Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
26/04/2024, 07:45
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-26_82e60cfc88c6cf2693b74246f759cbe7_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-04-26_82e60cfc88c6cf2693b74246f759cbe7_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-26_82e60cfc88c6cf2693b74246f759cbe7_mafia.exe
-
Size
486KB
-
MD5
82e60cfc88c6cf2693b74246f759cbe7
-
SHA1
b8828969540b077f72818f7f6972d8800d7b18ea
-
SHA256
672596802aca2e4b031af66bd8c695c027df1acdcd2992d012edaf76ba982ba0
-
SHA512
4f3a67cded79631d7a01fd5e7e4cd7b542e0d53f5ccbadc2168729bde74c1d025c351b7048dbe5bd3333827f6fb3864d8262d253a5ebfd8503936020e5173da5
-
SSDEEP
12288:UU5rCOTeiD7Ec8+NkLBlVIuHwFD8klTGpNZ:UUQOJD7EF+iNIuQFDvTGpN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2428 770.tmp 2092 7BE.tmp 2112 82B.tmp 2576 889.tmp 2692 8F6.tmp 2616 944.tmp 2740 9B1.tmp 2728 A0F.tmp 2704 A6C.tmp 2464 ADA.tmp 2588 B37.tmp 1924 B85.tmp 1820 BF2.tmp 2768 C50.tmp 2364 CBD.tmp 1264 D2A.tmp 1404 D88.tmp 2760 DE6.tmp 2848 E43.tmp 2996 EA1.tmp 1604 F0E.tmp 1612 F6C.tmp 2084 FBA.tmp 1228 FF8.tmp 852 1046.tmp 2332 1084.tmp 2224 10C3.tmp 2564 1111.tmp 540 115F.tmp 2888 119D.tmp 1016 11DC.tmp 1724 121A.tmp 2068 1268.tmp 1792 12A6.tmp 2172 12F4.tmp 328 1342.tmp 1740 1381.tmp 1360 13CF.tmp 2020 140D.tmp 1520 145B.tmp 1788 149A.tmp 1600 14D8.tmp 2252 1516.tmp 1876 1564.tmp 924 15A3.tmp 580 15E1.tmp 2228 1620.tmp 768 165E.tmp 3028 169C.tmp 1544 16DB.tmp 1492 1719.tmp 904 1758.tmp 948 1796.tmp 940 17D4.tmp 1556 1813.tmp 1584 1851.tmp 3056 1890.tmp 3040 18CE.tmp 1508 190C.tmp 2796 194B.tmp 2664 1989.tmp 2680 19C8.tmp 2872 1A06.tmp 3052 1A44.tmp -
Loads dropped DLL 64 IoCs
pid Process 2748 2024-04-26_82e60cfc88c6cf2693b74246f759cbe7_mafia.exe 2428 770.tmp 2092 7BE.tmp 2112 82B.tmp 2576 889.tmp 2692 8F6.tmp 2616 944.tmp 2740 9B1.tmp 2728 A0F.tmp 2704 A6C.tmp 2464 ADA.tmp 2588 B37.tmp 1924 B85.tmp 1820 BF2.tmp 2768 C50.tmp 2364 CBD.tmp 1264 D2A.tmp 1404 D88.tmp 2760 DE6.tmp 2848 E43.tmp 2996 EA1.tmp 1604 F0E.tmp 1612 F6C.tmp 2084 FBA.tmp 1228 FF8.tmp 852 1046.tmp 2332 1084.tmp 2224 10C3.tmp 2564 1111.tmp 540 115F.tmp 2888 119D.tmp 1016 11DC.tmp 1724 121A.tmp 2068 1268.tmp 1792 12A6.tmp 2172 12F4.tmp 328 1342.tmp 1740 1381.tmp 1360 13CF.tmp 2020 140D.tmp 1520 145B.tmp 1788 149A.tmp 1600 14D8.tmp 2252 1516.tmp 1876 1564.tmp 924 15A3.tmp 580 15E1.tmp 2228 1620.tmp 768 165E.tmp 3028 169C.tmp 1544 16DB.tmp 1492 1719.tmp 904 1758.tmp 948 1796.tmp 940 17D4.tmp 1556 1813.tmp 1584 1851.tmp 3056 1890.tmp 3040 18CE.tmp 1508 190C.tmp 2796 194B.tmp 2664 1989.tmp 2680 19C8.tmp 2872 1A06.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2748 wrote to memory of 2428 2748 2024-04-26_82e60cfc88c6cf2693b74246f759cbe7_mafia.exe 28 PID 2748 wrote to memory of 2428 2748 2024-04-26_82e60cfc88c6cf2693b74246f759cbe7_mafia.exe 28 PID 2748 wrote to memory of 2428 2748 2024-04-26_82e60cfc88c6cf2693b74246f759cbe7_mafia.exe 28 PID 2748 wrote to memory of 2428 2748 2024-04-26_82e60cfc88c6cf2693b74246f759cbe7_mafia.exe 28 PID 2428 wrote to memory of 2092 2428 770.tmp 29 PID 2428 wrote to memory of 2092 2428 770.tmp 29 PID 2428 wrote to memory of 2092 2428 770.tmp 29 PID 2428 wrote to memory of 2092 2428 770.tmp 29 PID 2092 wrote to memory of 2112 2092 7BE.tmp 30 PID 2092 wrote to memory of 2112 2092 7BE.tmp 30 PID 2092 wrote to memory of 2112 2092 7BE.tmp 30 PID 2092 wrote to memory of 2112 2092 7BE.tmp 30 PID 2112 wrote to memory of 2576 2112 82B.tmp 31 PID 2112 wrote to memory of 2576 2112 82B.tmp 31 PID 2112 wrote to memory of 2576 2112 82B.tmp 31 PID 2112 wrote to memory of 2576 2112 82B.tmp 31 PID 2576 wrote to memory of 2692 2576 889.tmp 32 PID 2576 wrote to memory of 2692 2576 889.tmp 32 PID 2576 wrote to memory of 2692 2576 889.tmp 32 PID 2576 wrote to memory of 2692 2576 889.tmp 32 PID 2692 wrote to memory of 2616 2692 8F6.tmp 33 PID 2692 wrote to memory of 2616 2692 8F6.tmp 33 PID 2692 wrote to memory of 2616 2692 8F6.tmp 33 PID 2692 wrote to memory of 2616 2692 8F6.tmp 33 PID 2616 wrote to memory of 2740 2616 944.tmp 34 PID 2616 wrote to memory of 2740 2616 944.tmp 34 PID 2616 wrote to memory of 2740 2616 944.tmp 34 PID 2616 wrote to memory of 2740 2616 944.tmp 34 PID 2740 wrote to memory of 2728 2740 9B1.tmp 35 PID 2740 wrote to memory of 2728 2740 9B1.tmp 35 PID 2740 wrote to memory of 2728 2740 9B1.tmp 35 PID 2740 wrote to memory of 2728 2740 9B1.tmp 35 PID 2728 wrote to memory of 2704 2728 A0F.tmp 36 PID 2728 wrote to memory of 2704 2728 A0F.tmp 36 PID 2728 wrote to memory of 2704 2728 A0F.tmp 36 PID 2728 wrote to memory of 2704 2728 A0F.tmp 36 PID 2704 wrote to memory of 2464 2704 A6C.tmp 37 PID 2704 wrote to memory of 2464 2704 A6C.tmp 37 PID 2704 wrote to memory of 2464 2704 A6C.tmp 37 PID 2704 wrote to memory of 2464 2704 A6C.tmp 37 PID 2464 wrote to memory of 2588 2464 ADA.tmp 38 PID 2464 wrote to memory of 2588 2464 ADA.tmp 38 PID 2464 wrote to memory of 2588 2464 ADA.tmp 38 PID 2464 wrote to memory of 2588 2464 ADA.tmp 38 PID 2588 wrote to memory of 1924 2588 B37.tmp 39 PID 2588 wrote to memory of 1924 2588 B37.tmp 39 PID 2588 wrote to memory of 1924 2588 B37.tmp 39 PID 2588 wrote to memory of 1924 2588 B37.tmp 39 PID 1924 wrote to memory of 1820 1924 B85.tmp 40 PID 1924 wrote to memory of 1820 1924 B85.tmp 40 PID 1924 wrote to memory of 1820 1924 B85.tmp 40 PID 1924 wrote to memory of 1820 1924 B85.tmp 40 PID 1820 wrote to memory of 2768 1820 BF2.tmp 41 PID 1820 wrote to memory of 2768 1820 BF2.tmp 41 PID 1820 wrote to memory of 2768 1820 BF2.tmp 41 PID 1820 wrote to memory of 2768 1820 BF2.tmp 41 PID 2768 wrote to memory of 2364 2768 C50.tmp 42 PID 2768 wrote to memory of 2364 2768 C50.tmp 42 PID 2768 wrote to memory of 2364 2768 C50.tmp 42 PID 2768 wrote to memory of 2364 2768 C50.tmp 42 PID 2364 wrote to memory of 1264 2364 CBD.tmp 43 PID 2364 wrote to memory of 1264 2364 CBD.tmp 43 PID 2364 wrote to memory of 1264 2364 CBD.tmp 43 PID 2364 wrote to memory of 1264 2364 CBD.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-26_82e60cfc88c6cf2693b74246f759cbe7_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-26_82e60cfc88c6cf2693b74246f759cbe7_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\770.tmp"C:\Users\Admin\AppData\Local\Temp\770.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\7BE.tmp"C:\Users\Admin\AppData\Local\Temp\7BE.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\82B.tmp"C:\Users\Admin\AppData\Local\Temp\82B.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\889.tmp"C:\Users\Admin\AppData\Local\Temp\889.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\8F6.tmp"C:\Users\Admin\AppData\Local\Temp\8F6.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\944.tmp"C:\Users\Admin\AppData\Local\Temp\944.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\9B1.tmp"C:\Users\Admin\AppData\Local\Temp\9B1.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\A0F.tmp"C:\Users\Admin\AppData\Local\Temp\A0F.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\A6C.tmp"C:\Users\Admin\AppData\Local\Temp\A6C.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\ADA.tmp"C:\Users\Admin\AppData\Local\Temp\ADA.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\B37.tmp"C:\Users\Admin\AppData\Local\Temp\B37.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\B85.tmp"C:\Users\Admin\AppData\Local\Temp\B85.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\BF2.tmp"C:\Users\Admin\AppData\Local\Temp\BF2.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\C50.tmp"C:\Users\Admin\AppData\Local\Temp\C50.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\CBD.tmp"C:\Users\Admin\AppData\Local\Temp\CBD.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\D2A.tmp"C:\Users\Admin\AppData\Local\Temp\D2A.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\D88.tmp"C:\Users\Admin\AppData\Local\Temp\D88.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\DE6.tmp"C:\Users\Admin\AppData\Local\Temp\DE6.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\E43.tmp"C:\Users\Admin\AppData\Local\Temp\E43.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\EA1.tmp"C:\Users\Admin\AppData\Local\Temp\EA1.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\F0E.tmp"C:\Users\Admin\AppData\Local\Temp\F0E.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\F6C.tmp"C:\Users\Admin\AppData\Local\Temp\F6C.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\FBA.tmp"C:\Users\Admin\AppData\Local\Temp\FBA.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\FF8.tmp"C:\Users\Admin\AppData\Local\Temp\FF8.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\1046.tmp"C:\Users\Admin\AppData\Local\Temp\1046.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:852 -
C:\Users\Admin\AppData\Local\Temp\1084.tmp"C:\Users\Admin\AppData\Local\Temp\1084.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\10C3.tmp"C:\Users\Admin\AppData\Local\Temp\10C3.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\1111.tmp"C:\Users\Admin\AppData\Local\Temp\1111.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\115F.tmp"C:\Users\Admin\AppData\Local\Temp\115F.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:540 -
C:\Users\Admin\AppData\Local\Temp\119D.tmp"C:\Users\Admin\AppData\Local\Temp\119D.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\11DC.tmp"C:\Users\Admin\AppData\Local\Temp\11DC.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\121A.tmp"C:\Users\Admin\AppData\Local\Temp\121A.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\1268.tmp"C:\Users\Admin\AppData\Local\Temp\1268.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\12A6.tmp"C:\Users\Admin\AppData\Local\Temp\12A6.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\12F4.tmp"C:\Users\Admin\AppData\Local\Temp\12F4.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\1342.tmp"C:\Users\Admin\AppData\Local\Temp\1342.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:328 -
C:\Users\Admin\AppData\Local\Temp\1381.tmp"C:\Users\Admin\AppData\Local\Temp\1381.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\13CF.tmp"C:\Users\Admin\AppData\Local\Temp\13CF.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\140D.tmp"C:\Users\Admin\AppData\Local\Temp\140D.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\145B.tmp"C:\Users\Admin\AppData\Local\Temp\145B.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\149A.tmp"C:\Users\Admin\AppData\Local\Temp\149A.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\14D8.tmp"C:\Users\Admin\AppData\Local\Temp\14D8.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\1516.tmp"C:\Users\Admin\AppData\Local\Temp\1516.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\1564.tmp"C:\Users\Admin\AppData\Local\Temp\1564.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\15A3.tmp"C:\Users\Admin\AppData\Local\Temp\15A3.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:924 -
C:\Users\Admin\AppData\Local\Temp\15E1.tmp"C:\Users\Admin\AppData\Local\Temp\15E1.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:580 -
C:\Users\Admin\AppData\Local\Temp\1620.tmp"C:\Users\Admin\AppData\Local\Temp\1620.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\165E.tmp"C:\Users\Admin\AppData\Local\Temp\165E.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:768 -
C:\Users\Admin\AppData\Local\Temp\169C.tmp"C:\Users\Admin\AppData\Local\Temp\169C.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\16DB.tmp"C:\Users\Admin\AppData\Local\Temp\16DB.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\1719.tmp"C:\Users\Admin\AppData\Local\Temp\1719.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\1758.tmp"C:\Users\Admin\AppData\Local\Temp\1758.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:904 -
C:\Users\Admin\AppData\Local\Temp\1796.tmp"C:\Users\Admin\AppData\Local\Temp\1796.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:948 -
C:\Users\Admin\AppData\Local\Temp\17D4.tmp"C:\Users\Admin\AppData\Local\Temp\17D4.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:940 -
C:\Users\Admin\AppData\Local\Temp\1813.tmp"C:\Users\Admin\AppData\Local\Temp\1813.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\1851.tmp"C:\Users\Admin\AppData\Local\Temp\1851.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\1890.tmp"C:\Users\Admin\AppData\Local\Temp\1890.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\18CE.tmp"C:\Users\Admin\AppData\Local\Temp\18CE.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\190C.tmp"C:\Users\Admin\AppData\Local\Temp\190C.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\194B.tmp"C:\Users\Admin\AppData\Local\Temp\194B.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\1989.tmp"C:\Users\Admin\AppData\Local\Temp\1989.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\19C8.tmp"C:\Users\Admin\AppData\Local\Temp\19C8.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\1A06.tmp"C:\Users\Admin\AppData\Local\Temp\1A06.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\1A44.tmp"C:\Users\Admin\AppData\Local\Temp\1A44.tmp"65⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\1A92.tmp"C:\Users\Admin\AppData\Local\Temp\1A92.tmp"66⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"67⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\1B0F.tmp"C:\Users\Admin\AppData\Local\Temp\1B0F.tmp"68⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"69⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"70⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\1BEA.tmp"C:\Users\Admin\AppData\Local\Temp\1BEA.tmp"71⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\1C28.tmp"C:\Users\Admin\AppData\Local\Temp\1C28.tmp"72⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\1C66.tmp"C:\Users\Admin\AppData\Local\Temp\1C66.tmp"73⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\1CB4.tmp"C:\Users\Admin\AppData\Local\Temp\1CB4.tmp"74⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"75⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\1D41.tmp"C:\Users\Admin\AppData\Local\Temp\1D41.tmp"76⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"77⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\1DCD.tmp"C:\Users\Admin\AppData\Local\Temp\1DCD.tmp"78⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"79⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\1E4A.tmp"C:\Users\Admin\AppData\Local\Temp\1E4A.tmp"80⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\1E88.tmp"C:\Users\Admin\AppData\Local\Temp\1E88.tmp"81⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"82⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\1F05.tmp"C:\Users\Admin\AppData\Local\Temp\1F05.tmp"83⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\1F44.tmp"C:\Users\Admin\AppData\Local\Temp\1F44.tmp"84⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\1F82.tmp"C:\Users\Admin\AppData\Local\Temp\1F82.tmp"85⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"86⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"87⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\203D.tmp"C:\Users\Admin\AppData\Local\Temp\203D.tmp"88⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\207C.tmp"C:\Users\Admin\AppData\Local\Temp\207C.tmp"89⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\20BA.tmp"C:\Users\Admin\AppData\Local\Temp\20BA.tmp"90⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\20F8.tmp"C:\Users\Admin\AppData\Local\Temp\20F8.tmp"91⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\2137.tmp"C:\Users\Admin\AppData\Local\Temp\2137.tmp"92⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\2175.tmp"C:\Users\Admin\AppData\Local\Temp\2175.tmp"93⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\21C3.tmp"C:\Users\Admin\AppData\Local\Temp\21C3.tmp"94⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\2202.tmp"C:\Users\Admin\AppData\Local\Temp\2202.tmp"95⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\2240.tmp"C:\Users\Admin\AppData\Local\Temp\2240.tmp"96⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\227E.tmp"C:\Users\Admin\AppData\Local\Temp\227E.tmp"97⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\22BD.tmp"C:\Users\Admin\AppData\Local\Temp\22BD.tmp"98⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\22FB.tmp"C:\Users\Admin\AppData\Local\Temp\22FB.tmp"99⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\233A.tmp"C:\Users\Admin\AppData\Local\Temp\233A.tmp"100⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\2378.tmp"C:\Users\Admin\AppData\Local\Temp\2378.tmp"101⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\23B6.tmp"C:\Users\Admin\AppData\Local\Temp\23B6.tmp"102⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\23F5.tmp"C:\Users\Admin\AppData\Local\Temp\23F5.tmp"103⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\2443.tmp"C:\Users\Admin\AppData\Local\Temp\2443.tmp"104⤵PID:328
-
C:\Users\Admin\AppData\Local\Temp\2481.tmp"C:\Users\Admin\AppData\Local\Temp\2481.tmp"105⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\24C0.tmp"C:\Users\Admin\AppData\Local\Temp\24C0.tmp"106⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\24FE.tmp"C:\Users\Admin\AppData\Local\Temp\24FE.tmp"107⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\253C.tmp"C:\Users\Admin\AppData\Local\Temp\253C.tmp"108⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\258A.tmp"C:\Users\Admin\AppData\Local\Temp\258A.tmp"109⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\25C9.tmp"C:\Users\Admin\AppData\Local\Temp\25C9.tmp"110⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"111⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\2674.tmp"C:\Users\Admin\AppData\Local\Temp\2674.tmp"112⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\26B3.tmp"C:\Users\Admin\AppData\Local\Temp\26B3.tmp"113⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\26F1.tmp"C:\Users\Admin\AppData\Local\Temp\26F1.tmp"114⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\2730.tmp"C:\Users\Admin\AppData\Local\Temp\2730.tmp"115⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\277E.tmp"C:\Users\Admin\AppData\Local\Temp\277E.tmp"116⤵PID:108
-
C:\Users\Admin\AppData\Local\Temp\27BC.tmp"C:\Users\Admin\AppData\Local\Temp\27BC.tmp"117⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"118⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\2858.tmp"C:\Users\Admin\AppData\Local\Temp\2858.tmp"119⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\2896.tmp"C:\Users\Admin\AppData\Local\Temp\2896.tmp"120⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\28E4.tmp"C:\Users\Admin\AppData\Local\Temp\28E4.tmp"121⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\2923.tmp"C:\Users\Admin\AppData\Local\Temp\2923.tmp"122⤵PID:1588
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-