Analysis
-
max time kernel
43s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 16:24
Static task
static1
Behavioral task
behavioral1
Sample
5a51e1e48cf514de495c13d1af463bc2_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
5a51e1e48cf514de495c13d1af463bc2_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
5a51e1e48cf514de495c13d1af463bc2_JaffaCakes118.exe
-
Size
840KB
-
MD5
5a51e1e48cf514de495c13d1af463bc2
-
SHA1
d7b288ecebebe4467bef48da25db6ba4fc424a89
-
SHA256
ec35c0f70e43316469957b8829e748bf1541bb1eff27f931e0f6df1310993030
-
SHA512
d803cf5f128d3e1879b99c567ec122b663daea8acc8a693e130e006f66e5eecfbe8c4b93117a6b7d8e15eeb1ec8e916c0b68b26ef77f02b167fd62d0224867c6
-
SSDEEP
12288:Y4YIo+/zfgajmG/4rzaM6SbjhlDdFbzZ4StxEF63U1wcJ5w:Y17YzgbGxSbjDd75txU6Z
Malware Config
Extracted
warzonerat
savagesquad.ooguy.com:5437
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 7 IoCs
resource yara_rule behavioral1/memory/2464-113-0x0000000000080000-0x000000000009D000-memory.dmp warzonerat behavioral1/memory/2464-118-0x0000000000080000-0x000000000009D000-memory.dmp warzonerat behavioral1/memory/2464-108-0x0000000000080000-0x000000000009D000-memory.dmp warzonerat behavioral1/memory/2464-104-0x0000000000080000-0x000000000009D000-memory.dmp warzonerat behavioral1/memory/2464-102-0x0000000000080000-0x000000000009D000-memory.dmp warzonerat behavioral1/memory/2464-100-0x0000000000080000-0x000000000009D000-memory.dmp warzonerat behavioral1/memory/2464-98-0x0000000000080000-0x000000000009D000-memory.dmp warzonerat -
Executes dropped EXE 64 IoCs
pid Process 2968 FGUI.EXE 2600 XXZZ.EXE 2720 XXZZ.EXE 2988 XXZZ.EXE 2644 XXZZ.EXE 2564 XXZZ.EXE 2404 XXZZ.EXE 2472 XXZZ.EXE 2944 XXZZ.EXE 2128 XXZZ.EXE 2468 XXZZ.EXE 2648 XXZZ.EXE 2668 XXZZ.EXE 2748 XXZZ.EXE 1568 XXZZ.EXE 404 XXZZ.EXE 1900 XXZZ.EXE 1496 XXZZ.EXE 272 XXZZ.EXE 1832 XXZZ.EXE 2376 XXZZ.EXE 112 XXZZ.EXE 856 XXZZ.EXE 1648 XXZZ.EXE 2068 XXZZ.EXE 1628 XXZZ.EXE 2236 XXZZ.EXE 2888 XXZZ.EXE 1956 XXZZ.EXE 772 XXZZ.EXE 292 XXZZ.EXE 960 XXZZ.EXE 560 XXZZ.EXE 2796 XXZZ.EXE 872 XXZZ.EXE 632 XXZZ.EXE 2976 XXZZ.EXE 2020 XXZZ.EXE 452 XXZZ.EXE 3064 XXZZ.EXE 3012 XXZZ.EXE 1712 XXZZ.EXE 1488 XXZZ.EXE 1928 XXZZ.EXE 1556 XXZZ.EXE 1704 XXZZ.EXE 1580 XXZZ.EXE 904 XXZZ.EXE 768 XXZZ.EXE 700 XXZZ.EXE 1976 XXZZ.EXE 2180 XXZZ.EXE 1084 XXZZ.EXE 2264 XXZZ.EXE 1724 XXZZ.EXE 2104 XXZZ.EXE 1492 XXZZ.EXE 2284 XXZZ.EXE 1668 XXZZ.EXE 1548 XXZZ.EXE 1536 XXZZ.EXE 2596 XXZZ.EXE 2540 XXZZ.EXE 2732 XXZZ.EXE -
Loads dropped DLL 64 IoCs
pid Process 2732 5a51e1e48cf514de495c13d1af463bc2_JaffaCakes118.exe 2732 5a51e1e48cf514de495c13d1af463bc2_JaffaCakes118.exe 2732 5a51e1e48cf514de495c13d1af463bc2_JaffaCakes118.exe 2600 XXZZ.EXE 2720 XXZZ.EXE 2988 XXZZ.EXE 2644 XXZZ.EXE 2564 XXZZ.EXE 2404 XXZZ.EXE 2472 XXZZ.EXE 2944 XXZZ.EXE 2128 XXZZ.EXE 2468 XXZZ.EXE 2648 XXZZ.EXE 2668 XXZZ.EXE 2748 XXZZ.EXE 1568 XXZZ.EXE 404 XXZZ.EXE 1900 XXZZ.EXE 1496 XXZZ.EXE 272 XXZZ.EXE 1832 XXZZ.EXE 2376 XXZZ.EXE 112 XXZZ.EXE 856 XXZZ.EXE 1648 XXZZ.EXE 2068 XXZZ.EXE 1628 XXZZ.EXE 2236 XXZZ.EXE 2888 XXZZ.EXE 1956 XXZZ.EXE 772 XXZZ.EXE 292 XXZZ.EXE 960 XXZZ.EXE 560 XXZZ.EXE 2796 XXZZ.EXE 872 XXZZ.EXE 632 XXZZ.EXE 2976 XXZZ.EXE 2020 XXZZ.EXE 452 XXZZ.EXE 3064 XXZZ.EXE 3012 XXZZ.EXE 1712 XXZZ.EXE 1488 XXZZ.EXE 1928 XXZZ.EXE 1556 XXZZ.EXE 1704 XXZZ.EXE 1580 XXZZ.EXE 904 XXZZ.EXE 768 XXZZ.EXE 700 XXZZ.EXE 1976 XXZZ.EXE 2180 XXZZ.EXE 1084 XXZZ.EXE 2264 XXZZ.EXE 1724 XXZZ.EXE 2104 XXZZ.EXE 1492 XXZZ.EXE 2284 XXZZ.EXE 1668 XXZZ.EXE 1548 XXZZ.EXE 1536 XXZZ.EXE 2596 XXZZ.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2448 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2732 wrote to memory of 2968 2732 5a51e1e48cf514de495c13d1af463bc2_JaffaCakes118.exe 28 PID 2732 wrote to memory of 2968 2732 5a51e1e48cf514de495c13d1af463bc2_JaffaCakes118.exe 28 PID 2732 wrote to memory of 2968 2732 5a51e1e48cf514de495c13d1af463bc2_JaffaCakes118.exe 28 PID 2732 wrote to memory of 2968 2732 5a51e1e48cf514de495c13d1af463bc2_JaffaCakes118.exe 28 PID 2732 wrote to memory of 2600 2732 5a51e1e48cf514de495c13d1af463bc2_JaffaCakes118.exe 29 PID 2732 wrote to memory of 2600 2732 5a51e1e48cf514de495c13d1af463bc2_JaffaCakes118.exe 29 PID 2732 wrote to memory of 2600 2732 5a51e1e48cf514de495c13d1af463bc2_JaffaCakes118.exe 29 PID 2732 wrote to memory of 2600 2732 5a51e1e48cf514de495c13d1af463bc2_JaffaCakes118.exe 29 PID 2600 wrote to memory of 2720 2600 XXZZ.EXE 30 PID 2600 wrote to memory of 2720 2600 XXZZ.EXE 30 PID 2600 wrote to memory of 2720 2600 XXZZ.EXE 30 PID 2600 wrote to memory of 2720 2600 XXZZ.EXE 30 PID 2720 wrote to memory of 2988 2720 XXZZ.EXE 31 PID 2720 wrote to memory of 2988 2720 XXZZ.EXE 31 PID 2720 wrote to memory of 2988 2720 XXZZ.EXE 31 PID 2720 wrote to memory of 2988 2720 XXZZ.EXE 31 PID 2988 wrote to memory of 2644 2988 XXZZ.EXE 32 PID 2988 wrote to memory of 2644 2988 XXZZ.EXE 32 PID 2988 wrote to memory of 2644 2988 XXZZ.EXE 32 PID 2988 wrote to memory of 2644 2988 XXZZ.EXE 32 PID 2644 wrote to memory of 2564 2644 XXZZ.EXE 33 PID 2644 wrote to memory of 2564 2644 XXZZ.EXE 33 PID 2644 wrote to memory of 2564 2644 XXZZ.EXE 33 PID 2644 wrote to memory of 2564 2644 XXZZ.EXE 33 PID 2564 wrote to memory of 2404 2564 XXZZ.EXE 34 PID 2564 wrote to memory of 2404 2564 XXZZ.EXE 34 PID 2564 wrote to memory of 2404 2564 XXZZ.EXE 34 PID 2564 wrote to memory of 2404 2564 XXZZ.EXE 34 PID 2404 wrote to memory of 2472 2404 XXZZ.EXE 102 PID 2404 wrote to memory of 2472 2404 XXZZ.EXE 102 PID 2404 wrote to memory of 2472 2404 XXZZ.EXE 102 PID 2404 wrote to memory of 2472 2404 XXZZ.EXE 102 PID 2472 wrote to memory of 2944 2472 XXZZ.EXE 36 PID 2472 wrote to memory of 2944 2472 XXZZ.EXE 36 PID 2472 wrote to memory of 2944 2472 XXZZ.EXE 36 PID 2472 wrote to memory of 2944 2472 XXZZ.EXE 36 PID 2944 wrote to memory of 2128 2944 XXZZ.EXE 105 PID 2944 wrote to memory of 2128 2944 XXZZ.EXE 105 PID 2944 wrote to memory of 2128 2944 XXZZ.EXE 105 PID 2944 wrote to memory of 2128 2944 XXZZ.EXE 105 PID 2128 wrote to memory of 2468 2128 XXZZ.EXE 38 PID 2128 wrote to memory of 2468 2128 XXZZ.EXE 38 PID 2128 wrote to memory of 2468 2128 XXZZ.EXE 38 PID 2128 wrote to memory of 2468 2128 XXZZ.EXE 38 PID 2468 wrote to memory of 2648 2468 XXZZ.EXE 39 PID 2468 wrote to memory of 2648 2468 XXZZ.EXE 39 PID 2468 wrote to memory of 2648 2468 XXZZ.EXE 39 PID 2468 wrote to memory of 2648 2468 XXZZ.EXE 39 PID 2648 wrote to memory of 2668 2648 XXZZ.EXE 40 PID 2648 wrote to memory of 2668 2648 XXZZ.EXE 40 PID 2648 wrote to memory of 2668 2648 XXZZ.EXE 40 PID 2648 wrote to memory of 2668 2648 XXZZ.EXE 40 PID 2668 wrote to memory of 2748 2668 XXZZ.EXE 110 PID 2668 wrote to memory of 2748 2668 XXZZ.EXE 110 PID 2668 wrote to memory of 2748 2668 XXZZ.EXE 110 PID 2668 wrote to memory of 2748 2668 XXZZ.EXE 110 PID 2748 wrote to memory of 1568 2748 XXZZ.EXE 42 PID 2748 wrote to memory of 1568 2748 XXZZ.EXE 42 PID 2748 wrote to memory of 1568 2748 XXZZ.EXE 42 PID 2748 wrote to memory of 1568 2748 XXZZ.EXE 42 PID 1568 wrote to memory of 404 1568 XXZZ.EXE 43 PID 1568 wrote to memory of 404 1568 XXZZ.EXE 43 PID 1568 wrote to memory of 404 1568 XXZZ.EXE 43 PID 1568 wrote to memory of 404 1568 XXZZ.EXE 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a51e1e48cf514de495c13d1af463bc2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5a51e1e48cf514de495c13d1af463bc2_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\FGUI.EXE"C:\Users\Admin\AppData\Local\Temp\FGUI.EXE"2⤵
- Executes dropped EXE
PID:2968
-
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"16⤵
- Executes dropped EXE
- Loads dropped DLL
PID:404 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:272 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:112 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:856 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:772 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:292 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:960 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:560 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:872 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:632 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:452 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:904 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:768 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:700 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"63⤵
- Executes dropped EXE
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"64⤵
- Executes dropped EXE
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"65⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"66⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"67⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"68⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"69⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"70⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"71⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"72⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"73⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"74⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"75⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"76⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"77⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"78⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"79⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"80⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"81⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"82⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"83⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"84⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"85⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"86⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"87⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"88⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"89⤵PID:332
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"90⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"91⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"92⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"93⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"94⤵PID:492
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"95⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"96⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"97⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"98⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"99⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"100⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"101⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"102⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"103⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"104⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"105⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"106⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"107⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"108⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"109⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"110⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"111⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"112⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"113⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"114⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"115⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"116⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"117⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"118⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"119⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"120⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"121⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"122⤵PID:776
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-