Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15-03-2024 03:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-03-15_cdb4bdaa283b56651504f304778c6c4e_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-15_cdb4bdaa283b56651504f304778c6c4e_mafia.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-03-15_cdb4bdaa283b56651504f304778c6c4e_mafia.exe
-
Size
486KB
-
MD5
cdb4bdaa283b56651504f304778c6c4e
-
SHA1
2174ce67d602f0ffc88e0b37d049b181eec3b2b1
-
SHA256
e404be145e54af6bc47e06d9fca4a8f6027373455dd054de31daa300dfa9b8c2
-
SHA512
52e4dd02b3a5a9802265bcd50444e3e9a033823177f56068a3110138f9175d7cf5aa079129e1058e884725c279250492d415b9dfdf61d9c4e3a3f106a2ce10bd
-
SSDEEP
12288:/U5rCOTeiDT86SYCJzsz5JTqR+z9D+1M38YuYNZ:/UQOJDT86rL5G+l1N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1936 46D0.tmp 2592 47AA.tmp 3036 48A4.tmp 2676 498E.tmp 2552 4A49.tmp 2692 4B43.tmp 2688 4C0E.tmp 2684 4D26.tmp 2720 4DF1.tmp 2448 4EAC.tmp 2936 4F87.tmp 804 5080.tmp 524 516A.tmp 2588 5235.tmp 2824 5310.tmp 2312 53CB.tmp 1948 5496.tmp 1576 5560.tmp 2472 562B.tmp 1788 56D7.tmp 548 57B1.tmp 1716 5947.tmp 2292 5A50.tmp 2748 5ADC.tmp 916 5B59.tmp 2272 5BC6.tmp 1300 5C34.tmp 1108 5CA1.tmp 2268 5D0E.tmp 2144 5D7B.tmp 2884 5DE8.tmp 2076 5E65.tmp 2300 5ED2.tmp 1848 5F30.tmp 2108 5FAD.tmp 2308 601A.tmp 2976 6087.tmp 2264 60F4.tmp 1120 6162.tmp 1744 61DE.tmp 1624 625B.tmp 1032 62D8.tmp 1376 6345.tmp 1704 63B3.tmp 2204 642F.tmp 1776 649D.tmp 944 6519.tmp 3044 6596.tmp 1048 6613.tmp 2904 669F.tmp 2900 670D.tmp 2020 6789.tmp 924 6806.tmp 2920 6883.tmp 1644 68F0.tmp 1612 69DA.tmp 2068 6A57.tmp 2996 6AD4.tmp 2508 6B51.tmp 2664 6BBE.tmp 2868 6C4A.tmp 2260 6CC7.tmp 2856 6D34.tmp 2520 6ECA.tmp -
Loads dropped DLL 64 IoCs
pid Process 2336 2024-03-15_cdb4bdaa283b56651504f304778c6c4e_mafia.exe 1936 46D0.tmp 2592 47AA.tmp 3036 48A4.tmp 2676 498E.tmp 2552 4A49.tmp 2692 4B43.tmp 2688 4C0E.tmp 2684 4D26.tmp 2720 4DF1.tmp 2448 4EAC.tmp 2936 4F87.tmp 804 5080.tmp 524 516A.tmp 2588 5235.tmp 2824 5310.tmp 2312 53CB.tmp 1948 5496.tmp 1576 5560.tmp 2472 562B.tmp 1788 56D7.tmp 548 57B1.tmp 1716 5947.tmp 2292 5A50.tmp 2748 5ADC.tmp 916 5B59.tmp 2272 5BC6.tmp 1300 5C34.tmp 1108 5CA1.tmp 2268 5D0E.tmp 2144 5D7B.tmp 2884 5DE8.tmp 2076 5E65.tmp 2300 5ED2.tmp 1848 5F30.tmp 2108 5FAD.tmp 2308 601A.tmp 2976 6087.tmp 2264 60F4.tmp 1120 6162.tmp 1744 61DE.tmp 1624 625B.tmp 1032 62D8.tmp 1376 6345.tmp 1704 63B3.tmp 2204 642F.tmp 1776 649D.tmp 944 6519.tmp 3044 6596.tmp 1048 6613.tmp 2904 669F.tmp 2900 670D.tmp 2020 6789.tmp 924 6806.tmp 2920 6883.tmp 1652 696D.tmp 1612 69DA.tmp 2068 6A57.tmp 2996 6AD4.tmp 2508 6B51.tmp 2664 6BBE.tmp 2868 6C4A.tmp 2260 6CC7.tmp 2856 6D34.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2336 wrote to memory of 1936 2336 2024-03-15_cdb4bdaa283b56651504f304778c6c4e_mafia.exe 28 PID 2336 wrote to memory of 1936 2336 2024-03-15_cdb4bdaa283b56651504f304778c6c4e_mafia.exe 28 PID 2336 wrote to memory of 1936 2336 2024-03-15_cdb4bdaa283b56651504f304778c6c4e_mafia.exe 28 PID 2336 wrote to memory of 1936 2336 2024-03-15_cdb4bdaa283b56651504f304778c6c4e_mafia.exe 28 PID 1936 wrote to memory of 2592 1936 46D0.tmp 29 PID 1936 wrote to memory of 2592 1936 46D0.tmp 29 PID 1936 wrote to memory of 2592 1936 46D0.tmp 29 PID 1936 wrote to memory of 2592 1936 46D0.tmp 29 PID 2592 wrote to memory of 3036 2592 47AA.tmp 30 PID 2592 wrote to memory of 3036 2592 47AA.tmp 30 PID 2592 wrote to memory of 3036 2592 47AA.tmp 30 PID 2592 wrote to memory of 3036 2592 47AA.tmp 30 PID 3036 wrote to memory of 2676 3036 48A4.tmp 31 PID 3036 wrote to memory of 2676 3036 48A4.tmp 31 PID 3036 wrote to memory of 2676 3036 48A4.tmp 31 PID 3036 wrote to memory of 2676 3036 48A4.tmp 31 PID 2676 wrote to memory of 2552 2676 498E.tmp 32 PID 2676 wrote to memory of 2552 2676 498E.tmp 32 PID 2676 wrote to memory of 2552 2676 498E.tmp 32 PID 2676 wrote to memory of 2552 2676 498E.tmp 32 PID 2552 wrote to memory of 2692 2552 4A49.tmp 33 PID 2552 wrote to memory of 2692 2552 4A49.tmp 33 PID 2552 wrote to memory of 2692 2552 4A49.tmp 33 PID 2552 wrote to memory of 2692 2552 4A49.tmp 33 PID 2692 wrote to memory of 2688 2692 4B43.tmp 34 PID 2692 wrote to memory of 2688 2692 4B43.tmp 34 PID 2692 wrote to memory of 2688 2692 4B43.tmp 34 PID 2692 wrote to memory of 2688 2692 4B43.tmp 34 PID 2688 wrote to memory of 2684 2688 4C0E.tmp 35 PID 2688 wrote to memory of 2684 2688 4C0E.tmp 35 PID 2688 wrote to memory of 2684 2688 4C0E.tmp 35 PID 2688 wrote to memory of 2684 2688 4C0E.tmp 35 PID 2684 wrote to memory of 2720 2684 4D26.tmp 36 PID 2684 wrote to memory of 2720 2684 4D26.tmp 36 PID 2684 wrote to memory of 2720 2684 4D26.tmp 36 PID 2684 wrote to memory of 2720 2684 4D26.tmp 36 PID 2720 wrote to memory of 2448 2720 4DF1.tmp 37 PID 2720 wrote to memory of 2448 2720 4DF1.tmp 37 PID 2720 wrote to memory of 2448 2720 4DF1.tmp 37 PID 2720 wrote to memory of 2448 2720 4DF1.tmp 37 PID 2448 wrote to memory of 2936 2448 4EAC.tmp 38 PID 2448 wrote to memory of 2936 2448 4EAC.tmp 38 PID 2448 wrote to memory of 2936 2448 4EAC.tmp 38 PID 2448 wrote to memory of 2936 2448 4EAC.tmp 38 PID 2936 wrote to memory of 804 2936 4F87.tmp 39 PID 2936 wrote to memory of 804 2936 4F87.tmp 39 PID 2936 wrote to memory of 804 2936 4F87.tmp 39 PID 2936 wrote to memory of 804 2936 4F87.tmp 39 PID 804 wrote to memory of 524 804 5080.tmp 40 PID 804 wrote to memory of 524 804 5080.tmp 40 PID 804 wrote to memory of 524 804 5080.tmp 40 PID 804 wrote to memory of 524 804 5080.tmp 40 PID 524 wrote to memory of 2588 524 516A.tmp 41 PID 524 wrote to memory of 2588 524 516A.tmp 41 PID 524 wrote to memory of 2588 524 516A.tmp 41 PID 524 wrote to memory of 2588 524 516A.tmp 41 PID 2588 wrote to memory of 2824 2588 5235.tmp 42 PID 2588 wrote to memory of 2824 2588 5235.tmp 42 PID 2588 wrote to memory of 2824 2588 5235.tmp 42 PID 2588 wrote to memory of 2824 2588 5235.tmp 42 PID 2824 wrote to memory of 2312 2824 5310.tmp 43 PID 2824 wrote to memory of 2312 2824 5310.tmp 43 PID 2824 wrote to memory of 2312 2824 5310.tmp 43 PID 2824 wrote to memory of 2312 2824 5310.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-15_cdb4bdaa283b56651504f304778c6c4e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-15_cdb4bdaa283b56651504f304778c6c4e_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\46D0.tmp"C:\Users\Admin\AppData\Local\Temp\46D0.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\47AA.tmp"C:\Users\Admin\AppData\Local\Temp\47AA.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\48A4.tmp"C:\Users\Admin\AppData\Local\Temp\48A4.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\498E.tmp"C:\Users\Admin\AppData\Local\Temp\498E.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\4A49.tmp"C:\Users\Admin\AppData\Local\Temp\4A49.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\4B43.tmp"C:\Users\Admin\AppData\Local\Temp\4B43.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\4C0E.tmp"C:\Users\Admin\AppData\Local\Temp\4C0E.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\5080.tmp"C:\Users\Admin\AppData\Local\Temp\5080.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Users\Admin\AppData\Local\Temp\516A.tmp"C:\Users\Admin\AppData\Local\Temp\516A.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:524 -
C:\Users\Admin\AppData\Local\Temp\5235.tmp"C:\Users\Admin\AppData\Local\Temp\5235.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\5310.tmp"C:\Users\Admin\AppData\Local\Temp\5310.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\53CB.tmp"C:\Users\Admin\AppData\Local\Temp\53CB.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\5496.tmp"C:\Users\Admin\AppData\Local\Temp\5496.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\5560.tmp"C:\Users\Admin\AppData\Local\Temp\5560.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\562B.tmp"C:\Users\Admin\AppData\Local\Temp\562B.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\56D7.tmp"C:\Users\Admin\AppData\Local\Temp\56D7.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\57B1.tmp"C:\Users\Admin\AppData\Local\Temp\57B1.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:548 -
C:\Users\Admin\AppData\Local\Temp\5947.tmp"C:\Users\Admin\AppData\Local\Temp\5947.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\5A50.tmp"C:\Users\Admin\AppData\Local\Temp\5A50.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\5ADC.tmp"C:\Users\Admin\AppData\Local\Temp\5ADC.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\5B59.tmp"C:\Users\Admin\AppData\Local\Temp\5B59.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:916 -
C:\Users\Admin\AppData\Local\Temp\5BC6.tmp"C:\Users\Admin\AppData\Local\Temp\5BC6.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\5C34.tmp"C:\Users\Admin\AppData\Local\Temp\5C34.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\5CA1.tmp"C:\Users\Admin\AppData\Local\Temp\5CA1.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\5D0E.tmp"C:\Users\Admin\AppData\Local\Temp\5D0E.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\5D7B.tmp"C:\Users\Admin\AppData\Local\Temp\5D7B.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\5DE8.tmp"C:\Users\Admin\AppData\Local\Temp\5DE8.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\5E65.tmp"C:\Users\Admin\AppData\Local\Temp\5E65.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\5ED2.tmp"C:\Users\Admin\AppData\Local\Temp\5ED2.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\5F30.tmp"C:\Users\Admin\AppData\Local\Temp\5F30.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\5FAD.tmp"C:\Users\Admin\AppData\Local\Temp\5FAD.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\601A.tmp"C:\Users\Admin\AppData\Local\Temp\601A.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\6087.tmp"C:\Users\Admin\AppData\Local\Temp\6087.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\60F4.tmp"C:\Users\Admin\AppData\Local\Temp\60F4.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\6162.tmp"C:\Users\Admin\AppData\Local\Temp\6162.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\61DE.tmp"C:\Users\Admin\AppData\Local\Temp\61DE.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\625B.tmp"C:\Users\Admin\AppData\Local\Temp\625B.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\62D8.tmp"C:\Users\Admin\AppData\Local\Temp\62D8.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\6345.tmp"C:\Users\Admin\AppData\Local\Temp\6345.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\63B3.tmp"C:\Users\Admin\AppData\Local\Temp\63B3.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\642F.tmp"C:\Users\Admin\AppData\Local\Temp\642F.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\649D.tmp"C:\Users\Admin\AppData\Local\Temp\649D.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\6519.tmp"C:\Users\Admin\AppData\Local\Temp\6519.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:944 -
C:\Users\Admin\AppData\Local\Temp\6596.tmp"C:\Users\Admin\AppData\Local\Temp\6596.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\6613.tmp"C:\Users\Admin\AppData\Local\Temp\6613.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\669F.tmp"C:\Users\Admin\AppData\Local\Temp\669F.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\670D.tmp"C:\Users\Admin\AppData\Local\Temp\670D.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\6789.tmp"C:\Users\Admin\AppData\Local\Temp\6789.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\6806.tmp"C:\Users\Admin\AppData\Local\Temp\6806.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:924 -
C:\Users\Admin\AppData\Local\Temp\6883.tmp"C:\Users\Admin\AppData\Local\Temp\6883.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\68F0.tmp"C:\Users\Admin\AppData\Local\Temp\68F0.tmp"56⤵
- Executes dropped EXE
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\696D.tmp"C:\Users\Admin\AppData\Local\Temp\696D.tmp"57⤵
- Loads dropped DLL
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\69DA.tmp"C:\Users\Admin\AppData\Local\Temp\69DA.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\6A57.tmp"C:\Users\Admin\AppData\Local\Temp\6A57.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\6AD4.tmp"C:\Users\Admin\AppData\Local\Temp\6AD4.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\6B51.tmp"C:\Users\Admin\AppData\Local\Temp\6B51.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\6BBE.tmp"C:\Users\Admin\AppData\Local\Temp\6BBE.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\6C4A.tmp"C:\Users\Admin\AppData\Local\Temp\6C4A.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\6CC7.tmp"C:\Users\Admin\AppData\Local\Temp\6CC7.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\6D34.tmp"C:\Users\Admin\AppData\Local\Temp\6D34.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\6ECA.tmp"C:\Users\Admin\AppData\Local\Temp\6ECA.tmp"66⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\6F27.tmp"C:\Users\Admin\AppData\Local\Temp\6F27.tmp"67⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\6F85.tmp"C:\Users\Admin\AppData\Local\Temp\6F85.tmp"68⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\6FE3.tmp"C:\Users\Admin\AppData\Local\Temp\6FE3.tmp"69⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\7040.tmp"C:\Users\Admin\AppData\Local\Temp\7040.tmp"70⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\70BD.tmp"C:\Users\Admin\AppData\Local\Temp\70BD.tmp"71⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\713A.tmp"C:\Users\Admin\AppData\Local\Temp\713A.tmp"72⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\71A7.tmp"C:\Users\Admin\AppData\Local\Temp\71A7.tmp"73⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\7214.tmp"C:\Users\Admin\AppData\Local\Temp\7214.tmp"74⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\7272.tmp"C:\Users\Admin\AppData\Local\Temp\7272.tmp"75⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\72DF.tmp"C:\Users\Admin\AppData\Local\Temp\72DF.tmp"76⤵PID:472
-
C:\Users\Admin\AppData\Local\Temp\735C.tmp"C:\Users\Admin\AppData\Local\Temp\735C.tmp"77⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\73D9.tmp"C:\Users\Admin\AppData\Local\Temp\73D9.tmp"78⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\7475.tmp"C:\Users\Admin\AppData\Local\Temp\7475.tmp"79⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"80⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\755F.tmp"C:\Users\Admin\AppData\Local\Temp\755F.tmp"81⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\75DB.tmp"C:\Users\Admin\AppData\Local\Temp\75DB.tmp"82⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\7649.tmp"C:\Users\Admin\AppData\Local\Temp\7649.tmp"83⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\76B6.tmp"C:\Users\Admin\AppData\Local\Temp\76B6.tmp"84⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\7742.tmp"C:\Users\Admin\AppData\Local\Temp\7742.tmp"85⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\77BF.tmp"C:\Users\Admin\AppData\Local\Temp\77BF.tmp"86⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\782C.tmp"C:\Users\Admin\AppData\Local\Temp\782C.tmp"87⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\78A9.tmp"C:\Users\Admin\AppData\Local\Temp\78A9.tmp"88⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\7926.tmp"C:\Users\Admin\AppData\Local\Temp\7926.tmp"89⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\79A3.tmp"C:\Users\Admin\AppData\Local\Temp\79A3.tmp"90⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\7A1F.tmp"C:\Users\Admin\AppData\Local\Temp\7A1F.tmp"91⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\7A8D.tmp"C:\Users\Admin\AppData\Local\Temp\7A8D.tmp"92⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\7B09.tmp"C:\Users\Admin\AppData\Local\Temp\7B09.tmp"93⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\7B77.tmp"C:\Users\Admin\AppData\Local\Temp\7B77.tmp"94⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\7BF3.tmp"C:\Users\Admin\AppData\Local\Temp\7BF3.tmp"95⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\7C51.tmp"C:\Users\Admin\AppData\Local\Temp\7C51.tmp"96⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\7CCE.tmp"C:\Users\Admin\AppData\Local\Temp\7CCE.tmp"97⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\7D2B.tmp"C:\Users\Admin\AppData\Local\Temp\7D2B.tmp"98⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\7D99.tmp"C:\Users\Admin\AppData\Local\Temp\7D99.tmp"99⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\7E15.tmp"C:\Users\Admin\AppData\Local\Temp\7E15.tmp"100⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\7E92.tmp"C:\Users\Admin\AppData\Local\Temp\7E92.tmp"101⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\7EFF.tmp"C:\Users\Admin\AppData\Local\Temp\7EFF.tmp"102⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\7F6D.tmp"C:\Users\Admin\AppData\Local\Temp\7F6D.tmp"103⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\7FCA.tmp"C:\Users\Admin\AppData\Local\Temp\7FCA.tmp"104⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\8037.tmp"C:\Users\Admin\AppData\Local\Temp\8037.tmp"105⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\80A5.tmp"C:\Users\Admin\AppData\Local\Temp\80A5.tmp"106⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\8121.tmp"C:\Users\Admin\AppData\Local\Temp\8121.tmp"107⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\818F.tmp"C:\Users\Admin\AppData\Local\Temp\818F.tmp"108⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\81FC.tmp"C:\Users\Admin\AppData\Local\Temp\81FC.tmp"109⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\8279.tmp"C:\Users\Admin\AppData\Local\Temp\8279.tmp"110⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\8391.tmp"C:\Users\Admin\AppData\Local\Temp\8391.tmp"111⤵PID:728
-
C:\Users\Admin\AppData\Local\Temp\83FF.tmp"C:\Users\Admin\AppData\Local\Temp\83FF.tmp"112⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\847B.tmp"C:\Users\Admin\AppData\Local\Temp\847B.tmp"113⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\84E9.tmp"C:\Users\Admin\AppData\Local\Temp\84E9.tmp"114⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\8575.tmp"C:\Users\Admin\AppData\Local\Temp\8575.tmp"115⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\85F2.tmp"C:\Users\Admin\AppData\Local\Temp\85F2.tmp"116⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\864F.tmp"C:\Users\Admin\AppData\Local\Temp\864F.tmp"117⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\86DC.tmp"C:\Users\Admin\AppData\Local\Temp\86DC.tmp"118⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\8749.tmp"C:\Users\Admin\AppData\Local\Temp\8749.tmp"119⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\87B6.tmp"C:\Users\Admin\AppData\Local\Temp\87B6.tmp"120⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\8823.tmp"C:\Users\Admin\AppData\Local\Temp\8823.tmp"121⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\88A0.tmp"C:\Users\Admin\AppData\Local\Temp\88A0.tmp"122⤵PID:2852
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-