Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
11/02/2024, 11:49
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-11_efbc07997341353b9fb72ce02ecd9864_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-11_efbc07997341353b9fb72ce02ecd9864_mafia.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-02-11_efbc07997341353b9fb72ce02ecd9864_mafia.exe
-
Size
488KB
-
MD5
efbc07997341353b9fb72ce02ecd9864
-
SHA1
d5d86bc14ea630e78adf3010088246159a599b25
-
SHA256
1b94bf805eae04909b4c324b035b1a836a90b1b93b123a4fb11ad604556b9bba
-
SHA512
0f636ecab8303cc478bbba8e7cdf9c94a94a6ceeac5945f41e0630452a2309ab2541b38a8d7844028c689de9a5cd774967c4190129452992a59989541bd8cf67
-
SSDEEP
12288:/U5rCOTeiD95VXL2U5fN2S9r2/iTSjFNZ:/UQOJD95V7D5f4N5N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2984 934.tmp 2924 9B1.tmp 2464 A5D.tmp 2820 AE9.tmp 2944 B56.tmp 2476 BD3.tmp 2872 C50.tmp 2808 CBD.tmp 2220 D1B.tmp 2648 DB7.tmp 3024 E43.tmp 2544 EDF.tmp 2912 F5C.tmp 2500 FC9.tmp 912 1056.tmp 1656 10F2.tmp 2348 117E.tmp 1800 11FB.tmp 1044 1297.tmp 1160 12F4.tmp 2016 1342.tmp 1680 13B0.tmp 1196 142C.tmp 1724 147A.tmp 1692 14C8.tmp 1640 1516.tmp 2136 1564.tmp 2596 15A3.tmp 2112 15F1.tmp 2576 162F.tmp 688 167D.tmp 772 16BC.tmp 1600 16FA.tmp 1812 1738.tmp 1888 1777.tmp 2800 17C5.tmp 2412 1813.tmp 1884 1861.tmp 2420 18AF.tmp 2816 18FD.tmp 1548 194B.tmp 888 1989.tmp 808 19D7.tmp 1880 1A35.tmp 1876 1A83.tmp 968 1AD1.tmp 2196 1B0F.tmp 2216 1B5D.tmp 1744 1BAB.tmp 632 1BEA.tmp 2128 1C38.tmp 2572 1C76.tmp 1520 1CB4.tmp 2580 1CF3.tmp 2980 1D41.tmp 3036 1D7F.tmp 3052 1DBE.tmp 1300 1E0C.tmp 2712 1E5A.tmp 2748 1E98.tmp 2836 1ED6.tmp 2772 1F15.tmp 2764 1F53.tmp 2736 1F92.tmp -
Loads dropped DLL 64 IoCs
pid Process 1272 2024-02-11_efbc07997341353b9fb72ce02ecd9864_mafia.exe 2984 934.tmp 2924 9B1.tmp 2464 A5D.tmp 2820 AE9.tmp 2944 B56.tmp 2476 BD3.tmp 2872 C50.tmp 2808 CBD.tmp 2220 D1B.tmp 2648 DB7.tmp 3024 E43.tmp 2544 EDF.tmp 2912 F5C.tmp 2500 FC9.tmp 912 1056.tmp 1656 10F2.tmp 2348 117E.tmp 1800 11FB.tmp 1044 1297.tmp 1160 12F4.tmp 2016 1342.tmp 1680 13B0.tmp 1196 142C.tmp 1724 147A.tmp 1692 14C8.tmp 1640 1516.tmp 2136 1564.tmp 2596 15A3.tmp 2112 15F1.tmp 2576 162F.tmp 688 167D.tmp 772 16BC.tmp 1600 16FA.tmp 1812 1738.tmp 1888 1777.tmp 2800 17C5.tmp 2412 1813.tmp 1884 1861.tmp 2420 18AF.tmp 2816 18FD.tmp 1548 194B.tmp 888 1989.tmp 808 19D7.tmp 1880 1A35.tmp 1876 1A83.tmp 968 1AD1.tmp 2196 1B0F.tmp 2216 1B5D.tmp 1744 1BAB.tmp 632 1BEA.tmp 2128 1C38.tmp 2572 1C76.tmp 1520 1CB4.tmp 2580 1CF3.tmp 2980 1D41.tmp 3036 1D7F.tmp 3052 1DBE.tmp 1300 1E0C.tmp 2712 1E5A.tmp 2748 1E98.tmp 2836 1ED6.tmp 2772 1F15.tmp 2764 1F53.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1272 wrote to memory of 2984 1272 2024-02-11_efbc07997341353b9fb72ce02ecd9864_mafia.exe 28 PID 1272 wrote to memory of 2984 1272 2024-02-11_efbc07997341353b9fb72ce02ecd9864_mafia.exe 28 PID 1272 wrote to memory of 2984 1272 2024-02-11_efbc07997341353b9fb72ce02ecd9864_mafia.exe 28 PID 1272 wrote to memory of 2984 1272 2024-02-11_efbc07997341353b9fb72ce02ecd9864_mafia.exe 28 PID 2984 wrote to memory of 2924 2984 934.tmp 29 PID 2984 wrote to memory of 2924 2984 934.tmp 29 PID 2984 wrote to memory of 2924 2984 934.tmp 29 PID 2984 wrote to memory of 2924 2984 934.tmp 29 PID 2924 wrote to memory of 2464 2924 9B1.tmp 30 PID 2924 wrote to memory of 2464 2924 9B1.tmp 30 PID 2924 wrote to memory of 2464 2924 9B1.tmp 30 PID 2924 wrote to memory of 2464 2924 9B1.tmp 30 PID 2464 wrote to memory of 2820 2464 A5D.tmp 31 PID 2464 wrote to memory of 2820 2464 A5D.tmp 31 PID 2464 wrote to memory of 2820 2464 A5D.tmp 31 PID 2464 wrote to memory of 2820 2464 A5D.tmp 31 PID 2820 wrote to memory of 2944 2820 AE9.tmp 32 PID 2820 wrote to memory of 2944 2820 AE9.tmp 32 PID 2820 wrote to memory of 2944 2820 AE9.tmp 32 PID 2820 wrote to memory of 2944 2820 AE9.tmp 32 PID 2944 wrote to memory of 2476 2944 B56.tmp 33 PID 2944 wrote to memory of 2476 2944 B56.tmp 33 PID 2944 wrote to memory of 2476 2944 B56.tmp 33 PID 2944 wrote to memory of 2476 2944 B56.tmp 33 PID 2476 wrote to memory of 2872 2476 BD3.tmp 34 PID 2476 wrote to memory of 2872 2476 BD3.tmp 34 PID 2476 wrote to memory of 2872 2476 BD3.tmp 34 PID 2476 wrote to memory of 2872 2476 BD3.tmp 34 PID 2872 wrote to memory of 2808 2872 C50.tmp 35 PID 2872 wrote to memory of 2808 2872 C50.tmp 35 PID 2872 wrote to memory of 2808 2872 C50.tmp 35 PID 2872 wrote to memory of 2808 2872 C50.tmp 35 PID 2808 wrote to memory of 2220 2808 CBD.tmp 36 PID 2808 wrote to memory of 2220 2808 CBD.tmp 36 PID 2808 wrote to memory of 2220 2808 CBD.tmp 36 PID 2808 wrote to memory of 2220 2808 CBD.tmp 36 PID 2220 wrote to memory of 2648 2220 D1B.tmp 37 PID 2220 wrote to memory of 2648 2220 D1B.tmp 37 PID 2220 wrote to memory of 2648 2220 D1B.tmp 37 PID 2220 wrote to memory of 2648 2220 D1B.tmp 37 PID 2648 wrote to memory of 3024 2648 DB7.tmp 38 PID 2648 wrote to memory of 3024 2648 DB7.tmp 38 PID 2648 wrote to memory of 3024 2648 DB7.tmp 38 PID 2648 wrote to memory of 3024 2648 DB7.tmp 38 PID 3024 wrote to memory of 2544 3024 E43.tmp 39 PID 3024 wrote to memory of 2544 3024 E43.tmp 39 PID 3024 wrote to memory of 2544 3024 E43.tmp 39 PID 3024 wrote to memory of 2544 3024 E43.tmp 39 PID 2544 wrote to memory of 2912 2544 EDF.tmp 40 PID 2544 wrote to memory of 2912 2544 EDF.tmp 40 PID 2544 wrote to memory of 2912 2544 EDF.tmp 40 PID 2544 wrote to memory of 2912 2544 EDF.tmp 40 PID 2912 wrote to memory of 2500 2912 F5C.tmp 41 PID 2912 wrote to memory of 2500 2912 F5C.tmp 41 PID 2912 wrote to memory of 2500 2912 F5C.tmp 41 PID 2912 wrote to memory of 2500 2912 F5C.tmp 41 PID 2500 wrote to memory of 912 2500 FC9.tmp 42 PID 2500 wrote to memory of 912 2500 FC9.tmp 42 PID 2500 wrote to memory of 912 2500 FC9.tmp 42 PID 2500 wrote to memory of 912 2500 FC9.tmp 42 PID 912 wrote to memory of 1656 912 1056.tmp 43 PID 912 wrote to memory of 1656 912 1056.tmp 43 PID 912 wrote to memory of 1656 912 1056.tmp 43 PID 912 wrote to memory of 1656 912 1056.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-11_efbc07997341353b9fb72ce02ecd9864_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-11_efbc07997341353b9fb72ce02ecd9864_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\934.tmp"C:\Users\Admin\AppData\Local\Temp\934.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\9B1.tmp"C:\Users\Admin\AppData\Local\Temp\9B1.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\A5D.tmp"C:\Users\Admin\AppData\Local\Temp\A5D.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\AE9.tmp"C:\Users\Admin\AppData\Local\Temp\AE9.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\B56.tmp"C:\Users\Admin\AppData\Local\Temp\B56.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\BD3.tmp"C:\Users\Admin\AppData\Local\Temp\BD3.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\C50.tmp"C:\Users\Admin\AppData\Local\Temp\C50.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\CBD.tmp"C:\Users\Admin\AppData\Local\Temp\CBD.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\D1B.tmp"C:\Users\Admin\AppData\Local\Temp\D1B.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\DB7.tmp"C:\Users\Admin\AppData\Local\Temp\DB7.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\E43.tmp"C:\Users\Admin\AppData\Local\Temp\E43.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\EDF.tmp"C:\Users\Admin\AppData\Local\Temp\EDF.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\F5C.tmp"C:\Users\Admin\AppData\Local\Temp\F5C.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\FC9.tmp"C:\Users\Admin\AppData\Local\Temp\FC9.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\1056.tmp"C:\Users\Admin\AppData\Local\Temp\1056.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Users\Admin\AppData\Local\Temp\10F2.tmp"C:\Users\Admin\AppData\Local\Temp\10F2.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\117E.tmp"C:\Users\Admin\AppData\Local\Temp\117E.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\11FB.tmp"C:\Users\Admin\AppData\Local\Temp\11FB.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\1297.tmp"C:\Users\Admin\AppData\Local\Temp\1297.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\12F4.tmp"C:\Users\Admin\AppData\Local\Temp\12F4.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\1342.tmp"C:\Users\Admin\AppData\Local\Temp\1342.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\13B0.tmp"C:\Users\Admin\AppData\Local\Temp\13B0.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\142C.tmp"C:\Users\Admin\AppData\Local\Temp\142C.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\147A.tmp"C:\Users\Admin\AppData\Local\Temp\147A.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\14C8.tmp"C:\Users\Admin\AppData\Local\Temp\14C8.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\1516.tmp"C:\Users\Admin\AppData\Local\Temp\1516.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\1564.tmp"C:\Users\Admin\AppData\Local\Temp\1564.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\15A3.tmp"C:\Users\Admin\AppData\Local\Temp\15A3.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\15F1.tmp"C:\Users\Admin\AppData\Local\Temp\15F1.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\162F.tmp"C:\Users\Admin\AppData\Local\Temp\162F.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\167D.tmp"C:\Users\Admin\AppData\Local\Temp\167D.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:688 -
C:\Users\Admin\AppData\Local\Temp\16BC.tmp"C:\Users\Admin\AppData\Local\Temp\16BC.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:772 -
C:\Users\Admin\AppData\Local\Temp\16FA.tmp"C:\Users\Admin\AppData\Local\Temp\16FA.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\1738.tmp"C:\Users\Admin\AppData\Local\Temp\1738.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\1777.tmp"C:\Users\Admin\AppData\Local\Temp\1777.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\17C5.tmp"C:\Users\Admin\AppData\Local\Temp\17C5.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\1813.tmp"C:\Users\Admin\AppData\Local\Temp\1813.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\1861.tmp"C:\Users\Admin\AppData\Local\Temp\1861.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\18AF.tmp"C:\Users\Admin\AppData\Local\Temp\18AF.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\18FD.tmp"C:\Users\Admin\AppData\Local\Temp\18FD.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\194B.tmp"C:\Users\Admin\AppData\Local\Temp\194B.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\1989.tmp"C:\Users\Admin\AppData\Local\Temp\1989.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:888 -
C:\Users\Admin\AppData\Local\Temp\19D7.tmp"C:\Users\Admin\AppData\Local\Temp\19D7.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:808 -
C:\Users\Admin\AppData\Local\Temp\1A35.tmp"C:\Users\Admin\AppData\Local\Temp\1A35.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\1A83.tmp"C:\Users\Admin\AppData\Local\Temp\1A83.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:968 -
C:\Users\Admin\AppData\Local\Temp\1B0F.tmp"C:\Users\Admin\AppData\Local\Temp\1B0F.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\1BEA.tmp"C:\Users\Admin\AppData\Local\Temp\1BEA.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:632 -
C:\Users\Admin\AppData\Local\Temp\1C38.tmp"C:\Users\Admin\AppData\Local\Temp\1C38.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\1C76.tmp"C:\Users\Admin\AppData\Local\Temp\1C76.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\1CB4.tmp"C:\Users\Admin\AppData\Local\Temp\1CB4.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\1D41.tmp"C:\Users\Admin\AppData\Local\Temp\1D41.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\1E98.tmp"C:\Users\Admin\AppData\Local\Temp\1E98.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\1F15.tmp"C:\Users\Admin\AppData\Local\Temp\1F15.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\1F53.tmp"C:\Users\Admin\AppData\Local\Temp\1F53.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\1F92.tmp"C:\Users\Admin\AppData\Local\Temp\1F92.tmp"65⤵
- Executes dropped EXE
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"66⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\200E.tmp"C:\Users\Admin\AppData\Local\Temp\200E.tmp"67⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\204D.tmp"C:\Users\Admin\AppData\Local\Temp\204D.tmp"68⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\208B.tmp"C:\Users\Admin\AppData\Local\Temp\208B.tmp"69⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\20D9.tmp"C:\Users\Admin\AppData\Local\Temp\20D9.tmp"70⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\2127.tmp"C:\Users\Admin\AppData\Local\Temp\2127.tmp"71⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\2175.tmp"C:\Users\Admin\AppData\Local\Temp\2175.tmp"72⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\21B4.tmp"C:\Users\Admin\AppData\Local\Temp\21B4.tmp"73⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\21F2.tmp"C:\Users\Admin\AppData\Local\Temp\21F2.tmp"74⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\2240.tmp"C:\Users\Admin\AppData\Local\Temp\2240.tmp"75⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\228E.tmp"C:\Users\Admin\AppData\Local\Temp\228E.tmp"76⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\22DC.tmp"C:\Users\Admin\AppData\Local\Temp\22DC.tmp"77⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\232A.tmp"C:\Users\Admin\AppData\Local\Temp\232A.tmp"78⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\2368.tmp"C:\Users\Admin\AppData\Local\Temp\2368.tmp"79⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\23A7.tmp"C:\Users\Admin\AppData\Local\Temp\23A7.tmp"80⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"81⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\2433.tmp"C:\Users\Admin\AppData\Local\Temp\2433.tmp"82⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\2472.tmp"C:\Users\Admin\AppData\Local\Temp\2472.tmp"83⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\24B0.tmp"C:\Users\Admin\AppData\Local\Temp\24B0.tmp"84⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\24FE.tmp"C:\Users\Admin\AppData\Local\Temp\24FE.tmp"85⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\253C.tmp"C:\Users\Admin\AppData\Local\Temp\253C.tmp"86⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\257B.tmp"C:\Users\Admin\AppData\Local\Temp\257B.tmp"87⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\25B9.tmp"C:\Users\Admin\AppData\Local\Temp\25B9.tmp"88⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\25F8.tmp"C:\Users\Admin\AppData\Local\Temp\25F8.tmp"89⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\2646.tmp"C:\Users\Admin\AppData\Local\Temp\2646.tmp"90⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\2684.tmp"C:\Users\Admin\AppData\Local\Temp\2684.tmp"91⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\26C2.tmp"C:\Users\Admin\AppData\Local\Temp\26C2.tmp"92⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\2701.tmp"C:\Users\Admin\AppData\Local\Temp\2701.tmp"93⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\273F.tmp"C:\Users\Admin\AppData\Local\Temp\273F.tmp"94⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\277E.tmp"C:\Users\Admin\AppData\Local\Temp\277E.tmp"95⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\27BC.tmp"C:\Users\Admin\AppData\Local\Temp\27BC.tmp"96⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"97⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\2848.tmp"C:\Users\Admin\AppData\Local\Temp\2848.tmp"98⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\2887.tmp"C:\Users\Admin\AppData\Local\Temp\2887.tmp"99⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\28C5.tmp"C:\Users\Admin\AppData\Local\Temp\28C5.tmp"100⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\2913.tmp"C:\Users\Admin\AppData\Local\Temp\2913.tmp"101⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\2952.tmp"C:\Users\Admin\AppData\Local\Temp\2952.tmp"102⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\2990.tmp"C:\Users\Admin\AppData\Local\Temp\2990.tmp"103⤵PID:332
-
C:\Users\Admin\AppData\Local\Temp\29DE.tmp"C:\Users\Admin\AppData\Local\Temp\29DE.tmp"104⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"105⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"106⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"107⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\2B06.tmp"C:\Users\Admin\AppData\Local\Temp\2B06.tmp"108⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\2B45.tmp"C:\Users\Admin\AppData\Local\Temp\2B45.tmp"109⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\2B93.tmp"C:\Users\Admin\AppData\Local\Temp\2B93.tmp"110⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"111⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"112⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"113⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"114⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"115⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\2D57.tmp"C:\Users\Admin\AppData\Local\Temp\2D57.tmp"116⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"117⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"118⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\2E22.tmp"C:\Users\Admin\AppData\Local\Temp\2E22.tmp"119⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\2E60.tmp"C:\Users\Admin\AppData\Local\Temp\2E60.tmp"120⤵PID:328
-
C:\Users\Admin\AppData\Local\Temp\2E9F.tmp"C:\Users\Admin\AppData\Local\Temp\2E9F.tmp"121⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\2EDD.tmp"C:\Users\Admin\AppData\Local\Temp\2EDD.tmp"122⤵PID:1584
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-