Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
26/03/2024, 16:43
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-26_968006a7839eef920c809d646613313b_mafia.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-03-26_968006a7839eef920c809d646613313b_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-26_968006a7839eef920c809d646613313b_mafia.exe
-
Size
487KB
-
MD5
968006a7839eef920c809d646613313b
-
SHA1
86047cf86c95b9029e61cdd0f2f5969b52444d2d
-
SHA256
d3e9af0660d82f00350871d2cb8bad400b19ab555043ae058295a118096dfa6e
-
SHA512
309c2de6c2519ade02c2bd2ce3713aedb47e8c115e1b75ff820c941f80fe07fa63d733748cea1aeac9212af1167f2d830307ce008de8d98a485c23471cec6373
-
SSDEEP
6144:zorf3lPvovsgZnqG2C7mOTeiLxDx8apfkmDKxmj9P3uzlkKUQZslV5944iQ8qVFR:yU5rCOTeiN5KxZR6bjgUHbZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2940 18CE.tmp 3040 192C.tmp 3016 1999.tmp 2588 19E7.tmp 2548 1A35.tmp 2700 1A92.tmp 2796 1AF0.tmp 2436 1B3E.tmp 2688 1B9C.tmp 2416 1C09.tmp 2884 1C66.tmp 1640 1CC4.tmp 548 1D22.tmp 1504 1D9E.tmp 2456 1DFC.tmp 352 1E4A.tmp 760 1EA8.tmp 1828 1F05.tmp 2140 1F72.tmp 2320 1FC0.tmp 1940 201E.tmp 1436 208B.tmp 872 20D9.tmp 2496 2127.tmp 2664 2166.tmp 2868 21B4.tmp 2100 21F2.tmp 2012 2230.tmp 2872 226F.tmp 596 22BD.tmp 744 230B.tmp 1412 2349.tmp 844 2397.tmp 1716 23E5.tmp 1552 2424.tmp 2364 2462.tmp 2072 24A0.tmp 1992 24EE.tmp 1152 253C.tmp 2820 258A.tmp 1476 25D8.tmp 692 2626.tmp 2840 2665.tmp 2128 26A3.tmp 900 26E2.tmp 608 2730.tmp 1672 276E.tmp 1252 27AC.tmp 2040 27EB.tmp 1968 2829.tmp 2864 2877.tmp 2092 28B6.tmp 884 28F4.tmp 2164 2942.tmp 3068 2990.tmp 1520 29CE.tmp 2960 2A0D.tmp 3036 2A5B.tmp 3020 2A99.tmp 3044 2AE7.tmp 2576 2B26.tmp 2544 2B64.tmp 2596 2BA2.tmp 2528 2BF0.tmp -
Loads dropped DLL 64 IoCs
pid Process 1776 2024-03-26_968006a7839eef920c809d646613313b_mafia.exe 2940 18CE.tmp 3040 192C.tmp 3016 1999.tmp 2588 19E7.tmp 2548 1A35.tmp 2700 1A92.tmp 2796 1AF0.tmp 2436 1B3E.tmp 2688 1B9C.tmp 2416 1C09.tmp 2884 1C66.tmp 1640 1CC4.tmp 548 1D22.tmp 1504 1D9E.tmp 2456 1DFC.tmp 352 1E4A.tmp 760 1EA8.tmp 1828 1F05.tmp 2140 1F72.tmp 2320 1FC0.tmp 1940 201E.tmp 1436 208B.tmp 872 20D9.tmp 2496 2127.tmp 2664 2166.tmp 2868 21B4.tmp 2100 21F2.tmp 2012 2230.tmp 2872 226F.tmp 596 22BD.tmp 744 230B.tmp 1412 2349.tmp 844 2397.tmp 1716 23E5.tmp 1552 2424.tmp 2364 2462.tmp 2072 24A0.tmp 1992 24EE.tmp 1152 253C.tmp 2820 258A.tmp 1476 25D8.tmp 692 2626.tmp 2840 2665.tmp 2128 26A3.tmp 900 26E2.tmp 608 2730.tmp 1672 276E.tmp 1252 27AC.tmp 2040 27EB.tmp 1968 2829.tmp 2864 2877.tmp 2092 28B6.tmp 884 28F4.tmp 2164 2942.tmp 3068 2990.tmp 1520 29CE.tmp 2960 2A0D.tmp 3036 2A5B.tmp 3020 2A99.tmp 3044 2AE7.tmp 2576 2B26.tmp 2544 2B64.tmp 2596 2BA2.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1776 wrote to memory of 2940 1776 2024-03-26_968006a7839eef920c809d646613313b_mafia.exe 28 PID 1776 wrote to memory of 2940 1776 2024-03-26_968006a7839eef920c809d646613313b_mafia.exe 28 PID 1776 wrote to memory of 2940 1776 2024-03-26_968006a7839eef920c809d646613313b_mafia.exe 28 PID 1776 wrote to memory of 2940 1776 2024-03-26_968006a7839eef920c809d646613313b_mafia.exe 28 PID 2940 wrote to memory of 3040 2940 18CE.tmp 29 PID 2940 wrote to memory of 3040 2940 18CE.tmp 29 PID 2940 wrote to memory of 3040 2940 18CE.tmp 29 PID 2940 wrote to memory of 3040 2940 18CE.tmp 29 PID 3040 wrote to memory of 3016 3040 192C.tmp 30 PID 3040 wrote to memory of 3016 3040 192C.tmp 30 PID 3040 wrote to memory of 3016 3040 192C.tmp 30 PID 3040 wrote to memory of 3016 3040 192C.tmp 30 PID 3016 wrote to memory of 2588 3016 1999.tmp 31 PID 3016 wrote to memory of 2588 3016 1999.tmp 31 PID 3016 wrote to memory of 2588 3016 1999.tmp 31 PID 3016 wrote to memory of 2588 3016 1999.tmp 31 PID 2588 wrote to memory of 2548 2588 19E7.tmp 32 PID 2588 wrote to memory of 2548 2588 19E7.tmp 32 PID 2588 wrote to memory of 2548 2588 19E7.tmp 32 PID 2588 wrote to memory of 2548 2588 19E7.tmp 32 PID 2548 wrote to memory of 2700 2548 1A35.tmp 33 PID 2548 wrote to memory of 2700 2548 1A35.tmp 33 PID 2548 wrote to memory of 2700 2548 1A35.tmp 33 PID 2548 wrote to memory of 2700 2548 1A35.tmp 33 PID 2700 wrote to memory of 2796 2700 1A92.tmp 34 PID 2700 wrote to memory of 2796 2700 1A92.tmp 34 PID 2700 wrote to memory of 2796 2700 1A92.tmp 34 PID 2700 wrote to memory of 2796 2700 1A92.tmp 34 PID 2796 wrote to memory of 2436 2796 1AF0.tmp 35 PID 2796 wrote to memory of 2436 2796 1AF0.tmp 35 PID 2796 wrote to memory of 2436 2796 1AF0.tmp 35 PID 2796 wrote to memory of 2436 2796 1AF0.tmp 35 PID 2436 wrote to memory of 2688 2436 1B3E.tmp 36 PID 2436 wrote to memory of 2688 2436 1B3E.tmp 36 PID 2436 wrote to memory of 2688 2436 1B3E.tmp 36 PID 2436 wrote to memory of 2688 2436 1B3E.tmp 36 PID 2688 wrote to memory of 2416 2688 1B9C.tmp 37 PID 2688 wrote to memory of 2416 2688 1B9C.tmp 37 PID 2688 wrote to memory of 2416 2688 1B9C.tmp 37 PID 2688 wrote to memory of 2416 2688 1B9C.tmp 37 PID 2416 wrote to memory of 2884 2416 1C09.tmp 38 PID 2416 wrote to memory of 2884 2416 1C09.tmp 38 PID 2416 wrote to memory of 2884 2416 1C09.tmp 38 PID 2416 wrote to memory of 2884 2416 1C09.tmp 38 PID 2884 wrote to memory of 1640 2884 1C66.tmp 39 PID 2884 wrote to memory of 1640 2884 1C66.tmp 39 PID 2884 wrote to memory of 1640 2884 1C66.tmp 39 PID 2884 wrote to memory of 1640 2884 1C66.tmp 39 PID 1640 wrote to memory of 548 1640 1CC4.tmp 40 PID 1640 wrote to memory of 548 1640 1CC4.tmp 40 PID 1640 wrote to memory of 548 1640 1CC4.tmp 40 PID 1640 wrote to memory of 548 1640 1CC4.tmp 40 PID 548 wrote to memory of 1504 548 1D22.tmp 41 PID 548 wrote to memory of 1504 548 1D22.tmp 41 PID 548 wrote to memory of 1504 548 1D22.tmp 41 PID 548 wrote to memory of 1504 548 1D22.tmp 41 PID 1504 wrote to memory of 2456 1504 1D9E.tmp 42 PID 1504 wrote to memory of 2456 1504 1D9E.tmp 42 PID 1504 wrote to memory of 2456 1504 1D9E.tmp 42 PID 1504 wrote to memory of 2456 1504 1D9E.tmp 42 PID 2456 wrote to memory of 352 2456 1DFC.tmp 43 PID 2456 wrote to memory of 352 2456 1DFC.tmp 43 PID 2456 wrote to memory of 352 2456 1DFC.tmp 43 PID 2456 wrote to memory of 352 2456 1DFC.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-26_968006a7839eef920c809d646613313b_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-26_968006a7839eef920c809d646613313b_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\18CE.tmp"C:\Users\Admin\AppData\Local\Temp\18CE.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\192C.tmp"C:\Users\Admin\AppData\Local\Temp\192C.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\1999.tmp"C:\Users\Admin\AppData\Local\Temp\1999.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\19E7.tmp"C:\Users\Admin\AppData\Local\Temp\19E7.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\1A35.tmp"C:\Users\Admin\AppData\Local\Temp\1A35.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\1A92.tmp"C:\Users\Admin\AppData\Local\Temp\1A92.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\1C09.tmp"C:\Users\Admin\AppData\Local\Temp\1C09.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\1C66.tmp"C:\Users\Admin\AppData\Local\Temp\1C66.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\1D22.tmp"C:\Users\Admin\AppData\Local\Temp\1D22.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\1E4A.tmp"C:\Users\Admin\AppData\Local\Temp\1E4A.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:352 -
C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:760 -
C:\Users\Admin\AppData\Local\Temp\1F05.tmp"C:\Users\Admin\AppData\Local\Temp\1F05.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\1F72.tmp"C:\Users\Admin\AppData\Local\Temp\1F72.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\201E.tmp"C:\Users\Admin\AppData\Local\Temp\201E.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\208B.tmp"C:\Users\Admin\AppData\Local\Temp\208B.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\20D9.tmp"C:\Users\Admin\AppData\Local\Temp\20D9.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:872 -
C:\Users\Admin\AppData\Local\Temp\2127.tmp"C:\Users\Admin\AppData\Local\Temp\2127.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\2166.tmp"C:\Users\Admin\AppData\Local\Temp\2166.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\21B4.tmp"C:\Users\Admin\AppData\Local\Temp\21B4.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\21F2.tmp"C:\Users\Admin\AppData\Local\Temp\21F2.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\2230.tmp"C:\Users\Admin\AppData\Local\Temp\2230.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\226F.tmp"C:\Users\Admin\AppData\Local\Temp\226F.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\22BD.tmp"C:\Users\Admin\AppData\Local\Temp\22BD.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:596 -
C:\Users\Admin\AppData\Local\Temp\230B.tmp"C:\Users\Admin\AppData\Local\Temp\230B.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:744 -
C:\Users\Admin\AppData\Local\Temp\2349.tmp"C:\Users\Admin\AppData\Local\Temp\2349.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\2397.tmp"C:\Users\Admin\AppData\Local\Temp\2397.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:844 -
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\2424.tmp"C:\Users\Admin\AppData\Local\Temp\2424.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\24A0.tmp"C:\Users\Admin\AppData\Local\Temp\24A0.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\24EE.tmp"C:\Users\Admin\AppData\Local\Temp\24EE.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\253C.tmp"C:\Users\Admin\AppData\Local\Temp\253C.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\258A.tmp"C:\Users\Admin\AppData\Local\Temp\258A.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\25D8.tmp"C:\Users\Admin\AppData\Local\Temp\25D8.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\2626.tmp"C:\Users\Admin\AppData\Local\Temp\2626.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:692 -
C:\Users\Admin\AppData\Local\Temp\2665.tmp"C:\Users\Admin\AppData\Local\Temp\2665.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\26A3.tmp"C:\Users\Admin\AppData\Local\Temp\26A3.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\26E2.tmp"C:\Users\Admin\AppData\Local\Temp\26E2.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:900 -
C:\Users\Admin\AppData\Local\Temp\2730.tmp"C:\Users\Admin\AppData\Local\Temp\2730.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:608 -
C:\Users\Admin\AppData\Local\Temp\276E.tmp"C:\Users\Admin\AppData\Local\Temp\276E.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\27AC.tmp"C:\Users\Admin\AppData\Local\Temp\27AC.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\27EB.tmp"C:\Users\Admin\AppData\Local\Temp\27EB.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\2829.tmp"C:\Users\Admin\AppData\Local\Temp\2829.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\2877.tmp"C:\Users\Admin\AppData\Local\Temp\2877.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\28B6.tmp"C:\Users\Admin\AppData\Local\Temp\28B6.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\28F4.tmp"C:\Users\Admin\AppData\Local\Temp\28F4.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:884 -
C:\Users\Admin\AppData\Local\Temp\2942.tmp"C:\Users\Admin\AppData\Local\Temp\2942.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\2990.tmp"C:\Users\Admin\AppData\Local\Temp\2990.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\29CE.tmp"C:\Users\Admin\AppData\Local\Temp\29CE.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\2A99.tmp"C:\Users\Admin\AppData\Local\Temp\2A99.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\2B26.tmp"C:\Users\Admin\AppData\Local\Temp\2B26.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\2B64.tmp"C:\Users\Admin\AppData\Local\Temp\2B64.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"65⤵
- Executes dropped EXE
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"66⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"67⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"68⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"69⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\2D38.tmp"C:\Users\Admin\AppData\Local\Temp\2D38.tmp"70⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\2D76.tmp"C:\Users\Admin\AppData\Local\Temp\2D76.tmp"71⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"72⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"73⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\2E32.tmp"C:\Users\Admin\AppData\Local\Temp\2E32.tmp"74⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\2E70.tmp"C:\Users\Admin\AppData\Local\Temp\2E70.tmp"75⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"76⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\2EED.tmp"C:\Users\Admin\AppData\Local\Temp\2EED.tmp"77⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"78⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\2F6A.tmp"C:\Users\Admin\AppData\Local\Temp\2F6A.tmp"79⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"80⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"81⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\3025.tmp"C:\Users\Admin\AppData\Local\Temp\3025.tmp"82⤵PID:352
-
C:\Users\Admin\AppData\Local\Temp\3073.tmp"C:\Users\Admin\AppData\Local\Temp\3073.tmp"83⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\30B1.tmp"C:\Users\Admin\AppData\Local\Temp\30B1.tmp"84⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\30F0.tmp"C:\Users\Admin\AppData\Local\Temp\30F0.tmp"85⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\313E.tmp"C:\Users\Admin\AppData\Local\Temp\313E.tmp"86⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\317C.tmp"C:\Users\Admin\AppData\Local\Temp\317C.tmp"87⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\31BA.tmp"C:\Users\Admin\AppData\Local\Temp\31BA.tmp"88⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\31F9.tmp"C:\Users\Admin\AppData\Local\Temp\31F9.tmp"89⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\3237.tmp"C:\Users\Admin\AppData\Local\Temp\3237.tmp"90⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\3276.tmp"C:\Users\Admin\AppData\Local\Temp\3276.tmp"91⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\32B4.tmp"C:\Users\Admin\AppData\Local\Temp\32B4.tmp"92⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\32F2.tmp"C:\Users\Admin\AppData\Local\Temp\32F2.tmp"93⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\3331.tmp"C:\Users\Admin\AppData\Local\Temp\3331.tmp"94⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\336F.tmp"C:\Users\Admin\AppData\Local\Temp\336F.tmp"95⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\33AE.tmp"C:\Users\Admin\AppData\Local\Temp\33AE.tmp"96⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\33EC.tmp"C:\Users\Admin\AppData\Local\Temp\33EC.tmp"97⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\343A.tmp"C:\Users\Admin\AppData\Local\Temp\343A.tmp"98⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\3478.tmp"C:\Users\Admin\AppData\Local\Temp\3478.tmp"99⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\34B7.tmp"C:\Users\Admin\AppData\Local\Temp\34B7.tmp"100⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\34F5.tmp"C:\Users\Admin\AppData\Local\Temp\34F5.tmp"101⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\3543.tmp"C:\Users\Admin\AppData\Local\Temp\3543.tmp"102⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\3582.tmp"C:\Users\Admin\AppData\Local\Temp\3582.tmp"103⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\35C0.tmp"C:\Users\Admin\AppData\Local\Temp\35C0.tmp"104⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\35FE.tmp"C:\Users\Admin\AppData\Local\Temp\35FE.tmp"105⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\363D.tmp"C:\Users\Admin\AppData\Local\Temp\363D.tmp"106⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\367B.tmp"C:\Users\Admin\AppData\Local\Temp\367B.tmp"107⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\36C9.tmp"C:\Users\Admin\AppData\Local\Temp\36C9.tmp"108⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\3708.tmp"C:\Users\Admin\AppData\Local\Temp\3708.tmp"109⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\3746.tmp"C:\Users\Admin\AppData\Local\Temp\3746.tmp"110⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\3784.tmp"C:\Users\Admin\AppData\Local\Temp\3784.tmp"111⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\37C3.tmp"C:\Users\Admin\AppData\Local\Temp\37C3.tmp"112⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\3811.tmp"C:\Users\Admin\AppData\Local\Temp\3811.tmp"113⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\384F.tmp"C:\Users\Admin\AppData\Local\Temp\384F.tmp"114⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\388E.tmp"C:\Users\Admin\AppData\Local\Temp\388E.tmp"115⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\38CC.tmp"C:\Users\Admin\AppData\Local\Temp\38CC.tmp"116⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\390A.tmp"C:\Users\Admin\AppData\Local\Temp\390A.tmp"117⤵PID:304
-
C:\Users\Admin\AppData\Local\Temp\3949.tmp"C:\Users\Admin\AppData\Local\Temp\3949.tmp"118⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\3987.tmp"C:\Users\Admin\AppData\Local\Temp\3987.tmp"119⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\39C6.tmp"C:\Users\Admin\AppData\Local\Temp\39C6.tmp"120⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\3A04.tmp"C:\Users\Admin\AppData\Local\Temp\3A04.tmp"121⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\3A42.tmp"C:\Users\Admin\AppData\Local\Temp\3A42.tmp"122⤵PID:2956
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-