Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/01/2024, 17:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-01-25_dcb87b5027552512aa4142b3b2878b6d_mafia.exe
Resource
win7-20231215-en
3 signatures
150 seconds
General
-
Target
2024-01-25_dcb87b5027552512aa4142b3b2878b6d_mafia.exe
-
Size
486KB
-
MD5
dcb87b5027552512aa4142b3b2878b6d
-
SHA1
1cabb0216050fbf9ab870ede80ea426a006a8b6c
-
SHA256
1a18f269bf35818b8254e1fffc598099060a35796f627da39b6c22dec4c576b8
-
SHA512
64c66510ae4a0be499ff4f8219bd7381c0c7cc5a2cdd62a8760183378d24a5193acfd51b3a0abee508f987624c4255029fed8f34947dd6f4b413c47b647e75cd
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7JG7yVvrpBfTIPFXIg/aaLtIE9pTJYLQXlGca:/U5rCOTeiDJG7IbIP6gCaLtnJZYNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1244 39D5.tmp 2024 3A42.tmp 2712 3B3C.tmp 2912 3C07.tmp 2788 3CF1.tmp 1084 3DBC.tmp 2636 3E77.tmp 2768 3F51.tmp 2612 400C.tmp 1804 40D7.tmp 2416 4183.tmp 1248 420F.tmp 2896 42AB.tmp 2964 4366.tmp 1576 4460.tmp 1640 451B.tmp 2512 4605.tmp 1584 46A1.tmp 320 475C.tmp 672 4808.tmp 2892 48E2.tmp 2668 49BD.tmp 300 4B04.tmp 1776 4B72.tmp 1556 4BDF.tmp 1828 4C4C.tmp 2004 4CAA.tmp 1704 4D07.tmp 764 4D65.tmp 3060 4DE2.tmp 2420 4E4F.tmp 1388 4EBC.tmp 2444 4F29.tmp 2340 4FA6.tmp 3028 5013.tmp 996 5071.tmp 2324 50DE.tmp 2400 514B.tmp 1664 51B8.tmp 2940 5216.tmp 1580 52A2.tmp 952 5300.tmp 1880 536D.tmp 1840 53CB.tmp 1072 5457.tmp 1288 54C4.tmp 1360 5551.tmp 2280 55BE.tmp 1800 563B.tmp 2436 56A8.tmp 988 5725.tmp 2248 5792.tmp 892 57F0.tmp 2412 585D.tmp 1312 58DA.tmp 1132 5956.tmp 2572 59C4.tmp 2300 5A21.tmp 2732 5A9E.tmp 2752 5AEC.tmp 2408 5B59.tmp 2916 5BD6.tmp 2860 5C62.tmp 2796 5CDF.tmp -
Loads dropped DLL 64 IoCs
pid Process 2220 2024-01-25_dcb87b5027552512aa4142b3b2878b6d_mafia.exe 1244 39D5.tmp 2024 3A42.tmp 2712 3B3C.tmp 2912 3C07.tmp 2788 3CF1.tmp 1084 3DBC.tmp 2636 3E77.tmp 2768 3F51.tmp 2612 400C.tmp 1804 40D7.tmp 2416 4183.tmp 1248 420F.tmp 2896 42AB.tmp 2964 4366.tmp 1576 4460.tmp 1640 451B.tmp 2512 4605.tmp 1584 46A1.tmp 320 475C.tmp 672 4808.tmp 2892 48E2.tmp 2668 49BD.tmp 300 4B04.tmp 1776 4B72.tmp 1556 4BDF.tmp 1828 4C4C.tmp 2004 4CAA.tmp 1704 4D07.tmp 764 4D65.tmp 3060 4DE2.tmp 2420 4E4F.tmp 1388 4EBC.tmp 2444 4F29.tmp 2340 4FA6.tmp 3028 5013.tmp 996 5071.tmp 2324 50DE.tmp 2400 514B.tmp 1664 51B8.tmp 2940 5216.tmp 1580 52A2.tmp 952 5300.tmp 1880 536D.tmp 1840 53CB.tmp 1072 5457.tmp 1288 54C4.tmp 1360 5551.tmp 2280 55BE.tmp 1800 563B.tmp 2436 56A8.tmp 988 5725.tmp 2248 5792.tmp 892 57F0.tmp 2412 585D.tmp 1312 58DA.tmp 1132 5956.tmp 2572 59C4.tmp 2300 5A21.tmp 2732 5A9E.tmp 2752 5AEC.tmp 2408 5B59.tmp 2916 5BD6.tmp 2860 5C62.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2220 wrote to memory of 1244 2220 2024-01-25_dcb87b5027552512aa4142b3b2878b6d_mafia.exe 28 PID 2220 wrote to memory of 1244 2220 2024-01-25_dcb87b5027552512aa4142b3b2878b6d_mafia.exe 28 PID 2220 wrote to memory of 1244 2220 2024-01-25_dcb87b5027552512aa4142b3b2878b6d_mafia.exe 28 PID 2220 wrote to memory of 1244 2220 2024-01-25_dcb87b5027552512aa4142b3b2878b6d_mafia.exe 28 PID 1244 wrote to memory of 2024 1244 39D5.tmp 29 PID 1244 wrote to memory of 2024 1244 39D5.tmp 29 PID 1244 wrote to memory of 2024 1244 39D5.tmp 29 PID 1244 wrote to memory of 2024 1244 39D5.tmp 29 PID 2024 wrote to memory of 2712 2024 3A42.tmp 30 PID 2024 wrote to memory of 2712 2024 3A42.tmp 30 PID 2024 wrote to memory of 2712 2024 3A42.tmp 30 PID 2024 wrote to memory of 2712 2024 3A42.tmp 30 PID 2712 wrote to memory of 2912 2712 3B3C.tmp 31 PID 2712 wrote to memory of 2912 2712 3B3C.tmp 31 PID 2712 wrote to memory of 2912 2712 3B3C.tmp 31 PID 2712 wrote to memory of 2912 2712 3B3C.tmp 31 PID 2912 wrote to memory of 2788 2912 3C07.tmp 32 PID 2912 wrote to memory of 2788 2912 3C07.tmp 32 PID 2912 wrote to memory of 2788 2912 3C07.tmp 32 PID 2912 wrote to memory of 2788 2912 3C07.tmp 32 PID 2788 wrote to memory of 1084 2788 3CF1.tmp 33 PID 2788 wrote to memory of 1084 2788 3CF1.tmp 33 PID 2788 wrote to memory of 1084 2788 3CF1.tmp 33 PID 2788 wrote to memory of 1084 2788 3CF1.tmp 33 PID 1084 wrote to memory of 2636 1084 3DBC.tmp 34 PID 1084 wrote to memory of 2636 1084 3DBC.tmp 34 PID 1084 wrote to memory of 2636 1084 3DBC.tmp 34 PID 1084 wrote to memory of 2636 1084 3DBC.tmp 34 PID 2636 wrote to memory of 2768 2636 3E77.tmp 35 PID 2636 wrote to memory of 2768 2636 3E77.tmp 35 PID 2636 wrote to memory of 2768 2636 3E77.tmp 35 PID 2636 wrote to memory of 2768 2636 3E77.tmp 35 PID 2768 wrote to memory of 2612 2768 3F51.tmp 36 PID 2768 wrote to memory of 2612 2768 3F51.tmp 36 PID 2768 wrote to memory of 2612 2768 3F51.tmp 36 PID 2768 wrote to memory of 2612 2768 3F51.tmp 36 PID 2612 wrote to memory of 1804 2612 400C.tmp 37 PID 2612 wrote to memory of 1804 2612 400C.tmp 37 PID 2612 wrote to memory of 1804 2612 400C.tmp 37 PID 2612 wrote to memory of 1804 2612 400C.tmp 37 PID 1804 wrote to memory of 2416 1804 40D7.tmp 38 PID 1804 wrote to memory of 2416 1804 40D7.tmp 38 PID 1804 wrote to memory of 2416 1804 40D7.tmp 38 PID 1804 wrote to memory of 2416 1804 40D7.tmp 38 PID 2416 wrote to memory of 1248 2416 4183.tmp 39 PID 2416 wrote to memory of 1248 2416 4183.tmp 39 PID 2416 wrote to memory of 1248 2416 4183.tmp 39 PID 2416 wrote to memory of 1248 2416 4183.tmp 39 PID 1248 wrote to memory of 2896 1248 420F.tmp 40 PID 1248 wrote to memory of 2896 1248 420F.tmp 40 PID 1248 wrote to memory of 2896 1248 420F.tmp 40 PID 1248 wrote to memory of 2896 1248 420F.tmp 40 PID 2896 wrote to memory of 2964 2896 42AB.tmp 41 PID 2896 wrote to memory of 2964 2896 42AB.tmp 41 PID 2896 wrote to memory of 2964 2896 42AB.tmp 41 PID 2896 wrote to memory of 2964 2896 42AB.tmp 41 PID 2964 wrote to memory of 1576 2964 4366.tmp 42 PID 2964 wrote to memory of 1576 2964 4366.tmp 42 PID 2964 wrote to memory of 1576 2964 4366.tmp 42 PID 2964 wrote to memory of 1576 2964 4366.tmp 42 PID 1576 wrote to memory of 1640 1576 4460.tmp 43 PID 1576 wrote to memory of 1640 1576 4460.tmp 43 PID 1576 wrote to memory of 1640 1576 4460.tmp 43 PID 1576 wrote to memory of 1640 1576 4460.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_dcb87b5027552512aa4142b3b2878b6d_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_dcb87b5027552512aa4142b3b2878b6d_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\39D5.tmp"C:\Users\Admin\AppData\Local\Temp\39D5.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\3A42.tmp"C:\Users\Admin\AppData\Local\Temp\3A42.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\3B3C.tmp"C:\Users\Admin\AppData\Local\Temp\3B3C.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\3C07.tmp"C:\Users\Admin\AppData\Local\Temp\3C07.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\3CF1.tmp"C:\Users\Admin\AppData\Local\Temp\3CF1.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\3DBC.tmp"C:\Users\Admin\AppData\Local\Temp\3DBC.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\3E77.tmp"C:\Users\Admin\AppData\Local\Temp\3E77.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\3F51.tmp"C:\Users\Admin\AppData\Local\Temp\3F51.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\400C.tmp"C:\Users\Admin\AppData\Local\Temp\400C.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\40D7.tmp"C:\Users\Admin\AppData\Local\Temp\40D7.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\4183.tmp"C:\Users\Admin\AppData\Local\Temp\4183.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\420F.tmp"C:\Users\Admin\AppData\Local\Temp\420F.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\42AB.tmp"C:\Users\Admin\AppData\Local\Temp\42AB.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\4366.tmp"C:\Users\Admin\AppData\Local\Temp\4366.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\4460.tmp"C:\Users\Admin\AppData\Local\Temp\4460.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\451B.tmp"C:\Users\Admin\AppData\Local\Temp\451B.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\4605.tmp"C:\Users\Admin\AppData\Local\Temp\4605.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\46A1.tmp"C:\Users\Admin\AppData\Local\Temp\46A1.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\475C.tmp"C:\Users\Admin\AppData\Local\Temp\475C.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:320 -
C:\Users\Admin\AppData\Local\Temp\4808.tmp"C:\Users\Admin\AppData\Local\Temp\4808.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:672 -
C:\Users\Admin\AppData\Local\Temp\48E2.tmp"C:\Users\Admin\AppData\Local\Temp\48E2.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\49BD.tmp"C:\Users\Admin\AppData\Local\Temp\49BD.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\4B04.tmp"C:\Users\Admin\AppData\Local\Temp\4B04.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:300 -
C:\Users\Admin\AppData\Local\Temp\4B72.tmp"C:\Users\Admin\AppData\Local\Temp\4B72.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\4BDF.tmp"C:\Users\Admin\AppData\Local\Temp\4BDF.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\4C4C.tmp"C:\Users\Admin\AppData\Local\Temp\4C4C.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\4CAA.tmp"C:\Users\Admin\AppData\Local\Temp\4CAA.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\4D65.tmp"C:\Users\Admin\AppData\Local\Temp\4D65.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:764 -
C:\Users\Admin\AppData\Local\Temp\4DE2.tmp"C:\Users\Admin\AppData\Local\Temp\4DE2.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\5013.tmp"C:\Users\Admin\AppData\Local\Temp\5013.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\5071.tmp"C:\Users\Admin\AppData\Local\Temp\5071.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:996 -
C:\Users\Admin\AppData\Local\Temp\50DE.tmp"C:\Users\Admin\AppData\Local\Temp\50DE.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\514B.tmp"C:\Users\Admin\AppData\Local\Temp\514B.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\51B8.tmp"C:\Users\Admin\AppData\Local\Temp\51B8.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\5216.tmp"C:\Users\Admin\AppData\Local\Temp\5216.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\52A2.tmp"C:\Users\Admin\AppData\Local\Temp\52A2.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\5300.tmp"C:\Users\Admin\AppData\Local\Temp\5300.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:952 -
C:\Users\Admin\AppData\Local\Temp\536D.tmp"C:\Users\Admin\AppData\Local\Temp\536D.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\53CB.tmp"C:\Users\Admin\AppData\Local\Temp\53CB.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\5457.tmp"C:\Users\Admin\AppData\Local\Temp\5457.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\54C4.tmp"C:\Users\Admin\AppData\Local\Temp\54C4.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\5551.tmp"C:\Users\Admin\AppData\Local\Temp\5551.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\55BE.tmp"C:\Users\Admin\AppData\Local\Temp\55BE.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\563B.tmp"C:\Users\Admin\AppData\Local\Temp\563B.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\56A8.tmp"C:\Users\Admin\AppData\Local\Temp\56A8.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\5725.tmp"C:\Users\Admin\AppData\Local\Temp\5725.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:988 -
C:\Users\Admin\AppData\Local\Temp\5792.tmp"C:\Users\Admin\AppData\Local\Temp\5792.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\57F0.tmp"C:\Users\Admin\AppData\Local\Temp\57F0.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:892 -
C:\Users\Admin\AppData\Local\Temp\585D.tmp"C:\Users\Admin\AppData\Local\Temp\585D.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\58DA.tmp"C:\Users\Admin\AppData\Local\Temp\58DA.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\5956.tmp"C:\Users\Admin\AppData\Local\Temp\5956.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\59C4.tmp"C:\Users\Admin\AppData\Local\Temp\59C4.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\5A21.tmp"C:\Users\Admin\AppData\Local\Temp\5A21.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\5AEC.tmp"C:\Users\Admin\AppData\Local\Temp\5AEC.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\5B59.tmp"C:\Users\Admin\AppData\Local\Temp\5B59.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\5BD6.tmp"C:\Users\Admin\AppData\Local\Temp\5BD6.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\5C62.tmp"C:\Users\Admin\AppData\Local\Temp\5C62.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\5CDF.tmp"C:\Users\Admin\AppData\Local\Temp\5CDF.tmp"65⤵
- Executes dropped EXE
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\5D4C.tmp"C:\Users\Admin\AppData\Local\Temp\5D4C.tmp"66⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\5DAA.tmp"C:\Users\Admin\AppData\Local\Temp\5DAA.tmp"67⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\5E17.tmp"C:\Users\Admin\AppData\Local\Temp\5E17.tmp"68⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\5E75.tmp"C:\Users\Admin\AppData\Local\Temp\5E75.tmp"69⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\5EE2.tmp"C:\Users\Admin\AppData\Local\Temp\5EE2.tmp"70⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\5FFB.tmp"C:\Users\Admin\AppData\Local\Temp\5FFB.tmp"71⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\6087.tmp"C:\Users\Admin\AppData\Local\Temp\6087.tmp"72⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\60F4.tmp"C:\Users\Admin\AppData\Local\Temp\60F4.tmp"73⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\6162.tmp"C:\Users\Admin\AppData\Local\Temp\6162.tmp"74⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\61DE.tmp"C:\Users\Admin\AppData\Local\Temp\61DE.tmp"75⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\624C.tmp"C:\Users\Admin\AppData\Local\Temp\624C.tmp"76⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\62C8.tmp"C:\Users\Admin\AppData\Local\Temp\62C8.tmp"77⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\6326.tmp"C:\Users\Admin\AppData\Local\Temp\6326.tmp"78⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\63A3.tmp"C:\Users\Admin\AppData\Local\Temp\63A3.tmp"79⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\6410.tmp"C:\Users\Admin\AppData\Local\Temp\6410.tmp"80⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\648D.tmp"C:\Users\Admin\AppData\Local\Temp\648D.tmp"81⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\650A.tmp"C:\Users\Admin\AppData\Local\Temp\650A.tmp"82⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\6577.tmp"C:\Users\Admin\AppData\Local\Temp\6577.tmp"83⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\65F4.tmp"C:\Users\Admin\AppData\Local\Temp\65F4.tmp"84⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\6661.tmp"C:\Users\Admin\AppData\Local\Temp\6661.tmp"85⤵PID:596
-
C:\Users\Admin\AppData\Local\Temp\66DE.tmp"C:\Users\Admin\AppData\Local\Temp\66DE.tmp"86⤵PID:268
-
C:\Users\Admin\AppData\Local\Temp\674B.tmp"C:\Users\Admin\AppData\Local\Temp\674B.tmp"87⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\67B8.tmp"C:\Users\Admin\AppData\Local\Temp\67B8.tmp"88⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\6835.tmp"C:\Users\Admin\AppData\Local\Temp\6835.tmp"89⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\68A2.tmp"C:\Users\Admin\AppData\Local\Temp\68A2.tmp"90⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\691F.tmp"C:\Users\Admin\AppData\Local\Temp\691F.tmp"91⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\699C.tmp"C:\Users\Admin\AppData\Local\Temp\699C.tmp"92⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\6A09.tmp"C:\Users\Admin\AppData\Local\Temp\6A09.tmp"93⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\6A76.tmp"C:\Users\Admin\AppData\Local\Temp\6A76.tmp"94⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\6AF3.tmp"C:\Users\Admin\AppData\Local\Temp\6AF3.tmp"95⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\6B60.tmp"C:\Users\Admin\AppData\Local\Temp\6B60.tmp"96⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\6BDD.tmp"C:\Users\Admin\AppData\Local\Temp\6BDD.tmp"97⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\6C4A.tmp"C:\Users\Admin\AppData\Local\Temp\6C4A.tmp"98⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\6CA8.tmp"C:\Users\Admin\AppData\Local\Temp\6CA8.tmp"99⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\6D05.tmp"C:\Users\Admin\AppData\Local\Temp\6D05.tmp"100⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\6D63.tmp"C:\Users\Admin\AppData\Local\Temp\6D63.tmp"101⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\6DC1.tmp"C:\Users\Admin\AppData\Local\Temp\6DC1.tmp"102⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\6E2E.tmp"C:\Users\Admin\AppData\Local\Temp\6E2E.tmp"103⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\6E8B.tmp"C:\Users\Admin\AppData\Local\Temp\6E8B.tmp"104⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\6EE9.tmp"C:\Users\Admin\AppData\Local\Temp\6EE9.tmp"105⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\6F47.tmp"C:\Users\Admin\AppData\Local\Temp\6F47.tmp"106⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\6FB4.tmp"C:\Users\Admin\AppData\Local\Temp\6FB4.tmp"107⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\7011.tmp"C:\Users\Admin\AppData\Local\Temp\7011.tmp"108⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\707F.tmp"C:\Users\Admin\AppData\Local\Temp\707F.tmp"109⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\70EC.tmp"C:\Users\Admin\AppData\Local\Temp\70EC.tmp"110⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\7169.tmp"C:\Users\Admin\AppData\Local\Temp\7169.tmp"111⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\71D6.tmp"C:\Users\Admin\AppData\Local\Temp\71D6.tmp"112⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\7243.tmp"C:\Users\Admin\AppData\Local\Temp\7243.tmp"113⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\72B0.tmp"C:\Users\Admin\AppData\Local\Temp\72B0.tmp"114⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"115⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\739A.tmp"C:\Users\Admin\AppData\Local\Temp\739A.tmp"116⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\73F8.tmp"C:\Users\Admin\AppData\Local\Temp\73F8.tmp"117⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"118⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\753F.tmp"C:\Users\Admin\AppData\Local\Temp\753F.tmp"119⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\759D.tmp"C:\Users\Admin\AppData\Local\Temp\759D.tmp"120⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\75FB.tmp"C:\Users\Admin\AppData\Local\Temp\75FB.tmp"121⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\7668.tmp"C:\Users\Admin\AppData\Local\Temp\7668.tmp"122⤵PID:2316
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-