Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/04/2024, 18:21
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-27_96707f62495cd668b69c1963ce2665f4_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-27_96707f62495cd668b69c1963ce2665f4_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-04-27_96707f62495cd668b69c1963ce2665f4_mafia.exe
-
Size
527KB
-
MD5
96707f62495cd668b69c1963ce2665f4
-
SHA1
7678747443dea1906c6eefc46d6248f6e64cc659
-
SHA256
07c903bfc27763f9c6ac5ccb491f4a50d2a18efc9c9a2306cf5480306c7f42d6
-
SHA512
3fbd29d923e9cda66b73c475c220480f06a29315408bf131ba8e4fd029d8bb370824e69451b82d02b85943456cc7f81322fead81365791469e377067bbcc3c4d
-
SSDEEP
12288:fU5rCOTeidP/ECnXgWES234Zez1GipKDZu:fUQOJdP6SQGezYIKDo
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2816 313E.tmp 1200 31CA.tmp 2552 3276.tmp 2468 3312.tmp 2612 339E.tmp 2432 343A.tmp 2568 34C6.tmp 2328 3562.tmp 2408 35EF.tmp 2748 367B.tmp 2088 3717.tmp 2216 37A4.tmp 1548 3830.tmp 1700 38CC.tmp 2060 3968.tmp 1880 3A14.tmp 1636 3AB0.tmp 2236 3B3C.tmp 324 3BC8.tmp 1412 3C64.tmp 1712 3CF1.tmp 2128 3D8D.tmp 1428 3E0A.tmp 1460 3E58.tmp 1684 3EA6.tmp 2652 3EF4.tmp 2968 3F32.tmp 2164 3F80.tmp 2312 3FCE.tmp 1076 401C.tmp 3032 405A.tmp 696 40A8.tmp 1696 40E7.tmp 612 4135.tmp 3036 4173.tmp 436 41C1.tmp 2224 4200.tmp 2848 424E.tmp 360 428C.tmp 1852 42DA.tmp 964 4318.tmp 816 4357.tmp 2072 4395.tmp 240 43E3.tmp 960 4431.tmp 692 447F.tmp 2212 44BE.tmp 2004 44FC.tmp 2412 453A.tmp 2668 4579.tmp 352 45B7.tmp 896 4605.tmp 2244 4644.tmp 1620 4692.tmp 1504 46D0.tmp 2092 471E.tmp 2948 475C.tmp 2996 47AA.tmp 2444 47F8.tmp 2492 4846.tmp 2488 4894.tmp 2468 48E2.tmp 2436 4921.tmp 1888 495F.tmp -
Loads dropped DLL 64 IoCs
pid Process 2008 2024-04-27_96707f62495cd668b69c1963ce2665f4_mafia.exe 2816 313E.tmp 1200 31CA.tmp 2552 3276.tmp 2468 3312.tmp 2612 339E.tmp 2432 343A.tmp 2568 34C6.tmp 2328 3562.tmp 2408 35EF.tmp 2748 367B.tmp 2088 3717.tmp 2216 37A4.tmp 1548 3830.tmp 1700 38CC.tmp 2060 3968.tmp 1880 3A14.tmp 1636 3AB0.tmp 2236 3B3C.tmp 324 3BC8.tmp 1412 3C64.tmp 1712 3CF1.tmp 2128 3D8D.tmp 1428 3E0A.tmp 1460 3E58.tmp 1684 3EA6.tmp 2652 3EF4.tmp 2968 3F32.tmp 2164 3F80.tmp 2312 3FCE.tmp 1076 401C.tmp 3032 405A.tmp 696 40A8.tmp 1696 40E7.tmp 612 4135.tmp 3036 4173.tmp 436 41C1.tmp 2224 4200.tmp 2848 424E.tmp 360 428C.tmp 1852 42DA.tmp 964 4318.tmp 816 4357.tmp 2072 4395.tmp 240 43E3.tmp 960 4431.tmp 692 447F.tmp 2212 44BE.tmp 2004 44FC.tmp 2412 453A.tmp 2668 4579.tmp 352 45B7.tmp 896 4605.tmp 2244 4644.tmp 1620 4692.tmp 1504 46D0.tmp 2092 471E.tmp 2948 475C.tmp 2996 47AA.tmp 2444 47F8.tmp 2492 4846.tmp 2488 4894.tmp 2468 48E2.tmp 2436 4921.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2008 wrote to memory of 2816 2008 2024-04-27_96707f62495cd668b69c1963ce2665f4_mafia.exe 28 PID 2008 wrote to memory of 2816 2008 2024-04-27_96707f62495cd668b69c1963ce2665f4_mafia.exe 28 PID 2008 wrote to memory of 2816 2008 2024-04-27_96707f62495cd668b69c1963ce2665f4_mafia.exe 28 PID 2008 wrote to memory of 2816 2008 2024-04-27_96707f62495cd668b69c1963ce2665f4_mafia.exe 28 PID 2816 wrote to memory of 1200 2816 313E.tmp 29 PID 2816 wrote to memory of 1200 2816 313E.tmp 29 PID 2816 wrote to memory of 1200 2816 313E.tmp 29 PID 2816 wrote to memory of 1200 2816 313E.tmp 29 PID 1200 wrote to memory of 2552 1200 31CA.tmp 30 PID 1200 wrote to memory of 2552 1200 31CA.tmp 30 PID 1200 wrote to memory of 2552 1200 31CA.tmp 30 PID 1200 wrote to memory of 2552 1200 31CA.tmp 30 PID 2552 wrote to memory of 2468 2552 3276.tmp 31 PID 2552 wrote to memory of 2468 2552 3276.tmp 31 PID 2552 wrote to memory of 2468 2552 3276.tmp 31 PID 2552 wrote to memory of 2468 2552 3276.tmp 31 PID 2468 wrote to memory of 2612 2468 3312.tmp 32 PID 2468 wrote to memory of 2612 2468 3312.tmp 32 PID 2468 wrote to memory of 2612 2468 3312.tmp 32 PID 2468 wrote to memory of 2612 2468 3312.tmp 32 PID 2612 wrote to memory of 2432 2612 339E.tmp 33 PID 2612 wrote to memory of 2432 2612 339E.tmp 33 PID 2612 wrote to memory of 2432 2612 339E.tmp 33 PID 2612 wrote to memory of 2432 2612 339E.tmp 33 PID 2432 wrote to memory of 2568 2432 343A.tmp 34 PID 2432 wrote to memory of 2568 2432 343A.tmp 34 PID 2432 wrote to memory of 2568 2432 343A.tmp 34 PID 2432 wrote to memory of 2568 2432 343A.tmp 34 PID 2568 wrote to memory of 2328 2568 34C6.tmp 35 PID 2568 wrote to memory of 2328 2568 34C6.tmp 35 PID 2568 wrote to memory of 2328 2568 34C6.tmp 35 PID 2568 wrote to memory of 2328 2568 34C6.tmp 35 PID 2328 wrote to memory of 2408 2328 3562.tmp 36 PID 2328 wrote to memory of 2408 2328 3562.tmp 36 PID 2328 wrote to memory of 2408 2328 3562.tmp 36 PID 2328 wrote to memory of 2408 2328 3562.tmp 36 PID 2408 wrote to memory of 2748 2408 35EF.tmp 37 PID 2408 wrote to memory of 2748 2408 35EF.tmp 37 PID 2408 wrote to memory of 2748 2408 35EF.tmp 37 PID 2408 wrote to memory of 2748 2408 35EF.tmp 37 PID 2748 wrote to memory of 2088 2748 367B.tmp 38 PID 2748 wrote to memory of 2088 2748 367B.tmp 38 PID 2748 wrote to memory of 2088 2748 367B.tmp 38 PID 2748 wrote to memory of 2088 2748 367B.tmp 38 PID 2088 wrote to memory of 2216 2088 3717.tmp 39 PID 2088 wrote to memory of 2216 2088 3717.tmp 39 PID 2088 wrote to memory of 2216 2088 3717.tmp 39 PID 2088 wrote to memory of 2216 2088 3717.tmp 39 PID 2216 wrote to memory of 1548 2216 37A4.tmp 40 PID 2216 wrote to memory of 1548 2216 37A4.tmp 40 PID 2216 wrote to memory of 1548 2216 37A4.tmp 40 PID 2216 wrote to memory of 1548 2216 37A4.tmp 40 PID 1548 wrote to memory of 1700 1548 3830.tmp 41 PID 1548 wrote to memory of 1700 1548 3830.tmp 41 PID 1548 wrote to memory of 1700 1548 3830.tmp 41 PID 1548 wrote to memory of 1700 1548 3830.tmp 41 PID 1700 wrote to memory of 2060 1700 38CC.tmp 42 PID 1700 wrote to memory of 2060 1700 38CC.tmp 42 PID 1700 wrote to memory of 2060 1700 38CC.tmp 42 PID 1700 wrote to memory of 2060 1700 38CC.tmp 42 PID 2060 wrote to memory of 1880 2060 3968.tmp 43 PID 2060 wrote to memory of 1880 2060 3968.tmp 43 PID 2060 wrote to memory of 1880 2060 3968.tmp 43 PID 2060 wrote to memory of 1880 2060 3968.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-27_96707f62495cd668b69c1963ce2665f4_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-27_96707f62495cd668b69c1963ce2665f4_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\313E.tmp"C:\Users\Admin\AppData\Local\Temp\313E.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\31CA.tmp"C:\Users\Admin\AppData\Local\Temp\31CA.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\3276.tmp"C:\Users\Admin\AppData\Local\Temp\3276.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\3312.tmp"C:\Users\Admin\AppData\Local\Temp\3312.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\339E.tmp"C:\Users\Admin\AppData\Local\Temp\339E.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\343A.tmp"C:\Users\Admin\AppData\Local\Temp\343A.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\34C6.tmp"C:\Users\Admin\AppData\Local\Temp\34C6.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\3562.tmp"C:\Users\Admin\AppData\Local\Temp\3562.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\35EF.tmp"C:\Users\Admin\AppData\Local\Temp\35EF.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\367B.tmp"C:\Users\Admin\AppData\Local\Temp\367B.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\3717.tmp"C:\Users\Admin\AppData\Local\Temp\3717.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\37A4.tmp"C:\Users\Admin\AppData\Local\Temp\37A4.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\3830.tmp"C:\Users\Admin\AppData\Local\Temp\3830.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\38CC.tmp"C:\Users\Admin\AppData\Local\Temp\38CC.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\3968.tmp"C:\Users\Admin\AppData\Local\Temp\3968.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\3A14.tmp"C:\Users\Admin\AppData\Local\Temp\3A14.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\3AB0.tmp"C:\Users\Admin\AppData\Local\Temp\3AB0.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\3B3C.tmp"C:\Users\Admin\AppData\Local\Temp\3B3C.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\3BC8.tmp"C:\Users\Admin\AppData\Local\Temp\3BC8.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:324 -
C:\Users\Admin\AppData\Local\Temp\3C64.tmp"C:\Users\Admin\AppData\Local\Temp\3C64.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\3CF1.tmp"C:\Users\Admin\AppData\Local\Temp\3CF1.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\3D8D.tmp"C:\Users\Admin\AppData\Local\Temp\3D8D.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\3E0A.tmp"C:\Users\Admin\AppData\Local\Temp\3E0A.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\3E58.tmp"C:\Users\Admin\AppData\Local\Temp\3E58.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\3EA6.tmp"C:\Users\Admin\AppData\Local\Temp\3EA6.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\3EF4.tmp"C:\Users\Admin\AppData\Local\Temp\3EF4.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\3F32.tmp"C:\Users\Admin\AppData\Local\Temp\3F32.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\3F80.tmp"C:\Users\Admin\AppData\Local\Temp\3F80.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\3FCE.tmp"C:\Users\Admin\AppData\Local\Temp\3FCE.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\401C.tmp"C:\Users\Admin\AppData\Local\Temp\401C.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\405A.tmp"C:\Users\Admin\AppData\Local\Temp\405A.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\40A8.tmp"C:\Users\Admin\AppData\Local\Temp\40A8.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:696 -
C:\Users\Admin\AppData\Local\Temp\40E7.tmp"C:\Users\Admin\AppData\Local\Temp\40E7.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\4135.tmp"C:\Users\Admin\AppData\Local\Temp\4135.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:612 -
C:\Users\Admin\AppData\Local\Temp\4173.tmp"C:\Users\Admin\AppData\Local\Temp\4173.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\41C1.tmp"C:\Users\Admin\AppData\Local\Temp\41C1.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:436 -
C:\Users\Admin\AppData\Local\Temp\4200.tmp"C:\Users\Admin\AppData\Local\Temp\4200.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\424E.tmp"C:\Users\Admin\AppData\Local\Temp\424E.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\428C.tmp"C:\Users\Admin\AppData\Local\Temp\428C.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:360 -
C:\Users\Admin\AppData\Local\Temp\42DA.tmp"C:\Users\Admin\AppData\Local\Temp\42DA.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\4318.tmp"C:\Users\Admin\AppData\Local\Temp\4318.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:964 -
C:\Users\Admin\AppData\Local\Temp\4357.tmp"C:\Users\Admin\AppData\Local\Temp\4357.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:816 -
C:\Users\Admin\AppData\Local\Temp\4395.tmp"C:\Users\Admin\AppData\Local\Temp\4395.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\43E3.tmp"C:\Users\Admin\AppData\Local\Temp\43E3.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:240 -
C:\Users\Admin\AppData\Local\Temp\4431.tmp"C:\Users\Admin\AppData\Local\Temp\4431.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:960 -
C:\Users\Admin\AppData\Local\Temp\447F.tmp"C:\Users\Admin\AppData\Local\Temp\447F.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:692 -
C:\Users\Admin\AppData\Local\Temp\44BE.tmp"C:\Users\Admin\AppData\Local\Temp\44BE.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\44FC.tmp"C:\Users\Admin\AppData\Local\Temp\44FC.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\453A.tmp"C:\Users\Admin\AppData\Local\Temp\453A.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\4579.tmp"C:\Users\Admin\AppData\Local\Temp\4579.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\45B7.tmp"C:\Users\Admin\AppData\Local\Temp\45B7.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:352 -
C:\Users\Admin\AppData\Local\Temp\4605.tmp"C:\Users\Admin\AppData\Local\Temp\4605.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:896 -
C:\Users\Admin\AppData\Local\Temp\4644.tmp"C:\Users\Admin\AppData\Local\Temp\4644.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\4692.tmp"C:\Users\Admin\AppData\Local\Temp\4692.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\46D0.tmp"C:\Users\Admin\AppData\Local\Temp\46D0.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\471E.tmp"C:\Users\Admin\AppData\Local\Temp\471E.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\475C.tmp"C:\Users\Admin\AppData\Local\Temp\475C.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\47AA.tmp"C:\Users\Admin\AppData\Local\Temp\47AA.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\47F8.tmp"C:\Users\Admin\AppData\Local\Temp\47F8.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\4846.tmp"C:\Users\Admin\AppData\Local\Temp\4846.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\4894.tmp"C:\Users\Admin\AppData\Local\Temp\4894.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\48E2.tmp"C:\Users\Admin\AppData\Local\Temp\48E2.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\4921.tmp"C:\Users\Admin\AppData\Local\Temp\4921.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\495F.tmp"C:\Users\Admin\AppData\Local\Temp\495F.tmp"65⤵
- Executes dropped EXE
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\49AD.tmp"C:\Users\Admin\AppData\Local\Temp\49AD.tmp"66⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\49FB.tmp"C:\Users\Admin\AppData\Local\Temp\49FB.tmp"67⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\4A49.tmp"C:\Users\Admin\AppData\Local\Temp\4A49.tmp"68⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\4A97.tmp"C:\Users\Admin\AppData\Local\Temp\4A97.tmp"69⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\4AE5.tmp"C:\Users\Admin\AppData\Local\Temp\4AE5.tmp"70⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\4B33.tmp"C:\Users\Admin\AppData\Local\Temp\4B33.tmp"71⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\4B72.tmp"C:\Users\Admin\AppData\Local\Temp\4B72.tmp"72⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\4BB0.tmp"C:\Users\Admin\AppData\Local\Temp\4BB0.tmp"73⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\4BEE.tmp"C:\Users\Admin\AppData\Local\Temp\4BEE.tmp"74⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\4C3C.tmp"C:\Users\Admin\AppData\Local\Temp\4C3C.tmp"75⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"76⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"77⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\4D17.tmp"C:\Users\Admin\AppData\Local\Temp\4D17.tmp"78⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"79⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"80⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"81⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\4E30.tmp"C:\Users\Admin\AppData\Local\Temp\4E30.tmp"82⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"83⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"84⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\4EFA.tmp"C:\Users\Admin\AppData\Local\Temp\4EFA.tmp"85⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"86⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\4F77.tmp"C:\Users\Admin\AppData\Local\Temp\4F77.tmp"87⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"88⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"89⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\5042.tmp"C:\Users\Admin\AppData\Local\Temp\5042.tmp"90⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\5080.tmp"C:\Users\Admin\AppData\Local\Temp\5080.tmp"91⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\50BF.tmp"C:\Users\Admin\AppData\Local\Temp\50BF.tmp"92⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\50FD.tmp"C:\Users\Admin\AppData\Local\Temp\50FD.tmp"93⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\513C.tmp"C:\Users\Admin\AppData\Local\Temp\513C.tmp"94⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\517A.tmp"C:\Users\Admin\AppData\Local\Temp\517A.tmp"95⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\51B8.tmp"C:\Users\Admin\AppData\Local\Temp\51B8.tmp"96⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\5206.tmp"C:\Users\Admin\AppData\Local\Temp\5206.tmp"97⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\5245.tmp"C:\Users\Admin\AppData\Local\Temp\5245.tmp"98⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\5283.tmp"C:\Users\Admin\AppData\Local\Temp\5283.tmp"99⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\52C2.tmp"C:\Users\Admin\AppData\Local\Temp\52C2.tmp"100⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\5310.tmp"C:\Users\Admin\AppData\Local\Temp\5310.tmp"101⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\534E.tmp"C:\Users\Admin\AppData\Local\Temp\534E.tmp"102⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\539C.tmp"C:\Users\Admin\AppData\Local\Temp\539C.tmp"103⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\53DA.tmp"C:\Users\Admin\AppData\Local\Temp\53DA.tmp"104⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\5419.tmp"C:\Users\Admin\AppData\Local\Temp\5419.tmp"105⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\5457.tmp"C:\Users\Admin\AppData\Local\Temp\5457.tmp"106⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\5496.tmp"C:\Users\Admin\AppData\Local\Temp\5496.tmp"107⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\54D4.tmp"C:\Users\Admin\AppData\Local\Temp\54D4.tmp"108⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\5512.tmp"C:\Users\Admin\AppData\Local\Temp\5512.tmp"109⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\5551.tmp"C:\Users\Admin\AppData\Local\Temp\5551.tmp"110⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\559F.tmp"C:\Users\Admin\AppData\Local\Temp\559F.tmp"111⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\55DD.tmp"C:\Users\Admin\AppData\Local\Temp\55DD.tmp"112⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\562B.tmp"C:\Users\Admin\AppData\Local\Temp\562B.tmp"113⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\566A.tmp"C:\Users\Admin\AppData\Local\Temp\566A.tmp"114⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\56A8.tmp"C:\Users\Admin\AppData\Local\Temp\56A8.tmp"115⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\56E6.tmp"C:\Users\Admin\AppData\Local\Temp\56E6.tmp"116⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\5725.tmp"C:\Users\Admin\AppData\Local\Temp\5725.tmp"117⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\5763.tmp"C:\Users\Admin\AppData\Local\Temp\5763.tmp"118⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\57A2.tmp"C:\Users\Admin\AppData\Local\Temp\57A2.tmp"119⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\57E0.tmp"C:\Users\Admin\AppData\Local\Temp\57E0.tmp"120⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\583E.tmp"C:\Users\Admin\AppData\Local\Temp\583E.tmp"121⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\587C.tmp"C:\Users\Admin\AppData\Local\Temp\587C.tmp"122⤵PID:2240
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-