Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05/05/2024, 15:47
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-05_2fb6ff29e64a2c74e23e2faabbd6c640_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-05_2fb6ff29e64a2c74e23e2faabbd6c640_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-05_2fb6ff29e64a2c74e23e2faabbd6c640_mafia.exe
-
Size
529KB
-
MD5
2fb6ff29e64a2c74e23e2faabbd6c640
-
SHA1
5a9bef3b5512762c3ed6fe869330632973d1b50f
-
SHA256
dff21502787ccb11fe4f87044f28590966e82d64c16c607ffdfb09cc060de7a7
-
SHA512
e914012f6f04cd81fa710303cf45cfe2b02d7d81be28b8cfa0f61a2a6e7cf3d8442d1d3be4242a0f8051e17c6fe168759166d553257946c0924540d52e920e35
-
SSDEEP
12288:NU5rCOTeijgV4zU5Zp6qkJ5UYSy41aFVJvNQEPTZwlH4Hp:NUQOJjgVR6Iy41GVYEPTSlH4Hp
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1168 13DE.tmp 3060 141D.tmp 2292 148A.tmp 2660 14E8.tmp 2724 1555.tmp 2468 15A3.tmp 2496 1610.tmp 2424 166E.tmp 2744 16CB.tmp 2508 1729.tmp 864 1786.tmp 1960 17E4.tmp 2836 1842.tmp 2856 18AF.tmp 2964 191C.tmp 2212 197A.tmp 1984 19D7.tmp 1608 1A35.tmp 1704 1A92.tmp 2448 1B00.tmp 2796 1B4E.tmp 776 1BAB.tmp 1532 1C09.tmp 1280 1C47.tmp 868 1C95.tmp 1812 1CE3.tmp 2912 1D31.tmp 2300 1D70.tmp 548 1DBE.tmp 2784 1DFC.tmp 596 1E3A.tmp 488 1E79.tmp 1056 1EC7.tmp 652 1F05.tmp 2180 1F44.tmp 564 1F82.tmp 1104 1FD0.tmp 1376 200E.tmp 2432 204D.tmp 2100 208B.tmp 1552 20D9.tmp 1780 2118.tmp 972 2156.tmp 1884 2194.tmp 2136 21D3.tmp 1840 2211.tmp 1612 225F.tmp 1428 229E.tmp 1768 22DC.tmp 1792 232A.tmp 580 2378.tmp 916 23B6.tmp 1724 2404.tmp 3028 2443.tmp 1604 2491.tmp 1112 24DF.tmp 1716 251D.tmp 2868 256B.tmp 3048 25AA.tmp 3068 25F8.tmp 2676 2636.tmp 2672 2684.tmp 2896 26C2.tmp 2724 2710.tmp -
Loads dropped DLL 64 IoCs
pid Process 2032 2024-05-05_2fb6ff29e64a2c74e23e2faabbd6c640_mafia.exe 1168 13DE.tmp 3060 141D.tmp 2292 148A.tmp 2660 14E8.tmp 2724 1555.tmp 2468 15A3.tmp 2496 1610.tmp 2424 166E.tmp 2744 16CB.tmp 2508 1729.tmp 864 1786.tmp 1960 17E4.tmp 2836 1842.tmp 2856 18AF.tmp 2964 191C.tmp 2212 197A.tmp 1984 19D7.tmp 1608 1A35.tmp 1704 1A92.tmp 2448 1B00.tmp 2796 1B4E.tmp 776 1BAB.tmp 1532 1C09.tmp 1280 1C47.tmp 868 1C95.tmp 1812 1CE3.tmp 2912 1D31.tmp 2300 1D70.tmp 548 1DBE.tmp 2784 1DFC.tmp 596 1E3A.tmp 488 1E79.tmp 1056 1EC7.tmp 652 1F05.tmp 2180 1F44.tmp 564 1F82.tmp 1104 1FD0.tmp 1376 200E.tmp 2432 204D.tmp 2100 208B.tmp 1552 20D9.tmp 1780 2118.tmp 972 2156.tmp 1884 2194.tmp 2136 21D3.tmp 1840 2211.tmp 1612 225F.tmp 1428 229E.tmp 1768 22DC.tmp 1792 232A.tmp 580 2378.tmp 916 23B6.tmp 1724 2404.tmp 3028 2443.tmp 1604 2491.tmp 1112 24DF.tmp 1716 251D.tmp 2868 256B.tmp 3048 25AA.tmp 3068 25F8.tmp 2676 2636.tmp 2672 2684.tmp 2896 26C2.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2032 wrote to memory of 1168 2032 2024-05-05_2fb6ff29e64a2c74e23e2faabbd6c640_mafia.exe 28 PID 2032 wrote to memory of 1168 2032 2024-05-05_2fb6ff29e64a2c74e23e2faabbd6c640_mafia.exe 28 PID 2032 wrote to memory of 1168 2032 2024-05-05_2fb6ff29e64a2c74e23e2faabbd6c640_mafia.exe 28 PID 2032 wrote to memory of 1168 2032 2024-05-05_2fb6ff29e64a2c74e23e2faabbd6c640_mafia.exe 28 PID 1168 wrote to memory of 3060 1168 13DE.tmp 29 PID 1168 wrote to memory of 3060 1168 13DE.tmp 29 PID 1168 wrote to memory of 3060 1168 13DE.tmp 29 PID 1168 wrote to memory of 3060 1168 13DE.tmp 29 PID 3060 wrote to memory of 2292 3060 141D.tmp 30 PID 3060 wrote to memory of 2292 3060 141D.tmp 30 PID 3060 wrote to memory of 2292 3060 141D.tmp 30 PID 3060 wrote to memory of 2292 3060 141D.tmp 30 PID 2292 wrote to memory of 2660 2292 148A.tmp 31 PID 2292 wrote to memory of 2660 2292 148A.tmp 31 PID 2292 wrote to memory of 2660 2292 148A.tmp 31 PID 2292 wrote to memory of 2660 2292 148A.tmp 31 PID 2660 wrote to memory of 2724 2660 14E8.tmp 32 PID 2660 wrote to memory of 2724 2660 14E8.tmp 32 PID 2660 wrote to memory of 2724 2660 14E8.tmp 32 PID 2660 wrote to memory of 2724 2660 14E8.tmp 32 PID 2724 wrote to memory of 2468 2724 1555.tmp 33 PID 2724 wrote to memory of 2468 2724 1555.tmp 33 PID 2724 wrote to memory of 2468 2724 1555.tmp 33 PID 2724 wrote to memory of 2468 2724 1555.tmp 33 PID 2468 wrote to memory of 2496 2468 15A3.tmp 34 PID 2468 wrote to memory of 2496 2468 15A3.tmp 34 PID 2468 wrote to memory of 2496 2468 15A3.tmp 34 PID 2468 wrote to memory of 2496 2468 15A3.tmp 34 PID 2496 wrote to memory of 2424 2496 1610.tmp 35 PID 2496 wrote to memory of 2424 2496 1610.tmp 35 PID 2496 wrote to memory of 2424 2496 1610.tmp 35 PID 2496 wrote to memory of 2424 2496 1610.tmp 35 PID 2424 wrote to memory of 2744 2424 166E.tmp 36 PID 2424 wrote to memory of 2744 2424 166E.tmp 36 PID 2424 wrote to memory of 2744 2424 166E.tmp 36 PID 2424 wrote to memory of 2744 2424 166E.tmp 36 PID 2744 wrote to memory of 2508 2744 16CB.tmp 37 PID 2744 wrote to memory of 2508 2744 16CB.tmp 37 PID 2744 wrote to memory of 2508 2744 16CB.tmp 37 PID 2744 wrote to memory of 2508 2744 16CB.tmp 37 PID 2508 wrote to memory of 864 2508 1729.tmp 38 PID 2508 wrote to memory of 864 2508 1729.tmp 38 PID 2508 wrote to memory of 864 2508 1729.tmp 38 PID 2508 wrote to memory of 864 2508 1729.tmp 38 PID 864 wrote to memory of 1960 864 1786.tmp 39 PID 864 wrote to memory of 1960 864 1786.tmp 39 PID 864 wrote to memory of 1960 864 1786.tmp 39 PID 864 wrote to memory of 1960 864 1786.tmp 39 PID 1960 wrote to memory of 2836 1960 17E4.tmp 40 PID 1960 wrote to memory of 2836 1960 17E4.tmp 40 PID 1960 wrote to memory of 2836 1960 17E4.tmp 40 PID 1960 wrote to memory of 2836 1960 17E4.tmp 40 PID 2836 wrote to memory of 2856 2836 1842.tmp 41 PID 2836 wrote to memory of 2856 2836 1842.tmp 41 PID 2836 wrote to memory of 2856 2836 1842.tmp 41 PID 2836 wrote to memory of 2856 2836 1842.tmp 41 PID 2856 wrote to memory of 2964 2856 18AF.tmp 42 PID 2856 wrote to memory of 2964 2856 18AF.tmp 42 PID 2856 wrote to memory of 2964 2856 18AF.tmp 42 PID 2856 wrote to memory of 2964 2856 18AF.tmp 42 PID 2964 wrote to memory of 2212 2964 191C.tmp 43 PID 2964 wrote to memory of 2212 2964 191C.tmp 43 PID 2964 wrote to memory of 2212 2964 191C.tmp 43 PID 2964 wrote to memory of 2212 2964 191C.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-05_2fb6ff29e64a2c74e23e2faabbd6c640_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-05_2fb6ff29e64a2c74e23e2faabbd6c640_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\13DE.tmp"C:\Users\Admin\AppData\Local\Temp\13DE.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\141D.tmp"C:\Users\Admin\AppData\Local\Temp\141D.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\148A.tmp"C:\Users\Admin\AppData\Local\Temp\148A.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\14E8.tmp"C:\Users\Admin\AppData\Local\Temp\14E8.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\1555.tmp"C:\Users\Admin\AppData\Local\Temp\1555.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\15A3.tmp"C:\Users\Admin\AppData\Local\Temp\15A3.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\1610.tmp"C:\Users\Admin\AppData\Local\Temp\1610.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\166E.tmp"C:\Users\Admin\AppData\Local\Temp\166E.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\16CB.tmp"C:\Users\Admin\AppData\Local\Temp\16CB.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\1729.tmp"C:\Users\Admin\AppData\Local\Temp\1729.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\1786.tmp"C:\Users\Admin\AppData\Local\Temp\1786.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\AppData\Local\Temp\17E4.tmp"C:\Users\Admin\AppData\Local\Temp\17E4.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\1842.tmp"C:\Users\Admin\AppData\Local\Temp\1842.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\18AF.tmp"C:\Users\Admin\AppData\Local\Temp\18AF.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\191C.tmp"C:\Users\Admin\AppData\Local\Temp\191C.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\197A.tmp"C:\Users\Admin\AppData\Local\Temp\197A.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\19D7.tmp"C:\Users\Admin\AppData\Local\Temp\19D7.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\1A35.tmp"C:\Users\Admin\AppData\Local\Temp\1A35.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\1A92.tmp"C:\Users\Admin\AppData\Local\Temp\1A92.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\1B00.tmp"C:\Users\Admin\AppData\Local\Temp\1B00.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:776 -
C:\Users\Admin\AppData\Local\Temp\1C09.tmp"C:\Users\Admin\AppData\Local\Temp\1C09.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\1C47.tmp"C:\Users\Admin\AppData\Local\Temp\1C47.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\1C95.tmp"C:\Users\Admin\AppData\Local\Temp\1C95.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:868 -
C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\1D31.tmp"C:\Users\Admin\AppData\Local\Temp\1D31.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\1D70.tmp"C:\Users\Admin\AppData\Local\Temp\1D70.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:548 -
C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:596 -
C:\Users\Admin\AppData\Local\Temp\1E79.tmp"C:\Users\Admin\AppData\Local\Temp\1E79.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:488 -
C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\1F05.tmp"C:\Users\Admin\AppData\Local\Temp\1F05.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:652 -
C:\Users\Admin\AppData\Local\Temp\1F44.tmp"C:\Users\Admin\AppData\Local\Temp\1F44.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\1F82.tmp"C:\Users\Admin\AppData\Local\Temp\1F82.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:564 -
C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\200E.tmp"C:\Users\Admin\AppData\Local\Temp\200E.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\204D.tmp"C:\Users\Admin\AppData\Local\Temp\204D.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\208B.tmp"C:\Users\Admin\AppData\Local\Temp\208B.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\20D9.tmp"C:\Users\Admin\AppData\Local\Temp\20D9.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\2118.tmp"C:\Users\Admin\AppData\Local\Temp\2118.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\2156.tmp"C:\Users\Admin\AppData\Local\Temp\2156.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:972 -
C:\Users\Admin\AppData\Local\Temp\2194.tmp"C:\Users\Admin\AppData\Local\Temp\2194.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\21D3.tmp"C:\Users\Admin\AppData\Local\Temp\21D3.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\2211.tmp"C:\Users\Admin\AppData\Local\Temp\2211.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\225F.tmp"C:\Users\Admin\AppData\Local\Temp\225F.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\229E.tmp"C:\Users\Admin\AppData\Local\Temp\229E.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\22DC.tmp"C:\Users\Admin\AppData\Local\Temp\22DC.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\232A.tmp"C:\Users\Admin\AppData\Local\Temp\232A.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\2378.tmp"C:\Users\Admin\AppData\Local\Temp\2378.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:580 -
C:\Users\Admin\AppData\Local\Temp\23B6.tmp"C:\Users\Admin\AppData\Local\Temp\23B6.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:916 -
C:\Users\Admin\AppData\Local\Temp\2404.tmp"C:\Users\Admin\AppData\Local\Temp\2404.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\2443.tmp"C:\Users\Admin\AppData\Local\Temp\2443.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\2491.tmp"C:\Users\Admin\AppData\Local\Temp\2491.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\24DF.tmp"C:\Users\Admin\AppData\Local\Temp\24DF.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\251D.tmp"C:\Users\Admin\AppData\Local\Temp\251D.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\256B.tmp"C:\Users\Admin\AppData\Local\Temp\256B.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\25AA.tmp"C:\Users\Admin\AppData\Local\Temp\25AA.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\25F8.tmp"C:\Users\Admin\AppData\Local\Temp\25F8.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\2636.tmp"C:\Users\Admin\AppData\Local\Temp\2636.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\2684.tmp"C:\Users\Admin\AppData\Local\Temp\2684.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\26C2.tmp"C:\Users\Admin\AppData\Local\Temp\26C2.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\2710.tmp"C:\Users\Admin\AppData\Local\Temp\2710.tmp"65⤵
- Executes dropped EXE
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\275E.tmp"C:\Users\Admin\AppData\Local\Temp\275E.tmp"66⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\279D.tmp"C:\Users\Admin\AppData\Local\Temp\279D.tmp"67⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\27DB.tmp"C:\Users\Admin\AppData\Local\Temp\27DB.tmp"68⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\281A.tmp"C:\Users\Admin\AppData\Local\Temp\281A.tmp"69⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\2868.tmp"C:\Users\Admin\AppData\Local\Temp\2868.tmp"70⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\28A6.tmp"C:\Users\Admin\AppData\Local\Temp\28A6.tmp"71⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\28E4.tmp"C:\Users\Admin\AppData\Local\Temp\28E4.tmp"72⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\2923.tmp"C:\Users\Admin\AppData\Local\Temp\2923.tmp"73⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\2961.tmp"C:\Users\Admin\AppData\Local\Temp\2961.tmp"74⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\29A0.tmp"C:\Users\Admin\AppData\Local\Temp\29A0.tmp"75⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\29EE.tmp"C:\Users\Admin\AppData\Local\Temp\29EE.tmp"76⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"77⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"78⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"79⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"80⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\2B35.tmp"C:\Users\Admin\AppData\Local\Temp\2B35.tmp"81⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\2B74.tmp"C:\Users\Admin\AppData\Local\Temp\2B74.tmp"82⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"83⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\2C00.tmp"C:\Users\Admin\AppData\Local\Temp\2C00.tmp"84⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"85⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"86⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"87⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"88⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\2D38.tmp"C:\Users\Admin\AppData\Local\Temp\2D38.tmp"89⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\2D76.tmp"C:\Users\Admin\AppData\Local\Temp\2D76.tmp"90⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"91⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\2E03.tmp"C:\Users\Admin\AppData\Local\Temp\2E03.tmp"92⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\2E41.tmp"C:\Users\Admin\AppData\Local\Temp\2E41.tmp"93⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\2E80.tmp"C:\Users\Admin\AppData\Local\Temp\2E80.tmp"94⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"95⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"96⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\2F3B.tmp"C:\Users\Admin\AppData\Local\Temp\2F3B.tmp"97⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\2F79.tmp"C:\Users\Admin\AppData\Local\Temp\2F79.tmp"98⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"99⤵PID:596
-
C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"100⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\3034.tmp"C:\Users\Admin\AppData\Local\Temp\3034.tmp"101⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\3073.tmp"C:\Users\Admin\AppData\Local\Temp\3073.tmp"102⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\30B1.tmp"C:\Users\Admin\AppData\Local\Temp\30B1.tmp"103⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\30F0.tmp"C:\Users\Admin\AppData\Local\Temp\30F0.tmp"104⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\312E.tmp"C:\Users\Admin\AppData\Local\Temp\312E.tmp"105⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\316C.tmp"C:\Users\Admin\AppData\Local\Temp\316C.tmp"106⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\31AB.tmp"C:\Users\Admin\AppData\Local\Temp\31AB.tmp"107⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\31E9.tmp"C:\Users\Admin\AppData\Local\Temp\31E9.tmp"108⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\3237.tmp"C:\Users\Admin\AppData\Local\Temp\3237.tmp"109⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\3276.tmp"C:\Users\Admin\AppData\Local\Temp\3276.tmp"110⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\32B4.tmp"C:\Users\Admin\AppData\Local\Temp\32B4.tmp"111⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\32F2.tmp"C:\Users\Admin\AppData\Local\Temp\32F2.tmp"112⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\3331.tmp"C:\Users\Admin\AppData\Local\Temp\3331.tmp"113⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\336F.tmp"C:\Users\Admin\AppData\Local\Temp\336F.tmp"114⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\33AE.tmp"C:\Users\Admin\AppData\Local\Temp\33AE.tmp"115⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\33EC.tmp"C:\Users\Admin\AppData\Local\Temp\33EC.tmp"116⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\342A.tmp"C:\Users\Admin\AppData\Local\Temp\342A.tmp"117⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\3469.tmp"C:\Users\Admin\AppData\Local\Temp\3469.tmp"118⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\34A7.tmp"C:\Users\Admin\AppData\Local\Temp\34A7.tmp"119⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\34E6.tmp"C:\Users\Admin\AppData\Local\Temp\34E6.tmp"120⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\3524.tmp"C:\Users\Admin\AppData\Local\Temp\3524.tmp"121⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\3562.tmp"C:\Users\Admin\AppData\Local\Temp\3562.tmp"122⤵PID:3028
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-