Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
10-07-2024 00:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-07-10_cdc033be6ef29d91b873cfef9e9682df_mafia.exe
Resource
win7-20240704-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-10_cdc033be6ef29d91b873cfef9e9682df_mafia.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-07-10_cdc033be6ef29d91b873cfef9e9682df_mafia.exe
-
Size
520KB
-
MD5
cdc033be6ef29d91b873cfef9e9682df
-
SHA1
5ab7021071a871a48174615432a20dcfaad94acc
-
SHA256
ec1788a86bf16de558f8d5ecd3d27b262e7257c18a6251d9128349fd28a5793b
-
SHA512
1d4b1b05a28a126dc2a853849345837801281951b38806544fa81284a8b15acfdb348d3a86356e7177c069a64a35b80b473caa61c732499a940171d15d1a5698
-
SSDEEP
12288:gj8fuxR21t5i8ftIlG7imiHLanKA1TNZ:gj8fuK1GYWrmiHLoHTN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2040 8AE1.tmp 2716 8BAC.tmp 2916 8C96.tmp 2816 8D42.tmp 2124 8E0D.tmp 3048 8E7A.tmp 2752 8F64.tmp 2612 8FF0.tmp 2688 905D.tmp 2204 9176.tmp 2592 9222.tmp 2468 929F.tmp 1140 932B.tmp 2308 9415.tmp 3060 9492.tmp 3032 957C.tmp 3040 95D9.tmp 2164 9647.tmp 2944 96E3.tmp 2008 9750.tmp 1492 97EC.tmp 1972 98A7.tmp 2216 9914.tmp 2152 99C0.tmp 2224 9A8B.tmp 2568 9AF8.tmp 1932 9B55.tmp 2084 9BC3.tmp 2180 9C20.tmp 1660 9F99.tmp 1764 A0D1.tmp 884 A12F.tmp 2076 A19C.tmp 1976 A1FA.tmp 1196 A267.tmp 2028 A2D4.tmp 2424 A341.tmp 752 A3AF.tmp 2500 A40C.tmp 1688 A479.tmp 1692 A4E7.tmp 2880 A544.tmp 1008 A5B1.tmp 3008 A60F.tmp 2000 A67C.tmp 2464 A6DA.tmp 848 A737.tmp 1192 A7A5.tmp 1504 A812.tmp 852 A86F.tmp 2024 A8CD.tmp 2936 A92B.tmp 1596 A988.tmp 1956 A9E6.tmp 2836 AA43.tmp 2720 AAA1.tmp 2852 AAFF.tmp 2740 AB6C.tmp 1652 ABC9.tmp 2636 AC27.tmp 2888 AC85.tmp 2724 AD01.tmp 2912 AD6F.tmp 2652 ADDC.tmp -
Loads dropped DLL 64 IoCs
pid Process 2936 2024-07-10_cdc033be6ef29d91b873cfef9e9682df_mafia.exe 2040 8AE1.tmp 2716 8BAC.tmp 2916 8C96.tmp 2816 8D42.tmp 2124 8E0D.tmp 3048 8E7A.tmp 2752 8F64.tmp 2612 8FF0.tmp 2688 905D.tmp 2204 9176.tmp 2592 9222.tmp 2468 929F.tmp 1140 932B.tmp 2308 9415.tmp 3060 9492.tmp 3032 957C.tmp 3040 95D9.tmp 2164 9647.tmp 2944 96E3.tmp 2008 9750.tmp 1492 97EC.tmp 1972 98A7.tmp 2216 9914.tmp 2152 99C0.tmp 2224 9A8B.tmp 2568 9AF8.tmp 1932 9B55.tmp 2084 9BC3.tmp 2180 9C20.tmp 1660 9F99.tmp 1764 A0D1.tmp 884 A12F.tmp 2076 A19C.tmp 1976 A1FA.tmp 1196 A267.tmp 2028 A2D4.tmp 2424 A341.tmp 752 A3AF.tmp 2500 A40C.tmp 1688 A479.tmp 1692 A4E7.tmp 2880 A544.tmp 1008 A5B1.tmp 3008 A60F.tmp 2000 A67C.tmp 2464 A6DA.tmp 848 A737.tmp 1192 A7A5.tmp 1504 A812.tmp 852 A86F.tmp 2024 A8CD.tmp 2936 A92B.tmp 1596 A988.tmp 1956 A9E6.tmp 2836 AA43.tmp 2720 AAA1.tmp 2852 AAFF.tmp 2740 AB6C.tmp 1652 ABC9.tmp 2636 AC27.tmp 2888 AC85.tmp 2724 AD01.tmp 2912 AD6F.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2936 wrote to memory of 2040 2936 2024-07-10_cdc033be6ef29d91b873cfef9e9682df_mafia.exe 30 PID 2936 wrote to memory of 2040 2936 2024-07-10_cdc033be6ef29d91b873cfef9e9682df_mafia.exe 30 PID 2936 wrote to memory of 2040 2936 2024-07-10_cdc033be6ef29d91b873cfef9e9682df_mafia.exe 30 PID 2936 wrote to memory of 2040 2936 2024-07-10_cdc033be6ef29d91b873cfef9e9682df_mafia.exe 30 PID 2040 wrote to memory of 2716 2040 8AE1.tmp 31 PID 2040 wrote to memory of 2716 2040 8AE1.tmp 31 PID 2040 wrote to memory of 2716 2040 8AE1.tmp 31 PID 2040 wrote to memory of 2716 2040 8AE1.tmp 31 PID 2716 wrote to memory of 2916 2716 8BAC.tmp 32 PID 2716 wrote to memory of 2916 2716 8BAC.tmp 32 PID 2716 wrote to memory of 2916 2716 8BAC.tmp 32 PID 2716 wrote to memory of 2916 2716 8BAC.tmp 32 PID 2916 wrote to memory of 2816 2916 8C96.tmp 33 PID 2916 wrote to memory of 2816 2916 8C96.tmp 33 PID 2916 wrote to memory of 2816 2916 8C96.tmp 33 PID 2916 wrote to memory of 2816 2916 8C96.tmp 33 PID 2816 wrote to memory of 2124 2816 8D42.tmp 34 PID 2816 wrote to memory of 2124 2816 8D42.tmp 34 PID 2816 wrote to memory of 2124 2816 8D42.tmp 34 PID 2816 wrote to memory of 2124 2816 8D42.tmp 34 PID 2124 wrote to memory of 3048 2124 8E0D.tmp 35 PID 2124 wrote to memory of 3048 2124 8E0D.tmp 35 PID 2124 wrote to memory of 3048 2124 8E0D.tmp 35 PID 2124 wrote to memory of 3048 2124 8E0D.tmp 35 PID 3048 wrote to memory of 2752 3048 8E7A.tmp 36 PID 3048 wrote to memory of 2752 3048 8E7A.tmp 36 PID 3048 wrote to memory of 2752 3048 8E7A.tmp 36 PID 3048 wrote to memory of 2752 3048 8E7A.tmp 36 PID 2752 wrote to memory of 2612 2752 8F64.tmp 94 PID 2752 wrote to memory of 2612 2752 8F64.tmp 94 PID 2752 wrote to memory of 2612 2752 8F64.tmp 94 PID 2752 wrote to memory of 2612 2752 8F64.tmp 94 PID 2612 wrote to memory of 2688 2612 8FF0.tmp 38 PID 2612 wrote to memory of 2688 2612 8FF0.tmp 38 PID 2612 wrote to memory of 2688 2612 8FF0.tmp 38 PID 2612 wrote to memory of 2688 2612 8FF0.tmp 38 PID 2688 wrote to memory of 2204 2688 905D.tmp 39 PID 2688 wrote to memory of 2204 2688 905D.tmp 39 PID 2688 wrote to memory of 2204 2688 905D.tmp 39 PID 2688 wrote to memory of 2204 2688 905D.tmp 39 PID 2204 wrote to memory of 2592 2204 9176.tmp 40 PID 2204 wrote to memory of 2592 2204 9176.tmp 40 PID 2204 wrote to memory of 2592 2204 9176.tmp 40 PID 2204 wrote to memory of 2592 2204 9176.tmp 40 PID 2592 wrote to memory of 2468 2592 9222.tmp 41 PID 2592 wrote to memory of 2468 2592 9222.tmp 41 PID 2592 wrote to memory of 2468 2592 9222.tmp 41 PID 2592 wrote to memory of 2468 2592 9222.tmp 41 PID 2468 wrote to memory of 1140 2468 929F.tmp 42 PID 2468 wrote to memory of 1140 2468 929F.tmp 42 PID 2468 wrote to memory of 1140 2468 929F.tmp 42 PID 2468 wrote to memory of 1140 2468 929F.tmp 42 PID 1140 wrote to memory of 2308 1140 932B.tmp 43 PID 1140 wrote to memory of 2308 1140 932B.tmp 43 PID 1140 wrote to memory of 2308 1140 932B.tmp 43 PID 1140 wrote to memory of 2308 1140 932B.tmp 43 PID 2308 wrote to memory of 3060 2308 9415.tmp 44 PID 2308 wrote to memory of 3060 2308 9415.tmp 44 PID 2308 wrote to memory of 3060 2308 9415.tmp 44 PID 2308 wrote to memory of 3060 2308 9415.tmp 44 PID 3060 wrote to memory of 3032 3060 9492.tmp 45 PID 3060 wrote to memory of 3032 3060 9492.tmp 45 PID 3060 wrote to memory of 3032 3060 9492.tmp 45 PID 3060 wrote to memory of 3032 3060 9492.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-10_cdc033be6ef29d91b873cfef9e9682df_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-10_cdc033be6ef29d91b873cfef9e9682df_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\8AE1.tmp"C:\Users\Admin\AppData\Local\Temp\8AE1.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\8BAC.tmp"C:\Users\Admin\AppData\Local\Temp\8BAC.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\8C96.tmp"C:\Users\Admin\AppData\Local\Temp\8C96.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\8D42.tmp"C:\Users\Admin\AppData\Local\Temp\8D42.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\8E7A.tmp"C:\Users\Admin\AppData\Local\Temp\8E7A.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\8F64.tmp"C:\Users\Admin\AppData\Local\Temp\8F64.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\8FF0.tmp"C:\Users\Admin\AppData\Local\Temp\8FF0.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\905D.tmp"C:\Users\Admin\AppData\Local\Temp\905D.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\9176.tmp"C:\Users\Admin\AppData\Local\Temp\9176.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\9222.tmp"C:\Users\Admin\AppData\Local\Temp\9222.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\929F.tmp"C:\Users\Admin\AppData\Local\Temp\929F.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\932B.tmp"C:\Users\Admin\AppData\Local\Temp\932B.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\9415.tmp"C:\Users\Admin\AppData\Local\Temp\9415.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\9492.tmp"C:\Users\Admin\AppData\Local\Temp\9492.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\957C.tmp"C:\Users\Admin\AppData\Local\Temp\957C.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\95D9.tmp"C:\Users\Admin\AppData\Local\Temp\95D9.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\9647.tmp"C:\Users\Admin\AppData\Local\Temp\9647.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\96E3.tmp"C:\Users\Admin\AppData\Local\Temp\96E3.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\9750.tmp"C:\Users\Admin\AppData\Local\Temp\9750.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\97EC.tmp"C:\Users\Admin\AppData\Local\Temp\97EC.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\98A7.tmp"C:\Users\Admin\AppData\Local\Temp\98A7.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\9914.tmp"C:\Users\Admin\AppData\Local\Temp\9914.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\99C0.tmp"C:\Users\Admin\AppData\Local\Temp\99C0.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\9A8B.tmp"C:\Users\Admin\AppData\Local\Temp\9A8B.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\9B55.tmp"C:\Users\Admin\AppData\Local\Temp\9B55.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\9C20.tmp"C:\Users\Admin\AppData\Local\Temp\9C20.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\9F99.tmp"C:\Users\Admin\AppData\Local\Temp\9F99.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\A0D1.tmp"C:\Users\Admin\AppData\Local\Temp\A0D1.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\A12F.tmp"C:\Users\Admin\AppData\Local\Temp\A12F.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:884 -
C:\Users\Admin\AppData\Local\Temp\A19C.tmp"C:\Users\Admin\AppData\Local\Temp\A19C.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\A1FA.tmp"C:\Users\Admin\AppData\Local\Temp\A1FA.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\A267.tmp"C:\Users\Admin\AppData\Local\Temp\A267.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\A2D4.tmp"C:\Users\Admin\AppData\Local\Temp\A2D4.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\A341.tmp"C:\Users\Admin\AppData\Local\Temp\A341.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\A3AF.tmp"C:\Users\Admin\AppData\Local\Temp\A3AF.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:752 -
C:\Users\Admin\AppData\Local\Temp\A40C.tmp"C:\Users\Admin\AppData\Local\Temp\A40C.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\A479.tmp"C:\Users\Admin\AppData\Local\Temp\A479.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\A4E7.tmp"C:\Users\Admin\AppData\Local\Temp\A4E7.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\A544.tmp"C:\Users\Admin\AppData\Local\Temp\A544.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\A5B1.tmp"C:\Users\Admin\AppData\Local\Temp\A5B1.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\A60F.tmp"C:\Users\Admin\AppData\Local\Temp\A60F.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\A67C.tmp"C:\Users\Admin\AppData\Local\Temp\A67C.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\A6DA.tmp"C:\Users\Admin\AppData\Local\Temp\A6DA.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\A737.tmp"C:\Users\Admin\AppData\Local\Temp\A737.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:848 -
C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\A812.tmp"C:\Users\Admin\AppData\Local\Temp\A812.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\A86F.tmp"C:\Users\Admin\AppData\Local\Temp\A86F.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:852 -
C:\Users\Admin\AppData\Local\Temp\A8CD.tmp"C:\Users\Admin\AppData\Local\Temp\A8CD.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\A92B.tmp"C:\Users\Admin\AppData\Local\Temp\A92B.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\A988.tmp"C:\Users\Admin\AppData\Local\Temp\A988.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\A9E6.tmp"C:\Users\Admin\AppData\Local\Temp\A9E6.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\AA43.tmp"C:\Users\Admin\AppData\Local\Temp\AA43.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\AAA1.tmp"C:\Users\Admin\AppData\Local\Temp\AAA1.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\AAFF.tmp"C:\Users\Admin\AppData\Local\Temp\AAFF.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\AB6C.tmp"C:\Users\Admin\AppData\Local\Temp\AB6C.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\ABC9.tmp"C:\Users\Admin\AppData\Local\Temp\ABC9.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\AC27.tmp"C:\Users\Admin\AppData\Local\Temp\AC27.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\AC85.tmp"C:\Users\Admin\AppData\Local\Temp\AC85.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\AD01.tmp"C:\Users\Admin\AppData\Local\Temp\AD01.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\AD6F.tmp"C:\Users\Admin\AppData\Local\Temp\AD6F.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\ADDC.tmp"C:\Users\Admin\AppData\Local\Temp\ADDC.tmp"65⤵
- Executes dropped EXE
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\AE39.tmp"C:\Users\Admin\AppData\Local\Temp\AE39.tmp"66⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\AE97.tmp"C:\Users\Admin\AppData\Local\Temp\AE97.tmp"67⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\AEF5.tmp"C:\Users\Admin\AppData\Local\Temp\AEF5.tmp"68⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\AF71.tmp"C:\Users\Admin\AppData\Local\Temp\AF71.tmp"69⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\B01D.tmp"C:\Users\Admin\AppData\Local\Temp\B01D.tmp"70⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\B0B9.tmp"C:\Users\Admin\AppData\Local\Temp\B0B9.tmp"71⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\B165.tmp"C:\Users\Admin\AppData\Local\Temp\B165.tmp"72⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\B22F.tmp"C:\Users\Admin\AppData\Local\Temp\B22F.tmp"73⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\B30A.tmp"C:\Users\Admin\AppData\Local\Temp\B30A.tmp"74⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\B3B5.tmp"C:\Users\Admin\AppData\Local\Temp\B3B5.tmp"75⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\B451.tmp"C:\Users\Admin\AppData\Local\Temp\B451.tmp"76⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\B645.tmp"C:\Users\Admin\AppData\Local\Temp\B645.tmp"77⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\B75D.tmp"C:\Users\Admin\AppData\Local\Temp\B75D.tmp"78⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\B7F9.tmp"C:\Users\Admin\AppData\Local\Temp\B7F9.tmp"79⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\B886.tmp"C:\Users\Admin\AppData\Local\Temp\B886.tmp"80⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\B922.tmp"C:\Users\Admin\AppData\Local\Temp\B922.tmp"81⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\B9FC.tmp"C:\Users\Admin\AppData\Local\Temp\B9FC.tmp"82⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\BA5A.tmp"C:\Users\Admin\AppData\Local\Temp\BA5A.tmp"83⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\BAE6.tmp"C:\Users\Admin\AppData\Local\Temp\BAE6.tmp"84⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\BB92.tmp"C:\Users\Admin\AppData\Local\Temp\BB92.tmp"85⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\BC5D.tmp"C:\Users\Admin\AppData\Local\Temp\BC5D.tmp"86⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\BCF9.tmp"C:\Users\Admin\AppData\Local\Temp\BCF9.tmp"87⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\BDC3.tmp"C:\Users\Admin\AppData\Local\Temp\BDC3.tmp"88⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\BE40.tmp"C:\Users\Admin\AppData\Local\Temp\BE40.tmp"89⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\BEAD.tmp"C:\Users\Admin\AppData\Local\Temp\BEAD.tmp"90⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\BF1B.tmp"C:\Users\Admin\AppData\Local\Temp\BF1B.tmp"91⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\BF78.tmp"C:\Users\Admin\AppData\Local\Temp\BF78.tmp"92⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"93⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\C053.tmp"C:\Users\Admin\AppData\Local\Temp\C053.tmp"94⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"95⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\C11D.tmp"C:\Users\Admin\AppData\Local\Temp\C11D.tmp"96⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\C17B.tmp"C:\Users\Admin\AppData\Local\Temp\C17B.tmp"97⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\C207.tmp"C:\Users\Admin\AppData\Local\Temp\C207.tmp"98⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\C265.tmp"C:\Users\Admin\AppData\Local\Temp\C265.tmp"99⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\C2D2.tmp"C:\Users\Admin\AppData\Local\Temp\C2D2.tmp"100⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\C33F.tmp"C:\Users\Admin\AppData\Local\Temp\C33F.tmp"101⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\C39D.tmp"C:\Users\Admin\AppData\Local\Temp\C39D.tmp"102⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\C40A.tmp"C:\Users\Admin\AppData\Local\Temp\C40A.tmp"103⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\C458.tmp"C:\Users\Admin\AppData\Local\Temp\C458.tmp"104⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\C4D5.tmp"C:\Users\Admin\AppData\Local\Temp\C4D5.tmp"105⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\C542.tmp"C:\Users\Admin\AppData\Local\Temp\C542.tmp"106⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\C5AF.tmp"C:\Users\Admin\AppData\Local\Temp\C5AF.tmp"107⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\C61D.tmp"C:\Users\Admin\AppData\Local\Temp\C61D.tmp"108⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\C68A.tmp"C:\Users\Admin\AppData\Local\Temp\C68A.tmp"109⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\C6E7.tmp"C:\Users\Admin\AppData\Local\Temp\C6E7.tmp"110⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\C764.tmp"C:\Users\Admin\AppData\Local\Temp\C764.tmp"111⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\C7E1.tmp"C:\Users\Admin\AppData\Local\Temp\C7E1.tmp"112⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\C84E.tmp"C:\Users\Admin\AppData\Local\Temp\C84E.tmp"113⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\C8BB.tmp"C:\Users\Admin\AppData\Local\Temp\C8BB.tmp"114⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\C929.tmp"C:\Users\Admin\AppData\Local\Temp\C929.tmp"115⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\C9A5.tmp"C:\Users\Admin\AppData\Local\Temp\C9A5.tmp"116⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\CA22.tmp"C:\Users\Admin\AppData\Local\Temp\CA22.tmp"117⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\CBA8.tmp"C:\Users\Admin\AppData\Local\Temp\CBA8.tmp"118⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\CC25.tmp"C:\Users\Admin\AppData\Local\Temp\CC25.tmp"119⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\CCA2.tmp"C:\Users\Admin\AppData\Local\Temp\CCA2.tmp"120⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\CD1F.tmp"C:\Users\Admin\AppData\Local\Temp\CD1F.tmp"121⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\CDAB.tmp"C:\Users\Admin\AppData\Local\Temp\CDAB.tmp"122⤵PID:2776
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-