Analysis
-
max time kernel
56s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
29-04-2024 16:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-29_ff9a8338cd631ef25bc859be037836d5_mafia.exe
Resource
win7-20240215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-29_ff9a8338cd631ef25bc859be037836d5_mafia.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-04-29_ff9a8338cd631ef25bc859be037836d5_mafia.exe
-
Size
536KB
-
MD5
ff9a8338cd631ef25bc859be037836d5
-
SHA1
3d2e620d9ae9c4adea46b1a8a5c78becc821eb09
-
SHA256
6efb2d5a4bdbed4708233656d3560f4775807a13e3dde08cef78ea2257cf87f6
-
SHA512
5e8ba192a812394b2444375fb51d00e39da25f1f4bf817f572daf5af9eeedd804726b27b65a4c3875cad0f23af5ffa4c01eed6705db7603d42846d1dffff333e
-
SSDEEP
12288:wU5rCOTeiUDr7lsEKBfRSnONoVPIZxVJ0ZT9:wUQOJUDr7OEK332PIRJ0ZT9
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3044 1555.tmp 1708 15E1.tmp 2176 164E.tmp 2664 169C.tmp 2576 1748.tmp 2408 17D4.tmp 2808 1861.tmp 2564 18AF.tmp 2516 191C.tmp 2496 1999.tmp 2796 1A16.tmp 2988 1A54.tmp 2952 1AD1.tmp 1432 1B4E.tmp 1668 1BCA.tmp 800 1C28.tmp 2772 1C76.tmp 2984 1CD4.tmp 2072 1D41.tmp 2036 1D8F.tmp 2888 1E0C.tmp 1236 1E5A.tmp 1064 1ED6.tmp 1484 1F24.tmp 564 1F72.tmp 1868 1FB1.tmp 2512 1FEF.tmp 1136 202E.tmp 2084 209B.tmp 1540 20E9.tmp 960 2137.tmp 612 2185.tmp 1048 21D3.tmp 912 2211.tmp 1308 2250.tmp 2388 22AD.tmp 2384 22EC.tmp 1340 233A.tmp 2280 2388.tmp 1576 23C6.tmp 384 2424.tmp 1856 2462.tmp 2852 24B0.tmp 2012 24EE.tmp 2656 251D.tmp 2676 256B.tmp 2664 25AA.tmp 2720 25E8.tmp 2704 2626.tmp 2480 2665.tmp 2492 26A3.tmp 2504 26E2.tmp 2484 2730.tmp 1764 276E.tmp 2208 27AC.tmp 2812 27FA.tmp 2920 2848.tmp 2996 2896.tmp 2428 28D5.tmp 2520 2904.tmp 1988 2942.tmp 1668 2980.tmp 2700 29BF.tmp 1028 2A0D.tmp -
Loads dropped DLL 64 IoCs
pid Process 2416 2024-04-29_ff9a8338cd631ef25bc859be037836d5_mafia.exe 3044 1555.tmp 1708 15E1.tmp 2176 164E.tmp 2664 169C.tmp 2576 1748.tmp 2408 17D4.tmp 2808 1861.tmp 2564 18AF.tmp 2516 191C.tmp 2496 1999.tmp 2796 1A16.tmp 2988 1A54.tmp 2952 1AD1.tmp 1432 1B4E.tmp 1668 1BCA.tmp 800 1C28.tmp 2772 1C76.tmp 2984 1CD4.tmp 2072 1D41.tmp 2036 1D8F.tmp 2888 1E0C.tmp 1236 1E5A.tmp 1064 1ED6.tmp 1484 1F24.tmp 564 1F72.tmp 1868 1FB1.tmp 2512 1FEF.tmp 1136 202E.tmp 2084 209B.tmp 1540 20E9.tmp 960 2137.tmp 612 2185.tmp 1048 21D3.tmp 912 2211.tmp 1308 2250.tmp 2388 22AD.tmp 2384 22EC.tmp 1340 233A.tmp 2280 2388.tmp 1576 23C6.tmp 384 2424.tmp 1856 2462.tmp 2852 24B0.tmp 2012 24EE.tmp 2656 251D.tmp 2676 256B.tmp 2664 25AA.tmp 2720 25E8.tmp 2704 2626.tmp 2480 2665.tmp 2492 26A3.tmp 2504 26E2.tmp 2484 2730.tmp 1764 276E.tmp 2208 27AC.tmp 2812 27FA.tmp 2920 2848.tmp 2996 2896.tmp 2428 28D5.tmp 2520 2904.tmp 1988 2942.tmp 1668 2980.tmp 2700 29BF.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2416 wrote to memory of 3044 2416 2024-04-29_ff9a8338cd631ef25bc859be037836d5_mafia.exe 28 PID 2416 wrote to memory of 3044 2416 2024-04-29_ff9a8338cd631ef25bc859be037836d5_mafia.exe 28 PID 2416 wrote to memory of 3044 2416 2024-04-29_ff9a8338cd631ef25bc859be037836d5_mafia.exe 28 PID 2416 wrote to memory of 3044 2416 2024-04-29_ff9a8338cd631ef25bc859be037836d5_mafia.exe 28 PID 3044 wrote to memory of 1708 3044 1555.tmp 29 PID 3044 wrote to memory of 1708 3044 1555.tmp 29 PID 3044 wrote to memory of 1708 3044 1555.tmp 29 PID 3044 wrote to memory of 1708 3044 1555.tmp 29 PID 1708 wrote to memory of 2176 1708 15E1.tmp 30 PID 1708 wrote to memory of 2176 1708 15E1.tmp 30 PID 1708 wrote to memory of 2176 1708 15E1.tmp 30 PID 1708 wrote to memory of 2176 1708 15E1.tmp 30 PID 2176 wrote to memory of 2664 2176 164E.tmp 31 PID 2176 wrote to memory of 2664 2176 164E.tmp 31 PID 2176 wrote to memory of 2664 2176 164E.tmp 31 PID 2176 wrote to memory of 2664 2176 164E.tmp 31 PID 2664 wrote to memory of 2576 2664 169C.tmp 32 PID 2664 wrote to memory of 2576 2664 169C.tmp 32 PID 2664 wrote to memory of 2576 2664 169C.tmp 32 PID 2664 wrote to memory of 2576 2664 169C.tmp 32 PID 2576 wrote to memory of 2408 2576 1748.tmp 33 PID 2576 wrote to memory of 2408 2576 1748.tmp 33 PID 2576 wrote to memory of 2408 2576 1748.tmp 33 PID 2576 wrote to memory of 2408 2576 1748.tmp 33 PID 2408 wrote to memory of 2808 2408 17D4.tmp 34 PID 2408 wrote to memory of 2808 2408 17D4.tmp 34 PID 2408 wrote to memory of 2808 2408 17D4.tmp 34 PID 2408 wrote to memory of 2808 2408 17D4.tmp 34 PID 2808 wrote to memory of 2564 2808 1861.tmp 35 PID 2808 wrote to memory of 2564 2808 1861.tmp 35 PID 2808 wrote to memory of 2564 2808 1861.tmp 35 PID 2808 wrote to memory of 2564 2808 1861.tmp 35 PID 2564 wrote to memory of 2516 2564 18AF.tmp 36 PID 2564 wrote to memory of 2516 2564 18AF.tmp 36 PID 2564 wrote to memory of 2516 2564 18AF.tmp 36 PID 2564 wrote to memory of 2516 2564 18AF.tmp 36 PID 2516 wrote to memory of 2496 2516 191C.tmp 37 PID 2516 wrote to memory of 2496 2516 191C.tmp 37 PID 2516 wrote to memory of 2496 2516 191C.tmp 37 PID 2516 wrote to memory of 2496 2516 191C.tmp 37 PID 2496 wrote to memory of 2796 2496 1999.tmp 38 PID 2496 wrote to memory of 2796 2496 1999.tmp 38 PID 2496 wrote to memory of 2796 2496 1999.tmp 38 PID 2496 wrote to memory of 2796 2496 1999.tmp 38 PID 2796 wrote to memory of 2988 2796 1A16.tmp 39 PID 2796 wrote to memory of 2988 2796 1A16.tmp 39 PID 2796 wrote to memory of 2988 2796 1A16.tmp 39 PID 2796 wrote to memory of 2988 2796 1A16.tmp 39 PID 2988 wrote to memory of 2952 2988 1A54.tmp 40 PID 2988 wrote to memory of 2952 2988 1A54.tmp 40 PID 2988 wrote to memory of 2952 2988 1A54.tmp 40 PID 2988 wrote to memory of 2952 2988 1A54.tmp 40 PID 2952 wrote to memory of 1432 2952 1AD1.tmp 41 PID 2952 wrote to memory of 1432 2952 1AD1.tmp 41 PID 2952 wrote to memory of 1432 2952 1AD1.tmp 41 PID 2952 wrote to memory of 1432 2952 1AD1.tmp 41 PID 1432 wrote to memory of 1668 1432 1B4E.tmp 42 PID 1432 wrote to memory of 1668 1432 1B4E.tmp 42 PID 1432 wrote to memory of 1668 1432 1B4E.tmp 42 PID 1432 wrote to memory of 1668 1432 1B4E.tmp 42 PID 1668 wrote to memory of 800 1668 1BCA.tmp 43 PID 1668 wrote to memory of 800 1668 1BCA.tmp 43 PID 1668 wrote to memory of 800 1668 1BCA.tmp 43 PID 1668 wrote to memory of 800 1668 1BCA.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-29_ff9a8338cd631ef25bc859be037836d5_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-29_ff9a8338cd631ef25bc859be037836d5_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\1555.tmp"C:\Users\Admin\AppData\Local\Temp\1555.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\15E1.tmp"C:\Users\Admin\AppData\Local\Temp\15E1.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\164E.tmp"C:\Users\Admin\AppData\Local\Temp\164E.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\169C.tmp"C:\Users\Admin\AppData\Local\Temp\169C.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\1748.tmp"C:\Users\Admin\AppData\Local\Temp\1748.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\17D4.tmp"C:\Users\Admin\AppData\Local\Temp\17D4.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\1861.tmp"C:\Users\Admin\AppData\Local\Temp\1861.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\18AF.tmp"C:\Users\Admin\AppData\Local\Temp\18AF.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\191C.tmp"C:\Users\Admin\AppData\Local\Temp\191C.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\1999.tmp"C:\Users\Admin\AppData\Local\Temp\1999.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\1A16.tmp"C:\Users\Admin\AppData\Local\Temp\1A16.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\1A54.tmp"C:\Users\Admin\AppData\Local\Temp\1A54.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\1C28.tmp"C:\Users\Admin\AppData\Local\Temp\1C28.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:800 -
C:\Users\Admin\AppData\Local\Temp\1C76.tmp"C:\Users\Admin\AppData\Local\Temp\1C76.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\1CD4.tmp"C:\Users\Admin\AppData\Local\Temp\1CD4.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\1D41.tmp"C:\Users\Admin\AppData\Local\Temp\1D41.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\1D8F.tmp"C:\Users\Admin\AppData\Local\Temp\1D8F.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\1F24.tmp"C:\Users\Admin\AppData\Local\Temp\1F24.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\1F72.tmp"C:\Users\Admin\AppData\Local\Temp\1F72.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:564 -
C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\202E.tmp"C:\Users\Admin\AppData\Local\Temp\202E.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\209B.tmp"C:\Users\Admin\AppData\Local\Temp\209B.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\20E9.tmp"C:\Users\Admin\AppData\Local\Temp\20E9.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\2137.tmp"C:\Users\Admin\AppData\Local\Temp\2137.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:960 -
C:\Users\Admin\AppData\Local\Temp\2185.tmp"C:\Users\Admin\AppData\Local\Temp\2185.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:612 -
C:\Users\Admin\AppData\Local\Temp\21D3.tmp"C:\Users\Admin\AppData\Local\Temp\21D3.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\2211.tmp"C:\Users\Admin\AppData\Local\Temp\2211.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:912 -
C:\Users\Admin\AppData\Local\Temp\2250.tmp"C:\Users\Admin\AppData\Local\Temp\2250.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\22AD.tmp"C:\Users\Admin\AppData\Local\Temp\22AD.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\22EC.tmp"C:\Users\Admin\AppData\Local\Temp\22EC.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\233A.tmp"C:\Users\Admin\AppData\Local\Temp\233A.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\2388.tmp"C:\Users\Admin\AppData\Local\Temp\2388.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\23C6.tmp"C:\Users\Admin\AppData\Local\Temp\23C6.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\2424.tmp"C:\Users\Admin\AppData\Local\Temp\2424.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:384 -
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\24B0.tmp"C:\Users\Admin\AppData\Local\Temp\24B0.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\24EE.tmp"C:\Users\Admin\AppData\Local\Temp\24EE.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\251D.tmp"C:\Users\Admin\AppData\Local\Temp\251D.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\256B.tmp"C:\Users\Admin\AppData\Local\Temp\256B.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\25AA.tmp"C:\Users\Admin\AppData\Local\Temp\25AA.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\25E8.tmp"C:\Users\Admin\AppData\Local\Temp\25E8.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\2626.tmp"C:\Users\Admin\AppData\Local\Temp\2626.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\2665.tmp"C:\Users\Admin\AppData\Local\Temp\2665.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\26A3.tmp"C:\Users\Admin\AppData\Local\Temp\26A3.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\26E2.tmp"C:\Users\Admin\AppData\Local\Temp\26E2.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\2730.tmp"C:\Users\Admin\AppData\Local\Temp\2730.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\276E.tmp"C:\Users\Admin\AppData\Local\Temp\276E.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\27AC.tmp"C:\Users\Admin\AppData\Local\Temp\27AC.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\27FA.tmp"C:\Users\Admin\AppData\Local\Temp\27FA.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\2848.tmp"C:\Users\Admin\AppData\Local\Temp\2848.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\2896.tmp"C:\Users\Admin\AppData\Local\Temp\2896.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\28D5.tmp"C:\Users\Admin\AppData\Local\Temp\28D5.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\2904.tmp"C:\Users\Admin\AppData\Local\Temp\2904.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\2942.tmp"C:\Users\Admin\AppData\Local\Temp\2942.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\2980.tmp"C:\Users\Admin\AppData\Local\Temp\2980.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\29BF.tmp"C:\Users\Admin\AppData\Local\Temp\29BF.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"65⤵
- Executes dropped EXE
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"66⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\2A99.tmp"C:\Users\Admin\AppData\Local\Temp\2A99.tmp"67⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"68⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\2B16.tmp"C:\Users\Admin\AppData\Local\Temp\2B16.tmp"69⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\2B54.tmp"C:\Users\Admin\AppData\Local\Temp\2B54.tmp"70⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\2B93.tmp"C:\Users\Admin\AppData\Local\Temp\2B93.tmp"71⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"72⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\2C10.tmp"C:\Users\Admin\AppData\Local\Temp\2C10.tmp"73⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"74⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\2C9C.tmp"C:\Users\Admin\AppData\Local\Temp\2C9C.tmp"75⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"76⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\2D28.tmp"C:\Users\Admin\AppData\Local\Temp\2D28.tmp"77⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\2D67.tmp"C:\Users\Admin\AppData\Local\Temp\2D67.tmp"78⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"79⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"80⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\2E22.tmp"C:\Users\Admin\AppData\Local\Temp\2E22.tmp"81⤵PID:360
-
C:\Users\Admin\AppData\Local\Temp\2E60.tmp"C:\Users\Admin\AppData\Local\Temp\2E60.tmp"82⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\2E9F.tmp"C:\Users\Admin\AppData\Local\Temp\2E9F.tmp"83⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\2EDD.tmp"C:\Users\Admin\AppData\Local\Temp\2EDD.tmp"84⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\2F1C.tmp"C:\Users\Admin\AppData\Local\Temp\2F1C.tmp"85⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\2F5A.tmp"C:\Users\Admin\AppData\Local\Temp\2F5A.tmp"86⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\2F98.tmp"C:\Users\Admin\AppData\Local\Temp\2F98.tmp"87⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\2FD7.tmp"C:\Users\Admin\AppData\Local\Temp\2FD7.tmp"88⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\3015.tmp"C:\Users\Admin\AppData\Local\Temp\3015.tmp"89⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\3054.tmp"C:\Users\Admin\AppData\Local\Temp\3054.tmp"90⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\3092.tmp"C:\Users\Admin\AppData\Local\Temp\3092.tmp"91⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\30D0.tmp"C:\Users\Admin\AppData\Local\Temp\30D0.tmp"92⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\310F.tmp"C:\Users\Admin\AppData\Local\Temp\310F.tmp"93⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\314D.tmp"C:\Users\Admin\AppData\Local\Temp\314D.tmp"94⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\318C.tmp"C:\Users\Admin\AppData\Local\Temp\318C.tmp"95⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\31CA.tmp"C:\Users\Admin\AppData\Local\Temp\31CA.tmp"96⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\3208.tmp"C:\Users\Admin\AppData\Local\Temp\3208.tmp"97⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\3247.tmp"C:\Users\Admin\AppData\Local\Temp\3247.tmp"98⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\3285.tmp"C:\Users\Admin\AppData\Local\Temp\3285.tmp"99⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\32C4.tmp"C:\Users\Admin\AppData\Local\Temp\32C4.tmp"100⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\3302.tmp"C:\Users\Admin\AppData\Local\Temp\3302.tmp"101⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\3340.tmp"C:\Users\Admin\AppData\Local\Temp\3340.tmp"102⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\338E.tmp"C:\Users\Admin\AppData\Local\Temp\338E.tmp"103⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\33CD.tmp"C:\Users\Admin\AppData\Local\Temp\33CD.tmp"104⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\341B.tmp"C:\Users\Admin\AppData\Local\Temp\341B.tmp"105⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\3459.tmp"C:\Users\Admin\AppData\Local\Temp\3459.tmp"106⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\3498.tmp"C:\Users\Admin\AppData\Local\Temp\3498.tmp"107⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\34D6.tmp"C:\Users\Admin\AppData\Local\Temp\34D6.tmp"108⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\3514.tmp"C:\Users\Admin\AppData\Local\Temp\3514.tmp"109⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\3553.tmp"C:\Users\Admin\AppData\Local\Temp\3553.tmp"110⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\3591.tmp"C:\Users\Admin\AppData\Local\Temp\3591.tmp"111⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\35D0.tmp"C:\Users\Admin\AppData\Local\Temp\35D0.tmp"112⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\360E.tmp"C:\Users\Admin\AppData\Local\Temp\360E.tmp"113⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\364C.tmp"C:\Users\Admin\AppData\Local\Temp\364C.tmp"114⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\368B.tmp"C:\Users\Admin\AppData\Local\Temp\368B.tmp"115⤵PID:240
-
C:\Users\Admin\AppData\Local\Temp\36C9.tmp"C:\Users\Admin\AppData\Local\Temp\36C9.tmp"116⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\3708.tmp"C:\Users\Admin\AppData\Local\Temp\3708.tmp"117⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\3746.tmp"C:\Users\Admin\AppData\Local\Temp\3746.tmp"118⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\3784.tmp"C:\Users\Admin\AppData\Local\Temp\3784.tmp"119⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\37C3.tmp"C:\Users\Admin\AppData\Local\Temp\37C3.tmp"120⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\37F2.tmp"C:\Users\Admin\AppData\Local\Temp\37F2.tmp"121⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\3830.tmp"C:\Users\Admin\AppData\Local\Temp\3830.tmp"122⤵PID:2700
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-