Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16/04/2024, 13:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-16_17b2d49e001a7188b5a3cffbefeb0be7_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-16_17b2d49e001a7188b5a3cffbefeb0be7_mafia.exe
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
2024-04-16_17b2d49e001a7188b5a3cffbefeb0be7_mafia.exe
-
Size
520KB
-
MD5
17b2d49e001a7188b5a3cffbefeb0be7
-
SHA1
78b93dee437f6760612594c7e8059ce34c54a90d
-
SHA256
bfc437b878184e0db9482ebecc2ada1f60addbd54eef8f083bd4f7b55efa296e
-
SHA512
ccb965749bdae779813de0d9697a46357af32aea561e745e06e5c31285e980af031b15ad2286071c5bfb62de200d1cff75298d0a55085adf340517aff2d0d5d9
-
SSDEEP
12288:roRXOQjmOyN8I2GUYAt/2jz6etYnuEhJEpNZ:rogQ9yN4YAt/2jz6etYnuEngN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2848 FE8.tmp 2908 1046.tmp 2152 10C3.tmp 2588 1120.tmp 2688 116E.tmp 2572 11DC.tmp 2704 1249.tmp 2464 12A6.tmp 2500 1314.tmp 2456 1381.tmp 2364 13DE.tmp 2868 144C.tmp 1628 14B9.tmp 2680 1526.tmp 2616 1584.tmp 1820 15E1.tmp 1668 164E.tmp 272 16BC.tmp 2180 170A.tmp 1292 1767.tmp 1632 17B5.tmp 768 1813.tmp 1220 1870.tmp 1388 18AF.tmp 2284 18ED.tmp 2272 192C.tmp 2112 196A.tmp 2752 19A8.tmp 2620 19F6.tmp 2052 1A44.tmp 536 1A83.tmp 696 1AC1.tmp 1488 1B00.tmp 1472 1B3E.tmp 348 1B7C.tmp 1804 1BBB.tmp 2156 1BF9.tmp 448 1C47.tmp 2412 1C86.tmp 1704 1CC4.tmp 1784 1D12.tmp 1676 1D60.tmp 1360 1DAE.tmp 1372 1DFC.tmp 1304 1E4A.tmp 1312 1E88.tmp 916 1EC7.tmp 2920 1F05.tmp 2780 1F44.tmp 792 1F82.tmp 1376 1FC0.tmp 2072 1FFF.tmp 896 203D.tmp 3012 207C.tmp 2336 20BA.tmp 1996 2108.tmp 1608 2146.tmp 2852 2185.tmp 2664 21C3.tmp 2956 2211.tmp 3004 225F.tmp 2584 229E.tmp 2692 22FB.tmp 1152 233A.tmp -
Loads dropped DLL 64 IoCs
pid Process 2732 2024-04-16_17b2d49e001a7188b5a3cffbefeb0be7_mafia.exe 2848 FE8.tmp 2908 1046.tmp 2152 10C3.tmp 2588 1120.tmp 2688 116E.tmp 2572 11DC.tmp 2704 1249.tmp 2464 12A6.tmp 2500 1314.tmp 2456 1381.tmp 2364 13DE.tmp 2868 144C.tmp 1628 14B9.tmp 2680 1526.tmp 2616 1584.tmp 1820 15E1.tmp 1668 164E.tmp 272 16BC.tmp 2180 170A.tmp 1292 1767.tmp 1632 17B5.tmp 768 1813.tmp 1220 1870.tmp 1388 18AF.tmp 2284 18ED.tmp 2272 192C.tmp 2112 196A.tmp 2752 19A8.tmp 2620 19F6.tmp 2052 1A44.tmp 536 1A83.tmp 696 1AC1.tmp 1488 1B00.tmp 1472 1B3E.tmp 348 1B7C.tmp 1804 1BBB.tmp 2156 1BF9.tmp 448 1C47.tmp 2412 1C86.tmp 1704 1CC4.tmp 1784 1D12.tmp 1676 1D60.tmp 1360 1DAE.tmp 1372 1DFC.tmp 1304 1E4A.tmp 1312 1E88.tmp 916 1EC7.tmp 2920 1F05.tmp 2780 1F44.tmp 792 1F82.tmp 1376 1FC0.tmp 2072 1FFF.tmp 896 203D.tmp 3012 207C.tmp 2336 20BA.tmp 1996 2108.tmp 1608 2146.tmp 2852 2185.tmp 2664 21C3.tmp 2956 2211.tmp 3004 225F.tmp 2584 229E.tmp 2692 22FB.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2732 wrote to memory of 2848 2732 2024-04-16_17b2d49e001a7188b5a3cffbefeb0be7_mafia.exe 28 PID 2732 wrote to memory of 2848 2732 2024-04-16_17b2d49e001a7188b5a3cffbefeb0be7_mafia.exe 28 PID 2732 wrote to memory of 2848 2732 2024-04-16_17b2d49e001a7188b5a3cffbefeb0be7_mafia.exe 28 PID 2732 wrote to memory of 2848 2732 2024-04-16_17b2d49e001a7188b5a3cffbefeb0be7_mafia.exe 28 PID 2848 wrote to memory of 2908 2848 FE8.tmp 29 PID 2848 wrote to memory of 2908 2848 FE8.tmp 29 PID 2848 wrote to memory of 2908 2848 FE8.tmp 29 PID 2848 wrote to memory of 2908 2848 FE8.tmp 29 PID 2908 wrote to memory of 2152 2908 1046.tmp 30 PID 2908 wrote to memory of 2152 2908 1046.tmp 30 PID 2908 wrote to memory of 2152 2908 1046.tmp 30 PID 2908 wrote to memory of 2152 2908 1046.tmp 30 PID 2152 wrote to memory of 2588 2152 10C3.tmp 31 PID 2152 wrote to memory of 2588 2152 10C3.tmp 31 PID 2152 wrote to memory of 2588 2152 10C3.tmp 31 PID 2152 wrote to memory of 2588 2152 10C3.tmp 31 PID 2588 wrote to memory of 2688 2588 1120.tmp 32 PID 2588 wrote to memory of 2688 2588 1120.tmp 32 PID 2588 wrote to memory of 2688 2588 1120.tmp 32 PID 2588 wrote to memory of 2688 2588 1120.tmp 32 PID 2688 wrote to memory of 2572 2688 116E.tmp 33 PID 2688 wrote to memory of 2572 2688 116E.tmp 33 PID 2688 wrote to memory of 2572 2688 116E.tmp 33 PID 2688 wrote to memory of 2572 2688 116E.tmp 33 PID 2572 wrote to memory of 2704 2572 11DC.tmp 34 PID 2572 wrote to memory of 2704 2572 11DC.tmp 34 PID 2572 wrote to memory of 2704 2572 11DC.tmp 34 PID 2572 wrote to memory of 2704 2572 11DC.tmp 34 PID 2704 wrote to memory of 2464 2704 1249.tmp 35 PID 2704 wrote to memory of 2464 2704 1249.tmp 35 PID 2704 wrote to memory of 2464 2704 1249.tmp 35 PID 2704 wrote to memory of 2464 2704 1249.tmp 35 PID 2464 wrote to memory of 2500 2464 12A6.tmp 36 PID 2464 wrote to memory of 2500 2464 12A6.tmp 36 PID 2464 wrote to memory of 2500 2464 12A6.tmp 36 PID 2464 wrote to memory of 2500 2464 12A6.tmp 36 PID 2500 wrote to memory of 2456 2500 1314.tmp 37 PID 2500 wrote to memory of 2456 2500 1314.tmp 37 PID 2500 wrote to memory of 2456 2500 1314.tmp 37 PID 2500 wrote to memory of 2456 2500 1314.tmp 37 PID 2456 wrote to memory of 2364 2456 1381.tmp 38 PID 2456 wrote to memory of 2364 2456 1381.tmp 38 PID 2456 wrote to memory of 2364 2456 1381.tmp 38 PID 2456 wrote to memory of 2364 2456 1381.tmp 38 PID 2364 wrote to memory of 2868 2364 13DE.tmp 39 PID 2364 wrote to memory of 2868 2364 13DE.tmp 39 PID 2364 wrote to memory of 2868 2364 13DE.tmp 39 PID 2364 wrote to memory of 2868 2364 13DE.tmp 39 PID 2868 wrote to memory of 1628 2868 144C.tmp 40 PID 2868 wrote to memory of 1628 2868 144C.tmp 40 PID 2868 wrote to memory of 1628 2868 144C.tmp 40 PID 2868 wrote to memory of 1628 2868 144C.tmp 40 PID 1628 wrote to memory of 2680 1628 14B9.tmp 41 PID 1628 wrote to memory of 2680 1628 14B9.tmp 41 PID 1628 wrote to memory of 2680 1628 14B9.tmp 41 PID 1628 wrote to memory of 2680 1628 14B9.tmp 41 PID 2680 wrote to memory of 2616 2680 1526.tmp 42 PID 2680 wrote to memory of 2616 2680 1526.tmp 42 PID 2680 wrote to memory of 2616 2680 1526.tmp 42 PID 2680 wrote to memory of 2616 2680 1526.tmp 42 PID 2616 wrote to memory of 1820 2616 1584.tmp 43 PID 2616 wrote to memory of 1820 2616 1584.tmp 43 PID 2616 wrote to memory of 1820 2616 1584.tmp 43 PID 2616 wrote to memory of 1820 2616 1584.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-16_17b2d49e001a7188b5a3cffbefeb0be7_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-16_17b2d49e001a7188b5a3cffbefeb0be7_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\FE8.tmp"C:\Users\Admin\AppData\Local\Temp\FE8.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\1046.tmp"C:\Users\Admin\AppData\Local\Temp\1046.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\10C3.tmp"C:\Users\Admin\AppData\Local\Temp\10C3.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\1120.tmp"C:\Users\Admin\AppData\Local\Temp\1120.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\116E.tmp"C:\Users\Admin\AppData\Local\Temp\116E.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\11DC.tmp"C:\Users\Admin\AppData\Local\Temp\11DC.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\1249.tmp"C:\Users\Admin\AppData\Local\Temp\1249.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\12A6.tmp"C:\Users\Admin\AppData\Local\Temp\12A6.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\1314.tmp"C:\Users\Admin\AppData\Local\Temp\1314.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\1381.tmp"C:\Users\Admin\AppData\Local\Temp\1381.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\13DE.tmp"C:\Users\Admin\AppData\Local\Temp\13DE.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\144C.tmp"C:\Users\Admin\AppData\Local\Temp\144C.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\14B9.tmp"C:\Users\Admin\AppData\Local\Temp\14B9.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\1526.tmp"C:\Users\Admin\AppData\Local\Temp\1526.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\1584.tmp"C:\Users\Admin\AppData\Local\Temp\1584.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\15E1.tmp"C:\Users\Admin\AppData\Local\Temp\15E1.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\164E.tmp"C:\Users\Admin\AppData\Local\Temp\164E.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\16BC.tmp"C:\Users\Admin\AppData\Local\Temp\16BC.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:272 -
C:\Users\Admin\AppData\Local\Temp\170A.tmp"C:\Users\Admin\AppData\Local\Temp\170A.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\1767.tmp"C:\Users\Admin\AppData\Local\Temp\1767.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\17B5.tmp"C:\Users\Admin\AppData\Local\Temp\17B5.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\1813.tmp"C:\Users\Admin\AppData\Local\Temp\1813.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:768 -
C:\Users\Admin\AppData\Local\Temp\1870.tmp"C:\Users\Admin\AppData\Local\Temp\1870.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\18AF.tmp"C:\Users\Admin\AppData\Local\Temp\18AF.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\18ED.tmp"C:\Users\Admin\AppData\Local\Temp\18ED.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\192C.tmp"C:\Users\Admin\AppData\Local\Temp\192C.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\196A.tmp"C:\Users\Admin\AppData\Local\Temp\196A.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\19A8.tmp"C:\Users\Admin\AppData\Local\Temp\19A8.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\19F6.tmp"C:\Users\Admin\AppData\Local\Temp\19F6.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\1A44.tmp"C:\Users\Admin\AppData\Local\Temp\1A44.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\1A83.tmp"C:\Users\Admin\AppData\Local\Temp\1A83.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:536 -
C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:696 -
C:\Users\Admin\AppData\Local\Temp\1B00.tmp"C:\Users\Admin\AppData\Local\Temp\1B00.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:348 -
C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\1BF9.tmp"C:\Users\Admin\AppData\Local\Temp\1BF9.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\1C47.tmp"C:\Users\Admin\AppData\Local\Temp\1C47.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:448 -
C:\Users\Admin\AppData\Local\Temp\1C86.tmp"C:\Users\Admin\AppData\Local\Temp\1C86.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\1D12.tmp"C:\Users\Admin\AppData\Local\Temp\1D12.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\1D60.tmp"C:\Users\Admin\AppData\Local\Temp\1D60.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\1E4A.tmp"C:\Users\Admin\AppData\Local\Temp\1E4A.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\1E88.tmp"C:\Users\Admin\AppData\Local\Temp\1E88.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:916 -
C:\Users\Admin\AppData\Local\Temp\1F05.tmp"C:\Users\Admin\AppData\Local\Temp\1F05.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\1F44.tmp"C:\Users\Admin\AppData\Local\Temp\1F44.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\1F82.tmp"C:\Users\Admin\AppData\Local\Temp\1F82.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:792 -
C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\203D.tmp"C:\Users\Admin\AppData\Local\Temp\203D.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:896 -
C:\Users\Admin\AppData\Local\Temp\207C.tmp"C:\Users\Admin\AppData\Local\Temp\207C.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\20BA.tmp"C:\Users\Admin\AppData\Local\Temp\20BA.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\2108.tmp"C:\Users\Admin\AppData\Local\Temp\2108.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\2146.tmp"C:\Users\Admin\AppData\Local\Temp\2146.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\2185.tmp"C:\Users\Admin\AppData\Local\Temp\2185.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\21C3.tmp"C:\Users\Admin\AppData\Local\Temp\21C3.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\2211.tmp"C:\Users\Admin\AppData\Local\Temp\2211.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\225F.tmp"C:\Users\Admin\AppData\Local\Temp\225F.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\229E.tmp"C:\Users\Admin\AppData\Local\Temp\229E.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\22FB.tmp"C:\Users\Admin\AppData\Local\Temp\22FB.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\233A.tmp"C:\Users\Admin\AppData\Local\Temp\233A.tmp"65⤵
- Executes dropped EXE
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\2378.tmp"C:\Users\Admin\AppData\Local\Temp\2378.tmp"66⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\23D6.tmp"C:\Users\Admin\AppData\Local\Temp\23D6.tmp"67⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\2414.tmp"C:\Users\Admin\AppData\Local\Temp\2414.tmp"68⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"69⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\24A0.tmp"C:\Users\Admin\AppData\Local\Temp\24A0.tmp"70⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\24DF.tmp"C:\Users\Admin\AppData\Local\Temp\24DF.tmp"71⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\251D.tmp"C:\Users\Admin\AppData\Local\Temp\251D.tmp"72⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"73⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\259A.tmp"C:\Users\Admin\AppData\Local\Temp\259A.tmp"74⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\25E8.tmp"C:\Users\Admin\AppData\Local\Temp\25E8.tmp"75⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"76⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\2655.tmp"C:\Users\Admin\AppData\Local\Temp\2655.tmp"77⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\26A3.tmp"C:\Users\Admin\AppData\Local\Temp\26A3.tmp"78⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\26F1.tmp"C:\Users\Admin\AppData\Local\Temp\26F1.tmp"79⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\2730.tmp"C:\Users\Admin\AppData\Local\Temp\2730.tmp"80⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\276E.tmp"C:\Users\Admin\AppData\Local\Temp\276E.tmp"81⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\27AC.tmp"C:\Users\Admin\AppData\Local\Temp\27AC.tmp"82⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\27EB.tmp"C:\Users\Admin\AppData\Local\Temp\27EB.tmp"83⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\2839.tmp"C:\Users\Admin\AppData\Local\Temp\2839.tmp"84⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\2877.tmp"C:\Users\Admin\AppData\Local\Temp\2877.tmp"85⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\28B6.tmp"C:\Users\Admin\AppData\Local\Temp\28B6.tmp"86⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\28F4.tmp"C:\Users\Admin\AppData\Local\Temp\28F4.tmp"87⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\2932.tmp"C:\Users\Admin\AppData\Local\Temp\2932.tmp"88⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\2971.tmp"C:\Users\Admin\AppData\Local\Temp\2971.tmp"89⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\29BF.tmp"C:\Users\Admin\AppData\Local\Temp\29BF.tmp"90⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\29FD.tmp"C:\Users\Admin\AppData\Local\Temp\29FD.tmp"91⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"92⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"93⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"94⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"95⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\2B45.tmp"C:\Users\Admin\AppData\Local\Temp\2B45.tmp"96⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\2B74.tmp"C:\Users\Admin\AppData\Local\Temp\2B74.tmp"97⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"98⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"99⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"100⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"101⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"102⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"103⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\2D38.tmp"C:\Users\Admin\AppData\Local\Temp\2D38.tmp"104⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\2D86.tmp"C:\Users\Admin\AppData\Local\Temp\2D86.tmp"105⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"106⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\2E03.tmp"C:\Users\Admin\AppData\Local\Temp\2E03.tmp"107⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\2E41.tmp"C:\Users\Admin\AppData\Local\Temp\2E41.tmp"108⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\2E80.tmp"C:\Users\Admin\AppData\Local\Temp\2E80.tmp"109⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"110⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"111⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"112⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\2F89.tmp"C:\Users\Admin\AppData\Local\Temp\2F89.tmp"113⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"114⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\3006.tmp"C:\Users\Admin\AppData\Local\Temp\3006.tmp"115⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\3063.tmp"C:\Users\Admin\AppData\Local\Temp\3063.tmp"116⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\30A2.tmp"C:\Users\Admin\AppData\Local\Temp\30A2.tmp"117⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\30E0.tmp"C:\Users\Admin\AppData\Local\Temp\30E0.tmp"118⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\311E.tmp"C:\Users\Admin\AppData\Local\Temp\311E.tmp"119⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\315D.tmp"C:\Users\Admin\AppData\Local\Temp\315D.tmp"120⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\319B.tmp"C:\Users\Admin\AppData\Local\Temp\319B.tmp"121⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\31DA.tmp"C:\Users\Admin\AppData\Local\Temp\31DA.tmp"122⤵PID:1748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-