Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26/04/2024, 09:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-26_97af8e395671051025e5729c0df8c515_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-26_97af8e395671051025e5729c0df8c515_mafia.exe
Resource
win10v2004-20240412-en
2 signatures
150 seconds
General
-
Target
2024-04-26_97af8e395671051025e5729c0df8c515_mafia.exe
-
Size
486KB
-
MD5
97af8e395671051025e5729c0df8c515
-
SHA1
9280c1919ac32ebe81356f0874162557c0feff71
-
SHA256
1d229edc986d55e9d2e8e538e721512fb80d10ed653e70d3fa85fcbc095b2681
-
SHA512
ea8af4c43111eeb2f5079d0e43bb0cd6c417be8f4cc78589a4ec37656bbc335bc7a4d7c434136e58a553011bba4ddf896dfa82d3c6db12f66ca93b159d366f4d
-
SSDEEP
12288:/U5rCOTeiDTIVYbuXnz/TUQ6RQSgyNRD49NZ:/UQOJDvo30hJwN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2024 90DA.tmp 2256 9195.tmp 2188 9260.tmp 2016 931B.tmp 2828 93B7.tmp 2456 9473.tmp 2616 950F.tmp 2548 95F9.tmp 2692 96C3.tmp 2452 9740.tmp 2516 97AD.tmp 2360 98A7.tmp 2472 9933.tmp 2924 99EF.tmp 884 9A8B.tmp 1200 9BA3.tmp 1884 9C11.tmp 1316 9C9D.tmp 1940 9D49.tmp 1776 9DC5.tmp 2312 9F0D.tmp 1796 9FB9.tmp 956 A016.tmp 1972 A093.tmp 1652 A0F1.tmp 1552 A14E.tmp 1440 A1BB.tmp 1624 A332.tmp 1148 A3BE.tmp 2656 A41C.tmp 2124 A489.tmp 2676 A4F6.tmp 2020 A554.tmp 2664 A5D1.tmp 2336 A62E.tmp 2040 A709.tmp 2712 A785.tmp 1988 A7F3.tmp 1520 A860.tmp 1756 A8FC.tmp 1644 A959.tmp 1836 A9D6.tmp 3028 AA53.tmp 1116 AAD0.tmp 1932 AB4D.tmp 2900 ABBA.tmp 392 AC27.tmp 2184 ACB3.tmp 2748 AD30.tmp 2756 ADEB.tmp 880 AE87.tmp 896 AF04.tmp 1540 AF71.tmp 872 AFEE.tmp 1424 B07B.tmp 2108 B126.tmp 2308 B184.tmp 2116 B201.tmp 2316 B27D.tmp 2604 B30A.tmp 2540 B387.tmp 2444 B3E4.tmp 2904 B471.tmp 2496 B50D.tmp -
Loads dropped DLL 64 IoCs
pid Process 2072 2024-04-26_97af8e395671051025e5729c0df8c515_mafia.exe 2024 90DA.tmp 2256 9195.tmp 2188 9260.tmp 2016 931B.tmp 2828 93B7.tmp 2456 9473.tmp 2616 950F.tmp 2548 95F9.tmp 2692 96C3.tmp 2452 9740.tmp 2516 97AD.tmp 2360 98A7.tmp 2472 9933.tmp 2924 99EF.tmp 884 9A8B.tmp 1200 9BA3.tmp 1884 9C11.tmp 1316 9C9D.tmp 1940 9D49.tmp 1776 9DC5.tmp 2312 9F0D.tmp 1796 9FB9.tmp 956 A016.tmp 1972 A093.tmp 1652 A0F1.tmp 1552 A14E.tmp 1440 A1BB.tmp 1624 A332.tmp 1148 A3BE.tmp 2656 A41C.tmp 2124 A489.tmp 2676 A4F6.tmp 2020 A554.tmp 2664 A5D1.tmp 2336 A62E.tmp 2040 A709.tmp 2712 A785.tmp 1988 A7F3.tmp 1520 A860.tmp 1756 A8FC.tmp 1644 A959.tmp 1836 A9D6.tmp 3028 AA53.tmp 1116 AAD0.tmp 1932 AB4D.tmp 2900 ABBA.tmp 392 AC27.tmp 2184 ACB3.tmp 2748 AD30.tmp 2756 ADEB.tmp 880 AE87.tmp 896 AF04.tmp 1540 AF71.tmp 872 AFEE.tmp 1424 B07B.tmp 2108 B126.tmp 2308 B184.tmp 2116 B201.tmp 2316 B27D.tmp 2604 B30A.tmp 2540 B387.tmp 2444 B3E4.tmp 2904 B471.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2072 wrote to memory of 2024 2072 2024-04-26_97af8e395671051025e5729c0df8c515_mafia.exe 28 PID 2072 wrote to memory of 2024 2072 2024-04-26_97af8e395671051025e5729c0df8c515_mafia.exe 28 PID 2072 wrote to memory of 2024 2072 2024-04-26_97af8e395671051025e5729c0df8c515_mafia.exe 28 PID 2072 wrote to memory of 2024 2072 2024-04-26_97af8e395671051025e5729c0df8c515_mafia.exe 28 PID 2024 wrote to memory of 2256 2024 90DA.tmp 29 PID 2024 wrote to memory of 2256 2024 90DA.tmp 29 PID 2024 wrote to memory of 2256 2024 90DA.tmp 29 PID 2024 wrote to memory of 2256 2024 90DA.tmp 29 PID 2256 wrote to memory of 2188 2256 9195.tmp 30 PID 2256 wrote to memory of 2188 2256 9195.tmp 30 PID 2256 wrote to memory of 2188 2256 9195.tmp 30 PID 2256 wrote to memory of 2188 2256 9195.tmp 30 PID 2188 wrote to memory of 2016 2188 9260.tmp 31 PID 2188 wrote to memory of 2016 2188 9260.tmp 31 PID 2188 wrote to memory of 2016 2188 9260.tmp 31 PID 2188 wrote to memory of 2016 2188 9260.tmp 31 PID 2016 wrote to memory of 2828 2016 931B.tmp 32 PID 2016 wrote to memory of 2828 2016 931B.tmp 32 PID 2016 wrote to memory of 2828 2016 931B.tmp 32 PID 2016 wrote to memory of 2828 2016 931B.tmp 32 PID 2828 wrote to memory of 2456 2828 93B7.tmp 33 PID 2828 wrote to memory of 2456 2828 93B7.tmp 33 PID 2828 wrote to memory of 2456 2828 93B7.tmp 33 PID 2828 wrote to memory of 2456 2828 93B7.tmp 33 PID 2456 wrote to memory of 2616 2456 9473.tmp 34 PID 2456 wrote to memory of 2616 2456 9473.tmp 34 PID 2456 wrote to memory of 2616 2456 9473.tmp 34 PID 2456 wrote to memory of 2616 2456 9473.tmp 34 PID 2616 wrote to memory of 2548 2616 950F.tmp 35 PID 2616 wrote to memory of 2548 2616 950F.tmp 35 PID 2616 wrote to memory of 2548 2616 950F.tmp 35 PID 2616 wrote to memory of 2548 2616 950F.tmp 35 PID 2548 wrote to memory of 2692 2548 95F9.tmp 36 PID 2548 wrote to memory of 2692 2548 95F9.tmp 36 PID 2548 wrote to memory of 2692 2548 95F9.tmp 36 PID 2548 wrote to memory of 2692 2548 95F9.tmp 36 PID 2692 wrote to memory of 2452 2692 96C3.tmp 37 PID 2692 wrote to memory of 2452 2692 96C3.tmp 37 PID 2692 wrote to memory of 2452 2692 96C3.tmp 37 PID 2692 wrote to memory of 2452 2692 96C3.tmp 37 PID 2452 wrote to memory of 2516 2452 9740.tmp 38 PID 2452 wrote to memory of 2516 2452 9740.tmp 38 PID 2452 wrote to memory of 2516 2452 9740.tmp 38 PID 2452 wrote to memory of 2516 2452 9740.tmp 38 PID 2516 wrote to memory of 2360 2516 97AD.tmp 39 PID 2516 wrote to memory of 2360 2516 97AD.tmp 39 PID 2516 wrote to memory of 2360 2516 97AD.tmp 39 PID 2516 wrote to memory of 2360 2516 97AD.tmp 39 PID 2360 wrote to memory of 2472 2360 98A7.tmp 40 PID 2360 wrote to memory of 2472 2360 98A7.tmp 40 PID 2360 wrote to memory of 2472 2360 98A7.tmp 40 PID 2360 wrote to memory of 2472 2360 98A7.tmp 40 PID 2472 wrote to memory of 2924 2472 9933.tmp 41 PID 2472 wrote to memory of 2924 2472 9933.tmp 41 PID 2472 wrote to memory of 2924 2472 9933.tmp 41 PID 2472 wrote to memory of 2924 2472 9933.tmp 41 PID 2924 wrote to memory of 884 2924 99EF.tmp 42 PID 2924 wrote to memory of 884 2924 99EF.tmp 42 PID 2924 wrote to memory of 884 2924 99EF.tmp 42 PID 2924 wrote to memory of 884 2924 99EF.tmp 42 PID 884 wrote to memory of 1200 884 9A8B.tmp 43 PID 884 wrote to memory of 1200 884 9A8B.tmp 43 PID 884 wrote to memory of 1200 884 9A8B.tmp 43 PID 884 wrote to memory of 1200 884 9A8B.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-26_97af8e395671051025e5729c0df8c515_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-26_97af8e395671051025e5729c0df8c515_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\90DA.tmp"C:\Users\Admin\AppData\Local\Temp\90DA.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\9195.tmp"C:\Users\Admin\AppData\Local\Temp\9195.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\9260.tmp"C:\Users\Admin\AppData\Local\Temp\9260.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\931B.tmp"C:\Users\Admin\AppData\Local\Temp\931B.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\93B7.tmp"C:\Users\Admin\AppData\Local\Temp\93B7.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\9473.tmp"C:\Users\Admin\AppData\Local\Temp\9473.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\950F.tmp"C:\Users\Admin\AppData\Local\Temp\950F.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\95F9.tmp"C:\Users\Admin\AppData\Local\Temp\95F9.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\96C3.tmp"C:\Users\Admin\AppData\Local\Temp\96C3.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\9740.tmp"C:\Users\Admin\AppData\Local\Temp\9740.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\97AD.tmp"C:\Users\Admin\AppData\Local\Temp\97AD.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\98A7.tmp"C:\Users\Admin\AppData\Local\Temp\98A7.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\9933.tmp"C:\Users\Admin\AppData\Local\Temp\9933.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\99EF.tmp"C:\Users\Admin\AppData\Local\Temp\99EF.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\9A8B.tmp"C:\Users\Admin\AppData\Local\Temp\9A8B.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Users\Admin\AppData\Local\Temp\9BA3.tmp"C:\Users\Admin\AppData\Local\Temp\9BA3.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\9C11.tmp"C:\Users\Admin\AppData\Local\Temp\9C11.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\9C9D.tmp"C:\Users\Admin\AppData\Local\Temp\9C9D.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\9D49.tmp"C:\Users\Admin\AppData\Local\Temp\9D49.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\9DC5.tmp"C:\Users\Admin\AppData\Local\Temp\9DC5.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\9F0D.tmp"C:\Users\Admin\AppData\Local\Temp\9F0D.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\9FB9.tmp"C:\Users\Admin\AppData\Local\Temp\9FB9.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\A016.tmp"C:\Users\Admin\AppData\Local\Temp\A016.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:956 -
C:\Users\Admin\AppData\Local\Temp\A093.tmp"C:\Users\Admin\AppData\Local\Temp\A093.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\A0F1.tmp"C:\Users\Admin\AppData\Local\Temp\A0F1.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\A14E.tmp"C:\Users\Admin\AppData\Local\Temp\A14E.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\A1BB.tmp"C:\Users\Admin\AppData\Local\Temp\A1BB.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\A332.tmp"C:\Users\Admin\AppData\Local\Temp\A332.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\A3BE.tmp"C:\Users\Admin\AppData\Local\Temp\A3BE.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\A41C.tmp"C:\Users\Admin\AppData\Local\Temp\A41C.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\A489.tmp"C:\Users\Admin\AppData\Local\Temp\A489.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\A4F6.tmp"C:\Users\Admin\AppData\Local\Temp\A4F6.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\A554.tmp"C:\Users\Admin\AppData\Local\Temp\A554.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\A5D1.tmp"C:\Users\Admin\AppData\Local\Temp\A5D1.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\A62E.tmp"C:\Users\Admin\AppData\Local\Temp\A62E.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\A709.tmp"C:\Users\Admin\AppData\Local\Temp\A709.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\A785.tmp"C:\Users\Admin\AppData\Local\Temp\A785.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\A7F3.tmp"C:\Users\Admin\AppData\Local\Temp\A7F3.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\A860.tmp"C:\Users\Admin\AppData\Local\Temp\A860.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\A8FC.tmp"C:\Users\Admin\AppData\Local\Temp\A8FC.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\A959.tmp"C:\Users\Admin\AppData\Local\Temp\A959.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\A9D6.tmp"C:\Users\Admin\AppData\Local\Temp\A9D6.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\AA53.tmp"C:\Users\Admin\AppData\Local\Temp\AA53.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\AAD0.tmp"C:\Users\Admin\AppData\Local\Temp\AAD0.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\AB4D.tmp"C:\Users\Admin\AppData\Local\Temp\AB4D.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\ABBA.tmp"C:\Users\Admin\AppData\Local\Temp\ABBA.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\AC27.tmp"C:\Users\Admin\AppData\Local\Temp\AC27.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:392 -
C:\Users\Admin\AppData\Local\Temp\ACB3.tmp"C:\Users\Admin\AppData\Local\Temp\ACB3.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\AD30.tmp"C:\Users\Admin\AppData\Local\Temp\AD30.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\ADEB.tmp"C:\Users\Admin\AppData\Local\Temp\ADEB.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\AE87.tmp"C:\Users\Admin\AppData\Local\Temp\AE87.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:880 -
C:\Users\Admin\AppData\Local\Temp\AF04.tmp"C:\Users\Admin\AppData\Local\Temp\AF04.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:896 -
C:\Users\Admin\AppData\Local\Temp\AF71.tmp"C:\Users\Admin\AppData\Local\Temp\AF71.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\AFEE.tmp"C:\Users\Admin\AppData\Local\Temp\AFEE.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:872 -
C:\Users\Admin\AppData\Local\Temp\B07B.tmp"C:\Users\Admin\AppData\Local\Temp\B07B.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\B126.tmp"C:\Users\Admin\AppData\Local\Temp\B126.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\B184.tmp"C:\Users\Admin\AppData\Local\Temp\B184.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\B201.tmp"C:\Users\Admin\AppData\Local\Temp\B201.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\B27D.tmp"C:\Users\Admin\AppData\Local\Temp\B27D.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\B30A.tmp"C:\Users\Admin\AppData\Local\Temp\B30A.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\B387.tmp"C:\Users\Admin\AppData\Local\Temp\B387.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\B3E4.tmp"C:\Users\Admin\AppData\Local\Temp\B3E4.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\B471.tmp"C:\Users\Admin\AppData\Local\Temp\B471.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\B50D.tmp"C:\Users\Admin\AppData\Local\Temp\B50D.tmp"65⤵
- Executes dropped EXE
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\B599.tmp"C:\Users\Admin\AppData\Local\Temp\B599.tmp"66⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\B625.tmp"C:\Users\Admin\AppData\Local\Temp\B625.tmp"67⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\B693.tmp"C:\Users\Admin\AppData\Local\Temp\B693.tmp"68⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\B71F.tmp"C:\Users\Admin\AppData\Local\Temp\B71F.tmp"69⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\B828.tmp"C:\Users\Admin\AppData\Local\Temp\B828.tmp"70⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\B912.tmp"C:\Users\Admin\AppData\Local\Temp\B912.tmp"71⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\B9AE.tmp"C:\Users\Admin\AppData\Local\Temp\B9AE.tmp"72⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\BA0C.tmp"C:\Users\Admin\AppData\Local\Temp\BA0C.tmp"73⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\BA89.tmp"C:\Users\Admin\AppData\Local\Temp\BA89.tmp"74⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\BB05.tmp"C:\Users\Admin\AppData\Local\Temp\BB05.tmp"75⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\BB73.tmp"C:\Users\Admin\AppData\Local\Temp\BB73.tmp"76⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\BBC1.tmp"C:\Users\Admin\AppData\Local\Temp\BBC1.tmp"77⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\BC3D.tmp"C:\Users\Admin\AppData\Local\Temp\BC3D.tmp"78⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\BCCA.tmp"C:\Users\Admin\AppData\Local\Temp\BCCA.tmp"79⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\BD37.tmp"C:\Users\Admin\AppData\Local\Temp\BD37.tmp"80⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\BDA4.tmp"C:\Users\Admin\AppData\Local\Temp\BDA4.tmp"81⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\BE31.tmp"C:\Users\Admin\AppData\Local\Temp\BE31.tmp"82⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\BECD.tmp"C:\Users\Admin\AppData\Local\Temp\BECD.tmp"83⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\BF49.tmp"C:\Users\Admin\AppData\Local\Temp\BF49.tmp"84⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"85⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\C043.tmp"C:\Users\Admin\AppData\Local\Temp\C043.tmp"86⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"87⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\C11D.tmp"C:\Users\Admin\AppData\Local\Temp\C11D.tmp"88⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\C18B.tmp"C:\Users\Admin\AppData\Local\Temp\C18B.tmp"89⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\C207.tmp"C:\Users\Admin\AppData\Local\Temp\C207.tmp"90⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\C284.tmp"C:\Users\Admin\AppData\Local\Temp\C284.tmp"91⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\C311.tmp"C:\Users\Admin\AppData\Local\Temp\C311.tmp"92⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\C38D.tmp"C:\Users\Admin\AppData\Local\Temp\C38D.tmp"93⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\C3EB.tmp"C:\Users\Admin\AppData\Local\Temp\C3EB.tmp"94⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\C458.tmp"C:\Users\Admin\AppData\Local\Temp\C458.tmp"95⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\C4F4.tmp"C:\Users\Admin\AppData\Local\Temp\C4F4.tmp"96⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\C5A0.tmp"C:\Users\Admin\AppData\Local\Temp\C5A0.tmp"97⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\C5FD.tmp"C:\Users\Admin\AppData\Local\Temp\C5FD.tmp"98⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\C67A.tmp"C:\Users\Admin\AppData\Local\Temp\C67A.tmp"99⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\C6E7.tmp"C:\Users\Admin\AppData\Local\Temp\C6E7.tmp"100⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\C764.tmp"C:\Users\Admin\AppData\Local\Temp\C764.tmp"101⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\C7E1.tmp"C:\Users\Admin\AppData\Local\Temp\C7E1.tmp"102⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\C84E.tmp"C:\Users\Admin\AppData\Local\Temp\C84E.tmp"103⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\C8BB.tmp"C:\Users\Admin\AppData\Local\Temp\C8BB.tmp"104⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\C929.tmp"C:\Users\Admin\AppData\Local\Temp\C929.tmp"105⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\C996.tmp"C:\Users\Admin\AppData\Local\Temp\C996.tmp"106⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\CA03.tmp"C:\Users\Admin\AppData\Local\Temp\CA03.tmp"107⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\CA80.tmp"C:\Users\Admin\AppData\Local\Temp\CA80.tmp"108⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\CAED.tmp"C:\Users\Admin\AppData\Local\Temp\CAED.tmp"109⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\CB6A.tmp"C:\Users\Admin\AppData\Local\Temp\CB6A.tmp"110⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\CBC7.tmp"C:\Users\Admin\AppData\Local\Temp\CBC7.tmp"111⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\CC25.tmp"C:\Users\Admin\AppData\Local\Temp\CC25.tmp"112⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\CE28.tmp"C:\Users\Admin\AppData\Local\Temp\CE28.tmp"113⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\CE95.tmp"C:\Users\Admin\AppData\Local\Temp\CE95.tmp"114⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\CF21.tmp"C:\Users\Admin\AppData\Local\Temp\CF21.tmp"115⤵PID:664
-
C:\Users\Admin\AppData\Local\Temp\CF9E.tmp"C:\Users\Admin\AppData\Local\Temp\CF9E.tmp"116⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\CFFC.tmp"C:\Users\Admin\AppData\Local\Temp\CFFC.tmp"117⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\D079.tmp"C:\Users\Admin\AppData\Local\Temp\D079.tmp"118⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\D0F5.tmp"C:\Users\Admin\AppData\Local\Temp\D0F5.tmp"119⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\D163.tmp"C:\Users\Admin\AppData\Local\Temp\D163.tmp"120⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\D1DF.tmp"C:\Users\Admin\AppData\Local\Temp\D1DF.tmp"121⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\D25C.tmp"C:\Users\Admin\AppData\Local\Temp\D25C.tmp"122⤵PID:1540
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-