Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 07:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-07-10_6f06cf31644cf7a2ea072c9cd563eea8_mafia.exe
Resource
win7-20240704-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-10_6f06cf31644cf7a2ea072c9cd563eea8_mafia.exe
Resource
win10v2004-20240709-en
2 signatures
150 seconds
General
-
Target
2024-07-10_6f06cf31644cf7a2ea072c9cd563eea8_mafia.exe
-
Size
529KB
-
MD5
6f06cf31644cf7a2ea072c9cd563eea8
-
SHA1
5dc0f541988e15fada3def03c3af7b780adc5e26
-
SHA256
612f099535a057ada06d69eb6bfa0129c3794fbbfa5d7b3f64e42148824e2e35
-
SHA512
eaef195c62a806668bf48c40cbc71324bb6a5cd0c8fb6747cc62840da7b66039a5ee01ff57b76a0d9ea1c352fe5da4ada5fe092fb7555fbfc96b6b7c75657d28
-
SSDEEP
12288:NU5rCOTeijeUzGGZUcDxZrv8X72qYbtTZwlH4Hp:NUQOJj7LDxGrjYxTSlH4Hp
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2780 7E63.tmp 2736 7EB1.tmp 2688 7F7C.tmp 2084 8018.tmp 1776 80C4.tmp 2744 8160.tmp 2588 81BD.tmp 2656 8279.tmp 3052 82F5.tmp 1884 8372.tmp 1792 83DF.tmp 2152 84AA.tmp 264 8537.tmp 2564 85D3.tmp 2344 867E.tmp 764 8749.tmp 2904 87C6.tmp 2680 8804.tmp 3028 88BF.tmp 1280 890D.tmp 1772 89E8.tmp 1488 8AA3.tmp 2972 8B3F.tmp 2448 8B8D.tmp 2540 8BCB.tmp 2300 8C0A.tmp 2248 8C58.tmp 1236 8CA6.tmp 1628 8CF4.tmp 932 8D51.tmp 916 8D9F.tmp 896 8DED.tmp 2204 8E3B.tmp 1560 8E89.tmp 992 8ED7.tmp 668 8F25.tmp 1324 8F64.tmp 2252 8FB2.tmp 2004 9000.tmp 1964 905D.tmp 1668 90AB.tmp 948 9109.tmp 1664 9186.tmp 2336 91D4.tmp 1716 9222.tmp 556 927F.tmp 2492 92CD.tmp 2200 931B.tmp 1528 9369.tmp 1508 93B7.tmp 2528 9405.tmp 2940 9463.tmp 2816 954D.tmp 2684 959B.tmp 2280 95F9.tmp 2316 9637.tmp 2828 9685.tmp 2604 96E3.tmp 2084 9731.tmp 1796 977F.tmp 2632 97CD.tmp 2744 980B.tmp 2644 9859.tmp 3044 98A7.tmp -
Loads dropped DLL 64 IoCs
pid Process 2312 2024-07-10_6f06cf31644cf7a2ea072c9cd563eea8_mafia.exe 2780 7E63.tmp 2736 7EB1.tmp 2688 7F7C.tmp 2084 8018.tmp 1776 80C4.tmp 2744 8160.tmp 2588 81BD.tmp 2656 8279.tmp 3052 82F5.tmp 1884 8372.tmp 1792 83DF.tmp 2152 84AA.tmp 264 8537.tmp 2564 85D3.tmp 2344 867E.tmp 764 8749.tmp 2904 87C6.tmp 2680 8804.tmp 3028 88BF.tmp 1280 890D.tmp 1772 89E8.tmp 1488 8AA3.tmp 2972 8B3F.tmp 2448 8B8D.tmp 2540 8BCB.tmp 2300 8C0A.tmp 2248 8C58.tmp 1236 8CA6.tmp 1628 8CF4.tmp 932 8D51.tmp 916 8D9F.tmp 896 8DED.tmp 2204 8E3B.tmp 1560 8E89.tmp 992 8ED7.tmp 668 8F25.tmp 1324 8F64.tmp 2252 8FB2.tmp 2004 9000.tmp 1964 905D.tmp 1668 90AB.tmp 948 9109.tmp 1664 9186.tmp 2336 91D4.tmp 1716 9222.tmp 556 927F.tmp 2492 92CD.tmp 2200 931B.tmp 1528 9369.tmp 1508 93B7.tmp 2528 9405.tmp 1700 94C1.tmp 2816 954D.tmp 2684 959B.tmp 2280 95F9.tmp 2316 9637.tmp 2828 9685.tmp 2604 96E3.tmp 2084 9731.tmp 1796 977F.tmp 2632 97CD.tmp 2744 980B.tmp 2644 9859.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2312 wrote to memory of 2780 2312 2024-07-10_6f06cf31644cf7a2ea072c9cd563eea8_mafia.exe 30 PID 2312 wrote to memory of 2780 2312 2024-07-10_6f06cf31644cf7a2ea072c9cd563eea8_mafia.exe 30 PID 2312 wrote to memory of 2780 2312 2024-07-10_6f06cf31644cf7a2ea072c9cd563eea8_mafia.exe 30 PID 2312 wrote to memory of 2780 2312 2024-07-10_6f06cf31644cf7a2ea072c9cd563eea8_mafia.exe 30 PID 2780 wrote to memory of 2736 2780 7E63.tmp 31 PID 2780 wrote to memory of 2736 2780 7E63.tmp 31 PID 2780 wrote to memory of 2736 2780 7E63.tmp 31 PID 2780 wrote to memory of 2736 2780 7E63.tmp 31 PID 2736 wrote to memory of 2688 2736 7EB1.tmp 32 PID 2736 wrote to memory of 2688 2736 7EB1.tmp 32 PID 2736 wrote to memory of 2688 2736 7EB1.tmp 32 PID 2736 wrote to memory of 2688 2736 7EB1.tmp 32 PID 2688 wrote to memory of 2084 2688 7F7C.tmp 33 PID 2688 wrote to memory of 2084 2688 7F7C.tmp 33 PID 2688 wrote to memory of 2084 2688 7F7C.tmp 33 PID 2688 wrote to memory of 2084 2688 7F7C.tmp 33 PID 2084 wrote to memory of 1776 2084 8018.tmp 34 PID 2084 wrote to memory of 1776 2084 8018.tmp 34 PID 2084 wrote to memory of 1776 2084 8018.tmp 34 PID 2084 wrote to memory of 1776 2084 8018.tmp 34 PID 1776 wrote to memory of 2744 1776 80C4.tmp 35 PID 1776 wrote to memory of 2744 1776 80C4.tmp 35 PID 1776 wrote to memory of 2744 1776 80C4.tmp 35 PID 1776 wrote to memory of 2744 1776 80C4.tmp 35 PID 2744 wrote to memory of 2588 2744 8160.tmp 36 PID 2744 wrote to memory of 2588 2744 8160.tmp 36 PID 2744 wrote to memory of 2588 2744 8160.tmp 36 PID 2744 wrote to memory of 2588 2744 8160.tmp 36 PID 2588 wrote to memory of 2656 2588 81BD.tmp 37 PID 2588 wrote to memory of 2656 2588 81BD.tmp 37 PID 2588 wrote to memory of 2656 2588 81BD.tmp 37 PID 2588 wrote to memory of 2656 2588 81BD.tmp 37 PID 2656 wrote to memory of 3052 2656 8279.tmp 38 PID 2656 wrote to memory of 3052 2656 8279.tmp 38 PID 2656 wrote to memory of 3052 2656 8279.tmp 38 PID 2656 wrote to memory of 3052 2656 8279.tmp 38 PID 3052 wrote to memory of 1884 3052 82F5.tmp 39 PID 3052 wrote to memory of 1884 3052 82F5.tmp 39 PID 3052 wrote to memory of 1884 3052 82F5.tmp 39 PID 3052 wrote to memory of 1884 3052 82F5.tmp 39 PID 1884 wrote to memory of 1792 1884 8372.tmp 40 PID 1884 wrote to memory of 1792 1884 8372.tmp 40 PID 1884 wrote to memory of 1792 1884 8372.tmp 40 PID 1884 wrote to memory of 1792 1884 8372.tmp 40 PID 1792 wrote to memory of 2152 1792 83DF.tmp 41 PID 1792 wrote to memory of 2152 1792 83DF.tmp 41 PID 1792 wrote to memory of 2152 1792 83DF.tmp 41 PID 1792 wrote to memory of 2152 1792 83DF.tmp 41 PID 2152 wrote to memory of 264 2152 84AA.tmp 42 PID 2152 wrote to memory of 264 2152 84AA.tmp 42 PID 2152 wrote to memory of 264 2152 84AA.tmp 42 PID 2152 wrote to memory of 264 2152 84AA.tmp 42 PID 264 wrote to memory of 2564 264 8537.tmp 43 PID 264 wrote to memory of 2564 264 8537.tmp 43 PID 264 wrote to memory of 2564 264 8537.tmp 43 PID 264 wrote to memory of 2564 264 8537.tmp 43 PID 2564 wrote to memory of 2344 2564 85D3.tmp 44 PID 2564 wrote to memory of 2344 2564 85D3.tmp 44 PID 2564 wrote to memory of 2344 2564 85D3.tmp 44 PID 2564 wrote to memory of 2344 2564 85D3.tmp 44 PID 2344 wrote to memory of 764 2344 867E.tmp 45 PID 2344 wrote to memory of 764 2344 867E.tmp 45 PID 2344 wrote to memory of 764 2344 867E.tmp 45 PID 2344 wrote to memory of 764 2344 867E.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-10_6f06cf31644cf7a2ea072c9cd563eea8_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-10_6f06cf31644cf7a2ea072c9cd563eea8_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\7E63.tmp"C:\Users\Admin\AppData\Local\Temp\7E63.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\7EB1.tmp"C:\Users\Admin\AppData\Local\Temp\7EB1.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\7F7C.tmp"C:\Users\Admin\AppData\Local\Temp\7F7C.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\8018.tmp"C:\Users\Admin\AppData\Local\Temp\8018.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\80C4.tmp"C:\Users\Admin\AppData\Local\Temp\80C4.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\8160.tmp"C:\Users\Admin\AppData\Local\Temp\8160.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\81BD.tmp"C:\Users\Admin\AppData\Local\Temp\81BD.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\8279.tmp"C:\Users\Admin\AppData\Local\Temp\8279.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\82F5.tmp"C:\Users\Admin\AppData\Local\Temp\82F5.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\8372.tmp"C:\Users\Admin\AppData\Local\Temp\8372.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\83DF.tmp"C:\Users\Admin\AppData\Local\Temp\83DF.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\84AA.tmp"C:\Users\Admin\AppData\Local\Temp\84AA.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\8537.tmp"C:\Users\Admin\AppData\Local\Temp\8537.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Users\Admin\AppData\Local\Temp\85D3.tmp"C:\Users\Admin\AppData\Local\Temp\85D3.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\867E.tmp"C:\Users\Admin\AppData\Local\Temp\867E.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\8749.tmp"C:\Users\Admin\AppData\Local\Temp\8749.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:764 -
C:\Users\Admin\AppData\Local\Temp\87C6.tmp"C:\Users\Admin\AppData\Local\Temp\87C6.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\8804.tmp"C:\Users\Admin\AppData\Local\Temp\8804.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\88BF.tmp"C:\Users\Admin\AppData\Local\Temp\88BF.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\890D.tmp"C:\Users\Admin\AppData\Local\Temp\890D.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\89E8.tmp"C:\Users\Admin\AppData\Local\Temp\89E8.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\8AA3.tmp"C:\Users\Admin\AppData\Local\Temp\8AA3.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\8B3F.tmp"C:\Users\Admin\AppData\Local\Temp\8B3F.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\8B8D.tmp"C:\Users\Admin\AppData\Local\Temp\8B8D.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\8BCB.tmp"C:\Users\Admin\AppData\Local\Temp\8BCB.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\8C0A.tmp"C:\Users\Admin\AppData\Local\Temp\8C0A.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\8C58.tmp"C:\Users\Admin\AppData\Local\Temp\8C58.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\8CA6.tmp"C:\Users\Admin\AppData\Local\Temp\8CA6.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\8CF4.tmp"C:\Users\Admin\AppData\Local\Temp\8CF4.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\8D51.tmp"C:\Users\Admin\AppData\Local\Temp\8D51.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:932 -
C:\Users\Admin\AppData\Local\Temp\8D9F.tmp"C:\Users\Admin\AppData\Local\Temp\8D9F.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:916 -
C:\Users\Admin\AppData\Local\Temp\8DED.tmp"C:\Users\Admin\AppData\Local\Temp\8DED.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:896 -
C:\Users\Admin\AppData\Local\Temp\8E3B.tmp"C:\Users\Admin\AppData\Local\Temp\8E3B.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\8E89.tmp"C:\Users\Admin\AppData\Local\Temp\8E89.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\8ED7.tmp"C:\Users\Admin\AppData\Local\Temp\8ED7.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:992 -
C:\Users\Admin\AppData\Local\Temp\8F25.tmp"C:\Users\Admin\AppData\Local\Temp\8F25.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:668 -
C:\Users\Admin\AppData\Local\Temp\8F64.tmp"C:\Users\Admin\AppData\Local\Temp\8F64.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\8FB2.tmp"C:\Users\Admin\AppData\Local\Temp\8FB2.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\9000.tmp"C:\Users\Admin\AppData\Local\Temp\9000.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\905D.tmp"C:\Users\Admin\AppData\Local\Temp\905D.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\90AB.tmp"C:\Users\Admin\AppData\Local\Temp\90AB.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\9109.tmp"C:\Users\Admin\AppData\Local\Temp\9109.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:948 -
C:\Users\Admin\AppData\Local\Temp\9186.tmp"C:\Users\Admin\AppData\Local\Temp\9186.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\91D4.tmp"C:\Users\Admin\AppData\Local\Temp\91D4.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\9222.tmp"C:\Users\Admin\AppData\Local\Temp\9222.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\927F.tmp"C:\Users\Admin\AppData\Local\Temp\927F.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:556 -
C:\Users\Admin\AppData\Local\Temp\92CD.tmp"C:\Users\Admin\AppData\Local\Temp\92CD.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\931B.tmp"C:\Users\Admin\AppData\Local\Temp\931B.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\9369.tmp"C:\Users\Admin\AppData\Local\Temp\9369.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\93B7.tmp"C:\Users\Admin\AppData\Local\Temp\93B7.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\9405.tmp"C:\Users\Admin\AppData\Local\Temp\9405.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\9463.tmp"C:\Users\Admin\AppData\Local\Temp\9463.tmp"53⤵
- Executes dropped EXE
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\94C1.tmp"C:\Users\Admin\AppData\Local\Temp\94C1.tmp"54⤵
- Loads dropped DLL
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\954D.tmp"C:\Users\Admin\AppData\Local\Temp\954D.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\959B.tmp"C:\Users\Admin\AppData\Local\Temp\959B.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\95F9.tmp"C:\Users\Admin\AppData\Local\Temp\95F9.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\9637.tmp"C:\Users\Admin\AppData\Local\Temp\9637.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\9685.tmp"C:\Users\Admin\AppData\Local\Temp\9685.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\96E3.tmp"C:\Users\Admin\AppData\Local\Temp\96E3.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\9731.tmp"C:\Users\Admin\AppData\Local\Temp\9731.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\977F.tmp"C:\Users\Admin\AppData\Local\Temp\977F.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\97CD.tmp"C:\Users\Admin\AppData\Local\Temp\97CD.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\980B.tmp"C:\Users\Admin\AppData\Local\Temp\980B.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\9859.tmp"C:\Users\Admin\AppData\Local\Temp\9859.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\98A7.tmp"C:\Users\Admin\AppData\Local\Temp\98A7.tmp"66⤵
- Executes dropped EXE
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\9905.tmp"C:\Users\Admin\AppData\Local\Temp\9905.tmp"67⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\9953.tmp"C:\Users\Admin\AppData\Local\Temp\9953.tmp"68⤵PID:608
-
C:\Users\Admin\AppData\Local\Temp\99A1.tmp"C:\Users\Admin\AppData\Local\Temp\99A1.tmp"69⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\99DF.tmp"C:\Users\Admin\AppData\Local\Temp\99DF.tmp"70⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\9A3D.tmp"C:\Users\Admin\AppData\Local\Temp\9A3D.tmp"71⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"72⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"73⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\9B07.tmp"C:\Users\Admin\AppData\Local\Temp\9B07.tmp"74⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\9B55.tmp"C:\Users\Admin\AppData\Local\Temp\9B55.tmp"75⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\9BA3.tmp"C:\Users\Admin\AppData\Local\Temp\9BA3.tmp"76⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\9BF1.tmp"C:\Users\Admin\AppData\Local\Temp\9BF1.tmp"77⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\9C30.tmp"C:\Users\Admin\AppData\Local\Temp\9C30.tmp"78⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"79⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"80⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\9D1A.tmp"C:\Users\Admin\AppData\Local\Temp\9D1A.tmp"81⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\9D68.tmp"C:\Users\Admin\AppData\Local\Temp\9D68.tmp"82⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\9DF4.tmp"C:\Users\Admin\AppData\Local\Temp\9DF4.tmp"83⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\9E33.tmp"C:\Users\Admin\AppData\Local\Temp\9E33.tmp"84⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\9E81.tmp"C:\Users\Admin\AppData\Local\Temp\9E81.tmp"85⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\9ECF.tmp"C:\Users\Admin\AppData\Local\Temp\9ECF.tmp"86⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\9F1D.tmp"C:\Users\Admin\AppData\Local\Temp\9F1D.tmp"87⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\9F6B.tmp"C:\Users\Admin\AppData\Local\Temp\9F6B.tmp"88⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\9FB9.tmp"C:\Users\Admin\AppData\Local\Temp\9FB9.tmp"89⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\9FF7.tmp"C:\Users\Admin\AppData\Local\Temp\9FF7.tmp"90⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\A055.tmp"C:\Users\Admin\AppData\Local\Temp\A055.tmp"91⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\A093.tmp"C:\Users\Admin\AppData\Local\Temp\A093.tmp"92⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\A0F1.tmp"C:\Users\Admin\AppData\Local\Temp\A0F1.tmp"93⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\A13F.tmp"C:\Users\Admin\AppData\Local\Temp\A13F.tmp"94⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\A18D.tmp"C:\Users\Admin\AppData\Local\Temp\A18D.tmp"95⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\A1DB.tmp"C:\Users\Admin\AppData\Local\Temp\A1DB.tmp"96⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\A229.tmp"C:\Users\Admin\AppData\Local\Temp\A229.tmp"97⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\A267.tmp"C:\Users\Admin\AppData\Local\Temp\A267.tmp"98⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\A2A5.tmp"C:\Users\Admin\AppData\Local\Temp\A2A5.tmp"99⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\A2F3.tmp"C:\Users\Admin\AppData\Local\Temp\A2F3.tmp"100⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\A341.tmp"C:\Users\Admin\AppData\Local\Temp\A341.tmp"101⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\A38F.tmp"C:\Users\Admin\AppData\Local\Temp\A38F.tmp"102⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\A3ED.tmp"C:\Users\Admin\AppData\Local\Temp\A3ED.tmp"103⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\A43B.tmp"C:\Users\Admin\AppData\Local\Temp\A43B.tmp"104⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\A489.tmp"C:\Users\Admin\AppData\Local\Temp\A489.tmp"105⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\A4E7.tmp"C:\Users\Admin\AppData\Local\Temp\A4E7.tmp"106⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\A544.tmp"C:\Users\Admin\AppData\Local\Temp\A544.tmp"107⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\A583.tmp"C:\Users\Admin\AppData\Local\Temp\A583.tmp"108⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\A5D1.tmp"C:\Users\Admin\AppData\Local\Temp\A5D1.tmp"109⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\A60F.tmp"C:\Users\Admin\AppData\Local\Temp\A60F.tmp"110⤵PID:292
-
C:\Users\Admin\AppData\Local\Temp\A65D.tmp"C:\Users\Admin\AppData\Local\Temp\A65D.tmp"111⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\A6AB.tmp"C:\Users\Admin\AppData\Local\Temp\A6AB.tmp"112⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\A6E9.tmp"C:\Users\Admin\AppData\Local\Temp\A6E9.tmp"113⤵PID:352
-
C:\Users\Admin\AppData\Local\Temp\A737.tmp"C:\Users\Admin\AppData\Local\Temp\A737.tmp"114⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\A785.tmp"C:\Users\Admin\AppData\Local\Temp\A785.tmp"115⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\A7D3.tmp"C:\Users\Admin\AppData\Local\Temp\A7D3.tmp"116⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\A812.tmp"C:\Users\Admin\AppData\Local\Temp\A812.tmp"117⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\A860.tmp"C:\Users\Admin\AppData\Local\Temp\A860.tmp"118⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\A8AE.tmp"C:\Users\Admin\AppData\Local\Temp\A8AE.tmp"119⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\A8FC.tmp"C:\Users\Admin\AppData\Local\Temp\A8FC.tmp"120⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\A94A.tmp"C:\Users\Admin\AppData\Local\Temp\A94A.tmp"121⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\A998.tmp"C:\Users\Admin\AppData\Local\Temp\A998.tmp"122⤵PID:2948
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-