Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
09-07-2024 16:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-07-09_5b7ad6e729773f8363bd5a961533a1df_mafia.exe
Resource
win7-20240704-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-09_5b7ad6e729773f8363bd5a961533a1df_mafia.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-07-09_5b7ad6e729773f8363bd5a961533a1df_mafia.exe
-
Size
488KB
-
MD5
5b7ad6e729773f8363bd5a961533a1df
-
SHA1
86547c246eccf1bad57316787d0b6e58da0fc9df
-
SHA256
9887b305a5795cc69ec6425da23264374d3dc1547b0fa7fb66e1d5b26fa59d4d
-
SHA512
afdd10b003fc2e3ad26b7c79e30fb623214ce7142b96e63ad0df7e8362851b59e6953e31aec357fadf1ac04d5dc241b50905a21acd6e6329f1481eee0357b817
-
SSDEEP
12288:/U5rCOTeiD+MgTh/INpT1AhozlIHwQyOk5ZENZ:/UQOJD+MCiT8oJIX65ZEN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2392 83C0.tmp 2456 840E.tmp 2284 847B.tmp 2408 84D9.tmp 2904 8537.tmp 3028 85A4.tmp 1972 8601.tmp 2256 867E.tmp 1880 86DC.tmp 2692 8749.tmp 2688 8797.tmp 2492 87F5.tmp 2804 8852.tmp 2724 88B0.tmp 2596 890D.tmp 2500 896B.tmp 2288 89C9.tmp 2652 8A45.tmp 1152 8AA3.tmp 1748 8B10.tmp 2544 8B7D.tmp 1260 8BEB.tmp 1712 8C48.tmp 2300 8C87.tmp 1496 8CD5.tmp 1608 8D23.tmp 1084 8D61.tmp 840 8DAF.tmp 1752 8DED.tmp 2728 8E2C.tmp 2740 8E6A.tmp 2980 8EA9.tmp 2080 8EE7.tmp 2132 8F25.tmp 2832 8F64.tmp 1836 8FB2.tmp 1048 8FF0.tmp 2068 902F.tmp 1624 906D.tmp 988 90BB.tmp 1968 90F9.tmp 1536 9138.tmp 1516 9176.tmp 2272 91B5.tmp 1268 91F3.tmp 1596 9231.tmp 784 9270.tmp 1380 92BE.tmp 2184 930C.tmp 996 934A.tmp 2884 9398.tmp 660 93D7.tmp 2108 9415.tmp 1852 9444.tmp 1584 9492.tmp 2240 94D0.tmp 1932 950F.tmp 2392 955D.tmp 2796 959B.tmp 2020 95D9.tmp 1708 9618.tmp 2236 9656.tmp 2912 9695.tmp 3016 96E3.tmp -
Loads dropped DLL 64 IoCs
pid Process 1628 2024-07-09_5b7ad6e729773f8363bd5a961533a1df_mafia.exe 2392 83C0.tmp 2456 840E.tmp 2284 847B.tmp 2408 84D9.tmp 2904 8537.tmp 3028 85A4.tmp 1972 8601.tmp 2256 867E.tmp 1880 86DC.tmp 2692 8749.tmp 2688 8797.tmp 2492 87F5.tmp 2804 8852.tmp 2724 88B0.tmp 2596 890D.tmp 2500 896B.tmp 2288 89C9.tmp 2652 8A45.tmp 1152 8AA3.tmp 1748 8B10.tmp 2544 8B7D.tmp 1260 8BEB.tmp 1712 8C48.tmp 2300 8C87.tmp 1496 8CD5.tmp 1608 8D23.tmp 1084 8D61.tmp 840 8DAF.tmp 1752 8DED.tmp 2728 8E2C.tmp 2740 8E6A.tmp 2980 8EA9.tmp 2080 8EE7.tmp 2132 8F25.tmp 2832 8F64.tmp 1836 8FB2.tmp 1048 8FF0.tmp 2068 902F.tmp 1624 906D.tmp 988 90BB.tmp 1968 90F9.tmp 1536 9138.tmp 1516 9176.tmp 2272 91B5.tmp 1268 91F3.tmp 1596 9231.tmp 784 9270.tmp 1380 92BE.tmp 2184 930C.tmp 996 934A.tmp 2884 9398.tmp 660 93D7.tmp 2108 9415.tmp 1852 9444.tmp 1584 9492.tmp 2240 94D0.tmp 1932 950F.tmp 2392 955D.tmp 2796 959B.tmp 2020 95D9.tmp 1708 9618.tmp 2236 9656.tmp 2912 9695.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1628 wrote to memory of 2392 1628 2024-07-09_5b7ad6e729773f8363bd5a961533a1df_mafia.exe 28 PID 1628 wrote to memory of 2392 1628 2024-07-09_5b7ad6e729773f8363bd5a961533a1df_mafia.exe 28 PID 1628 wrote to memory of 2392 1628 2024-07-09_5b7ad6e729773f8363bd5a961533a1df_mafia.exe 28 PID 1628 wrote to memory of 2392 1628 2024-07-09_5b7ad6e729773f8363bd5a961533a1df_mafia.exe 28 PID 2392 wrote to memory of 2456 2392 83C0.tmp 29 PID 2392 wrote to memory of 2456 2392 83C0.tmp 29 PID 2392 wrote to memory of 2456 2392 83C0.tmp 29 PID 2392 wrote to memory of 2456 2392 83C0.tmp 29 PID 2456 wrote to memory of 2284 2456 840E.tmp 30 PID 2456 wrote to memory of 2284 2456 840E.tmp 30 PID 2456 wrote to memory of 2284 2456 840E.tmp 30 PID 2456 wrote to memory of 2284 2456 840E.tmp 30 PID 2284 wrote to memory of 2408 2284 847B.tmp 31 PID 2284 wrote to memory of 2408 2284 847B.tmp 31 PID 2284 wrote to memory of 2408 2284 847B.tmp 31 PID 2284 wrote to memory of 2408 2284 847B.tmp 31 PID 2408 wrote to memory of 2904 2408 84D9.tmp 32 PID 2408 wrote to memory of 2904 2408 84D9.tmp 32 PID 2408 wrote to memory of 2904 2408 84D9.tmp 32 PID 2408 wrote to memory of 2904 2408 84D9.tmp 32 PID 2904 wrote to memory of 3028 2904 8537.tmp 33 PID 2904 wrote to memory of 3028 2904 8537.tmp 33 PID 2904 wrote to memory of 3028 2904 8537.tmp 33 PID 2904 wrote to memory of 3028 2904 8537.tmp 33 PID 3028 wrote to memory of 1972 3028 85A4.tmp 34 PID 3028 wrote to memory of 1972 3028 85A4.tmp 34 PID 3028 wrote to memory of 1972 3028 85A4.tmp 34 PID 3028 wrote to memory of 1972 3028 85A4.tmp 34 PID 1972 wrote to memory of 2256 1972 8601.tmp 35 PID 1972 wrote to memory of 2256 1972 8601.tmp 35 PID 1972 wrote to memory of 2256 1972 8601.tmp 35 PID 1972 wrote to memory of 2256 1972 8601.tmp 35 PID 2256 wrote to memory of 1880 2256 867E.tmp 36 PID 2256 wrote to memory of 1880 2256 867E.tmp 36 PID 2256 wrote to memory of 1880 2256 867E.tmp 36 PID 2256 wrote to memory of 1880 2256 867E.tmp 36 PID 1880 wrote to memory of 2692 1880 86DC.tmp 37 PID 1880 wrote to memory of 2692 1880 86DC.tmp 37 PID 1880 wrote to memory of 2692 1880 86DC.tmp 37 PID 1880 wrote to memory of 2692 1880 86DC.tmp 37 PID 2692 wrote to memory of 2688 2692 8749.tmp 38 PID 2692 wrote to memory of 2688 2692 8749.tmp 38 PID 2692 wrote to memory of 2688 2692 8749.tmp 38 PID 2692 wrote to memory of 2688 2692 8749.tmp 38 PID 2688 wrote to memory of 2492 2688 8797.tmp 39 PID 2688 wrote to memory of 2492 2688 8797.tmp 39 PID 2688 wrote to memory of 2492 2688 8797.tmp 39 PID 2688 wrote to memory of 2492 2688 8797.tmp 39 PID 2492 wrote to memory of 2804 2492 87F5.tmp 40 PID 2492 wrote to memory of 2804 2492 87F5.tmp 40 PID 2492 wrote to memory of 2804 2492 87F5.tmp 40 PID 2492 wrote to memory of 2804 2492 87F5.tmp 40 PID 2804 wrote to memory of 2724 2804 8852.tmp 41 PID 2804 wrote to memory of 2724 2804 8852.tmp 41 PID 2804 wrote to memory of 2724 2804 8852.tmp 41 PID 2804 wrote to memory of 2724 2804 8852.tmp 41 PID 2724 wrote to memory of 2596 2724 88B0.tmp 42 PID 2724 wrote to memory of 2596 2724 88B0.tmp 42 PID 2724 wrote to memory of 2596 2724 88B0.tmp 42 PID 2724 wrote to memory of 2596 2724 88B0.tmp 42 PID 2596 wrote to memory of 2500 2596 890D.tmp 43 PID 2596 wrote to memory of 2500 2596 890D.tmp 43 PID 2596 wrote to memory of 2500 2596 890D.tmp 43 PID 2596 wrote to memory of 2500 2596 890D.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-09_5b7ad6e729773f8363bd5a961533a1df_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-09_5b7ad6e729773f8363bd5a961533a1df_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\83C0.tmp"C:\Users\Admin\AppData\Local\Temp\83C0.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\840E.tmp"C:\Users\Admin\AppData\Local\Temp\840E.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\847B.tmp"C:\Users\Admin\AppData\Local\Temp\847B.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\84D9.tmp"C:\Users\Admin\AppData\Local\Temp\84D9.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\8537.tmp"C:\Users\Admin\AppData\Local\Temp\8537.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\85A4.tmp"C:\Users\Admin\AppData\Local\Temp\85A4.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\8601.tmp"C:\Users\Admin\AppData\Local\Temp\8601.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\867E.tmp"C:\Users\Admin\AppData\Local\Temp\867E.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\86DC.tmp"C:\Users\Admin\AppData\Local\Temp\86DC.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\8749.tmp"C:\Users\Admin\AppData\Local\Temp\8749.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\8797.tmp"C:\Users\Admin\AppData\Local\Temp\8797.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\87F5.tmp"C:\Users\Admin\AppData\Local\Temp\87F5.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\8852.tmp"C:\Users\Admin\AppData\Local\Temp\8852.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\88B0.tmp"C:\Users\Admin\AppData\Local\Temp\88B0.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\890D.tmp"C:\Users\Admin\AppData\Local\Temp\890D.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\896B.tmp"C:\Users\Admin\AppData\Local\Temp\896B.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\89C9.tmp"C:\Users\Admin\AppData\Local\Temp\89C9.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\8A45.tmp"C:\Users\Admin\AppData\Local\Temp\8A45.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\8AA3.tmp"C:\Users\Admin\AppData\Local\Temp\8AA3.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\8B10.tmp"C:\Users\Admin\AppData\Local\Temp\8B10.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\8BEB.tmp"C:\Users\Admin\AppData\Local\Temp\8BEB.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\8C48.tmp"C:\Users\Admin\AppData\Local\Temp\8C48.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\8C87.tmp"C:\Users\Admin\AppData\Local\Temp\8C87.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\8CD5.tmp"C:\Users\Admin\AppData\Local\Temp\8CD5.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\8D23.tmp"C:\Users\Admin\AppData\Local\Temp\8D23.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\8D61.tmp"C:\Users\Admin\AppData\Local\Temp\8D61.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\8DAF.tmp"C:\Users\Admin\AppData\Local\Temp\8DAF.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:840 -
C:\Users\Admin\AppData\Local\Temp\8DED.tmp"C:\Users\Admin\AppData\Local\Temp\8DED.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\8E2C.tmp"C:\Users\Admin\AppData\Local\Temp\8E2C.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\8E6A.tmp"C:\Users\Admin\AppData\Local\Temp\8E6A.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\8EA9.tmp"C:\Users\Admin\AppData\Local\Temp\8EA9.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\8EE7.tmp"C:\Users\Admin\AppData\Local\Temp\8EE7.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\8F25.tmp"C:\Users\Admin\AppData\Local\Temp\8F25.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\8F64.tmp"C:\Users\Admin\AppData\Local\Temp\8F64.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\8FB2.tmp"C:\Users\Admin\AppData\Local\Temp\8FB2.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\8FF0.tmp"C:\Users\Admin\AppData\Local\Temp\8FF0.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\902F.tmp"C:\Users\Admin\AppData\Local\Temp\902F.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\906D.tmp"C:\Users\Admin\AppData\Local\Temp\906D.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\90BB.tmp"C:\Users\Admin\AppData\Local\Temp\90BB.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:988 -
C:\Users\Admin\AppData\Local\Temp\90F9.tmp"C:\Users\Admin\AppData\Local\Temp\90F9.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\9138.tmp"C:\Users\Admin\AppData\Local\Temp\9138.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\9176.tmp"C:\Users\Admin\AppData\Local\Temp\9176.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\91B5.tmp"C:\Users\Admin\AppData\Local\Temp\91B5.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\91F3.tmp"C:\Users\Admin\AppData\Local\Temp\91F3.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\9231.tmp"C:\Users\Admin\AppData\Local\Temp\9231.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\9270.tmp"C:\Users\Admin\AppData\Local\Temp\9270.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:784 -
C:\Users\Admin\AppData\Local\Temp\92BE.tmp"C:\Users\Admin\AppData\Local\Temp\92BE.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\930C.tmp"C:\Users\Admin\AppData\Local\Temp\930C.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\934A.tmp"C:\Users\Admin\AppData\Local\Temp\934A.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:996 -
C:\Users\Admin\AppData\Local\Temp\9398.tmp"C:\Users\Admin\AppData\Local\Temp\9398.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\93D7.tmp"C:\Users\Admin\AppData\Local\Temp\93D7.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:660 -
C:\Users\Admin\AppData\Local\Temp\9415.tmp"C:\Users\Admin\AppData\Local\Temp\9415.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\9444.tmp"C:\Users\Admin\AppData\Local\Temp\9444.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\9492.tmp"C:\Users\Admin\AppData\Local\Temp\9492.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\94D0.tmp"C:\Users\Admin\AppData\Local\Temp\94D0.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\950F.tmp"C:\Users\Admin\AppData\Local\Temp\950F.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\955D.tmp"C:\Users\Admin\AppData\Local\Temp\955D.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\959B.tmp"C:\Users\Admin\AppData\Local\Temp\959B.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\95D9.tmp"C:\Users\Admin\AppData\Local\Temp\95D9.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\9618.tmp"C:\Users\Admin\AppData\Local\Temp\9618.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\9656.tmp"C:\Users\Admin\AppData\Local\Temp\9656.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\9695.tmp"C:\Users\Admin\AppData\Local\Temp\9695.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\96E3.tmp"C:\Users\Admin\AppData\Local\Temp\96E3.tmp"65⤵
- Executes dropped EXE
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\9721.tmp"C:\Users\Admin\AppData\Local\Temp\9721.tmp"66⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\978E.tmp"C:\Users\Admin\AppData\Local\Temp\978E.tmp"67⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\97DC.tmp"C:\Users\Admin\AppData\Local\Temp\97DC.tmp"68⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\981B.tmp"C:\Users\Admin\AppData\Local\Temp\981B.tmp"69⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\9859.tmp"C:\Users\Admin\AppData\Local\Temp\9859.tmp"70⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\98A7.tmp"C:\Users\Admin\AppData\Local\Temp\98A7.tmp"71⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\98E5.tmp"C:\Users\Admin\AppData\Local\Temp\98E5.tmp"72⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\9924.tmp"C:\Users\Admin\AppData\Local\Temp\9924.tmp"73⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\9962.tmp"C:\Users\Admin\AppData\Local\Temp\9962.tmp"74⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\99A1.tmp"C:\Users\Admin\AppData\Local\Temp\99A1.tmp"75⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\99DF.tmp"C:\Users\Admin\AppData\Local\Temp\99DF.tmp"76⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"77⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\9A5C.tmp"C:\Users\Admin\AppData\Local\Temp\9A5C.tmp"78⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"79⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\9AD9.tmp"C:\Users\Admin\AppData\Local\Temp\9AD9.tmp"80⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\9B17.tmp"C:\Users\Admin\AppData\Local\Temp\9B17.tmp"81⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\9B55.tmp"C:\Users\Admin\AppData\Local\Temp\9B55.tmp"82⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\9B94.tmp"C:\Users\Admin\AppData\Local\Temp\9B94.tmp"83⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"84⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\9C11.tmp"C:\Users\Admin\AppData\Local\Temp\9C11.tmp"85⤵PID:308
-
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"86⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"87⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\9CEB.tmp"C:\Users\Admin\AppData\Local\Temp\9CEB.tmp"88⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\9D29.tmp"C:\Users\Admin\AppData\Local\Temp\9D29.tmp"89⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\9D68.tmp"C:\Users\Admin\AppData\Local\Temp\9D68.tmp"90⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\9DB6.tmp"C:\Users\Admin\AppData\Local\Temp\9DB6.tmp"91⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\9DF4.tmp"C:\Users\Admin\AppData\Local\Temp\9DF4.tmp"92⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\9E33.tmp"C:\Users\Admin\AppData\Local\Temp\9E33.tmp"93⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\9E71.tmp"C:\Users\Admin\AppData\Local\Temp\9E71.tmp"94⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\9EAF.tmp"C:\Users\Admin\AppData\Local\Temp\9EAF.tmp"95⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\9EEE.tmp"C:\Users\Admin\AppData\Local\Temp\9EEE.tmp"96⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\9F2C.tmp"C:\Users\Admin\AppData\Local\Temp\9F2C.tmp"97⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\9F6B.tmp"C:\Users\Admin\AppData\Local\Temp\9F6B.tmp"98⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\9FA9.tmp"C:\Users\Admin\AppData\Local\Temp\9FA9.tmp"99⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\9FE7.tmp"C:\Users\Admin\AppData\Local\Temp\9FE7.tmp"100⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\A026.tmp"C:\Users\Admin\AppData\Local\Temp\A026.tmp"101⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\A064.tmp"C:\Users\Admin\AppData\Local\Temp\A064.tmp"102⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\A0A3.tmp"C:\Users\Admin\AppData\Local\Temp\A0A3.tmp"103⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\A0E1.tmp"C:\Users\Admin\AppData\Local\Temp\A0E1.tmp"104⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\A11F.tmp"C:\Users\Admin\AppData\Local\Temp\A11F.tmp"105⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\A15E.tmp"C:\Users\Admin\AppData\Local\Temp\A15E.tmp"106⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\A19C.tmp"C:\Users\Admin\AppData\Local\Temp\A19C.tmp"107⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\A1DB.tmp"C:\Users\Admin\AppData\Local\Temp\A1DB.tmp"108⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\A219.tmp"C:\Users\Admin\AppData\Local\Temp\A219.tmp"109⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\A257.tmp"C:\Users\Admin\AppData\Local\Temp\A257.tmp"110⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\A296.tmp"C:\Users\Admin\AppData\Local\Temp\A296.tmp"111⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\A2D4.tmp"C:\Users\Admin\AppData\Local\Temp\A2D4.tmp"112⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\A313.tmp"C:\Users\Admin\AppData\Local\Temp\A313.tmp"113⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\A351.tmp"C:\Users\Admin\AppData\Local\Temp\A351.tmp"114⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\A38F.tmp"C:\Users\Admin\AppData\Local\Temp\A38F.tmp"115⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\A3DD.tmp"C:\Users\Admin\AppData\Local\Temp\A3DD.tmp"116⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\A41C.tmp"C:\Users\Admin\AppData\Local\Temp\A41C.tmp"117⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\A46A.tmp"C:\Users\Admin\AppData\Local\Temp\A46A.tmp"118⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\A4A8.tmp"C:\Users\Admin\AppData\Local\Temp\A4A8.tmp"119⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\A4E7.tmp"C:\Users\Admin\AppData\Local\Temp\A4E7.tmp"120⤵PID:660
-
C:\Users\Admin\AppData\Local\Temp\A525.tmp"C:\Users\Admin\AppData\Local\Temp\A525.tmp"121⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\A563.tmp"C:\Users\Admin\AppData\Local\Temp\A563.tmp"122⤵PID:2440
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-