 38 PID 2836 wrote to memory of 2852 2836 204.tmp 38 PID 2836 wrote to memory of 2852 2836 204.tmp 38 PID 2836 wrote to memory of 2852 2836 204.tmp 38 PID 2852 wrote to memory of 1276 2852 271.tmp 39 PID 2852 wrote to memory of 1276 2852 271.tmp 39 PID 2852 wrote to memory of 1276 2852 271.tmp 39 PID 2852 wrote to memory of 1276 2852 271.tmp 39 PID 1276 wrote to memory of 2472 1276 2CE.tmp 40 PID 1276 wrote to memory of 2472 1276 2CE.tmp 40 PID 1276 wrote to memory of 2472 1276 2CE.tmp 40 PID 1276 wrote to memory of 2472 1276 2CE.tmp 40 PID 2472 wrote to memory of 2588 2472 32C.tmp 41 PID 2472 wrote to memory of 2588 2472 32C.tmp 41 PID 2472 wrote to memory of 2588 2472 32C.tmp 41 PID 2472 wrote to memory of 2588 2472 32C.tmp 41 PID 2588 wrote to memory of 676 2588 38A.tmp 42 PID 2588 wrote to memory of 676 2588 38A.tmp 42 PID 2588 wrote to memory of 676 2588 38A.tmp 42 PID 2588 wrote to memory of 676 2588 38A.tmp 42 PID 676 wrote to memory of 768 676 3E7.tmp 43 PID 676 wrote to memory of 768 676 3E7.tmp 43 PID 676 wrote to memory of 768 676 3E7.tmp 43 PID 676 wrote to memory of 768 676 3E7.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-09_3466df9051a58206a8a8216051c8b666_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-09_3466df9051a58206a8a8216051c8b666_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\FE4C.tmp"C:\Users\Admin\AppData\Local\Temp\FE4C.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\FEB9.tmp"C:\Users\Admin\AppData\Local\Temp\FEB9.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\FF36.tmp"C:\Users\Admin\AppData\Local\Temp\FF36.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\FF84.tmp"C:\Users\Admin\AppData\Local\Temp\FF84.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\FFF1.tmp"C:\Users\Admin\AppData\Local\Temp\FFF1.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\4F.tmp"C:\Users\Admin\AppData\Local\Temp\4F.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\BC.tmp"C:\Users\Admin\AppData\Local\Temp\BC.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\129.tmp"C:\Users\Admin\AppData\Local\Temp\129.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\196.tmp"C:\Users\Admin\AppData\Local\Temp\196.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\204.tmp"C:\Users\Admin\AppData\Local\Temp\204.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\271.tmp"C:\Users\Admin\AppData\Local\Temp\271.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\2CE.tmp"C:\Users\Admin\AppData\Local\Temp\2CE.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\32C.tmp"C:\Users\Admin\AppData\Local\Temp\32C.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\38A.tmp"C:\Users\Admin\AppData\Local\Temp\38A.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\3E7.tmp"C:\Users\Admin\AppData\Local\Temp\3E7.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Users\Admin\AppData\Local\Temp\454.tmp"C:\Users\Admin\AppData\Local\Temp\454.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:768 -
C:\Users\Admin\AppData\Local\Temp\4B2.tmp"C:\Users\Admin\AppData\Local\Temp\4B2.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:404 -
C:\Users\Admin\AppData\Local\Temp\51F.tmp"C:\Users\Admin\AppData\Local\Temp\51F.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\57D.tmp"C:\Users\Admin\AppData\Local\Temp\57D.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\5DA.tmp"C:\Users\Admin\AppData\Local\Temp\5DA.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\628.tmp"C:\Users\Admin\AppData\Local\Temp\628.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\686.tmp"C:\Users\Admin\AppData\Local\Temp\686.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\6E4.tmp"C:\Users\Admin\AppData\Local\Temp\6E4.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\722.tmp"C:\Users\Admin\AppData\Local\Temp\722.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\770.tmp"C:\Users\Admin\AppData\Local\Temp\770.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\7AE.tmp"C:\Users\Admin\AppData\Local\Temp\7AE.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\7FC.tmp"C:\Users\Admin\AppData\Local\Temp\7FC.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\83B.tmp"C:\Users\Admin\AppData\Local\Temp\83B.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\889.tmp"C:\Users\Admin\AppData\Local\Temp\889.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\8D7.tmp"C:\Users\Admin\AppData\Local\Temp\8D7.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:596 -
C:\Users\Admin\AppData\Local\Temp\915.tmp"C:\Users\Admin\AppData\Local\Temp\915.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:800 -
C:\Users\Admin\AppData\Local\Temp\954.tmp"C:\Users\Admin\AppData\Local\Temp\954.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\9A2.tmp"C:\Users\Admin\AppData\Local\Temp\9A2.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:916 -
C:\Users\Admin\AppData\Local\Temp\9F0.tmp"C:\Users\Admin\AppData\Local\Temp\9F0.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\A2E.tmp"C:\Users\Admin\AppData\Local\Temp\A2E.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\A7C.tmp"C:\Users\Admin\AppData\Local\Temp\A7C.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\ABA.tmp"C:\Users\Admin\AppData\Local\Temp\ABA.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\AF9.tmp"C:\Users\Admin\AppData\Local\Temp\AF9.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\B37.tmp"C:\Users\Admin\AppData\Local\Temp\B37.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\B76.tmp"C:\Users\Admin\AppData\Local\Temp\B76.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\BC4.tmp"C:\Users\Admin\AppData\Local\Temp\BC4.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\C02.tmp"C:\Users\Admin\AppData\Local\Temp\C02.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:772 -
C:\Users\Admin\AppData\Local\Temp\C40.tmp"C:\Users\Admin\AppData\Local\Temp\C40.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:292 -
C:\Users\Admin\AppData\Local\Temp\C8E.tmp"C:\Users\Admin\AppData\Local\Temp\C8E.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\CCD.tmp"C:\Users\Admin\AppData\Local\Temp\CCD.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:868 -
C:\Users\Admin\AppData\Local\Temp\D0B.tmp"C:\Users\Admin\AppData\Local\Temp\D0B.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\D4A.tmp"C:\Users\Admin\AppData\Local\Temp\D4A.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\D88.tmp"C:\Users\Admin\AppData\Local\Temp\D88.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\DC6.tmp"C:\Users\Admin\AppData\Local\Temp\DC6.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\E05.tmp"C:\Users\Admin\AppData\Local\Temp\E05.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\E53.tmp"C:\Users\Admin\AppData\Local\Temp\E53.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\E91.tmp"C:\Users\Admin\AppData\Local\Temp\E91.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\ED0.tmp"C:\Users\Admin\AppData\Local\Temp\ED0.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\F0E.tmp"C:\Users\Admin\AppData\Local\Temp\F0E.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\F5C.tmp"C:\Users\Admin\AppData\Local\Temp\F5C.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\FAA.tmp"C:\Users\Admin\AppData\Local\Temp\FAA.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\FE8.tmp"C:\Users\Admin\AppData\Local\Temp\FE8.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\1027.tmp"C:\Users\Admin\AppData\Local\Temp\1027.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\1075.tmp"C:\Users\Admin\AppData\Local\Temp\1075.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\10B3.tmp"C:\Users\Admin\AppData\Local\Temp\10B3.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\10F2.tmp"C:\Users\Admin\AppData\Local\Temp\10F2.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\1140.tmp"C:\Users\Admin\AppData\Local\Temp\1140.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\117E.tmp"C:\Users\Admin\AppData\Local\Temp\117E.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\11BC.tmp"C:\Users\Admin\AppData\Local\Temp\11BC.tmp"65⤵
- Executes dropped EXE
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\120A.tmp"C:\Users\Admin\AppData\Local\Temp\120A.tmp"66⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\1249.tmp"C:\Users\Admin\AppData\Local\Temp\1249.tmp"67⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\1287.tmp"C:\Users\Admin\AppData\Local\Temp\1287.tmp"68⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\12D5.tmp"C:\Users\Admin\AppData\Local\Temp\12D5.tmp"69⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\1323.tmp"C:\Users\Admin\AppData\Local\Temp\1323.tmp"70⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\1362.tmp"C:\Users\Admin\AppData\Local\Temp\1362.tmp"71⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\13A0.tmp"C:\Users\Admin\AppData\Local\Temp\13A0.tmp"72⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\13DE.tmp"C:\Users\Admin\AppData\Local\Temp\13DE.tmp"73⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\142C.tmp"C:\Users\Admin\AppData\Local\Temp\142C.tmp"74⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\146B.tmp"C:\Users\Admin\AppData\Local\Temp\146B.tmp"75⤵PID:328
-
C:\Users\Admin\AppData\Local\Temp\14A9.tmp"C:\Users\Admin\AppData\Local\Temp\14A9.tmp"76⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\14E8.tmp"C:\Users\Admin\AppData\Local\Temp\14E8.tmp"77⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\1526.tmp"C:\Users\Admin\AppData\Local\Temp\1526.tmp"78⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\1564.tmp"C:\Users\Admin\AppData\Local\Temp\1564.tmp"79⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\15A3.tmp"C:\Users\Admin\AppData\Local\Temp\15A3.tmp"80⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\15E1.tmp"C:\Users\Admin\AppData\Local\Temp\15E1.tmp"81⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\162F.tmp"C:\Users\Admin\AppData\Local\Temp\162F.tmp"82⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\166E.tmp"C:\Users\Admin\AppData\Local\Temp\166E.tmp"83⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\16AC.tmp"C:\Users\Admin\AppData\Local\Temp\16AC.tmp"84⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\16EA.tmp"C:\Users\Admin\AppData\Local\Temp\16EA.tmp"85⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\1729.tmp"C:\Users\Admin\AppData\Local\Temp\1729.tmp"86⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\1767.tmp"C:\Users\Admin\AppData\Local\Temp\1767.tmp"87⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\17A6.tmp"C:\Users\Admin\AppData\Local\Temp\17A6.tmp"88⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\17E4.tmp"C:\Users\Admin\AppData\Local\Temp\17E4.tmp"89⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\1832.tmp"C:\Users\Admin\AppData\Local\Temp\1832.tmp"90⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\1870.tmp"C:\Users\Admin\AppData\Local\Temp\1870.tmp"91⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\18AF.tmp"C:\Users\Admin\AppData\Local\Temp\18AF.tmp"92⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\18FD.tmp"C:\Users\Admin\AppData\Local\Temp\18FD.tmp"93⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\193B.tmp"C:\Users\Admin\AppData\Local\Temp\193B.tmp"94⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\197A.tmp"C:\Users\Admin\AppData\Local\Temp\197A.tmp"95⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\19B8.tmp"C:\Users\Admin\AppData\Local\Temp\19B8.tmp"96⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\1A06.tmp"C:\Users\Admin\AppData\Local\Temp\1A06.tmp"97⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\1A44.tmp"C:\Users\Admin\AppData\Local\Temp\1A44.tmp"98⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\1A83.tmp"C:\Users\Admin\AppData\Local\Temp\1A83.tmp"99⤵PID:604
-
C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"100⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\1B0F.tmp"C:\Users\Admin\AppData\Local\Temp\1B0F.tmp"101⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"102⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\1B8C.tmp"C:\Users\Admin\AppData\Local\Temp\1B8C.tmp"103⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"104⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\1C18.tmp"C:\Users\Admin\AppData\Local\Temp\1C18.tmp"105⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\1C57.tmp"C:\Users\Admin\AppData\Local\Temp\1C57.tmp"106⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\1C95.tmp"C:\Users\Admin\AppData\Local\Temp\1C95.tmp"107⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\1CD4.tmp"C:\Users\Admin\AppData\Local\Temp\1CD4.tmp"108⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\1D12.tmp"C:\Users\Admin\AppData\Local\Temp\1D12.tmp"109⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\1D50.tmp"C:\Users\Admin\AppData\Local\Temp\1D50.tmp"110⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\1D8F.tmp"C:\Users\Admin\AppData\Local\Temp\1D8F.tmp"111⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\1DCD.tmp"C:\Users\Admin\AppData\Local\Temp\1DCD.tmp"112⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"113⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\1E4A.tmp"C:\Users\Admin\AppData\Local\Temp\1E4A.tmp"114⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\1E88.tmp"C:\Users\Admin\AppData\Local\Temp\1E88.tmp"115⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"116⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\1F05.tmp"C:\Users\Admin\AppData\Local\Temp\1F05.tmp"117⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\1F44.tmp"C:\Users\Admin\AppData\Local\Temp\1F44.tmp"118⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\1F82.tmp"C:\Users\Admin\AppData\Local\Temp\1F82.tmp"119⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"120⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\200E.tmp"C:\Users\Admin\AppData\Local\Temp\200E.tmp"121⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\204D.tmp"C:\Users\Admin\AppData\Local\Temp\204D.tmp"122⤵PID:2236
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-