Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22/04/2024, 02:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-22_dfe0f8feb4c2c1c9af633ab02978506f_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-22_dfe0f8feb4c2c1c9af633ab02978506f_mafia.exe
Resource
win10v2004-20240412-en
2 signatures
150 seconds
General
-
Target
2024-04-22_dfe0f8feb4c2c1c9af633ab02978506f_mafia.exe
-
Size
486KB
-
MD5
dfe0f8feb4c2c1c9af633ab02978506f
-
SHA1
078d74aefc959d9811856c690268361df699054e
-
SHA256
7d5365a9efdc3731c32a87ceaa5bde2d94afff3ef1cd023cf20e12756de6b8b1
-
SHA512
91f152f12aa4331bd0426d6a376a384be5de6724245105f241612e489425837966a4d3f4b734dde9998013ac9a7fe34e30e77ca7b3428434108119fc87122a95
-
SSDEEP
12288:/U5rCOTeiD4otbrhlk+FLWrERU/jCumoI70:/UQOJD4U9lrgGULP
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1112 13CF.tmp 3060 141D.tmp 2292 148A.tmp 2564 14D8.tmp 2720 1545.tmp 2592 15A3.tmp 2756 1600.tmp 2484 164E.tmp 2572 169C.tmp 2480 16FA.tmp 1628 1767.tmp 2092 17B5.tmp 1580 1822.tmp 2848 1880.tmp 2956 18DE.tmp 1732 193B.tmp 1972 1999.tmp 2528 19E7.tmp 1680 1A44.tmp 2520 1AA2.tmp 2788 1B00.tmp 1524 1B5D.tmp 2556 1BBB.tmp 1420 1BF9.tmp 2024 1C47.tmp 2304 1C86.tmp 2904 1CC4.tmp 2860 1D02.tmp 2728 1D41.tmp 2364 1D7F.tmp 592 1DBE.tmp 788 1DFC.tmp 1296 1E3A.tmp 1648 1E79.tmp 3056 1EB7.tmp 2076 1EF6.tmp 828 1F34.tmp 2204 1F72.tmp 1148 1FB1.tmp 2412 1FEF.tmp 872 202E.tmp 1536 206C.tmp 280 20AA.tmp 760 20E9.tmp 1040 2127.tmp 2176 2166.tmp 276 21A4.tmp 2396 21E2.tmp 2772 2221.tmp 1792 225F.tmp 2220 22AD.tmp 2776 22EC.tmp 1744 232A.tmp 1344 2368.tmp 1592 23A7.tmp 1600 23E5.tmp 2112 2424.tmp 2080 2462.tmp 2552 24A0.tmp 2116 24EE.tmp 2292 253C.tmp 2712 258A.tmp 2692 25D8.tmp 2616 2617.tmp -
Loads dropped DLL 64 IoCs
pid Process 2420 2024-04-22_dfe0f8feb4c2c1c9af633ab02978506f_mafia.exe 1112 13CF.tmp 3060 141D.tmp 2292 148A.tmp 2564 14D8.tmp 2720 1545.tmp 2592 15A3.tmp 2756 1600.tmp 2484 164E.tmp 2572 169C.tmp 2480 16FA.tmp 1628 1767.tmp 2092 17B5.tmp 1580 1822.tmp 2848 1880.tmp 2956 18DE.tmp 1732 193B.tmp 1972 1999.tmp 2528 19E7.tmp 1680 1A44.tmp 2520 1AA2.tmp 2788 1B00.tmp 1524 1B5D.tmp 2556 1BBB.tmp 1420 1BF9.tmp 2024 1C47.tmp 2304 1C86.tmp 2904 1CC4.tmp 2860 1D02.tmp 2728 1D41.tmp 2364 1D7F.tmp 592 1DBE.tmp 788 1DFC.tmp 1296 1E3A.tmp 1648 1E79.tmp 3056 1EB7.tmp 2076 1EF6.tmp 828 1F34.tmp 2204 1F72.tmp 1148 1FB1.tmp 2412 1FEF.tmp 872 202E.tmp 1536 206C.tmp 280 20AA.tmp 760 20E9.tmp 1040 2127.tmp 2176 2166.tmp 276 21A4.tmp 2396 21E2.tmp 2772 2221.tmp 1792 225F.tmp 2220 22AD.tmp 2776 22EC.tmp 1744 232A.tmp 1344 2368.tmp 1592 23A7.tmp 1600 23E5.tmp 2112 2424.tmp 2080 2462.tmp 2552 24A0.tmp 2116 24EE.tmp 2292 253C.tmp 2712 258A.tmp 2692 25D8.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2420 wrote to memory of 1112 2420 2024-04-22_dfe0f8feb4c2c1c9af633ab02978506f_mafia.exe 28 PID 2420 wrote to memory of 1112 2420 2024-04-22_dfe0f8feb4c2c1c9af633ab02978506f_mafia.exe 28 PID 2420 wrote to memory of 1112 2420 2024-04-22_dfe0f8feb4c2c1c9af633ab02978506f_mafia.exe 28 PID 2420 wrote to memory of 1112 2420 2024-04-22_dfe0f8feb4c2c1c9af633ab02978506f_mafia.exe 28 PID 1112 wrote to memory of 3060 1112 13CF.tmp 29 PID 1112 wrote to memory of 3060 1112 13CF.tmp 29 PID 1112 wrote to memory of 3060 1112 13CF.tmp 29 PID 1112 wrote to memory of 3060 1112 13CF.tmp 29 PID 3060 wrote to memory of 2292 3060 141D.tmp 30 PID 3060 wrote to memory of 2292 3060 141D.tmp 30 PID 3060 wrote to memory of 2292 3060 141D.tmp 30 PID 3060 wrote to memory of 2292 3060 141D.tmp 30 PID 2292 wrote to memory of 2564 2292 148A.tmp 31 PID 2292 wrote to memory of 2564 2292 148A.tmp 31 PID 2292 wrote to memory of 2564 2292 148A.tmp 31 PID 2292 wrote to memory of 2564 2292 148A.tmp 31 PID 2564 wrote to memory of 2720 2564 14D8.tmp 32 PID 2564 wrote to memory of 2720 2564 14D8.tmp 32 PID 2564 wrote to memory of 2720 2564 14D8.tmp 32 PID 2564 wrote to memory of 2720 2564 14D8.tmp 32 PID 2720 wrote to memory of 2592 2720 1545.tmp 33 PID 2720 wrote to memory of 2592 2720 1545.tmp 33 PID 2720 wrote to memory of 2592 2720 1545.tmp 33 PID 2720 wrote to memory of 2592 2720 1545.tmp 33 PID 2592 wrote to memory of 2756 2592 15A3.tmp 34 PID 2592 wrote to memory of 2756 2592 15A3.tmp 34 PID 2592 wrote to memory of 2756 2592 15A3.tmp 34 PID 2592 wrote to memory of 2756 2592 15A3.tmp 34 PID 2756 wrote to memory of 2484 2756 1600.tmp 35 PID 2756 wrote to memory of 2484 2756 1600.tmp 35 PID 2756 wrote to memory of 2484 2756 1600.tmp 35 PID 2756 wrote to memory of 2484 2756 1600.tmp 35 PID 2484 wrote to memory of 2572 2484 164E.tmp 36 PID 2484 wrote to memory of 2572 2484 164E.tmp 36 PID 2484 wrote to memory of 2572 2484 164E.tmp 36 PID 2484 wrote to memory of 2572 2484 164E.tmp 36 PID 2572 wrote to memory of 2480 2572 169C.tmp 37 PID 2572 wrote to memory of 2480 2572 169C.tmp 37 PID 2572 wrote to memory of 2480 2572 169C.tmp 37 PID 2572 wrote to memory of 2480 2572 169C.tmp 37 PID 2480 wrote to memory of 1628 2480 16FA.tmp 38 PID 2480 wrote to memory of 1628 2480 16FA.tmp 38 PID 2480 wrote to memory of 1628 2480 16FA.tmp 38 PID 2480 wrote to memory of 1628 2480 16FA.tmp 38 PID 1628 wrote to memory of 2092 1628 1767.tmp 39 PID 1628 wrote to memory of 2092 1628 1767.tmp 39 PID 1628 wrote to memory of 2092 1628 1767.tmp 39 PID 1628 wrote to memory of 2092 1628 1767.tmp 39 PID 2092 wrote to memory of 1580 2092 17B5.tmp 40 PID 2092 wrote to memory of 1580 2092 17B5.tmp 40 PID 2092 wrote to memory of 1580 2092 17B5.tmp 40 PID 2092 wrote to memory of 1580 2092 17B5.tmp 40 PID 1580 wrote to memory of 2848 1580 1822.tmp 41 PID 1580 wrote to memory of 2848 1580 1822.tmp 41 PID 1580 wrote to memory of 2848 1580 1822.tmp 41 PID 1580 wrote to memory of 2848 1580 1822.tmp 41 PID 2848 wrote to memory of 2956 2848 1880.tmp 42 PID 2848 wrote to memory of 2956 2848 1880.tmp 42 PID 2848 wrote to memory of 2956 2848 1880.tmp 42 PID 2848 wrote to memory of 2956 2848 1880.tmp 42 PID 2956 wrote to memory of 1732 2956 18DE.tmp 43 PID 2956 wrote to memory of 1732 2956 18DE.tmp 43 PID 2956 wrote to memory of 1732 2956 18DE.tmp 43 PID 2956 wrote to memory of 1732 2956 18DE.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-22_dfe0f8feb4c2c1c9af633ab02978506f_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-22_dfe0f8feb4c2c1c9af633ab02978506f_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\13CF.tmp"C:\Users\Admin\AppData\Local\Temp\13CF.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\141D.tmp"C:\Users\Admin\AppData\Local\Temp\141D.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\148A.tmp"C:\Users\Admin\AppData\Local\Temp\148A.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\14D8.tmp"C:\Users\Admin\AppData\Local\Temp\14D8.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\1545.tmp"C:\Users\Admin\AppData\Local\Temp\1545.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\15A3.tmp"C:\Users\Admin\AppData\Local\Temp\15A3.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\1600.tmp"C:\Users\Admin\AppData\Local\Temp\1600.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\164E.tmp"C:\Users\Admin\AppData\Local\Temp\164E.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\169C.tmp"C:\Users\Admin\AppData\Local\Temp\169C.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\16FA.tmp"C:\Users\Admin\AppData\Local\Temp\16FA.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\1767.tmp"C:\Users\Admin\AppData\Local\Temp\1767.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\17B5.tmp"C:\Users\Admin\AppData\Local\Temp\17B5.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\1822.tmp"C:\Users\Admin\AppData\Local\Temp\1822.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\1880.tmp"C:\Users\Admin\AppData\Local\Temp\1880.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\18DE.tmp"C:\Users\Admin\AppData\Local\Temp\18DE.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\193B.tmp"C:\Users\Admin\AppData\Local\Temp\193B.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\1999.tmp"C:\Users\Admin\AppData\Local\Temp\1999.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\19E7.tmp"C:\Users\Admin\AppData\Local\Temp\19E7.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\1A44.tmp"C:\Users\Admin\AppData\Local\Temp\1A44.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\1B00.tmp"C:\Users\Admin\AppData\Local\Temp\1B00.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\1BF9.tmp"C:\Users\Admin\AppData\Local\Temp\1BF9.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\1C47.tmp"C:\Users\Admin\AppData\Local\Temp\1C47.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\1C86.tmp"C:\Users\Admin\AppData\Local\Temp\1C86.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\1D02.tmp"C:\Users\Admin\AppData\Local\Temp\1D02.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\1D41.tmp"C:\Users\Admin\AppData\Local\Temp\1D41.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:592 -
C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:788 -
C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\1E79.tmp"C:\Users\Admin\AppData\Local\Temp\1E79.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\1F34.tmp"C:\Users\Admin\AppData\Local\Temp\1F34.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:828 -
C:\Users\Admin\AppData\Local\Temp\1F72.tmp"C:\Users\Admin\AppData\Local\Temp\1F72.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\202E.tmp"C:\Users\Admin\AppData\Local\Temp\202E.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:872 -
C:\Users\Admin\AppData\Local\Temp\206C.tmp"C:\Users\Admin\AppData\Local\Temp\206C.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\20AA.tmp"C:\Users\Admin\AppData\Local\Temp\20AA.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:280 -
C:\Users\Admin\AppData\Local\Temp\20E9.tmp"C:\Users\Admin\AppData\Local\Temp\20E9.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:760 -
C:\Users\Admin\AppData\Local\Temp\2127.tmp"C:\Users\Admin\AppData\Local\Temp\2127.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\2166.tmp"C:\Users\Admin\AppData\Local\Temp\2166.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\21A4.tmp"C:\Users\Admin\AppData\Local\Temp\21A4.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:276 -
C:\Users\Admin\AppData\Local\Temp\21E2.tmp"C:\Users\Admin\AppData\Local\Temp\21E2.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\2221.tmp"C:\Users\Admin\AppData\Local\Temp\2221.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\225F.tmp"C:\Users\Admin\AppData\Local\Temp\225F.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\22AD.tmp"C:\Users\Admin\AppData\Local\Temp\22AD.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\22EC.tmp"C:\Users\Admin\AppData\Local\Temp\22EC.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\232A.tmp"C:\Users\Admin\AppData\Local\Temp\232A.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\2368.tmp"C:\Users\Admin\AppData\Local\Temp\2368.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\23A7.tmp"C:\Users\Admin\AppData\Local\Temp\23A7.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\2424.tmp"C:\Users\Admin\AppData\Local\Temp\2424.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\24A0.tmp"C:\Users\Admin\AppData\Local\Temp\24A0.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\24EE.tmp"C:\Users\Admin\AppData\Local\Temp\24EE.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\253C.tmp"C:\Users\Admin\AppData\Local\Temp\253C.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\258A.tmp"C:\Users\Admin\AppData\Local\Temp\258A.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\25D8.tmp"C:\Users\Admin\AppData\Local\Temp\25D8.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"65⤵
- Executes dropped EXE
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\2655.tmp"C:\Users\Admin\AppData\Local\Temp\2655.tmp"66⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\26A3.tmp"C:\Users\Admin\AppData\Local\Temp\26A3.tmp"67⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\26F1.tmp"C:\Users\Admin\AppData\Local\Temp\26F1.tmp"68⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\2730.tmp"C:\Users\Admin\AppData\Local\Temp\2730.tmp"69⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\276E.tmp"C:\Users\Admin\AppData\Local\Temp\276E.tmp"70⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\27AC.tmp"C:\Users\Admin\AppData\Local\Temp\27AC.tmp"71⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\27EB.tmp"C:\Users\Admin\AppData\Local\Temp\27EB.tmp"72⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\2839.tmp"C:\Users\Admin\AppData\Local\Temp\2839.tmp"73⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\2877.tmp"C:\Users\Admin\AppData\Local\Temp\2877.tmp"74⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\28B6.tmp"C:\Users\Admin\AppData\Local\Temp\28B6.tmp"75⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\2904.tmp"C:\Users\Admin\AppData\Local\Temp\2904.tmp"76⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\2942.tmp"C:\Users\Admin\AppData\Local\Temp\2942.tmp"77⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\2980.tmp"C:\Users\Admin\AppData\Local\Temp\2980.tmp"78⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\29BF.tmp"C:\Users\Admin\AppData\Local\Temp\29BF.tmp"79⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\29FD.tmp"C:\Users\Admin\AppData\Local\Temp\29FD.tmp"80⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"81⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"82⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"83⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\2B06.tmp"C:\Users\Admin\AppData\Local\Temp\2B06.tmp"84⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\2B45.tmp"C:\Users\Admin\AppData\Local\Temp\2B45.tmp"85⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\2B93.tmp"C:\Users\Admin\AppData\Local\Temp\2B93.tmp"86⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"87⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\2C10.tmp"C:\Users\Admin\AppData\Local\Temp\2C10.tmp"88⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"89⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\2C9C.tmp"C:\Users\Admin\AppData\Local\Temp\2C9C.tmp"90⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"91⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\2D19.tmp"C:\Users\Admin\AppData\Local\Temp\2D19.tmp"92⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\2D57.tmp"C:\Users\Admin\AppData\Local\Temp\2D57.tmp"93⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"94⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"95⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\2E22.tmp"C:\Users\Admin\AppData\Local\Temp\2E22.tmp"96⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\2E60.tmp"C:\Users\Admin\AppData\Local\Temp\2E60.tmp"97⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"98⤵PID:600
-
C:\Users\Admin\AppData\Local\Temp\2EED.tmp"C:\Users\Admin\AppData\Local\Temp\2EED.tmp"99⤵PID:596
-
C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"100⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\2F6A.tmp"C:\Users\Admin\AppData\Local\Temp\2F6A.tmp"101⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"102⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"103⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\3034.tmp"C:\Users\Admin\AppData\Local\Temp\3034.tmp"104⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\3073.tmp"C:\Users\Admin\AppData\Local\Temp\3073.tmp"105⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\30C1.tmp"C:\Users\Admin\AppData\Local\Temp\30C1.tmp"106⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\30FF.tmp"C:\Users\Admin\AppData\Local\Temp\30FF.tmp"107⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\314D.tmp"C:\Users\Admin\AppData\Local\Temp\314D.tmp"108⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\319B.tmp"C:\Users\Admin\AppData\Local\Temp\319B.tmp"109⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\31DA.tmp"C:\Users\Admin\AppData\Local\Temp\31DA.tmp"110⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\3218.tmp"C:\Users\Admin\AppData\Local\Temp\3218.tmp"111⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"112⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\3295.tmp"C:\Users\Admin\AppData\Local\Temp\3295.tmp"113⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\32D3.tmp"C:\Users\Admin\AppData\Local\Temp\32D3.tmp"114⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\3312.tmp"C:\Users\Admin\AppData\Local\Temp\3312.tmp"115⤵PID:276
-
C:\Users\Admin\AppData\Local\Temp\3350.tmp"C:\Users\Admin\AppData\Local\Temp\3350.tmp"116⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\338E.tmp"C:\Users\Admin\AppData\Local\Temp\338E.tmp"117⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\33CD.tmp"C:\Users\Admin\AppData\Local\Temp\33CD.tmp"118⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\340B.tmp"C:\Users\Admin\AppData\Local\Temp\340B.tmp"119⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\344A.tmp"C:\Users\Admin\AppData\Local\Temp\344A.tmp"120⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"121⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\34D6.tmp"C:\Users\Admin\AppData\Local\Temp\34D6.tmp"122⤵PID:1344
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-