Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02-06-2024 06:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-02_9bf0edc035483190568b12ab0311c552_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-02_9bf0edc035483190568b12ab0311c552_mafia.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-06-02_9bf0edc035483190568b12ab0311c552_mafia.exe
-
Size
536KB
-
MD5
9bf0edc035483190568b12ab0311c552
-
SHA1
f37984031e2fe2a39426503a27d4cea4320e3654
-
SHA256
d837bb1efc2ce1085030e5081120825624a821b52a4fefef52e0e95ae78ac97e
-
SHA512
7b99b7586a716599ff5a364625ab1cde0b748bd903cec57454e4872fb8d1d99c7f804353b53a0df0d02351880a1e7244c66ac50fbc1a8750eba7cade6e019a35
-
SSDEEP
12288:wU5rCOTeiUYMbubXALg0pU2TJ6QIZxVJ0ZT9:wUQOJUSEg0a7QIRJ0ZT9
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1696 1E0C.tmp 2524 1E79.tmp 2036 1EC7.tmp 2624 1F82.tmp 2588 201E.tmp 2724 20AA.tmp 2952 2146.tmp 2440 21C3.tmp 2516 2240.tmp 1732 22AD.tmp 2788 233A.tmp 2836 23D6.tmp 856 2433.tmp 1888 24EE.tmp 2336 257B.tmp 804 2617.tmp 2784 26C2.tmp 2296 274F.tmp 2312 27BC.tmp 2100 2858.tmp 2116 28D5.tmp 1992 29A0.tmp 868 29EE.tmp 788 2A4B.tmp 1040 2AB8.tmp 812 2AF7.tmp 452 2B35.tmp 1240 2BA2.tmp 1772 2BF0.tmp 1540 2C2F.tmp 1620 2C8C.tmp 560 2CEA.tmp 880 2D28.tmp 3068 2D67.tmp 1988 2DC4.tmp 836 2E12.tmp 2212 2E51.tmp 876 2E8F.tmp 2256 2EDD.tmp 1604 2F2B.tmp 1444 2F6A.tmp 2380 2FB8.tmp 3064 2FF6.tmp 1580 3034.tmp 2036 3073.tmp 2720 30C1.tmp 2580 30FF.tmp 2588 314D.tmp 2464 319B.tmp 2308 31E9.tmp 2452 3228.tmp 756 3266.tmp 2712 32A4.tmp 1892 32F2.tmp 2772 3331.tmp 2820 337F.tmp 2788 33BD.tmp 1544 33FC.tmp 2536 343A.tmp 1088 3498.tmp 1888 34D6.tmp 1244 3514.tmp 2744 3562.tmp 1284 35A1.tmp -
Loads dropped DLL 64 IoCs
pid Process 2844 2024-06-02_9bf0edc035483190568b12ab0311c552_mafia.exe 1696 1E0C.tmp 2524 1E79.tmp 2036 1EC7.tmp 2624 1F82.tmp 2588 201E.tmp 2724 20AA.tmp 2952 2146.tmp 2440 21C3.tmp 2516 2240.tmp 1732 22AD.tmp 2788 233A.tmp 2836 23D6.tmp 856 2433.tmp 1888 24EE.tmp 2336 257B.tmp 804 2617.tmp 2784 26C2.tmp 2296 274F.tmp 2312 27BC.tmp 2100 2858.tmp 2116 28D5.tmp 1992 29A0.tmp 868 29EE.tmp 788 2A4B.tmp 1040 2AB8.tmp 812 2AF7.tmp 452 2B35.tmp 1240 2BA2.tmp 1772 2BF0.tmp 1540 2C2F.tmp 1620 2C8C.tmp 560 2CEA.tmp 880 2D28.tmp 3068 2D67.tmp 1988 2DC4.tmp 836 2E12.tmp 2212 2E51.tmp 876 2E8F.tmp 2256 2EDD.tmp 1604 2F2B.tmp 1444 2F6A.tmp 2380 2FB8.tmp 3064 2FF6.tmp 1580 3034.tmp 2036 3073.tmp 2720 30C1.tmp 2580 30FF.tmp 2588 314D.tmp 2464 319B.tmp 2308 31E9.tmp 2452 3228.tmp 756 3266.tmp 2712 32A4.tmp 1892 32F2.tmp 2772 3331.tmp 2820 337F.tmp 2788 33BD.tmp 1544 33FC.tmp 2536 343A.tmp 1088 3498.tmp 1888 34D6.tmp 1244 3514.tmp 2744 3562.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2844 wrote to memory of 1696 2844 2024-06-02_9bf0edc035483190568b12ab0311c552_mafia.exe 28 PID 2844 wrote to memory of 1696 2844 2024-06-02_9bf0edc035483190568b12ab0311c552_mafia.exe 28 PID 2844 wrote to memory of 1696 2844 2024-06-02_9bf0edc035483190568b12ab0311c552_mafia.exe 28 PID 2844 wrote to memory of 1696 2844 2024-06-02_9bf0edc035483190568b12ab0311c552_mafia.exe 28 PID 1696 wrote to memory of 2524 1696 1E0C.tmp 29 PID 1696 wrote to memory of 2524 1696 1E0C.tmp 29 PID 1696 wrote to memory of 2524 1696 1E0C.tmp 29 PID 1696 wrote to memory of 2524 1696 1E0C.tmp 29 PID 2524 wrote to memory of 2036 2524 1E79.tmp 30 PID 2524 wrote to memory of 2036 2524 1E79.tmp 30 PID 2524 wrote to memory of 2036 2524 1E79.tmp 30 PID 2524 wrote to memory of 2036 2524 1E79.tmp 30 PID 2036 wrote to memory of 2624 2036 1EC7.tmp 31 PID 2036 wrote to memory of 2624 2036 1EC7.tmp 31 PID 2036 wrote to memory of 2624 2036 1EC7.tmp 31 PID 2036 wrote to memory of 2624 2036 1EC7.tmp 31 PID 2624 wrote to memory of 2588 2624 1F82.tmp 32 PID 2624 wrote to memory of 2588 2624 1F82.tmp 32 PID 2624 wrote to memory of 2588 2624 1F82.tmp 32 PID 2624 wrote to memory of 2588 2624 1F82.tmp 32 PID 2588 wrote to memory of 2724 2588 201E.tmp 33 PID 2588 wrote to memory of 2724 2588 201E.tmp 33 PID 2588 wrote to memory of 2724 2588 201E.tmp 33 PID 2588 wrote to memory of 2724 2588 201E.tmp 33 PID 2724 wrote to memory of 2952 2724 20AA.tmp 34 PID 2724 wrote to memory of 2952 2724 20AA.tmp 34 PID 2724 wrote to memory of 2952 2724 20AA.tmp 34 PID 2724 wrote to memory of 2952 2724 20AA.tmp 34 PID 2952 wrote to memory of 2440 2952 2146.tmp 35 PID 2952 wrote to memory of 2440 2952 2146.tmp 35 PID 2952 wrote to memory of 2440 2952 2146.tmp 35 PID 2952 wrote to memory of 2440 2952 2146.tmp 35 PID 2440 wrote to memory of 2516 2440 21C3.tmp 36 PID 2440 wrote to memory of 2516 2440 21C3.tmp 36 PID 2440 wrote to memory of 2516 2440 21C3.tmp 36 PID 2440 wrote to memory of 2516 2440 21C3.tmp 36 PID 2516 wrote to memory of 1732 2516 2240.tmp 37 PID 2516 wrote to memory of 1732 2516 2240.tmp 37 PID 2516 wrote to memory of 1732 2516 2240.tmp 37 PID 2516 wrote to memory of 1732 2516 2240.tmp 37 PID 1732 wrote to memory of 2788 1732 22AD.tmp 38 PID 1732 wrote to memory of 2788 1732 22AD.tmp 38 PID 1732 wrote to memory of 2788 1732 22AD.tmp 38 PID 1732 wrote to memory of 2788 1732 22AD.tmp 38 PID 2788 wrote to memory of 2836 2788 233A.tmp 39 PID 2788 wrote to memory of 2836 2788 233A.tmp 39 PID 2788 wrote to memory of 2836 2788 233A.tmp 39 PID 2788 wrote to memory of 2836 2788 233A.tmp 39 PID 2836 wrote to memory of 856 2836 23D6.tmp 40 PID 2836 wrote to memory of 856 2836 23D6.tmp 40 PID 2836 wrote to memory of 856 2836 23D6.tmp 40 PID 2836 wrote to memory of 856 2836 23D6.tmp 40 PID 856 wrote to memory of 1888 856 2433.tmp 41 PID 856 wrote to memory of 1888 856 2433.tmp 41 PID 856 wrote to memory of 1888 856 2433.tmp 41 PID 856 wrote to memory of 1888 856 2433.tmp 41 PID 1888 wrote to memory of 2336 1888 24EE.tmp 42 PID 1888 wrote to memory of 2336 1888 24EE.tmp 42 PID 1888 wrote to memory of 2336 1888 24EE.tmp 42 PID 1888 wrote to memory of 2336 1888 24EE.tmp 42 PID 2336 wrote to memory of 804 2336 257B.tmp 43 PID 2336 wrote to memory of 804 2336 257B.tmp 43 PID 2336 wrote to memory of 804 2336 257B.tmp 43 PID 2336 wrote to memory of 804 2336 257B.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-02_9bf0edc035483190568b12ab0311c552_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-02_9bf0edc035483190568b12ab0311c552_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\1E79.tmp"C:\Users\Admin\AppData\Local\Temp\1E79.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\1F82.tmp"C:\Users\Admin\AppData\Local\Temp\1F82.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\201E.tmp"C:\Users\Admin\AppData\Local\Temp\201E.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\20AA.tmp"C:\Users\Admin\AppData\Local\Temp\20AA.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\2146.tmp"C:\Users\Admin\AppData\Local\Temp\2146.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\21C3.tmp"C:\Users\Admin\AppData\Local\Temp\21C3.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\2240.tmp"C:\Users\Admin\AppData\Local\Temp\2240.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\22AD.tmp"C:\Users\Admin\AppData\Local\Temp\22AD.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\233A.tmp"C:\Users\Admin\AppData\Local\Temp\233A.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\23D6.tmp"C:\Users\Admin\AppData\Local\Temp\23D6.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\2433.tmp"C:\Users\Admin\AppData\Local\Temp\2433.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Users\Admin\AppData\Local\Temp\24EE.tmp"C:\Users\Admin\AppData\Local\Temp\24EE.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\257B.tmp"C:\Users\Admin\AppData\Local\Temp\257B.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:804 -
C:\Users\Admin\AppData\Local\Temp\26C2.tmp"C:\Users\Admin\AppData\Local\Temp\26C2.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\274F.tmp"C:\Users\Admin\AppData\Local\Temp\274F.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\27BC.tmp"C:\Users\Admin\AppData\Local\Temp\27BC.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\2858.tmp"C:\Users\Admin\AppData\Local\Temp\2858.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\28D5.tmp"C:\Users\Admin\AppData\Local\Temp\28D5.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\29A0.tmp"C:\Users\Admin\AppData\Local\Temp\29A0.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\29EE.tmp"C:\Users\Admin\AppData\Local\Temp\29EE.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:868 -
C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:788 -
C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:812 -
C:\Users\Admin\AppData\Local\Temp\2B35.tmp"C:\Users\Admin\AppData\Local\Temp\2B35.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:452 -
C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:560 -
C:\Users\Admin\AppData\Local\Temp\2D28.tmp"C:\Users\Admin\AppData\Local\Temp\2D28.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:880 -
C:\Users\Admin\AppData\Local\Temp\2D67.tmp"C:\Users\Admin\AppData\Local\Temp\2D67.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\2E12.tmp"C:\Users\Admin\AppData\Local\Temp\2E12.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:836 -
C:\Users\Admin\AppData\Local\Temp\2E51.tmp"C:\Users\Admin\AppData\Local\Temp\2E51.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:876 -
C:\Users\Admin\AppData\Local\Temp\2EDD.tmp"C:\Users\Admin\AppData\Local\Temp\2EDD.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\2F6A.tmp"C:\Users\Admin\AppData\Local\Temp\2F6A.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\3034.tmp"C:\Users\Admin\AppData\Local\Temp\3034.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\3073.tmp"C:\Users\Admin\AppData\Local\Temp\3073.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\30C1.tmp"C:\Users\Admin\AppData\Local\Temp\30C1.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\30FF.tmp"C:\Users\Admin\AppData\Local\Temp\30FF.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\314D.tmp"C:\Users\Admin\AppData\Local\Temp\314D.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\319B.tmp"C:\Users\Admin\AppData\Local\Temp\319B.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\31E9.tmp"C:\Users\Admin\AppData\Local\Temp\31E9.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\3228.tmp"C:\Users\Admin\AppData\Local\Temp\3228.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\3266.tmp"C:\Users\Admin\AppData\Local\Temp\3266.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:756 -
C:\Users\Admin\AppData\Local\Temp\32A4.tmp"C:\Users\Admin\AppData\Local\Temp\32A4.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\32F2.tmp"C:\Users\Admin\AppData\Local\Temp\32F2.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\3331.tmp"C:\Users\Admin\AppData\Local\Temp\3331.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\337F.tmp"C:\Users\Admin\AppData\Local\Temp\337F.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\33BD.tmp"C:\Users\Admin\AppData\Local\Temp\33BD.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\33FC.tmp"C:\Users\Admin\AppData\Local\Temp\33FC.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\343A.tmp"C:\Users\Admin\AppData\Local\Temp\343A.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\3498.tmp"C:\Users\Admin\AppData\Local\Temp\3498.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\34D6.tmp"C:\Users\Admin\AppData\Local\Temp\34D6.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\3514.tmp"C:\Users\Admin\AppData\Local\Temp\3514.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\3562.tmp"C:\Users\Admin\AppData\Local\Temp\3562.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\35A1.tmp"C:\Users\Admin\AppData\Local\Temp\35A1.tmp"65⤵
- Executes dropped EXE
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\35DF.tmp"C:\Users\Admin\AppData\Local\Temp\35DF.tmp"66⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\361E.tmp"C:\Users\Admin\AppData\Local\Temp\361E.tmp"67⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\366C.tmp"C:\Users\Admin\AppData\Local\Temp\366C.tmp"68⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\36AA.tmp"C:\Users\Admin\AppData\Local\Temp\36AA.tmp"69⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\36F8.tmp"C:\Users\Admin\AppData\Local\Temp\36F8.tmp"70⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\3736.tmp"C:\Users\Admin\AppData\Local\Temp\3736.tmp"71⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\3784.tmp"C:\Users\Admin\AppData\Local\Temp\3784.tmp"72⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\37C3.tmp"C:\Users\Admin\AppData\Local\Temp\37C3.tmp"73⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\3801.tmp"C:\Users\Admin\AppData\Local\Temp\3801.tmp"74⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\384F.tmp"C:\Users\Admin\AppData\Local\Temp\384F.tmp"75⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\388E.tmp"C:\Users\Admin\AppData\Local\Temp\388E.tmp"76⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\38CC.tmp"C:\Users\Admin\AppData\Local\Temp\38CC.tmp"77⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\391A.tmp"C:\Users\Admin\AppData\Local\Temp\391A.tmp"78⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\3958.tmp"C:\Users\Admin\AppData\Local\Temp\3958.tmp"79⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\3997.tmp"C:\Users\Admin\AppData\Local\Temp\3997.tmp"80⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\39D5.tmp"C:\Users\Admin\AppData\Local\Temp\39D5.tmp"81⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\3A14.tmp"C:\Users\Admin\AppData\Local\Temp\3A14.tmp"82⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\3A52.tmp"C:\Users\Admin\AppData\Local\Temp\3A52.tmp"83⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\3A90.tmp"C:\Users\Admin\AppData\Local\Temp\3A90.tmp"84⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\3ACF.tmp"C:\Users\Admin\AppData\Local\Temp\3ACF.tmp"85⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\3B0D.tmp"C:\Users\Admin\AppData\Local\Temp\3B0D.tmp"86⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\3B4C.tmp"C:\Users\Admin\AppData\Local\Temp\3B4C.tmp"87⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\3B8A.tmp"C:\Users\Admin\AppData\Local\Temp\3B8A.tmp"88⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\3BD8.tmp"C:\Users\Admin\AppData\Local\Temp\3BD8.tmp"89⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\3C16.tmp"C:\Users\Admin\AppData\Local\Temp\3C16.tmp"90⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\3C64.tmp"C:\Users\Admin\AppData\Local\Temp\3C64.tmp"91⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\3CA3.tmp"C:\Users\Admin\AppData\Local\Temp\3CA3.tmp"92⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\3CF1.tmp"C:\Users\Admin\AppData\Local\Temp\3CF1.tmp"93⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\3D2F.tmp"C:\Users\Admin\AppData\Local\Temp\3D2F.tmp"94⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\3D6E.tmp"C:\Users\Admin\AppData\Local\Temp\3D6E.tmp"95⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\3DBC.tmp"C:\Users\Admin\AppData\Local\Temp\3DBC.tmp"96⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\3DFA.tmp"C:\Users\Admin\AppData\Local\Temp\3DFA.tmp"97⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\3E38.tmp"C:\Users\Admin\AppData\Local\Temp\3E38.tmp"98⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\3E77.tmp"C:\Users\Admin\AppData\Local\Temp\3E77.tmp"99⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\3EB5.tmp"C:\Users\Admin\AppData\Local\Temp\3EB5.tmp"100⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\3EF4.tmp"C:\Users\Admin\AppData\Local\Temp\3EF4.tmp"101⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\3F32.tmp"C:\Users\Admin\AppData\Local\Temp\3F32.tmp"102⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\3F70.tmp"C:\Users\Admin\AppData\Local\Temp\3F70.tmp"103⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\3FAF.tmp"C:\Users\Admin\AppData\Local\Temp\3FAF.tmp"104⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\3FED.tmp"C:\Users\Admin\AppData\Local\Temp\3FED.tmp"105⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\403B.tmp"C:\Users\Admin\AppData\Local\Temp\403B.tmp"106⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\407A.tmp"C:\Users\Admin\AppData\Local\Temp\407A.tmp"107⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\40B8.tmp"C:\Users\Admin\AppData\Local\Temp\40B8.tmp"108⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\40F6.tmp"C:\Users\Admin\AppData\Local\Temp\40F6.tmp"109⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\4135.tmp"C:\Users\Admin\AppData\Local\Temp\4135.tmp"110⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\4183.tmp"C:\Users\Admin\AppData\Local\Temp\4183.tmp"111⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\41C1.tmp"C:\Users\Admin\AppData\Local\Temp\41C1.tmp"112⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\4200.tmp"C:\Users\Admin\AppData\Local\Temp\4200.tmp"113⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\424E.tmp"C:\Users\Admin\AppData\Local\Temp\424E.tmp"114⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\428C.tmp"C:\Users\Admin\AppData\Local\Temp\428C.tmp"115⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\42CA.tmp"C:\Users\Admin\AppData\Local\Temp\42CA.tmp"116⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\4309.tmp"C:\Users\Admin\AppData\Local\Temp\4309.tmp"117⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\4347.tmp"C:\Users\Admin\AppData\Local\Temp\4347.tmp"118⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\4395.tmp"C:\Users\Admin\AppData\Local\Temp\4395.tmp"119⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\43D4.tmp"C:\Users\Admin\AppData\Local\Temp\43D4.tmp"120⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\4412.tmp"C:\Users\Admin\AppData\Local\Temp\4412.tmp"121⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\4470.tmp"C:\Users\Admin\AppData\Local\Temp\4470.tmp"122⤵PID:2688
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-