Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
21/05/2024, 02:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-21_608706a0be08dc748f18a937a75e57bf_mafia.exe
Resource
win7-20240508-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-21_608706a0be08dc748f18a937a75e57bf_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-05-21_608706a0be08dc748f18a937a75e57bf_mafia.exe
-
Size
530KB
-
MD5
608706a0be08dc748f18a937a75e57bf
-
SHA1
2eaac4906fab3091cb3bdcc88624b74f41d1876a
-
SHA256
13c3c0e517e1be9539dd06ea08fccf7c66e12c8b4811a7d2d8066441554dab00
-
SHA512
be441976faa5d31d5b7fd4c36ad763261373c2422efa0ed34f1494ea726dd221464956d2d334804c0d99e5640588c613942e81d7d061a4cc5f7473b0ac76a77b
-
SSDEEP
12288:AU5rCOTeiohi21cE7S9jfcHTpwnW7TQHTNZulFVg0M1:AUQOJo021cCAjfGpwW7szNclFV/M1
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1792 F4C.tmp 2996 FC9.tmp 2676 1056.tmp 2672 10E2.tmp 2456 116E.tmp 2724 11EB.tmp 2760 1258.tmp 2564 12C6.tmp 2480 1333.tmp 2896 13B0.tmp 2900 142C.tmp 1884 149A.tmp 1488 1507.tmp 2512 1564.tmp 2748 15F1.tmp 1872 166E.tmp 1648 16EA.tmp 800 1758.tmp 1864 17D4.tmp 760 1842.tmp 1380 18AF.tmp 1324 191C.tmp 2880 1989.tmp 2876 19D7.tmp 2196 1A25.tmp 2220 1A64.tmp 1616 1AA2.tmp 2292 1AE0.tmp 664 1B1F.tmp 572 1B5D.tmp 2812 1B9C.tmp 584 1BDA.tmp 836 1C18.tmp 1728 1C57.tmp 2412 1CA5.tmp 2364 1CE3.tmp 2068 1D22.tmp 440 1D60.tmp 2000 1DAE.tmp 3020 1DEC.tmp 904 1E2B.tmp 1572 1E69.tmp 940 1EA8.tmp 2644 1EE6.tmp 1552 1F24.tmp 1712 1F63.tmp 644 1FA1.tmp 2840 1FE0.tmp 608 201E.tmp 776 205C.tmp 2536 209B.tmp 2728 20D9.tmp 1680 2118.tmp 2360 2166.tmp 2044 21B4.tmp 2404 21F2.tmp 2168 2240.tmp 2732 228E.tmp 3060 22DC.tmp 2680 231A.tmp 2700 2359.tmp 2676 2397.tmp 2652 23E5.tmp 2708 2424.tmp -
Loads dropped DLL 64 IoCs
pid Process 1632 2024-05-21_608706a0be08dc748f18a937a75e57bf_mafia.exe 1792 F4C.tmp 2996 FC9.tmp 2676 1056.tmp 2672 10E2.tmp 2456 116E.tmp 2724 11EB.tmp 2760 1258.tmp 2564 12C6.tmp 2480 1333.tmp 2896 13B0.tmp 2900 142C.tmp 1884 149A.tmp 1488 1507.tmp 2512 1564.tmp 2748 15F1.tmp 1872 166E.tmp 1648 16EA.tmp 800 1758.tmp 1864 17D4.tmp 760 1842.tmp 1380 18AF.tmp 1324 191C.tmp 2880 1989.tmp 2876 19D7.tmp 2196 1A25.tmp 2220 1A64.tmp 1616 1AA2.tmp 2292 1AE0.tmp 664 1B1F.tmp 572 1B5D.tmp 2812 1B9C.tmp 584 1BDA.tmp 836 1C18.tmp 1728 1C57.tmp 2412 1CA5.tmp 2364 1CE3.tmp 2068 1D22.tmp 440 1D60.tmp 2000 1DAE.tmp 3020 1DEC.tmp 904 1E2B.tmp 1572 1E69.tmp 940 1EA8.tmp 2644 1EE6.tmp 1552 1F24.tmp 1712 1F63.tmp 644 1FA1.tmp 2840 1FE0.tmp 608 201E.tmp 776 205C.tmp 2536 209B.tmp 2728 20D9.tmp 1680 2118.tmp 2360 2166.tmp 2044 21B4.tmp 2404 21F2.tmp 2168 2240.tmp 2732 228E.tmp 3060 22DC.tmp 2680 231A.tmp 2700 2359.tmp 2676 2397.tmp 2652 23E5.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1632 wrote to memory of 1792 1632 2024-05-21_608706a0be08dc748f18a937a75e57bf_mafia.exe 28 PID 1632 wrote to memory of 1792 1632 2024-05-21_608706a0be08dc748f18a937a75e57bf_mafia.exe 28 PID 1632 wrote to memory of 1792 1632 2024-05-21_608706a0be08dc748f18a937a75e57bf_mafia.exe 28 PID 1632 wrote to memory of 1792 1632 2024-05-21_608706a0be08dc748f18a937a75e57bf_mafia.exe 28 PID 1792 wrote to memory of 2996 1792 F4C.tmp 29 PID 1792 wrote to memory of 2996 1792 F4C.tmp 29 PID 1792 wrote to memory of 2996 1792 F4C.tmp 29 PID 1792 wrote to memory of 2996 1792 F4C.tmp 29 PID 2996 wrote to memory of 2676 2996 FC9.tmp 30 PID 2996 wrote to memory of 2676 2996 FC9.tmp 30 PID 2996 wrote to memory of 2676 2996 FC9.tmp 30 PID 2996 wrote to memory of 2676 2996 FC9.tmp 30 PID 2676 wrote to memory of 2672 2676 1056.tmp 31 PID 2676 wrote to memory of 2672 2676 1056.tmp 31 PID 2676 wrote to memory of 2672 2676 1056.tmp 31 PID 2676 wrote to memory of 2672 2676 1056.tmp 31 PID 2672 wrote to memory of 2456 2672 10E2.tmp 32 PID 2672 wrote to memory of 2456 2672 10E2.tmp 32 PID 2672 wrote to memory of 2456 2672 10E2.tmp 32 PID 2672 wrote to memory of 2456 2672 10E2.tmp 32 PID 2456 wrote to memory of 2724 2456 116E.tmp 33 PID 2456 wrote to memory of 2724 2456 116E.tmp 33 PID 2456 wrote to memory of 2724 2456 116E.tmp 33 PID 2456 wrote to memory of 2724 2456 116E.tmp 33 PID 2724 wrote to memory of 2760 2724 11EB.tmp 34 PID 2724 wrote to memory of 2760 2724 11EB.tmp 34 PID 2724 wrote to memory of 2760 2724 11EB.tmp 34 PID 2724 wrote to memory of 2760 2724 11EB.tmp 34 PID 2760 wrote to memory of 2564 2760 1258.tmp 35 PID 2760 wrote to memory of 2564 2760 1258.tmp 35 PID 2760 wrote to memory of 2564 2760 1258.tmp 35 PID 2760 wrote to memory of 2564 2760 1258.tmp 35 PID 2564 wrote to memory of 2480 2564 12C6.tmp 36 PID 2564 wrote to memory of 2480 2564 12C6.tmp 36 PID 2564 wrote to memory of 2480 2564 12C6.tmp 36 PID 2564 wrote to memory of 2480 2564 12C6.tmp 36 PID 2480 wrote to memory of 2896 2480 1333.tmp 37 PID 2480 wrote to memory of 2896 2480 1333.tmp 37 PID 2480 wrote to memory of 2896 2480 1333.tmp 37 PID 2480 wrote to memory of 2896 2480 1333.tmp 37 PID 2896 wrote to memory of 2900 2896 13B0.tmp 38 PID 2896 wrote to memory of 2900 2896 13B0.tmp 38 PID 2896 wrote to memory of 2900 2896 13B0.tmp 38 PID 2896 wrote to memory of 2900 2896 13B0.tmp 38 PID 2900 wrote to memory of 1884 2900 142C.tmp 39 PID 2900 wrote to memory of 1884 2900 142C.tmp 39 PID 2900 wrote to memory of 1884 2900 142C.tmp 39 PID 2900 wrote to memory of 1884 2900 142C.tmp 39 PID 1884 wrote to memory of 1488 1884 149A.tmp 40 PID 1884 wrote to memory of 1488 1884 149A.tmp 40 PID 1884 wrote to memory of 1488 1884 149A.tmp 40 PID 1884 wrote to memory of 1488 1884 149A.tmp 40 PID 1488 wrote to memory of 2512 1488 1507.tmp 41 PID 1488 wrote to memory of 2512 1488 1507.tmp 41 PID 1488 wrote to memory of 2512 1488 1507.tmp 41 PID 1488 wrote to memory of 2512 1488 1507.tmp 41 PID 2512 wrote to memory of 2748 2512 1564.tmp 42 PID 2512 wrote to memory of 2748 2512 1564.tmp 42 PID 2512 wrote to memory of 2748 2512 1564.tmp 42 PID 2512 wrote to memory of 2748 2512 1564.tmp 42 PID 2748 wrote to memory of 1872 2748 15F1.tmp 43 PID 2748 wrote to memory of 1872 2748 15F1.tmp 43 PID 2748 wrote to memory of 1872 2748 15F1.tmp 43 PID 2748 wrote to memory of 1872 2748 15F1.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_608706a0be08dc748f18a937a75e57bf_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-21_608706a0be08dc748f18a937a75e57bf_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\F4C.tmp"C:\Users\Admin\AppData\Local\Temp\F4C.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\FC9.tmp"C:\Users\Admin\AppData\Local\Temp\FC9.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\1056.tmp"C:\Users\Admin\AppData\Local\Temp\1056.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\10E2.tmp"C:\Users\Admin\AppData\Local\Temp\10E2.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\116E.tmp"C:\Users\Admin\AppData\Local\Temp\116E.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\11EB.tmp"C:\Users\Admin\AppData\Local\Temp\11EB.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\1258.tmp"C:\Users\Admin\AppData\Local\Temp\1258.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\12C6.tmp"C:\Users\Admin\AppData\Local\Temp\12C6.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\1333.tmp"C:\Users\Admin\AppData\Local\Temp\1333.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\13B0.tmp"C:\Users\Admin\AppData\Local\Temp\13B0.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\142C.tmp"C:\Users\Admin\AppData\Local\Temp\142C.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\149A.tmp"C:\Users\Admin\AppData\Local\Temp\149A.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\1507.tmp"C:\Users\Admin\AppData\Local\Temp\1507.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\1564.tmp"C:\Users\Admin\AppData\Local\Temp\1564.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\15F1.tmp"C:\Users\Admin\AppData\Local\Temp\15F1.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\166E.tmp"C:\Users\Admin\AppData\Local\Temp\166E.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\16EA.tmp"C:\Users\Admin\AppData\Local\Temp\16EA.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\1758.tmp"C:\Users\Admin\AppData\Local\Temp\1758.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:800 -
C:\Users\Admin\AppData\Local\Temp\17D4.tmp"C:\Users\Admin\AppData\Local\Temp\17D4.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\1842.tmp"C:\Users\Admin\AppData\Local\Temp\1842.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:760 -
C:\Users\Admin\AppData\Local\Temp\18AF.tmp"C:\Users\Admin\AppData\Local\Temp\18AF.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\191C.tmp"C:\Users\Admin\AppData\Local\Temp\191C.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\1989.tmp"C:\Users\Admin\AppData\Local\Temp\1989.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\19D7.tmp"C:\Users\Admin\AppData\Local\Temp\19D7.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\1A25.tmp"C:\Users\Admin\AppData\Local\Temp\1A25.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\1A64.tmp"C:\Users\Admin\AppData\Local\Temp\1A64.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\1AE0.tmp"C:\Users\Admin\AppData\Local\Temp\1AE0.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:664 -
C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:572 -
C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:584 -
C:\Users\Admin\AppData\Local\Temp\1C18.tmp"C:\Users\Admin\AppData\Local\Temp\1C18.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:836 -
C:\Users\Admin\AppData\Local\Temp\1C57.tmp"C:\Users\Admin\AppData\Local\Temp\1C57.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\1D22.tmp"C:\Users\Admin\AppData\Local\Temp\1D22.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\1D60.tmp"C:\Users\Admin\AppData\Local\Temp\1D60.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:440 -
C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:904 -
C:\Users\Admin\AppData\Local\Temp\1E69.tmp"C:\Users\Admin\AppData\Local\Temp\1E69.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:940 -
C:\Users\Admin\AppData\Local\Temp\1EE6.tmp"C:\Users\Admin\AppData\Local\Temp\1EE6.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\1F24.tmp"C:\Users\Admin\AppData\Local\Temp\1F24.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\1F63.tmp"C:\Users\Admin\AppData\Local\Temp\1F63.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\1FA1.tmp"C:\Users\Admin\AppData\Local\Temp\1FA1.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:644 -
C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\201E.tmp"C:\Users\Admin\AppData\Local\Temp\201E.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:608 -
C:\Users\Admin\AppData\Local\Temp\205C.tmp"C:\Users\Admin\AppData\Local\Temp\205C.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:776 -
C:\Users\Admin\AppData\Local\Temp\209B.tmp"C:\Users\Admin\AppData\Local\Temp\209B.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\20D9.tmp"C:\Users\Admin\AppData\Local\Temp\20D9.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\2118.tmp"C:\Users\Admin\AppData\Local\Temp\2118.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\2166.tmp"C:\Users\Admin\AppData\Local\Temp\2166.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\21B4.tmp"C:\Users\Admin\AppData\Local\Temp\21B4.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\21F2.tmp"C:\Users\Admin\AppData\Local\Temp\21F2.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\2240.tmp"C:\Users\Admin\AppData\Local\Temp\2240.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\228E.tmp"C:\Users\Admin\AppData\Local\Temp\228E.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\22DC.tmp"C:\Users\Admin\AppData\Local\Temp\22DC.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\231A.tmp"C:\Users\Admin\AppData\Local\Temp\231A.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\2359.tmp"C:\Users\Admin\AppData\Local\Temp\2359.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\2397.tmp"C:\Users\Admin\AppData\Local\Temp\2397.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\2424.tmp"C:\Users\Admin\AppData\Local\Temp\2424.tmp"65⤵
- Executes dropped EXE
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"66⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\24A0.tmp"C:\Users\Admin\AppData\Local\Temp\24A0.tmp"67⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\24DF.tmp"C:\Users\Admin\AppData\Local\Temp\24DF.tmp"68⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\251D.tmp"C:\Users\Admin\AppData\Local\Temp\251D.tmp"69⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"70⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\259A.tmp"C:\Users\Admin\AppData\Local\Temp\259A.tmp"71⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\25D8.tmp"C:\Users\Admin\AppData\Local\Temp\25D8.tmp"72⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"73⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\2665.tmp"C:\Users\Admin\AppData\Local\Temp\2665.tmp"74⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\26A3.tmp"C:\Users\Admin\AppData\Local\Temp\26A3.tmp"75⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\26E2.tmp"C:\Users\Admin\AppData\Local\Temp\26E2.tmp"76⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\2720.tmp"C:\Users\Admin\AppData\Local\Temp\2720.tmp"77⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\275E.tmp"C:\Users\Admin\AppData\Local\Temp\275E.tmp"78⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\279D.tmp"C:\Users\Admin\AppData\Local\Temp\279D.tmp"79⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\27DB.tmp"C:\Users\Admin\AppData\Local\Temp\27DB.tmp"80⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\281A.tmp"C:\Users\Admin\AppData\Local\Temp\281A.tmp"81⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\2858.tmp"C:\Users\Admin\AppData\Local\Temp\2858.tmp"82⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\2896.tmp"C:\Users\Admin\AppData\Local\Temp\2896.tmp"83⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\28D5.tmp"C:\Users\Admin\AppData\Local\Temp\28D5.tmp"84⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\2913.tmp"C:\Users\Admin\AppData\Local\Temp\2913.tmp"85⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\2952.tmp"C:\Users\Admin\AppData\Local\Temp\2952.tmp"86⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\29A0.tmp"C:\Users\Admin\AppData\Local\Temp\29A0.tmp"87⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\29DE.tmp"C:\Users\Admin\AppData\Local\Temp\29DE.tmp"88⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"89⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"90⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\2A99.tmp"C:\Users\Admin\AppData\Local\Temp\2A99.tmp"91⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"92⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\2B16.tmp"C:\Users\Admin\AppData\Local\Temp\2B16.tmp"93⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\2B54.tmp"C:\Users\Admin\AppData\Local\Temp\2B54.tmp"94⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\2B93.tmp"C:\Users\Admin\AppData\Local\Temp\2B93.tmp"95⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"96⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\2C10.tmp"C:\Users\Admin\AppData\Local\Temp\2C10.tmp"97⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"98⤵PID:664
-
C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"99⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"100⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\2D09.tmp"C:\Users\Admin\AppData\Local\Temp\2D09.tmp"101⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\2D48.tmp"C:\Users\Admin\AppData\Local\Temp\2D48.tmp"102⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\2D86.tmp"C:\Users\Admin\AppData\Local\Temp\2D86.tmp"103⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"104⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\2E03.tmp"C:\Users\Admin\AppData\Local\Temp\2E03.tmp"105⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\2E41.tmp"C:\Users\Admin\AppData\Local\Temp\2E41.tmp"106⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"107⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"108⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"109⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"110⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\2F89.tmp"C:\Users\Admin\AppData\Local\Temp\2F89.tmp"111⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"112⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\3006.tmp"C:\Users\Admin\AppData\Local\Temp\3006.tmp"113⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\3044.tmp"C:\Users\Admin\AppData\Local\Temp\3044.tmp"114⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\3082.tmp"C:\Users\Admin\AppData\Local\Temp\3082.tmp"115⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\30D0.tmp"C:\Users\Admin\AppData\Local\Temp\30D0.tmp"116⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\311E.tmp"C:\Users\Admin\AppData\Local\Temp\311E.tmp"117⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\316C.tmp"C:\Users\Admin\AppData\Local\Temp\316C.tmp"118⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\31AB.tmp"C:\Users\Admin\AppData\Local\Temp\31AB.tmp"119⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\31E9.tmp"C:\Users\Admin\AppData\Local\Temp\31E9.tmp"120⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\3228.tmp"C:\Users\Admin\AppData\Local\Temp\3228.tmp"121⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\3266.tmp"C:\Users\Admin\AppData\Local\Temp\3266.tmp"122⤵PID:1248
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-