Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
19/03/2024, 10:30
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-19_e62ddf02f1827459a22b6410305abc0c_mafia.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-03-19_e62ddf02f1827459a22b6410305abc0c_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-19_e62ddf02f1827459a22b6410305abc0c_mafia.exe
-
Size
765KB
-
MD5
e62ddf02f1827459a22b6410305abc0c
-
SHA1
2d5ae3503b626b38959bc8da96ae07a0a64fa7c7
-
SHA256
ce098f8c7cb3373a27b84952afd0d2e351e478f8ec82fe14c100efaae281b356
-
SHA512
7a40d685000f5fd0e2b2157247f04a95b754606760cdadd5f8b150ba170521cedb624d1960802125b607c3d5013453f7e6c86bf2e218c4dff7e0341c7e7f09d0
-
SSDEEP
12288:ZU5rCOTeiDe9E7l0YyTdCg6Vg0JGcL03ZF5rn5rLOa54U5w5A:ZUQOJDe9ER0DpR6Vjwcw3vh5Oa+UOS
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1704 12C6.tmp 2520 1342.tmp 2616 13BF.tmp 2612 143C.tmp 2664 149A.tmp 2704 14F7.tmp 1740 1555.tmp 2632 15A3.tmp 2444 1600.tmp 2840 164E.tmp 2848 16BC.tmp 1656 16FA.tmp 1468 1767.tmp 2480 17D4.tmp 800 1832.tmp 1528 1880.tmp 1640 18CE.tmp 548 194B.tmp 1688 19D7.tmp 1676 1A44.tmp 1260 1AB2.tmp 1236 1B3E.tmp 348 1B7C.tmp 2944 1BBB.tmp 1872 1C57.tmp 2072 1CC4.tmp 1992 1D02.tmp 1960 1D60.tmp 588 1DAE.tmp 476 1DFC.tmp 1004 1E4A.tmp 1584 1E88.tmp 1768 1ED6.tmp 1772 1F15.tmp 1724 1F53.tmp 2248 1F92.tmp 388 1FE0.tmp 2376 201E.tmp 3060 206C.tmp 2092 20AA.tmp 2916 20F8.tmp 1212 2137.tmp 1332 2185.tmp 1248 21C3.tmp 2796 2211.tmp 920 225F.tmp 1964 229E.tmp 2196 22DC.tmp 3008 232A.tmp 1272 2368.tmp 2976 23A7.tmp 996 23E5.tmp 2260 2433.tmp 2856 2472.tmp 2204 24CF.tmp 2748 250E.tmp 2804 254C.tmp 1888 259A.tmp 2900 25F8.tmp 2628 2655.tmp 2568 26A3.tmp 2636 26F1.tmp 2572 273F.tmp 2448 278D.tmp -
Loads dropped DLL 64 IoCs
pid Process 1600 2024-03-19_e62ddf02f1827459a22b6410305abc0c_mafia.exe 1704 12C6.tmp 2520 1342.tmp 2616 13BF.tmp 2612 143C.tmp 2664 149A.tmp 2704 14F7.tmp 1740 1555.tmp 2632 15A3.tmp 2444 1600.tmp 2840 164E.tmp 2848 16BC.tmp 1656 16FA.tmp 1468 1767.tmp 2480 17D4.tmp 800 1832.tmp 1528 1880.tmp 1640 18CE.tmp 548 194B.tmp 1688 19D7.tmp 1676 1A44.tmp 1260 1AB2.tmp 1236 1B3E.tmp 348 1B7C.tmp 2944 1BBB.tmp 1872 1C57.tmp 2072 1CC4.tmp 1992 1D02.tmp 1960 1D60.tmp 588 1DAE.tmp 476 1DFC.tmp 1004 1E4A.tmp 1584 1E88.tmp 1768 1ED6.tmp 1772 1F15.tmp 1724 1F53.tmp 2248 1F92.tmp 388 1FE0.tmp 2376 201E.tmp 3060 206C.tmp 2092 20AA.tmp 2916 20F8.tmp 1212 2137.tmp 1332 2185.tmp 1248 21C3.tmp 2796 2211.tmp 920 225F.tmp 1964 229E.tmp 2196 22DC.tmp 3008 232A.tmp 1272 2368.tmp 2976 23A7.tmp 996 23E5.tmp 2260 2433.tmp 2856 2472.tmp 2204 24CF.tmp 2748 250E.tmp 2804 254C.tmp 1888 259A.tmp 2900 25F8.tmp 2628 2655.tmp 2568 26A3.tmp 2636 26F1.tmp 2572 273F.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1600 wrote to memory of 1704 1600 2024-03-19_e62ddf02f1827459a22b6410305abc0c_mafia.exe 28 PID 1600 wrote to memory of 1704 1600 2024-03-19_e62ddf02f1827459a22b6410305abc0c_mafia.exe 28 PID 1600 wrote to memory of 1704 1600 2024-03-19_e62ddf02f1827459a22b6410305abc0c_mafia.exe 28 PID 1600 wrote to memory of 1704 1600 2024-03-19_e62ddf02f1827459a22b6410305abc0c_mafia.exe 28 PID 1704 wrote to memory of 2520 1704 12C6.tmp 29 PID 1704 wrote to memory of 2520 1704 12C6.tmp 29 PID 1704 wrote to memory of 2520 1704 12C6.tmp 29 PID 1704 wrote to memory of 2520 1704 12C6.tmp 29 PID 2520 wrote to memory of 2616 2520 1342.tmp 30 PID 2520 wrote to memory of 2616 2520 1342.tmp 30 PID 2520 wrote to memory of 2616 2520 1342.tmp 30 PID 2520 wrote to memory of 2616 2520 1342.tmp 30 PID 2616 wrote to memory of 2612 2616 13BF.tmp 31 PID 2616 wrote to memory of 2612 2616 13BF.tmp 31 PID 2616 wrote to memory of 2612 2616 13BF.tmp 31 PID 2616 wrote to memory of 2612 2616 13BF.tmp 31 PID 2612 wrote to memory of 2664 2612 143C.tmp 32 PID 2612 wrote to memory of 2664 2612 143C.tmp 32 PID 2612 wrote to memory of 2664 2612 143C.tmp 32 PID 2612 wrote to memory of 2664 2612 143C.tmp 32 PID 2664 wrote to memory of 2704 2664 149A.tmp 33 PID 2664 wrote to memory of 2704 2664 149A.tmp 33 PID 2664 wrote to memory of 2704 2664 149A.tmp 33 PID 2664 wrote to memory of 2704 2664 149A.tmp 33 PID 2704 wrote to memory of 1740 2704 14F7.tmp 34 PID 2704 wrote to memory of 1740 2704 14F7.tmp 34 PID 2704 wrote to memory of 1740 2704 14F7.tmp 34 PID 2704 wrote to memory of 1740 2704 14F7.tmp 34 PID 1740 wrote to memory of 2632 1740 1555.tmp 35 PID 1740 wrote to memory of 2632 1740 1555.tmp 35 PID 1740 wrote to memory of 2632 1740 1555.tmp 35 PID 1740 wrote to memory of 2632 1740 1555.tmp 35 PID 2632 wrote to memory of 2444 2632 15A3.tmp 36 PID 2632 wrote to memory of 2444 2632 15A3.tmp 36 PID 2632 wrote to memory of 2444 2632 15A3.tmp 36 PID 2632 wrote to memory of 2444 2632 15A3.tmp 36 PID 2444 wrote to memory of 2840 2444 1600.tmp 37 PID 2444 wrote to memory of 2840 2444 1600.tmp 37 PID 2444 wrote to memory of 2840 2444 1600.tmp 37 PID 2444 wrote to memory of 2840 2444 1600.tmp 37 PID 2840 wrote to memory of 2848 2840 164E.tmp 38 PID 2840 wrote to memory of 2848 2840 164E.tmp 38 PID 2840 wrote to memory of 2848 2840 164E.tmp 38 PID 2840 wrote to memory of 2848 2840 164E.tmp 38 PID 2848 wrote to memory of 1656 2848 16BC.tmp 39 PID 2848 wrote to memory of 1656 2848 16BC.tmp 39 PID 2848 wrote to memory of 1656 2848 16BC.tmp 39 PID 2848 wrote to memory of 1656 2848 16BC.tmp 39 PID 1656 wrote to memory of 1468 1656 16FA.tmp 40 PID 1656 wrote to memory of 1468 1656 16FA.tmp 40 PID 1656 wrote to memory of 1468 1656 16FA.tmp 40 PID 1656 wrote to memory of 1468 1656 16FA.tmp 40 PID 1468 wrote to memory of 2480 1468 1767.tmp 41 PID 1468 wrote to memory of 2480 1468 1767.tmp 41 PID 1468 wrote to memory of 2480 1468 1767.tmp 41 PID 1468 wrote to memory of 2480 1468 1767.tmp 41 PID 2480 wrote to memory of 800 2480 17D4.tmp 42 PID 2480 wrote to memory of 800 2480 17D4.tmp 42 PID 2480 wrote to memory of 800 2480 17D4.tmp 42 PID 2480 wrote to memory of 800 2480 17D4.tmp 42 PID 800 wrote to memory of 1528 800 1832.tmp 43 PID 800 wrote to memory of 1528 800 1832.tmp 43 PID 800 wrote to memory of 1528 800 1832.tmp 43 PID 800 wrote to memory of 1528 800 1832.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e62ddf02f1827459a22b6410305abc0c_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-19_e62ddf02f1827459a22b6410305abc0c_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\12C6.tmp"C:\Users\Admin\AppData\Local\Temp\12C6.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\1342.tmp"C:\Users\Admin\AppData\Local\Temp\1342.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\13BF.tmp"C:\Users\Admin\AppData\Local\Temp\13BF.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\143C.tmp"C:\Users\Admin\AppData\Local\Temp\143C.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\149A.tmp"C:\Users\Admin\AppData\Local\Temp\149A.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\14F7.tmp"C:\Users\Admin\AppData\Local\Temp\14F7.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\1555.tmp"C:\Users\Admin\AppData\Local\Temp\1555.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\15A3.tmp"C:\Users\Admin\AppData\Local\Temp\15A3.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\1600.tmp"C:\Users\Admin\AppData\Local\Temp\1600.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\164E.tmp"C:\Users\Admin\AppData\Local\Temp\164E.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\16BC.tmp"C:\Users\Admin\AppData\Local\Temp\16BC.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\16FA.tmp"C:\Users\Admin\AppData\Local\Temp\16FA.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\1767.tmp"C:\Users\Admin\AppData\Local\Temp\1767.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\17D4.tmp"C:\Users\Admin\AppData\Local\Temp\17D4.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\1832.tmp"C:\Users\Admin\AppData\Local\Temp\1832.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Users\Admin\AppData\Local\Temp\1880.tmp"C:\Users\Admin\AppData\Local\Temp\1880.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\18CE.tmp"C:\Users\Admin\AppData\Local\Temp\18CE.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\194B.tmp"C:\Users\Admin\AppData\Local\Temp\194B.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:548 -
C:\Users\Admin\AppData\Local\Temp\19D7.tmp"C:\Users\Admin\AppData\Local\Temp\19D7.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\1A44.tmp"C:\Users\Admin\AppData\Local\Temp\1A44.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:348 -
C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\1C57.tmp"C:\Users\Admin\AppData\Local\Temp\1C57.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\1D02.tmp"C:\Users\Admin\AppData\Local\Temp\1D02.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\1D60.tmp"C:\Users\Admin\AppData\Local\Temp\1D60.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:588 -
C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:476 -
C:\Users\Admin\AppData\Local\Temp\1E4A.tmp"C:\Users\Admin\AppData\Local\Temp\1E4A.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\1E88.tmp"C:\Users\Admin\AppData\Local\Temp\1E88.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\1F15.tmp"C:\Users\Admin\AppData\Local\Temp\1F15.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\1F53.tmp"C:\Users\Admin\AppData\Local\Temp\1F53.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\1F92.tmp"C:\Users\Admin\AppData\Local\Temp\1F92.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:388 -
C:\Users\Admin\AppData\Local\Temp\201E.tmp"C:\Users\Admin\AppData\Local\Temp\201E.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\206C.tmp"C:\Users\Admin\AppData\Local\Temp\206C.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\20AA.tmp"C:\Users\Admin\AppData\Local\Temp\20AA.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\20F8.tmp"C:\Users\Admin\AppData\Local\Temp\20F8.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\2137.tmp"C:\Users\Admin\AppData\Local\Temp\2137.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\2185.tmp"C:\Users\Admin\AppData\Local\Temp\2185.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\21C3.tmp"C:\Users\Admin\AppData\Local\Temp\21C3.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\2211.tmp"C:\Users\Admin\AppData\Local\Temp\2211.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\225F.tmp"C:\Users\Admin\AppData\Local\Temp\225F.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:920 -
C:\Users\Admin\AppData\Local\Temp\229E.tmp"C:\Users\Admin\AppData\Local\Temp\229E.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\22DC.tmp"C:\Users\Admin\AppData\Local\Temp\22DC.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\232A.tmp"C:\Users\Admin\AppData\Local\Temp\232A.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\2368.tmp"C:\Users\Admin\AppData\Local\Temp\2368.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\23A7.tmp"C:\Users\Admin\AppData\Local\Temp\23A7.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:996 -
C:\Users\Admin\AppData\Local\Temp\2433.tmp"C:\Users\Admin\AppData\Local\Temp\2433.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\2472.tmp"C:\Users\Admin\AppData\Local\Temp\2472.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\24CF.tmp"C:\Users\Admin\AppData\Local\Temp\24CF.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\250E.tmp"C:\Users\Admin\AppData\Local\Temp\250E.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\254C.tmp"C:\Users\Admin\AppData\Local\Temp\254C.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\259A.tmp"C:\Users\Admin\AppData\Local\Temp\259A.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\25F8.tmp"C:\Users\Admin\AppData\Local\Temp\25F8.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\2655.tmp"C:\Users\Admin\AppData\Local\Temp\2655.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\26A3.tmp"C:\Users\Admin\AppData\Local\Temp\26A3.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\26F1.tmp"C:\Users\Admin\AppData\Local\Temp\26F1.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\273F.tmp"C:\Users\Admin\AppData\Local\Temp\273F.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\278D.tmp"C:\Users\Admin\AppData\Local\Temp\278D.tmp"65⤵
- Executes dropped EXE
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\27DB.tmp"C:\Users\Admin\AppData\Local\Temp\27DB.tmp"66⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\281A.tmp"C:\Users\Admin\AppData\Local\Temp\281A.tmp"67⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\2858.tmp"C:\Users\Admin\AppData\Local\Temp\2858.tmp"68⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\2896.tmp"C:\Users\Admin\AppData\Local\Temp\2896.tmp"69⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\28D5.tmp"C:\Users\Admin\AppData\Local\Temp\28D5.tmp"70⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\2913.tmp"C:\Users\Admin\AppData\Local\Temp\2913.tmp"71⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\2961.tmp"C:\Users\Admin\AppData\Local\Temp\2961.tmp"72⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\29A0.tmp"C:\Users\Admin\AppData\Local\Temp\29A0.tmp"73⤵PID:292
-
C:\Users\Admin\AppData\Local\Temp\29DE.tmp"C:\Users\Admin\AppData\Local\Temp\29DE.tmp"74⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"75⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"76⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"77⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"78⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\2B35.tmp"C:\Users\Admin\AppData\Local\Temp\2B35.tmp"79⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\2B83.tmp"C:\Users\Admin\AppData\Local\Temp\2B83.tmp"80⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"81⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\2C00.tmp"C:\Users\Admin\AppData\Local\Temp\2C00.tmp"82⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"83⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"84⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"85⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\2D09.tmp"C:\Users\Admin\AppData\Local\Temp\2D09.tmp"86⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\2D48.tmp"C:\Users\Admin\AppData\Local\Temp\2D48.tmp"87⤵PID:108
-
C:\Users\Admin\AppData\Local\Temp\2D86.tmp"C:\Users\Admin\AppData\Local\Temp\2D86.tmp"88⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"89⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\2E03.tmp"C:\Users\Admin\AppData\Local\Temp\2E03.tmp"90⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\2E41.tmp"C:\Users\Admin\AppData\Local\Temp\2E41.tmp"91⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\2E80.tmp"C:\Users\Admin\AppData\Local\Temp\2E80.tmp"92⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"93⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"94⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\2F3B.tmp"C:\Users\Admin\AppData\Local\Temp\2F3B.tmp"95⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\2F89.tmp"C:\Users\Admin\AppData\Local\Temp\2F89.tmp"96⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"97⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\3015.tmp"C:\Users\Admin\AppData\Local\Temp\3015.tmp"98⤵PID:600
-
C:\Users\Admin\AppData\Local\Temp\3054.tmp"C:\Users\Admin\AppData\Local\Temp\3054.tmp"99⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\30B1.tmp"C:\Users\Admin\AppData\Local\Temp\30B1.tmp"100⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\30FF.tmp"C:\Users\Admin\AppData\Local\Temp\30FF.tmp"101⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\313E.tmp"C:\Users\Admin\AppData\Local\Temp\313E.tmp"102⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\317C.tmp"C:\Users\Admin\AppData\Local\Temp\317C.tmp"103⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\31CA.tmp"C:\Users\Admin\AppData\Local\Temp\31CA.tmp"104⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\3218.tmp"C:\Users\Admin\AppData\Local\Temp\3218.tmp"105⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\3276.tmp"C:\Users\Admin\AppData\Local\Temp\3276.tmp"106⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\32C4.tmp"C:\Users\Admin\AppData\Local\Temp\32C4.tmp"107⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\3302.tmp"C:\Users\Admin\AppData\Local\Temp\3302.tmp"108⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\3350.tmp"C:\Users\Admin\AppData\Local\Temp\3350.tmp"109⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\339E.tmp"C:\Users\Admin\AppData\Local\Temp\339E.tmp"110⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\33DC.tmp"C:\Users\Admin\AppData\Local\Temp\33DC.tmp"111⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\342A.tmp"C:\Users\Admin\AppData\Local\Temp\342A.tmp"112⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\3469.tmp"C:\Users\Admin\AppData\Local\Temp\3469.tmp"113⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\34A7.tmp"C:\Users\Admin\AppData\Local\Temp\34A7.tmp"114⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\34F5.tmp"C:\Users\Admin\AppData\Local\Temp\34F5.tmp"115⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\3534.tmp"C:\Users\Admin\AppData\Local\Temp\3534.tmp"116⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\3572.tmp"C:\Users\Admin\AppData\Local\Temp\3572.tmp"117⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\35B0.tmp"C:\Users\Admin\AppData\Local\Temp\35B0.tmp"118⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\35EF.tmp"C:\Users\Admin\AppData\Local\Temp\35EF.tmp"119⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\363D.tmp"C:\Users\Admin\AppData\Local\Temp\363D.tmp"120⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\367B.tmp"C:\Users\Admin\AppData\Local\Temp\367B.tmp"121⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\36BA.tmp"C:\Users\Admin\AppData\Local\Temp\36BA.tmp"122⤵PID:2260
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-