Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 19:49
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-20_e236a1b9176bc2931e358a7a354b40ba_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-20_e236a1b9176bc2931e358a7a354b40ba_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-20_e236a1b9176bc2931e358a7a354b40ba_mafia.exe
-
Size
541KB
-
MD5
e236a1b9176bc2931e358a7a354b40ba
-
SHA1
e7bbfaf5c3cff5d62edb9e94b4ea8d6054acc4f5
-
SHA256
ef7d69bace0a2f3234fe258c71a08207a22360717c29ecb49c8b212323767cc2
-
SHA512
92db52210b58632bf36837ae2fcfc3f91504710013c485853455025d6a39d9cfbb1e5bc5c24473db84c92c38e39dc19e59e3961a96ace9a5c9d0ee82c39d8ba6
-
SSDEEP
12288:UU5rCOTeifU9SepTg+0K9bD/NYrPnHvXJa3rZa73ctO:UUQOJfU9SL+0+RYrPno3rU73ctO
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1724 33AE.tmp 1748 342A.tmp 1972 34B7.tmp 2636 3534.tmp 2760 35B0.tmp 2728 363D.tmp 2604 36C9.tmp 2576 3746.tmp 2532 37C3.tmp 2504 3840.tmp 2932 38BC.tmp 2952 3939.tmp 2548 39B6.tmp 2796 3A14.tmp 2944 3AA0.tmp 2228 3B1D.tmp 1700 3BA9.tmp 1608 3C45.tmp 1620 3CE1.tmp 1404 3D5E.tmp 624 3DCB.tmp 1228 3E58.tmp 936 3EC5.tmp 572 3F13.tmp 1192 3F61.tmp 1268 3FAF.tmp 1088 3FFD.tmp 2244 404B.tmp 2292 4099.tmp 2272 40E7.tmp 1720 4135.tmp 2668 4183.tmp 2028 41D1.tmp 564 420F.tmp 772 425D.tmp 2448 429C.tmp 2368 42EA.tmp 2344 4328.tmp 1136 4376.tmp 300 43C4.tmp 1776 4412.tmp 2328 4450.tmp 1580 448F.tmp 1460 44CD.tmp 548 450C.tmp 888 454A.tmp 676 4588.tmp 1596 45C7.tmp 2116 4605.tmp 2296 4644.tmp 2176 4692.tmp 1672 46EF.tmp 1516 474D.tmp 1924 478B.tmp 1568 47CA.tmp 2892 4808.tmp 1644 4856.tmp 2460 4894.tmp 2376 48E2.tmp 2592 4930.tmp 1920 497E.tmp 2756 49BD.tmp 2636 49FB.tmp 2760 4A3A.tmp -
Loads dropped DLL 64 IoCs
pid Process 1644 2024-05-20_e236a1b9176bc2931e358a7a354b40ba_mafia.exe 1724 33AE.tmp 1748 342A.tmp 1972 34B7.tmp 2636 3534.tmp 2760 35B0.tmp 2728 363D.tmp 2604 36C9.tmp 2576 3746.tmp 2532 37C3.tmp 2504 3840.tmp 2932 38BC.tmp 2952 3939.tmp 2548 39B6.tmp 2796 3A14.tmp 2944 3AA0.tmp 2228 3B1D.tmp 1700 3BA9.tmp 1608 3C45.tmp 1620 3CE1.tmp 1404 3D5E.tmp 624 3DCB.tmp 1228 3E58.tmp 936 3EC5.tmp 572 3F13.tmp 1192 3F61.tmp 1268 3FAF.tmp 1088 3FFD.tmp 2244 404B.tmp 2292 4099.tmp 2272 40E7.tmp 1720 4135.tmp 2668 4183.tmp 2028 41D1.tmp 564 420F.tmp 772 425D.tmp 2448 429C.tmp 2368 42EA.tmp 2344 4328.tmp 1136 4376.tmp 300 43C4.tmp 1776 4412.tmp 2328 4450.tmp 1580 448F.tmp 1460 44CD.tmp 548 450C.tmp 888 454A.tmp 676 4588.tmp 1596 45C7.tmp 2116 4605.tmp 2296 4644.tmp 2176 4692.tmp 1672 46EF.tmp 1516 474D.tmp 1924 478B.tmp 1568 47CA.tmp 2892 4808.tmp 1644 4856.tmp 2460 4894.tmp 2376 48E2.tmp 2592 4930.tmp 1920 497E.tmp 2756 49BD.tmp 2636 49FB.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1644 wrote to memory of 1724 1644 2024-05-20_e236a1b9176bc2931e358a7a354b40ba_mafia.exe 28 PID 1644 wrote to memory of 1724 1644 2024-05-20_e236a1b9176bc2931e358a7a354b40ba_mafia.exe 28 PID 1644 wrote to memory of 1724 1644 2024-05-20_e236a1b9176bc2931e358a7a354b40ba_mafia.exe 28 PID 1644 wrote to memory of 1724 1644 2024-05-20_e236a1b9176bc2931e358a7a354b40ba_mafia.exe 28 PID 1724 wrote to memory of 1748 1724 33AE.tmp 29 PID 1724 wrote to memory of 1748 1724 33AE.tmp 29 PID 1724 wrote to memory of 1748 1724 33AE.tmp 29 PID 1724 wrote to memory of 1748 1724 33AE.tmp 29 PID 1748 wrote to memory of 1972 1748 342A.tmp 30 PID 1748 wrote to memory of 1972 1748 342A.tmp 30 PID 1748 wrote to memory of 1972 1748 342A.tmp 30 PID 1748 wrote to memory of 1972 1748 342A.tmp 30 PID 1972 wrote to memory of 2636 1972 34B7.tmp 31 PID 1972 wrote to memory of 2636 1972 34B7.tmp 31 PID 1972 wrote to memory of 2636 1972 34B7.tmp 31 PID 1972 wrote to memory of 2636 1972 34B7.tmp 31 PID 2636 wrote to memory of 2760 2636 3534.tmp 32 PID 2636 wrote to memory of 2760 2636 3534.tmp 32 PID 2636 wrote to memory of 2760 2636 3534.tmp 32 PID 2636 wrote to memory of 2760 2636 3534.tmp 32 PID 2760 wrote to memory of 2728 2760 35B0.tmp 33 PID 2760 wrote to memory of 2728 2760 35B0.tmp 33 PID 2760 wrote to memory of 2728 2760 35B0.tmp 33 PID 2760 wrote to memory of 2728 2760 35B0.tmp 33 PID 2728 wrote to memory of 2604 2728 363D.tmp 34 PID 2728 wrote to memory of 2604 2728 363D.tmp 34 PID 2728 wrote to memory of 2604 2728 363D.tmp 34 PID 2728 wrote to memory of 2604 2728 363D.tmp 34 PID 2604 wrote to memory of 2576 2604 36C9.tmp 35 PID 2604 wrote to memory of 2576 2604 36C9.tmp 35 PID 2604 wrote to memory of 2576 2604 36C9.tmp 35 PID 2604 wrote to memory of 2576 2604 36C9.tmp 35 PID 2576 wrote to memory of 2532 2576 3746.tmp 36 PID 2576 wrote to memory of 2532 2576 3746.tmp 36 PID 2576 wrote to memory of 2532 2576 3746.tmp 36 PID 2576 wrote to memory of 2532 2576 3746.tmp 36 PID 2532 wrote to memory of 2504 2532 37C3.tmp 37 PID 2532 wrote to memory of 2504 2532 37C3.tmp 37 PID 2532 wrote to memory of 2504 2532 37C3.tmp 37 PID 2532 wrote to memory of 2504 2532 37C3.tmp 37 PID 2504 wrote to memory of 2932 2504 3840.tmp 38 PID 2504 wrote to memory of 2932 2504 3840.tmp 38 PID 2504 wrote to memory of 2932 2504 3840.tmp 38 PID 2504 wrote to memory of 2932 2504 3840.tmp 38 PID 2932 wrote to memory of 2952 2932 38BC.tmp 39 PID 2932 wrote to memory of 2952 2932 38BC.tmp 39 PID 2932 wrote to memory of 2952 2932 38BC.tmp 39 PID 2932 wrote to memory of 2952 2932 38BC.tmp 39 PID 2952 wrote to memory of 2548 2952 3939.tmp 40 PID 2952 wrote to memory of 2548 2952 3939.tmp 40 PID 2952 wrote to memory of 2548 2952 3939.tmp 40 PID 2952 wrote to memory of 2548 2952 3939.tmp 40 PID 2548 wrote to memory of 2796 2548 39B6.tmp 41 PID 2548 wrote to memory of 2796 2548 39B6.tmp 41 PID 2548 wrote to memory of 2796 2548 39B6.tmp 41 PID 2548 wrote to memory of 2796 2548 39B6.tmp 41 PID 2796 wrote to memory of 2944 2796 3A14.tmp 42 PID 2796 wrote to memory of 2944 2796 3A14.tmp 42 PID 2796 wrote to memory of 2944 2796 3A14.tmp 42 PID 2796 wrote to memory of 2944 2796 3A14.tmp 42 PID 2944 wrote to memory of 2228 2944 3AA0.tmp 43 PID 2944 wrote to memory of 2228 2944 3AA0.tmp 43 PID 2944 wrote to memory of 2228 2944 3AA0.tmp 43 PID 2944 wrote to memory of 2228 2944 3AA0.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-20_e236a1b9176bc2931e358a7a354b40ba_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-20_e236a1b9176bc2931e358a7a354b40ba_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\33AE.tmp"C:\Users\Admin\AppData\Local\Temp\33AE.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\342A.tmp"C:\Users\Admin\AppData\Local\Temp\342A.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\34B7.tmp"C:\Users\Admin\AppData\Local\Temp\34B7.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\3534.tmp"C:\Users\Admin\AppData\Local\Temp\3534.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\35B0.tmp"C:\Users\Admin\AppData\Local\Temp\35B0.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\363D.tmp"C:\Users\Admin\AppData\Local\Temp\363D.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\36C9.tmp"C:\Users\Admin\AppData\Local\Temp\36C9.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\3746.tmp"C:\Users\Admin\AppData\Local\Temp\3746.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\37C3.tmp"C:\Users\Admin\AppData\Local\Temp\37C3.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\3840.tmp"C:\Users\Admin\AppData\Local\Temp\3840.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\38BC.tmp"C:\Users\Admin\AppData\Local\Temp\38BC.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\3939.tmp"C:\Users\Admin\AppData\Local\Temp\3939.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\39B6.tmp"C:\Users\Admin\AppData\Local\Temp\39B6.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\3A14.tmp"C:\Users\Admin\AppData\Local\Temp\3A14.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\3AA0.tmp"C:\Users\Admin\AppData\Local\Temp\3AA0.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\3B1D.tmp"C:\Users\Admin\AppData\Local\Temp\3B1D.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\3BA9.tmp"C:\Users\Admin\AppData\Local\Temp\3BA9.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\3C45.tmp"C:\Users\Admin\AppData\Local\Temp\3C45.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\3CE1.tmp"C:\Users\Admin\AppData\Local\Temp\3CE1.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\3D5E.tmp"C:\Users\Admin\AppData\Local\Temp\3D5E.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\3DCB.tmp"C:\Users\Admin\AppData\Local\Temp\3DCB.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:624 -
C:\Users\Admin\AppData\Local\Temp\3E58.tmp"C:\Users\Admin\AppData\Local\Temp\3E58.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\3EC5.tmp"C:\Users\Admin\AppData\Local\Temp\3EC5.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:936 -
C:\Users\Admin\AppData\Local\Temp\3F13.tmp"C:\Users\Admin\AppData\Local\Temp\3F13.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:572 -
C:\Users\Admin\AppData\Local\Temp\3F61.tmp"C:\Users\Admin\AppData\Local\Temp\3F61.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\3FAF.tmp"C:\Users\Admin\AppData\Local\Temp\3FAF.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\3FFD.tmp"C:\Users\Admin\AppData\Local\Temp\3FFD.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\404B.tmp"C:\Users\Admin\AppData\Local\Temp\404B.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\4099.tmp"C:\Users\Admin\AppData\Local\Temp\4099.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\40E7.tmp"C:\Users\Admin\AppData\Local\Temp\40E7.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\4135.tmp"C:\Users\Admin\AppData\Local\Temp\4135.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\4183.tmp"C:\Users\Admin\AppData\Local\Temp\4183.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\41D1.tmp"C:\Users\Admin\AppData\Local\Temp\41D1.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\420F.tmp"C:\Users\Admin\AppData\Local\Temp\420F.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:564 -
C:\Users\Admin\AppData\Local\Temp\425D.tmp"C:\Users\Admin\AppData\Local\Temp\425D.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:772 -
C:\Users\Admin\AppData\Local\Temp\429C.tmp"C:\Users\Admin\AppData\Local\Temp\429C.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\42EA.tmp"C:\Users\Admin\AppData\Local\Temp\42EA.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\4328.tmp"C:\Users\Admin\AppData\Local\Temp\4328.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\4376.tmp"C:\Users\Admin\AppData\Local\Temp\4376.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\43C4.tmp"C:\Users\Admin\AppData\Local\Temp\43C4.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:300 -
C:\Users\Admin\AppData\Local\Temp\4412.tmp"C:\Users\Admin\AppData\Local\Temp\4412.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\4450.tmp"C:\Users\Admin\AppData\Local\Temp\4450.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\448F.tmp"C:\Users\Admin\AppData\Local\Temp\448F.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\44CD.tmp"C:\Users\Admin\AppData\Local\Temp\44CD.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\450C.tmp"C:\Users\Admin\AppData\Local\Temp\450C.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:548 -
C:\Users\Admin\AppData\Local\Temp\454A.tmp"C:\Users\Admin\AppData\Local\Temp\454A.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:888 -
C:\Users\Admin\AppData\Local\Temp\4588.tmp"C:\Users\Admin\AppData\Local\Temp\4588.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:676 -
C:\Users\Admin\AppData\Local\Temp\45C7.tmp"C:\Users\Admin\AppData\Local\Temp\45C7.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\4605.tmp"C:\Users\Admin\AppData\Local\Temp\4605.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\4644.tmp"C:\Users\Admin\AppData\Local\Temp\4644.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\4692.tmp"C:\Users\Admin\AppData\Local\Temp\4692.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\46EF.tmp"C:\Users\Admin\AppData\Local\Temp\46EF.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\474D.tmp"C:\Users\Admin\AppData\Local\Temp\474D.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\478B.tmp"C:\Users\Admin\AppData\Local\Temp\478B.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\47CA.tmp"C:\Users\Admin\AppData\Local\Temp\47CA.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\4808.tmp"C:\Users\Admin\AppData\Local\Temp\4808.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\4856.tmp"C:\Users\Admin\AppData\Local\Temp\4856.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\4894.tmp"C:\Users\Admin\AppData\Local\Temp\4894.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\48E2.tmp"C:\Users\Admin\AppData\Local\Temp\48E2.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\4930.tmp"C:\Users\Admin\AppData\Local\Temp\4930.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\497E.tmp"C:\Users\Admin\AppData\Local\Temp\497E.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\49BD.tmp"C:\Users\Admin\AppData\Local\Temp\49BD.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\49FB.tmp"C:\Users\Admin\AppData\Local\Temp\49FB.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\4A3A.tmp"C:\Users\Admin\AppData\Local\Temp\4A3A.tmp"65⤵
- Executes dropped EXE
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\4A78.tmp"C:\Users\Admin\AppData\Local\Temp\4A78.tmp"66⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\4AB6.tmp"C:\Users\Admin\AppData\Local\Temp\4AB6.tmp"67⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\4AF5.tmp"C:\Users\Admin\AppData\Local\Temp\4AF5.tmp"68⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\4B33.tmp"C:\Users\Admin\AppData\Local\Temp\4B33.tmp"69⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\4B72.tmp"C:\Users\Admin\AppData\Local\Temp\4B72.tmp"70⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\4BB0.tmp"C:\Users\Admin\AppData\Local\Temp\4BB0.tmp"71⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\4BEE.tmp"C:\Users\Admin\AppData\Local\Temp\4BEE.tmp"72⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\4C2D.tmp"C:\Users\Admin\AppData\Local\Temp\4C2D.tmp"73⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\4C7B.tmp"C:\Users\Admin\AppData\Local\Temp\4C7B.tmp"74⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\4CB9.tmp"C:\Users\Admin\AppData\Local\Temp\4CB9.tmp"75⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"76⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\4D46.tmp"C:\Users\Admin\AppData\Local\Temp\4D46.tmp"77⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\4D94.tmp"C:\Users\Admin\AppData\Local\Temp\4D94.tmp"78⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"79⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"80⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"81⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"82⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"83⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"84⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"85⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"86⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\4FF4.tmp"C:\Users\Admin\AppData\Local\Temp\4FF4.tmp"87⤵PID:480
-
C:\Users\Admin\AppData\Local\Temp\5042.tmp"C:\Users\Admin\AppData\Local\Temp\5042.tmp"88⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\5080.tmp"C:\Users\Admin\AppData\Local\Temp\5080.tmp"89⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\50BF.tmp"C:\Users\Admin\AppData\Local\Temp\50BF.tmp"90⤵PID:268
-
C:\Users\Admin\AppData\Local\Temp\50FD.tmp"C:\Users\Admin\AppData\Local\Temp\50FD.tmp"91⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\513C.tmp"C:\Users\Admin\AppData\Local\Temp\513C.tmp"92⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\517A.tmp"C:\Users\Admin\AppData\Local\Temp\517A.tmp"93⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\51B8.tmp"C:\Users\Admin\AppData\Local\Temp\51B8.tmp"94⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\51F7.tmp"C:\Users\Admin\AppData\Local\Temp\51F7.tmp"95⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\5245.tmp"C:\Users\Admin\AppData\Local\Temp\5245.tmp"96⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\5293.tmp"C:\Users\Admin\AppData\Local\Temp\5293.tmp"97⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\52D1.tmp"C:\Users\Admin\AppData\Local\Temp\52D1.tmp"98⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\5310.tmp"C:\Users\Admin\AppData\Local\Temp\5310.tmp"99⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\534E.tmp"C:\Users\Admin\AppData\Local\Temp\534E.tmp"100⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\538C.tmp"C:\Users\Admin\AppData\Local\Temp\538C.tmp"101⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\53CB.tmp"C:\Users\Admin\AppData\Local\Temp\53CB.tmp"102⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\5409.tmp"C:\Users\Admin\AppData\Local\Temp\5409.tmp"103⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\5448.tmp"C:\Users\Admin\AppData\Local\Temp\5448.tmp"104⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\5486.tmp"C:\Users\Admin\AppData\Local\Temp\5486.tmp"105⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\54C4.tmp"C:\Users\Admin\AppData\Local\Temp\54C4.tmp"106⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\5503.tmp"C:\Users\Admin\AppData\Local\Temp\5503.tmp"107⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\5551.tmp"C:\Users\Admin\AppData\Local\Temp\5551.tmp"108⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\558F.tmp"C:\Users\Admin\AppData\Local\Temp\558F.tmp"109⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\55DD.tmp"C:\Users\Admin\AppData\Local\Temp\55DD.tmp"110⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\561C.tmp"C:\Users\Admin\AppData\Local\Temp\561C.tmp"111⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\565A.tmp"C:\Users\Admin\AppData\Local\Temp\565A.tmp"112⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\5698.tmp"C:\Users\Admin\AppData\Local\Temp\5698.tmp"113⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\56D7.tmp"C:\Users\Admin\AppData\Local\Temp\56D7.tmp"114⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\5715.tmp"C:\Users\Admin\AppData\Local\Temp\5715.tmp"115⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\5754.tmp"C:\Users\Admin\AppData\Local\Temp\5754.tmp"116⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\5792.tmp"C:\Users\Admin\AppData\Local\Temp\5792.tmp"117⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\57D0.tmp"C:\Users\Admin\AppData\Local\Temp\57D0.tmp"118⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\580F.tmp"C:\Users\Admin\AppData\Local\Temp\580F.tmp"119⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\585D.tmp"C:\Users\Admin\AppData\Local\Temp\585D.tmp"120⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\589B.tmp"C:\Users\Admin\AppData\Local\Temp\589B.tmp"121⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\58E9.tmp"C:\Users\Admin\AppData\Local\Temp\58E9.tmp"122⤵PID:2000
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-